Open-Source REA Lets Coding Agents Reverse Engineer Binaries, Hits 77K Stars in a Week

TL;DR

REA (Reverse Engineer Anything) is an MIT-licensed MCP server and CLI that hands your coding agent a bridge into Hopper, Ghidra, IDA, JADX and a Chrome debugging session, then returns pseudocode, references and explicit unknowns instead of a confident paragraph. The repo sat at 1,513 GitHub stars on October 4. By October 11 it passed 77,000, with the rea-agents npm package pulling 19,983 downloads in a single day and the project holding the top slot on GitHub trending. A 722-point Hacker News thread supplied the questions the README does not answer: model refusals, an unusual fork ratio, and what happens to the decompilation scene when anyone with a coding-agent subscription can emit a half-decent decomp.

What REA actually is

REA is not a decompiler and not a model. It is plumbing. One MCP server, registered into your agent by running npx rea-agents setup, exposes a catalog of analysis tools and ships a matching skill file so the agent knows how to run an investigation. The installation doc lists 17 supported clients in its setup table, including Claude Code, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode and GitHub Copilot CLI, with Grok Bot wired separately. The same workflows run from the terminal without an agent at all.

The target table is wide. Native binaries get pseudocode, assembly, strings, symbols and cross-references through whichever of Hopper, Ghidra or IDA you already have (setup can install Hopper, with approval, if you have none). Electron and JavaScript apps get module graphs, source maps, routes and IPC boundaries with no native engine required. Websites get page structure, scripts and network observations through a Chrome-family browser. Beyond that: .NET assemblies, Android APKs through JADX, live devices through adb, resources through Apktool, JEB projects, firmware through Binwalk or unblob, EVM bytecode through EVMole, ELF layout and crashes through pwntools and pwndbg, and HAR captures via mitmproxy. Node.js 22.19 or newer (24.11 on the 24 line) plus npm is the one hard requirement.

The README's pitch is unusually direct about the use case: "See a feature in an app that you want in your own product? Ask your agent to investigate it with REA. It can inspect the app without its source code, explain how the feature works, show the evidence, and build a version for your project." Analysis runs locally. The FAQ adds the caveat that matters: your agent receives the tool results, "and its model provider has its own data policy."

The adoption curve

The repo was created on April 14, 2026, and the npm package first published on July 12, so this is not a launch-day spike. From September 10 through October 2, daily downloads never exceeded 56. Then, around October 3, something lit. Wayback captures of the GitHub page show 1,513 stars and 149 forks at 21:01 UTC on October 4, and 5,957 stars with 654 forks at 04:06 UTC on October 6. From there the maintainer's own README commits provide the timestamps: a "celebrate 20,000 stars" commit on October 8, 30,000 and 40,000 on October 9, 50,000 and 60,000 on October 10. GitHub's API reported 77,333 stars and 16,538 forks on the morning of October 11.

Stars are cheap. Installs are a better signal, and the npm registry's daily counts tell the same story: 418 downloads on October 3, 798 on October 4, 4,048 on October 5, 5,032 on October 7, 9,000 on October 8 and 19,983 on October 9. The registry reported nothing for October 6, which looks like a reporting gap. The week of October 3 to 9 totaled 39,279 downloads; the 23 days before that totaled 423. Third-party tracker Trendshift logged 26,572 new stars on October 10 alone and placed the repo in the top three of GitHub trending every day from October 4 through October 8. At the time of writing it still sits at the top of github.com/trending.

How a session runs

The loop is the same whatever the target. Your agent asks a question about a local program. REA opens the target in the matching engine, traces the relevant code, and returns findings with the evidence behind them: the instructions, the callers, the constants, and the parts it could not resolve. The agent uses that to explain the behavior, or to write an implementation and test it against the original. The roadmap makes that the admission rule for new tools: they must "preserve observations and unknowns."

That design choice is the interesting part, and it needs one analogy. Decompiler pseudocode is a translation of a translation: the compiler turned C into machine code, and the decompiler guesses its way back. REA hands the agent the guess and the receipts together, like a translator who slides you the original audio along with the transcript. The model can check a pan constant against the actual instructions instead of trusting its own prose about them.

What people have rebuilt with it

The DX-Ball case study is the one with numbers. The target is the sound-panning function at 0x00406400 in the 1996 Windows game, which turns a brick's horizontal position into a left/right pan value. The recovered C function was checked against the original x86 across 3,205 behavior cases (every integer position from 0 to 640 at five pan scales), and a Visual C++ 4.0 compiler replay reproduced all 63 bytes of the compiled function. The wider reconstruction repo reports 55 maintained C functions, 45,380 comparisons against original code, and 33 functions with byte-matching compiled output. That repo was created on October 7, so it is work from inside the surge.

