REA, short for Reverse Engineer Anything, is an open-source tool that lets a coding agent inspect software without its source code. It has two parts you will hear called "the skill": a local MCP server that exposes analysis tools, and a workflow skill named reverse-engineer-anything that tells the agent how to investigate with evidence. This guide takes you from nothing to a first working investigation in Claude Code, and shows how to avoid the setup mistakes that cost the most time.
You do not need to be a security researcher. If you can run a command in a terminal and approve configuration changes, you can follow every step. If you want ideas first, see our ranked list of projects built with the REA skill.
TL;DR: install and first run
| Question | Answer |
|---|---|
| What is the one-line install? | npx rea-agents setup |
| Which agents are supported? | Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents that support local MCP servers |
| Which Node.js do I need? | 22.x at 22.19 or newer, 24.x at 24.11 or newer, or 26 and above |
| Do I need Ghidra, Hopper or IDA? | Only for deep native analysis; not for static JavaScript or .NET |
| Is it free? | Yes, MIT-licensed |
| Does it upload my app? | Analysis runs locally; your agent sees tool results under your model provider's data policy |
| What do I do after setup? | Restart your agent, then ask a narrow question |
Step 0: confirm you are installing the official project
The README opens with a warning, and it is worth repeating. Get REA only from morluto/rea, rea.tools or the rea-agents package on npm. A similar repository name or a copied README does not make a download official. Popular projects attract look-alikes, and a tool that edits your agent configuration is exactly the kind of thing you want from a source you trust.
Before you run anything, open the repository, check the owner name and read the install section yourself. Our REA security explainer walks through what the setup changes on your machine and what to review before you approve it.
Step 1: check your prerequisites
You need Node.js and npm. The README lists the accepted ranges: Node.js 22.x at 22.19 or newer, 24.x at 24.11 or newer, or 26 and above. Check yours:
node --version
npm --version
Then decide what you want to analyze, because the requirements depend on the target. The table below is a trimmed version of the one in the README.
| Target | Extra requirement |
|---|---|
| Native binaries | Hopper, Ghidra or IDA |
| JavaScript and Electron apps | Node.js and npm only (on Linux, a procps-compatible ps) |
| .NET assemblies | None, static inspection only |
| Android APKs | Headless JADX and a full JDK |
| Websites | A Chrome-family browser |
| Firmware | Binwalk or Unblob on Linux |
| Saved network captures | A HAR or Fiddler SAZ file |
If your first goal is to understand an Electron app or a .NET program, you can skip native providers entirely and start in minutes.
Step 2: run setup
From a terminal:
npx rea-agents setup
The flow is deliberately careful. You choose which agents to configure, review the proposed changes and approve them. Setup adds REA's MCP server and matching workflow instructions, and it keeps backups of existing configuration. Then you restart your agent so it loads the new server.
Read the diff it proposes before you approve. In practice that means checking which config files are touched, which agents are selected, and whether anything surprises you. If the mechanics of MCP are new to you, our MCP explainer covers the plumbing in plain language.
A terminal beside gears representing REA setup registering an MCP server with a coding agent
Skill-only install
The skill is the part that holds the investigation instructions. The README's FAQ says that installing it from skills.sh supplies those instructions to your agent, and that npx rea-agents setup registers the MCP server and installs matching instructions together. Community docs also cite a skill-only command:
npx skills add morluto/rea --skill reverse-engineer-anything
Use this if you already run REA's server some other way. Otherwise prefer full setup, because instructions without tools leave the agent describing a workflow it cannot execute. For background on how skills load and trigger, read our agent skills guide.
Step 3: add a native provider if you need one
For native binaries, REA drives a disassembler or decompiler. Pick one:
- Hopper: setup can install it after your approval. On macOS a first-run dialog may ask you to choose demo mode or activate a license. Complete that prompt in the same user session before your first operation or unattended job.
- Ghidra: uses your existing installation. Set
GHIDRA_INSTALL_DIRwhere the docs say so. Ghidra also supports 16-bit DOS analysis, which the TH04 case study relies on. - IDA: uses your existing installation, with an optional native MCP bridge.
