REA MCP
MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
- 369,210 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Runtime capture runs the chosen program and drives a browser and Android devices through adb with your user permissions
- Setup edits agent settings files and can install Hopper, though it shows a plan and makes backups before writing
- Decompiled code and the contents of analyzed programs enter the agent's context and reach its model provider
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/reaDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Runtime capture runs the chosen program and drives a browser and Android devices through adb with your user permissions
- Setup edits agent settings files and can install Hopper, though it shows a plan and makes backups before writing
- Decompiled code and the contents of analyzed programs enter the agent's context and reach its model provider
This is third-party code. Review the repository files before installing.
What it does
REA installs as the rea-agents npm package and works both as an MCP server for an agent and as the rea command in a terminal. The npx rea-agents setup command lists the supported agents, builds a plan of changes, backs up existing settings and, once you confirm, registers the MCP server and the workflow instructions. After a restart the agent gets tools for inspecting the target you name. The tools cover more than twenty kinds of targets. For native binaries REA returns pseudocode, assembly, strings, symbols, calls and references, and that needs Hopper, Ghidra or IDA. For JavaScript and Electron apps it recovers modules, imports, source maps, routes and IPC, for .NET assemblies it shows metadata and CIL instructions, and for APKs it works through JADX. Saved HAR and SAZ network captures, SQLite databases, firmware, WASM and websites in a Chrome-family browser are handled separately. Every result comes with evidence, limitations and a list of unknowns, so the agent can tell what was found from what was guessed. Static JavaScript and .NET inspection only reads files and runs nothing. Runtime capture runs the chosen program or interacts with it using your user permissions. Analysis stays local, while the agent receives the tool results and uses them to explain how a feature works or to write and test its own implementation.
Who it is for. For developers and security researchers who need to understand a built program without its source: an old build of their own, software they are authorized to examine, a sample for analysis or a CTF exercise.
Good fit when
- You need to find out how a feature works in a built app with no source code and get the explanation together with the evidence
- An Electron app where you have to trace a call from the interface through preload and IPC into the main process
- You want to compare two .NET builds by metadata and CIL instructions to see what changed between releases
- You have a saved HAR or SAZ capture and need the requests, responses and the code locations that produce them
- A study task or sample analysis: ELF layout, a recorded Linux crash, EVM bytecode, firmware
Not a fit when
- You need to analyze a repository with full source code: the skill's instructions send the agent to ordinary tools and do not run REA there
- The goal is bypassing DRM, a license check, anti-cheat or access protection: the project refuses such requests and closes them in its community without reply
- The machine has no Node.js 22.19, 24.11 or 26 and newer, and you cannot install it
- You need native binary decompilation, but Hopper, Ghidra and IDA are unavailable: without them only the static part for JavaScript and .NET works
Example request
Find out how search works in the Notes app, show me the evidence and build a similar feature for my projectMCP
- Transport
- stdio
- Authentication
- not required
Environment variables
REA_GHIDRA_STARTUP_TIMEOUT_MS- Ghidra startup deadline in milliseconds; raise it for large binaries.
REA_HOPPER_STARTUP_TIMEOUT_MS- Hopper startup deadline in milliseconds; raise it for large binaries.
REA_JEB_MCP_URL- Address of a JEB client that you started yourself and that serves MCP.
REA_MCP_MAX_RESPONSE_BYTES- Cap on the server response size in bytes.
Limitations
- Requires Node.js 22.x from 22.19, 24.x from 24.11 or 26 and newer, plus npm.
- Native analysis relies on Hopper, Ghidra or IDA. Ghidra and IDA come from your own installation, and setup installs Hopper only after a separate approval. REA grants no licenses for commercial tools: IDA Pro, Hopper and JEB must be obtained legally.
- What is available depends on the target and the system. APKs need JADX and a full JDK, firmware needs Binwalk or Unblob on Linux, packet analysis needs TShark, and the author calls Ghidra support on Windows experimental.
- On Linux, static JavaScript and Electron analysis and Ghidra and JADX launches need a procps-compatible ps on PATH: REA uses it to check process ownership.
- The project moves quickly. The author asks you to keep the install fresh with rea update, and features from the main branch may be missing from the latest npm release.
- You are responsible for authorization: by the disclaimer's wording, merely holding a file does not grant the right to do anything with it.
How to disable. The rea uninstall command removes only REA's entries in agent settings and its skill files, and rea uninstall --purge-data also clears REA's cache and state. It leaves Hopper, Node.js, other skills and the saved analysis results alone. In Claude Code, claude mcp remove --scope user rea drops a single registration.
FAQ
How does installing the skill from skills.sh differ from npx rea-agents setup?
The skill from skills.sh gives the agent investigation instructions only. It does not register the MCP server, install analysis engines or add tools to a session that is already running. The npx rea-agents setup command registers the server and installs the skill with it.
Can I use REA from a terminal without an agent?
Yes, the same workflows are available through the rea command. For an extracted JavaScript or Electron app or an ASAR file, npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json works. It needs neither MCP registration nor Hopper or Ghidra.
How do I check the setup without changing anything?
The rea doctor --json command only reads configuration and writes nothing. If the registration is correct but the agent session shows no tools, restart or reconnect the agent. If the registration is stale, look at the plan from setup --dry-run first.
What does REA return for an Electron app?
Modules and their imports, source maps, routes, IPC channels and links to native add-ons. The Notion case study uses this to trace the clipboard API from the interface through preload and IPC to the main process.
What if Hopper shows a choice dialog on first launch?
On macOS Hopper may offer demo mode or license activation on its first run. Answer that prompt in the same user session before the first CLI or MCP operation, otherwise an unattended job stalls waiting for the answer.
Discussion
No questions or reviews yet.
Related
MCP serversA Ghidra MCP server: the agent decompiles, renames variables, builds cross references and works through a binary via a set of small tools
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
An MCP server for IDA Pro with one endpoint for several open databases: decompilation, cross-references and similar-function search across binaries
The official Hex-Rays MCP server: an agent opens IDA databases, runs Python inside them and reverses binaries, with plugins for Claude Code and Codex
A native MCP plugin for the x64dbg debugger: the agent drives debugging over HTTP, sets breakpoints, steps through code, reads and patches memory
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| REA (this entry) | no | not required | 369,210 | |
| ReVa | no | API key | 879 | an MCP server for Ghidra only: decompilation, variable renaming and cross-references |
| Android Reverse Engineering & API Extraction | no | 8,262 | a Claude Code skill that decompiles APKs and finds the HTTP endpoints an app uses |
README in short
The repository's main page opens with the install command, followed by a quick start for an agent and for a terminal, a table of more than twenty target kinds with the requirements for each, three worked cases (DX-Ball, Notion, TH04), a list of frequent questions and links to documentation. The repository holds guides to installation, the CLI, MCP contracts and each kind of analysis, bridges for Ghidra, Hopper, Android and other tools, and the workflows folder sets up checks against real tools and browsers. The page is translated into 19 languages, with the Russian version in docs/readme/README_ru.md.