Fast2Future AI Tools · Pillar guide · Last updated October 15, 2026

Reverse Engineer Anything (REA): What 229,000 GitHub Stars in 12 Days Actually Means

By Justin Mark, Fast2Future · Updated October 2026

On October 2, 2026, a GitHub repository called REA had about 40 stars. Twelve days later it had 229,000 — and it's still climbing (over 245,000 by the time we checked the GitHub API on October 15). That's one of the fastest climbs in GitHub's history: per GitNova star-history measurements reported in the launch-wave coverage, October 11 alone added more than 40,000 new stars in a single day.

So what is it? REA — Reverse Engineer Anything — is an open-source MCP server and command-line tool that connects AI coding agents (Claude Code, Codex, Cursor, and others) to professional reverse-engineering tools like Ghidra, IDA Pro, and Hopper. Point your agent at a program with no source code, ask how a feature works, and REA hands the agent the decompiled code, the call graphs, and the evidence — so the agent can explain the behavior or rebuild it. The official repo is github.com/morluto/rea (MIT license), and the project's site is rea.tools.

A note on honesty: this is a researched guide, not a hands-on lab test. We studied REA's official repository and documentation, the project's own case studies, and independent test reports from developers who ran it on real software — and we say exactly where each claim comes from. We did not run REA ourselves. If something matters and we don't know it, we say so. There are no affiliate links in this guide: REA is free and open source, so every link here is a plain link to the official source.

What is REA, exactly?

Reverse engineering means learning how software works by inspecting the program itself — the compiled binary, the packaged app, the running website — instead of reading its source code. Traditionally that's a specialist skill: you open the binary in a disassembler like Ghidra, wade through assembly language, and slowly reconstruct what the program does.

REA's insight is that this workflow has two halves, and AI agents are suddenly good at one of them. The mechanical half — disassembling, decompiling, mapping functions, tracing calls — is what tools like Ghidra already do. The reasoning half — what does this function do, which code path handles this feature, how would I rebuild it — is what large language models are good at. REA is the bridge: it wraps the professional tools as MCP tools (Model Context Protocol, the open standard that lets AI agents call external tools), so your coding agent can drive them directly. You ask in plain English; the agent calls REA's tools; REA calls the decompiler; you get a cited answer instead of a 4,000-line assembly dump pasted into chat.

The project's own pitch is a three-step loop: decompile to recover readable code and naming clues, trace execution until the feature is explained, then recreate the logic in your own stack. Every conclusion is supposed to come with evidence and stated caveats — REA's design is "fail-closed," meaning it declares its limitations rather than hallucinating confidence.

How does REA actually work under the hood?

REA doesn't replace the professional tools; it drives them. Think of it as the layer between your agent and the engines:

• Analysis backends: Ghidra (run headless as the default engine), IDA Pro, Hopper, and Binary Ninja. You supply whatever you're licensed to use — Ghidra is free and open source, the others are commercial. Hopper can run in a free demo mode.
• Specialized readers: its own parsers for JavaScript/Electron apps (it can unpack ASAR archives and map modules, routes, and IPC channels), .NET assemblies, Android APKs (via JADX), firmware (via Binwalk and Unblob), and websites.
• Network capture support: REA reads HAR files and mitmproxy captures, which makes it a front end for API reverse engineering — watch what an app sends over the network, then reconstruct the API.
• The agent interface: roughly 139 MCP tools and 94 CLI commands (per third-party documentation of version 5.x — the project moves fast, so treat the count as approximate), plus a guided workflow skill your agent can load. It keeps investigation context, so you can ask follow-up questions about the same app without starting over.

Crucially, the analysis runs on your own machine, not on a hosted service. The binary you're inspecting never leaves your hardware — which is a meaningfully different trust model from uploading someone's app to a cloud API. (There is a caveat here, and it's important: see the limits section.)

How do you install REA?

Installation is genuinely one command, and the setup is designed to be safe: it detects what's already on your machine, prints every change it proposes, and asks before applying anything. The exact steps, adapted from the official documentation (verify against the repo before running — this project moves fast):

1. Check your prerequisites: Node.js 22.x (22.19 or newer), 24.x (24.11 or newer), or 26+. Note that Node 23 and 25 are not supported. You also need an MCP-capable coding agent: Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, or VS Code.
2. Run the guided setup: npx rea-agents setup (or npx rea-agents@latest setup to pin the latest release explicitly) — it detects your agents, shows you exactly which config files it will touch (with backups), and asks for approval. Existing REA registrations are preserved; nothing is overwritten blindly.
3. Verify it: rea doctor runs a sanity check on the installation.
4. Restart your agent so it loads the new MCP tools, then just ask: "Use REA to inspect this app and tell me how the export feature works."

