REA, Reverse Engineering Assistant MCP
Reverse Engineering Assistant (REA)
REA analyzes PE, ELF and Mach-O binaries, firmware and APKs in pure Rust and writes reports in Markdown, PDF and JSON.
- 109 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Analyzes untrusted files and emulates their code; in analyst mode analysis data goes to an external model.
Install
- Works in
Manual install
git clone https://github.com/mytechnotalent/rea.gitFirst command from the README: cloning before the Cargo build.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Analyzes untrusted files and emulates their code; in analyst mode analysis data goes to an external model.
This is third-party code. Review the repository files before installing.
What it does
REA, a reverse-engineering framework in pure Rust, detects the file format from its contents. It disassembles code, recovers call graphs, computes hashes and entropy, and extracts strings, indicators of compromise and packer traces. A P-code emulator runs code in a sandbox and reveals encrypted strings without executing anything on the host. `rea serve` starts an MCP server over stdio with 31 tools, including `open_binary`, `decompile_function`, `find_xrefs`, `run_rules` and `audit`. With an OpenRouter key an autonomous analyst writes the report, and without one it runs offline.
Who it is for. Malware researchers and firmware auditors who need an agent to take apart an unknown binary without Ghidra or Java.
Good fit when
- A suspicious `.exe` arrived and you quickly need to know what it does.
- A `uImage` firmware image with SquashFS: the filesystem and recovered credentials matter.
- An agent in Claude Code decompiles a function, finds cross-references and explains the entry point.
- Before a release an SBOM in CycloneDX and SPDX is built from your own binary.
Not a fit when
- You need interactive byte patching or live process debugging.
- The file format is not in the supported table, so the result stops at hashes, entropy and strings.
- The file belongs to someone else and the right to analyze it is unclear.
Example request
Open ./sample.exe with rea, decompile the entry point, run the capability rules and explain what the program does.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
OPENROUTER_API_KEYsecret- OpenRouter key for the autonomous analyst; offline mode works without it.
OPENROUTER_MODEL- Analyst model, a free one by default.
Limitations
A prebuilt binary exists only for macOS on Apple Silicon (the `releases/` folder), while Windows and Linux need `cargo build --release` on stable Rust. In analyst mode analysis data goes to OpenRouter, the key is set through `OPENROUTER_API_KEY`, and the default model is a free one. The emulator is software-only and does not reproduce hardware quirks. A validator flags quotations unsupported by evidence, yet analyst mistakes remain possible, so check conclusions against the primary data.
How to disable. Remove the registration with `claude mcp remove rea` and delete the `rea` binary. The `re-*.md`, `re-*.pdf` and `re-*.json` files sit next to the analyzed files and are deleted by hand.
FAQ
Are Ghidra or Java needed?
No. The disassembler and emulator are built in, and non-x86 architectures use SLEIGH specifications compiled into Rust.
Do files leave the machine?
Without an OpenRouter key no network is used and the report is built offline. With a key the analyst sends analysis data to the model.
How do I get settings for another agent?
`rea mcp --config` prints ready snippets for supported agents, and `rea mcp --setup` writes `mcp_config.json` and `opencode.jsonc`.
Which file formats are supported?
PE, ELF, Mach-O, firmware, APK and DEX, .NET, Go, WebAssembly, SQLite, PCAP and more. The full table is in the README.
What does a single command produce?
`rea <file>` writes `re-<name>.md`, `re-<name>.pdf` and `re-<name>.json` beside the target.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
MCP server for reverse engineering and malware analysis: decompilation, YARA, forensics and evidence-backed reports
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
A Ghidra MCP server: the agent decompiles, renames variables, builds cross references and works through a binary via a set of small tools
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| REA, Reverse Engineering Assistant (this card) | no | not required | 109 | |
| Ghidra CLI | no | 267 | drives an installed Ghidra; REA analyzes files with its own Rust engine | |
| IDA Pro MCP | no | not required | 13,459 | works through IDA Pro; REA needs no external disassembler |
README in short
The README presents REA as one tool: `rea <file>` writes Markdown, PDF and JSON reports beside the target. Version 7.1.0 added parsing of GGUF and safetensors models and Godot PCK archives. MCP mode is offered as a second option for agents, and the build comes from source through Cargo.