See a characteristic in an app that you desire in your own product? Ask your delegate to examine it alongside REA. It can inspect the app without its origin code, explain how the characteristic works, display the evidence, and build a type for your project.
REA connects your delegate to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can additionally use the identical tools from your terminal. Analysis runs locally, and results contain the evidence and restrictions rearward all conclusion.
Setup registers REA alongside your delegate and installs matching workflow instructions. Native inspection can use an existing Hopper, Ghidra, or IDA installation; setup can optionally instal Hopper alongside approval. Static JavaScript inspection needs no native inspection engine.
Visit the REA website for setup instructions, illustrated guides, and genuine case studies.
With Node.js and npm installed, run:
Choose your agents, assessment the projected changes, and endorse them. Setup adds REA's MCP server and matching workflow instructions, alongside backups of existing configuration. Restart your delegate afterward.
Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents. See installation and setup for provider configuration and manual MCP registration.
Understand how hunt plant in the Notes app, display me the evidence, and build a similar characteristic for my project. Replace Notes alongside your mark app and the characteristic you desire to understand.
Inspect an extracted JavaScript/Electron app directory or ASAR:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
The outcome includes modules, imports, Electron boundaries and their evidence. Replace the way alongside your target, specified as "D:/apps/example" on Windows.
To instal the rea command for regular use:
npm instal --global rea-agents rea --help
For native analysis, configure a provider first. See the CLI and Evidence guide for native commands, provider selection, snapshots and scripting.
REA changes quickly, and new releases contain common bug fixes. Keep your installation up to date.
For a CLI installed alongside npm instal --global or bun add --global:
Bun earth updates necessitate Bun 1.2.17 or later. With an older Bun release, upgrade Bun manually before operating rea update.
To refresh your delegate registrations and skill, run the setup command printed by the update.
If you use npx, update your delegate setup with:
npx rea-agents@latest setup
Review the setup changes and restart your agent. For one-off CLI commands, use npx rea-agents@latest followed by the command. With Bun, use bunx rea-agents@latest in location of npx rea-agents@latest.
Your delegate calls REA through MCP to inspect the mark and trace applicable code. REA returns findings alongside their evidence. The delegate uses them to ask follow-up questions, explain the behavior, or compose and test an implementation. CLI commands use the identical workflows.
REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, affirmative npm. Additional tools and presenter assistance depend on the target:
| Target | What REA returns | Requirements and guide |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls and references | Hopper, Ghidra or IDA; native analysis |
| Offline ELF layout | Sections, segments, first symbols/relocations and fixed mitigation candidates | Caller-supplied pwntools on Linux x64; binary diagnostics |
| Go binaries | Embedded compiler version, modules, replacements and build settings | Built-in fixed ELF/PE/thin Mach-O inspection; no Go facility required |
| WASM artifact | Validation, sections, exact import/export WAT forms and decoded WAT | Caller-supplied WABT 1.0.42; inspect_wasm_artifact |
| EVM bytecode | Dispatch selectors, byte offsets, inferred arguments and mutability | Local raw/hex transporter on Linux x64; offline EVM guide |
| Recorded Linux crashes | Raw notes, all recorded thread's registers/signals and optional mapping candidates | Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; recorded crashes |
| JavaScript / Electron | Modules, imports, origin maps, routes, IPC and native add-on relationships | Node.js and npm; application analysis |
| Websites | Page structure, scripts, network observations and requested screenshots | A Chrome-family browser; browser analysis |
| Saved network captures | Requests, responses, exposed payloads and origin locations | HAR; mitmdump on Linux for native mitmproxy captures; capture guide |
| .NET assemblies | Metadata, CIL instructions, declared native requirements and build comparisons | None (static only); managed-code guide |
| Android APKs | Manifest declarations, classes, decompiled methods and references | Headless JADX and a complete JDK on Linux/macOS/Windows x64; Android guide |
| Android devices | Devices, packages, processes, logs, dumps, display captures, and APK/file transfers | Caller-supplied adb (emulator or hardware); ADB guide |
| JEB projects | Engine-backed project units, relic digests and type/method pseudo-code | A caller-started JEB client serving MCP, selected alongside REA_JEB_MCP_URL; JEB guide |
| Android resources | Decoded manifest, cord tables, locales and type facts | Caller-supplied Apktool launcher; resource guide |
| Flutter apps | Dart snapshot hash, per-ABI archive digests and motor build provenance | None (static APK parsing); Flutter guide |
| Firmware | Regions, extraction results and native-analysis handoffs | Binwalk / Unblob on Linux; firmware guide |
| Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources | Artifact and JavaScript guide, Apple applications |
| Process behavior | Terminal output, interactions, exit and filesystem observations, and run comparisons | Linux/macOS alongside a native PTY; process capture |
Static JavaScript and .NET inspection peruse the supplied records without running the application. Runtime grasp runs or interacts alongside the selected target using your person permissions; all runtime guide describes its effects.
