morluto / rea

One MCP for reverse engineering · binaries, apps, runtime

See a feature you like. Understand how it works, down to the binary level.

Ask your agent to investigate the app with REA. It can inspect it without the source code, explain how the feature works, show the evidence, and build a version for your project.

Native binaries, JavaScript and Electron apps, .NET assemblies and websites — analyzed locally, with the evidence and limitations behind each conclusion.

npx rea-agents setup

Setup shows its changes before applying them and backs up existing configuration.

Read the docs View source
Finding 03 · example.appillustrative

prompt › Understand how search works in ‹app›, show me the evidence, and build a similar feature for my project.

Search reads a local index1 that one procedure opens2, and queries the network only on a miss3. How results are ranked4 is not yet known.

  1. 1search_stringsThe index file’s name appears in the binary.
  2. 2find_xrefs_to_nameA single procedure references it.
  3. 3get_call_graphThe network call sits on the miss branch.
  4. 4unknownReached through dynamic dispatch. Left open, not guessed.
artifact
9f2c…e41a
provider
ghidra
locations
3 procedures
confidence
medium
limitations
ranking unresolved

Every saved result carries artifact identity, provider, locations, confidence and limitations.

One prompt, a full investigation

the README’s example and its six steps

“Reverse engineer the Notes app. Find how offline search works, explain it, and build a version for my project using TypeScript and SQLite.”

1Opens and identifies the binaryopen_binary · binary_overview
2Finds likely offline-search cluessearch_strings · search_procedures · list_names
3Connects those clues to executable codefind_xrefs_to_name · xrefs · procedure_callers
4Reconstructs the relevant control flowget_call_graph · procedure_callees · procedure_info
5Decompiles the relevant routinesprocedure_pseudo_code · procedure_assembly · batch_decompile
6Builds the feature in your projectthe agent’s own file-editing and test tools

Shows its work

REA shows how it reached its conclusions. It does not claim to recover original source code or automatically clone an application.

Unknown stays unknown

Reconstruction checks report pass, fail, or unknown rather than treating missing evidence as a pass.

Local by design

Analysis runs on your supported local host. REA does not upload the app to a hosted analysis service.

Deep native analysis uses Hopper, Ghidra or IDA Pro. Static JavaScript analysis needs none of them.