Two warnings that belong here, not in the fine print. First, use only the official repository: morluto/rea. The star explosion spawned copycat forks with similar names — if the URL isn't morluto/rea, don't install it. Second, pin your version for anything serious. A project that gains 200,000 stars in under two weeks churns its APIs; expect breaking changes and don't auto-update a working setup.

What have people actually taken apart with REA? The 8 best real teardowns

When Matt Van Horn's viral post asked "WTF did people actually take apart?", the wave of replies was the real story. We couldn't retrieve his exact eight (X threads don't archive well), so here are the eight best-documented teardowns from the launch wave — each from a published write-up or the REA team's own case studies, with sources:

1. Obsidian's quick-switcher — rebuilt in 4 minutes, verified identical

The headline test. A developer pointed REA at Obsidian (the note-taking app) on a Mac and asked it to rebuild the quick-switcher's fuzzy-search ranking. REA mapped the 24 MB bundle — 3.9 million syntax nodes, 1,639 findings, 42 IPC channels — in about a minute. The agent found the scoring chain, built a one-file replica, and verified it against the original: 30 note titles × 4,915 queries, identical results. Then came the interesting part: asked to list everything the app can do behind your back via those 42 channels, the model's own safety classifier stopped the write mid-sentence. The tool worked; the guardrails worked too.

2. ShareX's Image Beautifier — rebuilt as a web app

REA read the .NET libraries of ShareX (the open-source screenshot tool for Windows), mapped how its Image Beautifier feature works, and the agent rebuilt it as a small web app dubbed MiniShot. The write-up is admirably honest about what REA couldn't see, which is rarer than it should be in launch-week coverage.

3. An indie dev's own iOS app — pricing formulas recovered exactly

A developer turned REA on his own app's arm64 binary and asked three questions about what it does. In 16 minutes it answered two correctly and one half-right — including an exact reconstruction of his max-loss and breakeven formulas. The honest caveat: his binary still had its 18,553 symbols intact, which makes the job dramatically easier. He also documented a real gotcha — Ghidra sat stuck on Swift demangling for minutes until he pointed it at Xcode's demangler, after which the analysis finished in 237 seconds.

4. FluxMark for macOS — "code was never the moat"

Another indie developer handed REA his own released app and published the full verdict up front: REA takes your code — but code was never the moat. The piece is the best articulation of the builder's takeaway from the whole wave: if your app could be perfectly cloned tomorrow, what would you have left? Brand, distribution, trust, iteration speed — everything except the code.

5. Windows Calculator's % button — why 200 + 10% = 220

The REA team's own interactive case study, and a perfect demo of what the tool is for. Ask why Calculator gives 220 for 200 + 10%: REA reads the installed app's library, finds the % handler's branch — after + or −, it takes the percentage of the first number (10% of 200 = 20, so 200 + 20); after × or ÷, it converts to a decimal (200 × 0.1 = 20). The case study cross-checks the recovered branch against Microsoft's public source. A mystery most of us have wondered about, answered from the binary.

6. Chrome's dinosaur game — the speed rule, recovered and rebuilt

Why does the dino get faster? REA inspected the running game's script through a local debugging connection and returned the actual rule: speed starts at 6, increases by 0.001 per update, capped at 13. The team verified it by calling the original update function 10,000 times (speed hit exactly 13.0), then rebuilt the rule in a mini-game with a speed slider. Delightful, rigorous, and reproducible.

7. Notion's copy-to-clipboard — Electron tracing

Following Notion's packaged JavaScript to the system clipboard to see how a copy preserves rich block data — a clean demo of REA's Electron/JS reader mapping modules and IPC from an ASAR archive. The kind of question a developer integrating with Notion would actually ask.

8. DX-Ball's 1996 sound-pan calculation — plus an Android authenticator

Two from the team's showcase: recovering how a ball's position becomes left/right stereo sound in a 1996 Windows game (reconstructing gameplay logic in C and testing it against the original), and tracing the Aegis authenticator's six-digit login code through its released APK to show why it changes every 30 seconds. Old games and modern Android apps — the range is the point.

The pattern across all eight: the wins are explanations, not clones. Nobody rebuilt Obsidian. They rebuilt one ranking function, one button's logic, one game's speed rule — then verified the rebuild against the original. That's the honest shape of the tool: a question-answerer about software, not a photocopier.