The TH04 showcase recovers a 16-bit angle helper from the PC-98 Touhou game Lotus Land Story into readable C++, with a reconstruction repo dating back to September 6. The Notion study traces the Electron clipboard path from a page-facing copy API through preload and IPC into the main process, down to the HTML marker that links rich block data to a copy. The Aegis study recovers how an Android authenticator computes its six-digit codes. The website's examples name REA 4.1.0 and a specific Windows Calculator build (11.2508.4.0, x64), but nowhere does the project say which model drove any session.

Eleven releases in nine days

Release velocity matches the star curve. The last release before the surge was 3.1.0 on August 9. Then: 3.2.0 and 3.2.1 on October 3, 4.0.0 and 4.0.1 on October 5, 4.1.0 on October 6, 5.0.0 on October 7, 6.0.0 on October 8, 6.1.0 through 6.3.0 on October 9, and 6.4.0 on October 11. Three of those are majors with breaking changes. The 4.0.0 notes remove the permission configuration and policy commands and approval fields from the tool layer. The 6.0.0 notes require absolute host paths for every MCP filesystem input. The 6.4.0 highlights add ADB device inspection, Apktool resource decoding, a JEB provider, and resource limits for JavaScript analysis so a huge bundle produces partial facts and explicit unknowns instead of an out-of-memory crash.

Behind that sit 2,230 commits, 82 contributors, 1,123 pull requests and 570 issues (110 open) as of October 11. The README's advice is candid: "REA changes quickly, and new releases include frequent bug fixes. Keep your installation up to date." The pseudonymous maintainer, whose GitHub bio reads "member of technically staff," did not post in the HN thread, which was submitted by someone else.

The caveats the thread raised

Refusals. One commenter asked how anyone runs this without hitting refusals, since the same techniques find exploits, and wondered whether users were on cyber-enabled models or local ones. The README does not address model refusals, and a search of the issue tracker for the word "refus" returns nothing. Reverse engineering a binary you own is lawful in most places, and REA's disclaimer says it provides tools "for lawful reverse-engineering research," but your model provider's policy is the real gate, and it is not REA's to set.

The fork ratio. Another commenter tracked the numbers and flagged that forks were running at about 19 percent of stars, unusually high. GitHub's figures on October 11 put it at 21 percent. There is an innocent reading (forking to keep a copy before a takedown) and a less innocent one, and the data does not pick between them.

The install pattern. The quick start invites you to paste a paragraph into your coding agent asking it to install REA and show you the plan for approval. One commenter called this "the next evolution of installation by curl | bash." They were not wrong, and it did not slow anyone down.

The flood. A commenter who glanced at the TH04 decomp called it better than most AI decomps they had seen, with matching code and sensibly named variables, then worried about what comes next: a scene already hit by low-effort ports now facing "a flood of half-decent decomps effortlessly generated by anyone with a $200/mo AI subscription." Others asked the blunter question of what REA adds over telling an agent to set up Ghidra or radare2 itself, given that Ghidra MCP and IDA Pro MCP servers already exist. The answer is breadth and packaging: one setup, seventeen clients, a dozen target types, and an evidence contract.

The README also now carries a note that the project has issued no cryptocurrency and that tokens using the REA name are unaffiliated, which in 2026 is the surest sign a repo has arrived.

Why a builder should care

The pitch is feature cloning, and it works in a direction most teams have not planned for. If a competitor's Electron app has a clever export path, an agent with REA can trace it from button to IPC channel to file writer and hand you a working equivalent, with the evidence trail attached. Useful on your own legacy binary with lost source; uncomfortable on someone else's product. The local-analysis design keeps the binary on your machine, but the pseudocode goes to whichever model you point at it, so read your provider's data terms before pointing REA at anything under NDA.

If you maintain a closed-source app, the practical takeaway is that the cost of understanding your client just dropped to a prompt. For everyone else, the thing to copy is the evidence contract: tools that return what they saw, what they inferred, and what they could not resolve are what make agent output checkable, and that pattern is worth stealing even if you never open a disassembler.

Key Takeaways

• REA is an MIT-licensed MCP server and CLI that connects 17 coding-agent clients to Hopper, Ghidra, IDA, JADX, Chrome and more, returning evidence and explicit unknowns alongside pseudocode.
• It went from 1,513 GitHub stars on October 4 to 77,333 on October 11, with README milestone commits timestamping every 10,000; npm installs rose from a few dozen a day to 19,983 on October 9.
• The DX-Ball showcase is the proof point: 3,205 behavior cases matched and all 63 compiled bytes reproduced, with 33 byte-exact functions across the wider reconstruction.
• Eleven releases shipped between October 3 and 11, three of them majors with breaking changes; expect to update often.
• The project is silent on model refusals, the fork-to-star ratio drew scrutiny, and the install-by-prompt pattern is curl | bash with better manners.
• Analysis is local but model output is not; check your provider's data policy before pointing it at anything sensitive.

Sources: morluto/rea on GitHub (README, releases, commits), rea.tools, DX-Ball case study, REA installation docs, rea-agents on npm, Trendshift, GitHub trending, Hacker News discussion, N0zoM1z0/dx-ball, N0zoM1z0/th04