Coderefercoderefer
CoursesWebinarsBlogAbout
Coderefercoderefer

Discover. Learn. Automate. Grow.

Learn

  • Courses
  • Webinars
  • Blog
  • Search

Company

  • About
  • Contact
  • FAQ

Legal

  • Privacy Policy
  • Terms of Service
  • Refund Policy
© 2026 Coderefer. All rights reserved.
HomeBlogHow to Use REA (Reverse Engineer Anything) with Claude Code
How to Use REA (Reverse Engineer Anything) with Claude Code
ai-toolsOctober 13, 20267 min read

How to Use REA (Reverse Engineer Anything) with Claude Code

Set up REA (Reverse Engineer Anything) with Claude Code in 4 steps: install the MCP server, ask your first question, and check the evidence it gives you.

V

Vamsi Tallapudi

Manager, Architect Technology at Cognizant

ai-tools claude-code mcp 2026
Share:

REA (Reverse Engineer Anything) is an open-source MCP server that lets Claude Code inspect an app it has no source code for, trace how a feature actually works, and hand you the evidence instead of a guess. You run one setup command, point your agent at an app and a feature, and it decompiles, traces, and reports back with what it found and what it couldn't determine.

The project lives at github.com/morluto/rea, it's MIT licensed, and as of October 13, 2026 it sits at more than 197,000 GitHub stars. That number is almost as interesting as the tool itself: the repo was under 10,000 stars on October 6 and crossed 100,000 by October 12. I've never watched a reverse-engineering tool go viral before. Most of this crowd doesn't post on main.

Here's how to get it running with Claude Code and what to actually expect once it's there.

What does REA do?

REA is an MCP server. MCP (Model Context Protocol) is the standard that lets an AI agent call out to extra tools beyond its own training. Once REA is registered with Claude Code, your agent can call it to inspect a target (a binary, a website, an Electron app, whatever) and trace the code path behind a specific feature.

It returns findings with evidence attached: the actual code, the references, the network calls it observed. Your agent then uses that to either explain the behavior in plain English or go write and test its own version of the feature.

Everything runs locally on your machine. No app gets uploaded anywhere. That said, your agent still receives the tool output as part of its context, so whatever model provider you're using behind Claude Code has its own data policy on that conversation. REA itself isn't the thing storing your data.

What can it actually analyze?

  • Native binaries: pseudocode, assembly, strings, symbols, calls and references
  • JavaScript and Electron apps: modules, imports, source maps, routes and IPC
  • Websites: page structure, scripts and the network requests a page fires
  • .NET assemblies: metadata and CIL instructions
  • Android APKs: manifest, classes and decompiled methods

The README also lists firmware, WASM, SQLite databases and packet captures, though those are less common use cases. If you're mostly curious about a web app or an Electron app someone built, you'll spend 90% of your time in the first three categories.

What you need before you start

  • Node.js 22.x (22.19+), 24.x (24.11+), or 26+, plus npm
  • An agent that supports local MCP servers: Claude Code, Codex, Cursor, Gemini CLI and Grok Build all have setup support baked in
  • Hopper, Ghidra or IDA, but only if you're analyzing native binaries. JavaScript and .NET inspection need none of them
  • A Chrome-family browser for website analysis
  • A full JDK and headless JADX for Android APKs

If you only care about JS, Electron or websites, you can skip the whole native toolchain section. That's most people.

Step 1: Run setup

npx rea-agents setup

This is the only command most people need to type.

Step 2: Pick Claude Code and approve the changes

Setup will ask which agents to configure. Pick Claude Code, look over the diff it proposes, and approve it. It registers REA's MCP server, drops in matching workflow instructions, and backs up whatever config you already had before touching it.

Step 3: Restart Claude Code

Close it and reopen it so the new MCP server actually loads. Skipping this step is the most common reason people think setup "didn't work."

Step 4: Ask your first question

Point it at a real app and a real feature. The project's own suggested prompt shape is a good template:

Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.

Swap in whatever app and feature you're actually curious about. A few more that work well:

  • "Find where this Electron app handles copy and paste, and show me the code path from the UI to the main process."
  • "List the modules in this app and tell me which one handles login."
  • "Explain how this website loads its search results, and show me the network requests involved."

I'd start small. Pick one feature, not "explain this whole app," or you'll get a wall of output that's hard to verify.

How do you check the evidence it gives you?

