📊 See REA rankings

📱 Get the AI Rank app

Point Claude Code at a closed-source app, ask how one feature works, and get back pseudocode with the evidence attached. That is the pitch for REA MCP, the MCP server that ships with REA Reverse Engineer Anything, an MIT-licensed project at morluto/rea. REA drives a native analysis engine (Hopper, Ghidra or IDA) or its own static tools, then hands your agent pseudocode, assembly, strings, references and the reasoning behind each finding. Codex and Cursor work the same way.

Developers noticed fast. REA topped AI Rank's daily GitHub star-growth ranking in the Oct 14, 15 and 16, 2026 snapshots and stood at 257,047 stars in the latest one.

A Claude REA setup is the pairing most people try first. Claude Code heads the README's list of supported agents, and setup can register REA with Claude Desktop as well. The tie ends there: REA is an independent MIT project published by morluto, not an Anthropic product, and it reaches Claude through MCP, the open protocol Anthropic released in November 2024.

Installation and Agent Workflow

REA needs npm and Node.js 22.x (22.19 or later), 24.x (24.11 or later) or 26+. Node.js 23, 25 and prereleases are not supported. Setup is a single line:

npx rea-agents setup

You choose which agents to wire up, read the config changes it proposes, and approve them. Existing configuration is backed up first; restart the agent when it finishes. The README names Claude Code, Codex, Cursor, Gemini CLI and Grok Build, and any client that supports local MCP servers can register it by hand. The latest GitHub release is rea-agents 6.5.0, published Oct 14, 2026.

Watch for copies. The README says look-alike repos exist and that only morluto/rea, rea.tools and the rea-agents npm package are official.

What setup actually installs, per the README, is REA's MCP server plus "matching workflow instructions". The agent calls REA over MCP, receives findings marked with evidence and unknowns, and can use them to explain a feature or to write and test a similar implementation. Every workflow also exists as a CLI command.

Install REA in Claude Code, Codex and Cursor

Each client has a setup ID. Pass it with --client to skip the selection menu and configure only that client:

npx rea-agents@latest setup --client claude_code
npx rea-agents@latest setup --client codex
npx rea-agents@latest setup --client cursor

@latest asks npm for the newest published release. Setup pins the MCP registration to the exact version that ran it, so rerunning this command later is also how you update.

Client --client ID Where setup registers REA
Claude Code claude_code mcpServers.rea in ~/.claude.json, skill in ~/.claude/skills
Claude Desktop claude_desktop mcpServers.rea in claude_desktop_config.json
Codex codex ~/.codex/config.toml (Codex reads CODEX_HOME if set)
Cursor cursor Not stated in REA's docs

Codex. New registrations get startup_timeout_sec = 30 and a tool_timeout_sec sized to the analysis engine. With Ghidra's default startup allowance that works out to 450 seconds. Both are client-side deadlines, so raise them in ~/.codex/config.toml if a large binary needs longer.

Cursor. The getting-started guide has you open your working folder in Cursor and switch the AI chat to Agent mode. After setup, quit Cursor completely and reopen it; closing the window is not enough. If the tools still don't appear, enable REA in Cursor's MCP settings and allow its tools in the agent chat. REA's docs don't say which Cursor config file setup edits.

To preview the changes for both without writing anything, the installation guide uses a dry run. This form needs the global rea command (npm install --global rea-agents):

rea setup --client codex --client cursor --skill=false --dry-run

--skill=false leaves out the workflow skill. For a client that setup does not support, the docs give a manual entry pinned to one version:

{
  "mcpServers": {
    "rea": {
      "command": "npx",
      "args": ["-y", "rea-agents@6.5.0", "mcp"]
    }
  }
}

On Windows, if PowerShell reports that running scripts is disabled, use npx.cmd rea-agents@latest setup instead.

