leanrea: An 8 KB Skill That Replaces the REA MCP Server, Claimed vs Verified

A one-file project is climbing GitHub's new-repo list: leanrea, an 8 KB skill that claims to do what the REA MCP server does with no server, no 207 tools and no setup. According to the repository, it sits near 1.4k stars and 206 forks. Its headline claim, from the author's own benchmark, is 38% faster and 35% cheaper than REA at similar accuracy. This post checks what that number is made of.

If you are new to the topic, start with our guides to installing the REA skill and the projects built with it.

TL;DR: questions people ask first

What the skill actually contains

The README describes the skill as "One 8 KB skill file that does what REA does: no MCP server, no 207 tools, no setup." Instead of exposing hundreds of tool schemas to the model, it gives the agent a decision table: for an Electron app, unpack with asar; for a Mach-O binary, start with otool and nm; for a Go binary, go version -m; plus entries for Android and WebAssembly, and a list of common pitfalls. The agent then calls the tools itself through its shell.

This is the same bet behind the wider agent skills movement: a text file the model loads on demand can replace a running server when the underlying tools already exist on the machine. Our primer on how skills turn into loops covers the mechanics.

The benchmark, as the author reports it

The author ran Claude Code headless with Sonnet on macOS arm64, four tasks, three repetitions per cell, three arms:

The 38% and 35% figures come from comparing the leanrea and REA rows (388 s versus 627 s, $2.17 versus $3.36). REA scored one point higher. The README also reports that merely loading all tools for a trivial "Reply OK" prompt cost about 34.5k tokens for leanrea versus 400.7k for REA, which is the structural reason an MCP server with 207 tools is expensive: every tool schema sits in context. Our MCP primer explains why.

What is verified and what is not

The numbers above are the author's. Nothing in the repository has been independently reproduced, and the README is candid about why you should be careful:

• Only three reps per cell, one model, one machine.
• REA was tested in its best case, with deferred tool loading.
• Ghidra, Hopper and jadx were not installed, so native tasks used Xcode tools for both arms. REA's real advantage, deep decompiler integration, was therefore not exercised.
• The gain over no skill is much smaller: about 19% faster and 32% fewer turns, at nearly equal cost.
• The answer keys match specific app and gh versions, so other versions need new keys.

The honest reading: on a small, macOS-only task set where the heavy decompilers were absent, a short skill matched a large toolset on quality while using far fewer tokens. That is plausible and consistent with how context overhead works, but it is not evidence that leanrea replaces REA for serious binary analysis.

The token math behind the claim

The most defensible number in the README is not the speed-up; it is the context overhead. Loading every tool definition for a trivial prompt cost about 34.5k tokens for leanrea versus 400.7k for REA, a gap of roughly 366k tokens. The cost row follows from that. REA's run cost $3.36 against leanrea's $2.17, a difference of $1.19 across the benchmark, while REA also needed 124 turns against 55. Every extra turn re-sends the accumulated context, so a large tool catalogue compounds: more schemas in the prompt, more turns, more cached or re-read tokens.

Prompt caching softens this. The author says REA was tested in its best case with deferred tool loading, which means the tools were not all injected up front. Even so, REA took 627 seconds against 388. That suggests the turn count, not only the schema size, drives the gap: the skill tells the agent which command to run first, so it wastes fewer exploratory calls. Note, however, that the no-skill arm used 81 turns and cost $2.21, almost the same as leanrea. In other words, the cheapest explanation for the cost advantage is that REA is expensive in this setup, not that leanrea is unusually cheap.

A per-target playbook, in plain terms

Based on the README's description, the skill works as a lookup from target type to first move. Treat this as our summary of the idea, not a copy of the file.

The value of a skill like this is encoded experience: which tool is fastest, and which traps waste turns. A strong model already knows most of these tools, which is why the no-skill arm scored a respectable 67 of 75. The skill's lift is in the last few points of accuracy and in fewer wasted turns.

How to check the claim yourself

You do not need to trust the table. A small replication is cheap:

1. Pick three or four targets you are allowed to analyze, such as an open-source Electron app and a Go CLI.
2. Write the same question for each, with a known answer key, such as "which endpoint does the updater call".
3. Run your agent headless with no skill, with leanrea installed, and with REA connected, three or more times each.
4. Record wall time, cost, turns and whether the answer matched the key.
5. Install the decompilers the author skipped, so the native-code tasks are a fair test.

If your numbers disagree, that is useful data; publish it. The author already flagged that three repetitions on one machine cannot separate a real gain from noise.

What people are likely to ask

Does it work on Linux and Windows? The benchmark ran on macOS arm64, and several listed tools such as otool are macOS-specific. The README does not claim cross-platform results, so expect to adapt the commands.

Is a skill safer than an MCP server? Not automatically. A skill steers an agent that already has shell access; an MCP server can constrain which tools exist at all. The trade-off is flexibility against a narrower attack surface, discussed in our REA MCP analysis.

Will it keep working after tool updates? The answer keys are tied to specific app and gh versions, so benchmark tasks will drift. The skill itself, being instructions, is easier to update than a server, but someone has to maintain it.

When leanrea makes sense, and when REA still does

Pick leanrea when your targets are packaged apps, Go binaries or simple Mach-O files and you already have the command-line tools installed. The setup cost is one command, and you avoid running another server in your agent's tool list. Pick REA when you need its integrated decompilation tools, structured tool outputs, or when you want a security boundary around what the agent can invoke; our MCP server analysis covers those trade-offs.

Try it safely

npx skills add aicodeking/leanrea

The repository is published by aicodeking. Read the README, and read the 8 KB file before installing; a skill is instructions your agent will follow with shell access. Run it on binaries you are allowed to analyze. Our clean-room checklist and the differential-testing guide explain how to stay on the right side of licensing and verify what an agent claims it found. For agent-security context, see AgentBeam, the agent security platform from the explainx.ai team, which stops agents before they take dangerous actions.

Why a tiny repo gets noticed

Two trends meet here. Developers are tired of paying a token tax for tool schemas they rarely use, and they are discovering that a well-written instruction file can steer an agent toward tools it already knows. A repo that quantifies the difference, even imperfectly, spreads quickly. Expect copycat skills for other domains and, ideally, independent re-runs with more repetitions and the decompilers installed.

Related reading

• REA MCP server and agent security
• How to install the REA skill
• Top 10 projects built with REA
• REA reverse engineering as a prompt
• Reverse engineering with an AI agent: prove it
• Agent skills donated to the Agentic AI Foundation

Repository details, star counts and benchmark figures are as of October 23, 2026.