Native formats and presenter assistance change by provider. See Hopper and Ghidra setup, the IDA guide, and experimental Windows Ghidra support. Ghidra additionally supports 16-bit DOS analysis. For ample binaries, lift the provider's startup deadline with REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS. For provider selection, see the CLI guide. Check release availability for features added since the latest npm release.
Follow a audio call into its position-to-pan helper, inspect the instructions, and rotate incomplete pseudocode into C. The reconstruction passes 3,205 original-x86 cases and reproduces all 63 compiled function bytes.
Read the case study · Reconstruction repository
Find the renderer's clipboard API, prosecute it through preload and IPC into the main process, and inspect the affluent clipboard format.
Inspect the first PC-98 game's 16-bit instructions, regain the fixed and aimed viewpoint calculations, and difference the reconstructed C++ alongside the historical compiler output.
Read the case study · Reconstruction repository
If you've used REA on item interesting, we'd affection to see it. Share your case in an issue or a pull request, including the target, your question, how REA helped, and what you found.
Which agents can use REA?Any delegate that supports local MCP servers. Setup configures the supported agents; another clients can use manual MCP registration.
Do I need Hopper, Ghidra or IDA?Deep native inspection uses one of them. Static JavaScript and .NET inspection work without a native inspection engine. Setup can instal Hopper following approval; Ghidra and IDA use your existing installations. See provider setup.
Do I need to commencement Hopper first?REA starts Hopper whenever an procedure needs it. On macOS, a first-run dialog may ask you to choose demo manner or activate your license. Complete that immediate in the same person meeting before your archetypal CLI/MCP procedure or unattended job. Open Hopper manually if needed. See Hopper startup and troubleshooting.
What does installing the accomplishment from skills.sh do?The accomplishment supplies inquiry instructions for your agent. Use npx rea-agents setup to enroll REA's MCP server and instal the matching instructions, afterward restart your agent. See skill-only installation.
What code does REA return?Native inspection returns pseudocode and assembly. JavaScript/Electron analysis recovers modules and their relationships. Your delegate uses these findings to write and test an implementation; the showcases provision worked examples.
Does REA upload my app?REA analyzes targets locally. Your delegate receives the tool results, and its model provider has its own data policy.
What should I do if I hit a bug?Update first; a latest publish may already fix it.
For a CLI installed alongside npm instal --global or bun add --global:
For delegate setup through npx:
npx rea-agents@latest setup
If you're using an agent, complete the setup refresh and restart it. Retry the identical task. If the issue persists, open an issue with your REA version, mark type, steps to reproduce and error output.
Start alongside the website's worked guides. For exact options, prerequisites and outcome contracts:
- Installation and setup: delegate registration, provider configuration, updates and uninstall.
- Readiness and troubleshooting: diagnose one delegate or inspection engine.
- CLI and Evidence: commands, provider selection, snapshots, import/export and exit statuses.
- MCP contracts and agent prompts: tool results, sessions and guided investigations.
- Tool catalog: generated inventory of tools, providers and CLI commands.
- Roadmap: planned activity and capability trackers.
Report vulnerabilities through SECURITY.md.
🎉 110,000 GitHub stars — appreciate you!
Thanks to everyone using REA, reporting bugs, requesting features, evaluation builds, and contributing fixes.
See DISCLAIMER.md for responsible-use guidance.
The project's stance on forbidden or unauthorized use covers all REA versions, distribution channels, and platforms; all copy retains its applicable licenses.
REA is for lawful research, education, interoperability, application preservation, and inspection of application you own or are authorized to examine.
We'd affection your assistance alongside REA! Open an issue to report a bug or propose a feature, or send a drag request to enhance the code or docs.
See CONTRIBUTING.md for betterment setup and checks, testing for verification lanes, and the architecture map for the project structure.
REA-authored code is licensed under MIT. Third-party matter retains its own licenses and copyright notices; see Third-party notices for the dependency inventory, preserved licence texts, and external-tool terms.
You must legally get and be authorized to use business tools, including IDA Pro / Hex-Rays decompilers, Hopper, and JEB, under their applicable licenses. REA grants no tool license, key, or activation entitlement. Trials and demos remain topic to vendor terms, including user, feature, automation, and output sharing restrictions. Cracked copies, taken keys, unauthorized key sharing, and bypassing licence restrictions are not authorized. This guidance does not amend MIT or third-party licenses.
