BuildNot yet confirmed elsewhere1 publisher2 min readPublished
Coding agents can now pull apart shipped binaries, APKs and Electron apps through one MCP server
REA, an open-source MCP server for taking software apart, passed 115,000 GitHub stars and 25,000 forks by October 12, according to a dev.to guide. Its case studies are scoped, checkable questions about a game binary and an Electron app, which is the workload to assume when judging what an agent can recover from your builds.
The Engineer · Build desk
REA had passed 115,000 GitHub stars and 25,000 forks by October 12. On October 4, the day it first appeared on the trending list, it drew about 1,400 new stars, per Trendshift as cited by the guide.
| Figure | Value | Note | Claim |
|---|---|---|---|
| GitHub stars by October 12 | 115,000 stars | 4 | |
| Forks by October 12 | 25,000 forks | 4 | |
| New stars on first trending day | 1,400 stars | about; per Trendshift, October 4 | 16 |
What happened
- The morluto/rea repo dates from April 2026 and drew little attention before early October.
- It ranked first on GitHub Trending on five of the seven days from October 6 to 12.
- The project shipped eight releases between October 3 and October 11, from 3.2 to 6.4.
- An agent can be pointed at a native binary, Electron app, .NET assembly, Android APK, website or saved capture, and gets back pseudocode, module graphs, request logs and evidence.
- REA needs Node.js 22.19 or later, and Node 23 and 25 are unsupported.
Why it matters
- exposure An APK, Electron build, .NET assembly or website you ship is a valid input, and the tool is built to work without your source code.
- decision The major version went from 3 to 6 in five days, so a team adopting REA has to decide on a pinned version and a re-test routine for each upgrade.
- constraint Analysis is local, but the agent's model provider still receives the tool results, so running it on unreleased or contract-restricted builds sends findings to that provider.
- cost The no-extra-engine path covers JavaScript, .NET, websites and captures. Deep native work needs Hopper, Ghidra 12.1 with JDK 21 or newer, or IDA, and Hopper is commercial software.
REA runs as a local MCP server. The agent calls a tool, REA inspects the target with the engine suited to it, and the agent gets structured findings plus their limitations and unknowns [10]. The same workflows run as CLI commands, so they can be scripted without an agent [10].
The good engineering is in the evidence model. Each result comes with byte ranges, file digests and JSON pointers that locate it in the capture, plus a stated list of the points the analysis left unresolved [11]. A reviewer can check a byte range. Setup follows the same habit: it shows a plan, backs up existing config, and writes only after approval [8].
Treat the case studies as claims about a particular workload. In the DX-Ball study, the reconstruction passed 3,205 original x86 test cases and reproduced all 63 compiled function bytes [13]. That result transfers only where there is an original binary to test against. The guide's author describes the cases the same way, as "tightly scoped questions about one function or one data path, with a way to verify the answer" [20]. The Notion study fits that description: the agent followed the clipboard API's path out of the renderer, via preload and IPC, to the Electron main process [14].
The author also calls REA "a well-packaged connector between agents and reverse-engineering tools that already existed" [21]. In our view that sets the limit on what is new. For native targets the ceiling is the engine underneath, Ghidra, Hopper or IDA [9]. The new part is the effort of asking: one setup command, then a question put to the agent, such as how search works in the Notes app, with evidence, and a similar feature built for your project [8] [17].
The popularity figures come from one dev.to guide, which cites Trendshift's daily tracking for the trend data, including about 1,400 new stars on October 4, the first day REA appeared on the trending list [16]. The same guide points readers to Apidog for finishing API reverse engineering from the HAR and mitmproxy captures REA reads [15].
What to watch
- Whether anyone outside the project publishes accuracy results beyond its three case studies.
- Whether the release numbering settles into a stable line after 6.4.
- Whether Ghidra support on Windows moves out of experimental status.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption30
- Hype gap+15
- Incentives50
- Confidence40
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
REA, short for Reverse Engineer Anything, is an open-source MCP server and CLI that gives a coding agent the tools to take software apart without its source code.
- [2]
A coding agent can be pointed at a native binary, an Electron app, a .NET assembly, an Android APK, a website, or a saved network capture, and REA returns pseudocode, module graphs, request logs and the evidence behind each claim.
- [3]
The morluto/rea repository was created in April 2026 and sat mostly unnoticed until the first week of October.
- [4]
By October 12 the repository had passed 115,000 stars and 25,000 forks.
- [5]
The repo held the number one spot on GitHub Trending for five of the seven days from October 6 to 12.
- [6]
Version 3.2 shipped on October 3, 4.0 on October 5, 5.0 on October 7, 6.0 on October 8, and 6.1 through 6.4 between October 9 and 11.
- [7]
REA needs Node.js 22.19 or later (23 and 25 are unsupported) and npm.
- [8]
One command, npx rea-agents setup, registers the MCP server and installs skill instructions; setup shows a plan, backs up existing config, and writes only after the user approves.
- [9]
Static JavaScript, .NET, website and capture analysis need no extra engine. Deep native analysis needs Hopper, Ghidra 12.1 with a JDK 21 or newer, or IDA. Hopper is separate commercial software with its own license, and Ghidra on Windows is marked experimental.
- [10]
REA runs as a local MCP server: the agent calls its tools, REA inspects the target with the right engine, and the agent gets structured findings plus their limitations and unknowns. The same workflows are available as CLI commands that can be scripted without an agent.
- [11]
Every REA result carries its provenance: file digests, byte ranges, JSON pointers into the capture, and an explicit list of what the analysis could not establish.
- [12]
Analysis runs on the user's machine, but the README's FAQ says the agent's model provider still receives the tool results under its own data policy.
- [13]
In the DX-Ball case study, the reconstruction passed 3,205 original x86 test cases while reproducing all 63 compiled function bytes.
ReportedSupportedSource: dev.to guide on REA, describing the project's own case studyView cited source - [14]
In the Notion case study, the agent traced the clipboard API from the renderer through preload and IPC into the Electron main process.
ReportedSupportedSource: dev.to guide on REA, describing the project's own case studyView cited source - [15]
REA reads HAR and mitmproxy captures, which the guide describes as making it a front end for API reverse engineering you can finish in Apidog.
- [16]
Trendshift's daily tracking, as cited by the guide, shows REA first appeared on the trending list on October 4 with about 1,400 new stars in a day.
- [17]
After setup and an agent restart, the guide suggests asking something like: "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project."
- [18]
REA shipped eight releases between October 3 and October 11.
- [19]
The major version number rose from 3 to 6 in five days, from October 3 to October 8.
- [20]
The guide's author wrote that the case studies are "tightly scoped questions about one function or one data path, with a way to verify the answer".
- [21]
The guide's author wrote that REA is "a well-packaged connector between agents and reverse-engineering tools that already existed".
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toWhat Is REA (Reverse Engineer Anything)? The MCP Server That Hit 115K GitHub Stars in a Week
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Open Source Developer ToolsFollow
- Agent-assisted reverse engineeringFollow
- Model Context ProtocolFollow