REA Claude Integration

For Claude Code, setup writes an mcpServers.rea entry to ~/.claude.json and installs REA's workflow skill under ~/.claude/skills. Both are user-level, so every project Claude Code opens can call REA. To keep REA inside a separate profile, the installation guide points setup at Claude Code's CLAUDE_CONFIG_DIR:

CLAUDE_CONFIG_DIR=~/.claude-rea npx rea-agents setup --client claude_code
CLAUDE_CONFIG_DIR=~/.claude-rea claude mcp list

To limit REA to one project instead, skip Claude Code during setup and register it at local scope from the project directory, with CLAUDE_CONFIG_DIR unset. This route does not install the skill, and rea doctor, rea update and rea uninstall ignore it:

claude mcp add --scope local rea -- npx -y rea-agents@6.5.0 mcp

Claude Desktop uses its own file, claude_desktop_config.json, where setup adds the same mcpServers.rea entry. Quit Claude Desktop completely before approving; a running app can overwrite the registration. Removal is two steps: claude mcp remove --scope user rea deletes only the registration, and the ~/.claude/skills/reverse-engineer-anything folder has to go separately.

REA Skill: Reverse Engineering Claude, Codex and Cursor Workflows

The REA skill, reverse-engineer-anything, is the instruction half of REA. The MCP server gives your agent the tools; the skill tells it when and how to use them. If you ran the setup command above, you already have it: setup installs the bundled skill by default, matched to the REA version it registers, unless you pass --skill=false. There is no separate install step for Claude Code, Codex or Cursor.

Setup puts the skill in each selected client's personal skill directory. For Claude Code that is ~/.claude/skills/reverse-engineer-anything. With no client selected, it goes to the shared ~/.agents/skills, which Grok Build also reads. REA's docs don't list the Codex or Cursor skill folders; the setup plan shows each destination before you approve it.

Task Command
Refresh only the skill, for one client rea setup --skill-client claude_code --yes --json
Check the installed skill against the bundled copy rea doctor --skill --json
Set up MCP without the skill rea setup --client codex --skill=false
Install the skill alone from skills.sh npx skills add morluto/rea --skill reverse-engineer-anything

The skills.sh route installs instructions and reference notes only. It does not register the MCP server or install an analysis engine, and it can pull newer instructions from the repository than the npm release you run. If REA's tools are missing after a skill-only install, the docs say to diagnose first with doctor --client codex --json, then plan the fix with setup --client codex --dry-run --json (swap in your client's ID).

The skill is selective. It tells the agent to use REA when an answer depends on a shipped binary or package, decompiled code or runtime evidence, and to stick with normal repository tools for ordinary source-code questions. It also maps target types to a first tool: an ASAR or extracted Electron tree goes to analyze_javascript_application, an Android APK to inspect_android_package, and native binaries through open_binary.

Example prompts from the README and rea.tools:

  • "Check that REA is connected and show me which REA tools you can use."
  • "Use REA to analyze /absolute/path/to/app and explain how it exports data. Show the relevant code and source locations."
  • "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project."
  • "Use REA with my configured provider to inspect /absolute/path/to/program. List its functions and strings, then explain the part that handles user input with references to the code."

Check Your Setup with REA Doctor

rea doctor is REA's read-only self-check. It reads host prerequisites and agent configuration and changes nothing. Run with no options, it audits every detected registration, the installed skill and the optional analysis engines. That full audit can report "healthy": false because of an engine you never planned to use, so scope it to the part you care about:

What to check Command
One agent registration npx -y rea-agents@latest doctor --client codex --json
One analysis engine npx -y rea-agents@latest doctor --provider ghidra --json (or hopper, ida)
Installed workflow skill rea doctor --skill --json
MCP server startup rea mcp doctor --json

Swap codex for claude_code, cursor or another setup ID. A passing check reports "healthy": true; doctor exits with code 1 when a required check in the selected scope fails, and the report names the failed check and a suggested next step.

For Ghidra, doctor validates the platform and architecture, a Ghidra 12.1.x version, the support/analyzeHeadless launcher, the Java version range the installation declares, a 64-bit JDK with javac, and a native decompiler that matches the host.

Doctor checks files and prerequisites, not the live agent connection. If the registration is aligned but the tools are missing from your session, restart or reconnect the agent.