REA starts Hopper itself when an operation needs it, so you do not need to open it first. For very large binaries the docs suggest raising the provider startup deadline with REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.
Step 4: run your first investigation
After the restart, ask a narrow question about something you are allowed to study. The README's own example is the pattern to copy:
Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.
Replace Notes with your target and search with one feature. Narrow beats broad every time, because a small question has an answer you can check in a few minutes. A good first prompt names three things: the target, one behavior, and the proof you expect.
Using REA, inspect the extracted Electron app in /absolute/path/to/app.
List the IPC channels the renderer can call, which handler receives each one,
and whether each handler checks the sender. Show the file and line for every
claim and list what you could not confirm.
The last sentence matters. Asking for unknowns pushes the agent to separate what the tools returned from what it guessed.
Using the terminal directly
REA's workflows also run from the command line, which is handy for scripting and for checking the agent's claims yourself:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
The result lists modules, imports, Electron boundaries and the evidence behind them. To install the rea command for regular use, run npm install --global rea-agents, then rea --help.
Step 5: keep it updated
The README is blunt about this: REA changes quickly, and new releases include frequent bug fixes. For a global install:
rea update
If you use npx, run npx rea-agents@latest setup, review the changes and restart your agent. With Bun, use bunx rea-agents@latest in place of npx rea-agents@latest. If you hit a bug, update first, because a recent release may already fix it.
Common mistakes and quick fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Agent does not see REA tools | Agent not restarted after setup | Restart the agent |
| Native analysis hangs on a large file | Provider startup deadline too short | Raise the startup timeout variable |
| Hopper never responds | First-run license dialog waiting | Open Hopper once and complete the prompt |
| Linux JavaScript analysis fails | No procps-compatible ps on the path | Install procps and see the docs' recovery steps |
| Agent gives confident answers with no evidence | Prompt too broad | Ask for file, address and unknowns for every claim |
| Behavior changed after a week | Old version installed | Run rea update or rerun setup |
Habits that make the skill worth using
- Pin your target. Note the version and a hash, as the official case studies do. Addresses change between releases.
- Ask for unknowns every time. A report that says "could not confirm" is more trustworthy than one that sounds certain.
- Check static before runtime. Static JavaScript and .NET inspection read files without running the app. Runtime capture runs the target with your user permissions, so reserve it for things you trust.
- Keep one question per session. Long, wide investigations drift. Small, checkable ones compound.
Reading about this is not the same as practicing it. If you want guided time with agent workflows from setup to review, see our workshops.
Next steps
Once the first prompt works, move to proof. The most valuable habit in the community's best projects is rebuilding a function and testing it against the original, which we cover in our guide to proving an AI-driven reverse engineering result. Before you point REA at anything you do not own, read the legal and clean-room checklist.
For commands you will use inside the agent itself, our Claude Code command reference is a handy companion, and the case-study breakdown shows what finished investigations look like.
Frequently asked questions
What is the fastest way to install REA? Run npx rea-agents setup, review the proposed changes, approve them and restart your agent.
Do I need Ghidra, Hopper or IDA? Only for deep native analysis. Static JavaScript, Electron and .NET inspection do not need one.
Which Node.js version do I need? 22.x at 22.19 or newer, 24.x at 24.11 or newer, or 26 and above.
Can I install only the skill? Yes, but most people run full setup so the agent has both the instructions and the tools.
How do I update? Run rea update for a global install, or rerun npx rea-agents@latest setup.
Related reading
- REA MCP server: what agent reverse engineering changes in your setup
- Top 10 projects built with the REA skill
- Reverse engineering is now a prompt: REA's case studies
- What are agent skills? A complete guide
- What is MCP? The Model Context Protocol guide
- Claude Code commands: complete reference
- Official: REA on GitHub · rea.tools
Requirements and commands are taken from the REA README as of October 19, 2026. REA releases frequently, so check the repository for current behavior.