REA (Reverse Engineer Anything): what the viral AI reverse engineering tool is

What REA is

REA, short for Reverse Engineer Anything, is an open-source project published on GitHub by a developer who goes by morluto. It presents itself as a single MCP server for reverse engineering programs, apps and runtime behavior, and it's distributed under the MIT license.

The project went viral in October 2026 and, on October 19, had passed 300,000 stars on GitHub. The numbers reported by the press vary a lot from one article to another; the reliable reference is the repository itself. For the full context, including the Adobe clones case, see the guide to reverse engineering with AI.

How REA works

REA isn't a program you open and use on its own. It's a bridge between an AI agent and the tools reverse engineering specialists already used. That bridge follows the Model Context Protocol (MCP), the open standard that lets a model call external tools. The flow has four steps:

• ✓Installation: one command registers the REA MCP server in the agent and adds the working instructions, backing up the previous configuration.
• ✓Request: the person points to a target (a file, an app, a website) and asks the agent a question, such as "what does this function do?" or "which servers does this app talk to?".
• ✓Analysis: REA runs the tools on the user's machine and returns pseudocode, call graphs, strings found in the program and execution logs.
• ✓Answer: every conclusion comes with the evidence that supports it and the known limitations, so a person can check it.

Which agents it works with

The repository lists Claude Code, Codex, Cursor, Gemini CLI and Grok Build, and says any agent that accepts local MCP servers can use REA, with manual registration when the automatic install doesn't cover the case.

What it can analyze

According to the repository, REA covers a wide range of targets, each with the appropriate tools:

• ✓Native Windows, macOS and Linux programs, with Ghidra, IDA or Hopper.
• ✓Go, Rust and WebAssembly code, and Ethereum (EVM) contracts.
• ✓JavaScript and Electron apps, and websites.
• ✓.NET programs.
• ✓Android apps and devices, with JADX, Apktool and adb.
• ✓Device firmware.
• ✓Network traffic captures, SQLite databases and crash logs.
• ✓Behavior of running processes.

What REA doesn't do

Many headlines exaggerated what the tool delivers. The analysis published by the IA.com.br portal and developer Fabio Akita's article converge on the same points:

• ✓It doesn't decompile on its own: for native programs, the heavy lifting is done by Ghidra, IDA or Hopper. REA coordinates.
• ✓It doesn't recover the original source code: the result is an approximate reconstruction that needs to be validated.
• ✓It doesn't clone apps with one click: turning an analysis into a working product still takes a lot of engineering.
• ✓It doesn't provide licenses: paid tools such as IDA, Hopper and JEB must be bought by the user.
• ✓It doesn't guarantee accuracy: the project's own disclaimer says AI-assisted analysis can be incomplete or incorrect.

What it costs to use

REA is free, but using it has indirect costs. The first is the tools: Ghidra is free, while IDA, Hopper and JEB are paid. The second, and more significant, is the agent's tokens, since the analysis runs on the user's subscription or API account.

Analyses consume a lot. Akita reports that REA's tool catalog is about 2.3 MB and that one of the project's own examples, analyzing a SQLite database compiled to WebAssembly, took 42 tool calls, five minutes and about 300,000 input tokens. On larger projects, the bill grows fast.

What it's for and what's off-limits

The repository's disclaimer lists as acceptable uses security research, malware analysis, coordinated vulnerability disclosure, security competitions (CTF), interoperability, software preservation and analysis of your own or authorized programs.

And it explicitly excludes: bypassing DRM, license checks or anti-cheat systems, cheating in online games, circumventing system authentication without authorization, copying proprietary software and using pirated copies of the tools. To understand the limits under Brazilian law, see is software reverse engineering a crime?.

Security precautions when using it

Two observations from the IA.com.br analysis deserve attention. First: REA's local bridge isn't an isolated environment and doesn't protect against malicious processes already running as the same user. Second: the tools' outputs pass through the AI model provider, so how that data is handled depends on the provider's policy.

To analyze company software, use plans whose terms guarantee that the data sent isn't used to train models, and don't run the tool on machines with access to production data.

What REA means for companies

For companies that publish software, the message is that analyzing an app got faster and more accessible, including for people with bad intentions. It's worth reviewing what's exposed, as we show in reverse engineering and AI: how to protect your app.

For companies with old systems and no documentation, the same technique is an ally: see how to document legacy systems with AI. And to decide where tools like this make sense in your business, with what rules and what risks, count on our AI consulting.