Where does the hype outrun reality? REA's honest limits

229,000 stars is a signal, not a certification. Here's where the serious coverage — including the REA team's own materials — says to pump the brakes:

• Stripped or obfuscated binaries are a different game. The iOS test above worked because the binary kept its symbols. Strip the symbol table or obfuscate the code and the agent loses its names and landmarks. Nobody in the launch wave published numbers for that case — which tells you something.
• "Local" has an asterisk. The analysis runs on your machine, but the results flow through your agent to your model provider. If the binary is confidential — your employer's proprietary code, a client's app — that's a data-governance decision, not a tooling detail. Treat REA as local-then-leaky.
• Velocity risk. A repo that goes from 40 to 245,000 stars in two weeks churns APIs. Pin the version that works for you; expect breaking changes; don't build production workflows on the bleeding edge.
• The author is a pseudonym. "morluto" maintains a fleet of small "for agents" repos. That's not disqualifying — it's MIT-licensed code you can read — but it's worth knowing before you pipe production binaries through it.
• Docs are thin; hype is thick. The developer-published documentation is sparse, and most third-party material is either launch-week excitement or ethics debates. Structured beginner content is the current gap in the ecosystem.

Is REA legal? The ethics frame, honestly stated

This is the section the hype posts skip and shouldn't. The REA community's own framing — echoed across the serious write-ups — is: inspired, yes; copying, no. Learn how the feature works; don't ship a clone of someone's product.

The legitimate uses are well-established: understanding software you own or are authorized to examine, interoperability (making your tools work with others), security research, education, and preservation. Reverse engineering for these purposes is lawful in the US and most jurisdictions — but the details vary by country, and contracts and licenses add their own restrictions. If you're going to sell something built from what REA shows you, check with a lawyer first. We're not lawyers, and a blog post isn't legal advice.

Two things worth knowing. First, the REA team's own materials stress respecting other people's code, designs, and licenses — get inspired by how things work, don't lift them. Second, context matters: days before REA's explosion, press reports blamed a different AI tool for a breach affecting seven South Korean banks (Startup Fortune). That wasn't REA — but it's why the line between "inspect to understand" and "inspect to exploit" is the whole conversation right now. REA's evidence-contract design (every claim cited, limitations declared) is built for the serious side of that line: professionals understanding binaries they're legitimately responsible for.

Our take, plainly: this is a power tool. Power tools are legal. What you point them at is your responsibility.

REA vs. the alternatives

The key row is the third one. REA's real competition isn't Ghidra — it's the workflow you were doing last month: disassemble a chunk, paste it into a chatbot, ask what it does, repeat 40 times, and hope the model doesn't invent an answer. REA replaces that with an agent that can see the whole binary, follow references itself, and show its evidence. That's the unlock the 229,000 stars are actually voting for.

Should you install REA? Our verdict

Here's our honest scorecard after researching the launch wave:

• Free and open source (MIT) — no subscription, no catch, code you can read.
• Genuinely new capability: an agent that can see inside compiled software and cite its evidence.
• Safe, reversible setup — it shows its plan and backs up your configs before touching anything.
• Real verified wins: identical rebuilds checked against originals, not demos.
• Runs analysis locally — the binary never leaves your machine.

• Weak on stripped/obfuscated binaries — the impressive demos mostly used symbol-rich targets.
• Findings still flow to your AI provider's cloud — don't point it at confidential code casually.
• Breakneck API churn — pin your version; this is not stable infrastructure yet.
• Thin official docs — you'll be learning from the community for now.
• Only the official repo (morluto/rea) — copycats are already circulating.

The deepest lesson of the REA wave isn't about REA. It's what the FluxMark developer wrote: code was never the moat. If an agent can recover your app's logic from the binary in an afternoon, your defensibility was never the code — it was your brand, your distribution, your users' trust, and how fast you ship the next thing. That's worth sitting with whether or not you ever install it.

If you want the broader picture of which AI tools are actually worth a solopreneur's money in 2026, start with our pillar guide: 30+ tools tested, 7 worth paying for.

Frequently asked questions

Sources

Every major claim in this guide traces to one of these (all accessed October 14–15, 2026). We link sources rather than asking you to trust us:

• Star count and license — GitHub API: morluto/rea (245,143 stars, 61,305 forks, MIT, checked October 15, 2026)
• What REA is and how to install it — morluto/rea official repository and installation docs
• Official site, interactive demos, and case studies (Calculator, dinosaur game, Notion, DX-Ball, Aegis) — rea.tools
• The viral wave post — Matt Van Horn (@mvanhorn): "Reverse Engineer Anything went from 40 to 229k GitHub stars in 12 days"
• Obsidian quick-switcher rebuild test — video walkthrough (4 minutes, 4,915 queries verified)
• ShareX / MiniShot test — video walkthrough
• iOS app analysis (16 minutes, formula recovery) — ai-muninn.com write-up
• FluxMark self-test ("code was never the moat") — dev.to write-up
• Setup sketch, honest caveats, and the "local-then-leaky" framing — dev.to: REA explained for AI coding agents
• What REA does and where hype outruns it — dev.to: what the viral repo actually does
• Context on AI tools and software security incidents — Startup Fortune