Supported Targets

Target What REA returns Needs
Native binaries Pseudocode, assembly, strings, symbols, calls, references Hopper, Ghidra or IDA
JavaScript / Electron apps Modules, imports, source maps, routes, IPC Node.js and npm only
.NET assemblies Metadata, CIL instructions, native dependencies Nothing extra (static)
Android APKs Manifest, classes, decompiled methods Headless JADX and a JDK
Websites Page structure, scripts, network observations A Chrome-family browser
Firmware Regions, extraction results, native handoffs Binwalk / Unblob on Linux

The README's full list runs longer: Go and Rust binary metadata, WASM, SQLite, packet captures and recorded Linux crashes.

Ghidra, IDA and Hopper Backends

There is no decompiler inside REA. For deep native work it "uses one of" Hopper, Ghidra or IDA. Static JavaScript, Electron and .NET inspection need none of them, so you only add an engine when the target is a native executable or library. Setup will install Hopper if you say yes; Ghidra and IDA have to be on the machine already.

Pick Ghidra if you want the free engine. REA connects to an existing Ghidra 12.1.x installation with a 64-bit JDK 21 or newer on Linux or macOS (x64 or arm64). Windows x64 support is experimental and read-only. Ghidra also covers 16-bit DOS analysis. Set the paths, check them, then rerun setup so it saves them into your agent's config:

export GHIDRA_INSTALL_DIR="/absolute/path/to/ghidra_12.1.4_PUBLIC"
export JAVA_HOME="/absolute/path/to/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

Pick IDA if you already work in IDA and run an MCP server for it. REA does not ship its own IDA server. It adapts an existing one: mrexodia/ida-pro-mcp for IDA Pro, either attached to a GUI that has the original binary open or as a headless supervisor, plus an optional native bridge for IDA Pro and IDA Free. Save the upstream registration as ida-mcp.json, then point REA at it:

export REA_IDA_MCP_CONFIG="/absolute/path/to/ida-mcp.json"
export REA_ANALYSIS_PROVIDER="ida"
npx -y rea-agents@latest doctor --provider ida --json
npx rea-agents@latest setup

Open the original input binary in REA, not an .idb or .i64 database. rea.tools notes that the macOS headless profile and the native GUI bridge are not in npm 6.4.0; the 6.5.0 changelog adds the native bridge.

When more than one engine can read a target, choose with --provider on the CLI, provider_id on open_binary over MCP, or a standing REA_ANALYSIS_PROVIDER. IDA Pro, Hopper, JEB and other commercial tools need a legal license. REA "grants no tool license, key, or activation entitlement".

Common Pitfalls

  • An app was left running. Quit Claude Desktop fully before you approve setup; a running copy can rewrite its config and drop the REA entry. Desktop clients such as Cursor, Windsurf and VS Code need a full quit and reopen after setup, not just a closed window.
  • The skill alone is not REA. npx skills add morluto/rea --skill reverse-engineer-anything installs instructions only. Without npx rea-agents setup, there is no MCP server to call. See the REA skill section above.
  • A stale pinned version. Registrations point at one exact release, and installing newer instructions does not update a running server. Refresh with npx rea-agents@latest setup, or rea update for a global install, then restart the agent.
  • rea is not on PATH. npm install rea-agents without --global only puts the command in the project's node_modules/.bin.
  • Linux refuses Ghidra or JavaScript analysis. REA needs a procps-compatible ps on its PATH before it launches Ghidra, JADX, firmware tools or static JavaScript/Electron analysis. Install procps or procps-ng.
  • The first Ghidra query times out. Ghidra imports and analyzes the binary on the first query, with a default startup deadline of 330,000 ms. Raise REA_GHIDRA_STARTUP_TIMEOUT_MS (or REA_HOPPER_STARTUP_TIMEOUT_MS) in the environment that starts REA. Your agent's own tool timeout can still expire first.
  • Hopper waits on a dialog. On macOS, choose demo mode or activate a license in Hopper's first-run prompt before the first REA operation.
  • The website's client list lags. The rea.tools client table still describes npm 6.4.0. Qoder, Factory Droid, Trae, ZCode, DeepSeek Harness, Kimi Code and WorkBuddy need rea-agents@6.5.0 or later.