This is the step people skip, and it's the one that matters most. REA's output includes the evidence behind each conclusion and, honestly, what it couldn't figure out. If your agent tells you a feature works a certain way, it should be pointing at actual code, specific references, or network calls that back that up, not just asserting it.

Read that part. Don't just skim the summary and move on. An agent that's confident and wrong is worse than one that says "I'm not sure."

Can you run REA without an agent?

Yes. If you want to inspect an extracted JavaScript or Electron app directory, or an ASAR file, directly from the terminal:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

And if you want the rea command around for regular use:

npm install --global rea-agents
rea --help

How do you keep it updated?

REA ships fast. If you installed it globally:

rea update

Using npx instead, just rerun setup against the latest version:

npx rea-agents@latest setup

Then restart Claude Code again.

What has REA actually reproduced?

This is where I'd push back on some of the hype. A lot of the viral coverage this past week leaned on star-count charts, not demos. One widely shared claim that REA had reproduced the entire Photoshop suite turned out to have no documentation behind it anywhere. The "clone Calendly in one prompt" videos making the rounds? Those were built with Base44, a commercial app builder, not REA. Worth knowing before you believe everything you see this week.

What REA's own case studies actually show is narrower, and more credible for it:

  • DX-Ball: a sound-pan calculation from the 1996 Windows game was rebuilt in C and validated against 3,205 original x86 behavior cases, matching across every integer position from 0 to 640 at five different pan scales. The compiled C reproduces all 63 bytes of the original function when run through the pinned VC4.0 toolchain.
  • Notion: the Electron clipboard bridge was traced from the renderer through the preload layer and into the main process, including the HTML marker Notion uses to keep rich block data intact on copy.
  • TH04: a bullet-ring targeting calculation from a 16-bit PC-98 DOS shooter was recovered from the original instructions.

That's legitimate, verifiable work on small, well-defined functions. It's not "clone any SaaS app in a weekend." Treat anyone claiming the latter with suspicion until they show you the diff.

A note on what's actually okay to point this at

Only run REA against software you're allowed to inspect. Reverse engineering can violate a product's license terms, and in some jurisdictions it can cross into legal trouble regardless of what the EULA says. The tool doesn't know or care about any of that, it just does what you tell it. Your own projects, open-source software, and anything you have explicit permission to study are the safe lanes. A commercial app's payment flow is not one of them, clever prompt or not.

Troubleshooting

  • Update first: rea update or a fresh npx rea-agents@latest setup. A lot of early bugs get fixed fast given how quickly this project is moving.
  • If native binary analysis fails, confirm Hopper, Ghidra or IDA is actually installed and licensed. On macOS, Hopper shows a first-run dialog you have to click through manually before REA can drive it.
  • Still stuck? Open an issue on the repo with your REA version, the target type, repro steps and the exact error.

Watch

REA - Reverse Engineer Anything With Your Coding Agent

Links

  • Repo: github.com/morluto/rea
  • Site and guides: rea.tools
  • Case studies: rea.tools/showcase

If you're already running Claude Code with MCP servers for other things, this one's worth the five minutes of setup: see our Claude Code 2.1 focus view walkthrough and how we wired up Playwright MCP for testing if you want more on building out an MCP toolchain. And if you're curious how REA's setup compares on a different agent, we covered Grok Build, xAI's coding agent, which is also on REA's supported list.

Get AI tricks that save you hours every week

New AI tools, automation workflows, and course drops — straight to your inbox. Join 2,400+ builders.

Read Next

Cursor Just Joined The X Subscription: What Actually Changes
ai-tools

Cursor Just Joined The X Subscription: What Actually Changes

Cursor joined The X Subscription on Oct 12: 5 tiers from $8-$200 bundling Cursor, Grok and X Premium, but Claude and GPT now cost API rates on top.

October 13, 20267 min read
Claude Dashboards and Motion: What They Actually Do
ai-tools

Claude Dashboards and Motion: What They Actually Do

Anthropic's Claude Dashboards turns your data into live, source-linked charts, and Claude Motion turns text into animated MP4s. Here's how both work in beta.

October 11, 20265 min read
Claude Haiku 5.5 Explained: Price, Benchmarks, and the Catch
ai-tools

Claude Haiku 5.5 Explained: Price, Benchmarks, and the Catch

Claude Haiku 5.5 launched October 7, 2026, with a 1M context window and up to 90% lower pricing than Haiku 4.5. Here's what's confirmed, what it costs, and the token-usage catch.

October 9, 20267 min read
View all posts →