Privacy and Data Flow

REA "analyzes targets locally", the FAQ says. The findings still travel to your agent, and "its model provider has its own data policy". For a confidential binary, that hop matters more than where the decompiler runs. DISCLAIMER.md limits the project to "lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine".

REA Adobe Clone Claims

REA has no connection to Adobe. The name does not appear in the repository's README, docs or website source, and REA is not an Adobe product. The two got linked in the same October news cycle: ArtCraft developer Brandon Thomas released free Rust apps modeled on Photoshop, Illustrator, Premiere and other Adobe programs, written with Claude Opus 5.5. Decrypt reported on Oct 12, 2026 that ArtCraft isn't built with REA, and Thomas describes it as a clean-room rebuild. PhotoCraft's README says it was "implemented from public specs and observed behaviour only" and is not affiliated with Adobe Inc. The apps themselves are covered in Get ArtCraft: PhotoCraft vs Photoshop, EffectCraft and the No. 1 GitHub Repo.

Running REA against Adobe software falls under the same disclaimer as any other commercial program: only software you own or are authorized to examine.

REA Repo on GitHub

The REA repo is github.com/morluto/rea. Releases are tagged rea-agents-<version> on its releases page; 6.5.0 is the latest, and CHANGELOG.md lists what each one added. The docs that matter for setup are installation.md, client-configuration.md and ida-provider.md. REA is also listed in the official MCP Registry as io.github.morluto/rea. The README now marks 300,000 GitHub stars. Bugs go to GitHub issues, with your REA version, target type, steps to reproduce and error output.

More Reverse Engineer GitHub Repos

Three other repositories come up next to REA on GitHub. Each description below follows the project's own README.

  • NationalSecurityAgency/ghidra is the software reverse engineering framework built and maintained by the NSA Research Directorate, with disassembly, assembly, decompilation, graphing and scripting for Windows, macOS and Linux. It is one of REA's native engines; REA's installation guide accepts Ghidra 12.1.x.
  • mytechnotalent/Reverse-Engineering is a free reverse engineering tutorial covering x86, x64, 32-bit and 64-bit ARM, 8-bit AVR and 32-bit RISC-V, released under Apache 2.0. Its README also links a project called "REA", the Reverse Engineering Assistant at mytechnotalent/rea. That is a different repository from morluto/rea.
  • morluto/awesome-reverse-engineering is a curated list of reverse engineering tools and learning resources for binaries, apps, firmware, file formats and protocols, sorted by task and released under CC0 1.0. It comes from the same creators as REA and features REA at the top.

GitHub Star Trend

REA was already tracked on Oct 13, 2026: 130,374 stars, no daily gain recorded, rank #6,622. The next day it was No. 1 and stayed there. Numbers are from the dated project API:

Snapshot Daily rank Stars +1 day
Oct 13, 2026 #6,622 130,374 0
Oct 14, 2026 #1 189,622 +59,248
Oct 15, 2026 #1 230,291 +40,669
Oct 16, 2026 #1 257,047 +26,756

Daily gains are shrinking, and no 7-day figure is shown yet. AI Rank lists it under AI Engineering (agent tools, protocols). Stars track attention. They say nothing about how well REA reads your binaries.

→ Project ranking: morluto/rea on AI Rank — daily GitHub star growth

Keep exploring: see which open-source AI projects are rising today in the open-source rankings on AI Rank.

Or 📱 get the AI Rank app to follow them on your phone.

Sources

Prepared with automated editorial assistance and checked on October 19, 2026 against the official morluto/rea repository and releases, rea.tools, Anthropic's MCP announcement, Decrypt's October 12 report and dated AI Rank snapshots. REA was not installed or tested.

Cover image: official product imagery; editorial composition by AI Rank.