rea

morluto

202.5k stars49.4k forksTypeScriptMIT

#5on Gitodds Trending this month #29most-starred repo on GitHub

agent-skillsai-agentsbinary-analysisclaude-codeclicodexcordisctfdecompilerdeveloper-tools

A local MCP and CLI tool that helps AI agents reverse engineer apps, websites, and binaries with evidence.

REA gives an AI agent local inspection tools and returns findings with evidence and stated limitations, rather than unsupported conclusions. Point it at an application, binary, website, capture, or device data and ask it to trace a feature or inspect its structure. Deep native analysis requires a separately installed provider such as Ghidra, Hopper, or IDA.

For Developers with AI coding agents recreating behavior without source code, and automation authors scripting inspections

CLI toolv6.5.0

Use cases

Recreate an app feature from observed behavior and code
Inspect native binary functions with pseudocode and assembly
Trace Electron application boundaries across modules, IPC, and add-ons
Analyze website behavior from pages, scripts, and requests
Inspect Android applications through APKs or connected devices

Key features

Evidence-backed findings: Returns evidence and limitations for each conclusion
Native binary analysis: Pseudocode, assembly, strings, symbols, calls and references
JavaScript and Electron inspection: Modules, imports, source maps, routes, IPC and add-ons
Offline EVM interface recovery: Supports raw or UTF-8 hex bytecode up to 4 MiB
Static .NET inspection: Metadata, CIL instructions and native dependency declarations
Android device analysis: Packages, logs, dumps, screenshots, APK and file transfers

Under the hood

4 parts

REA shares reverse-engineering workflows between a terminal CLI and an MCP server, preserving evidence provenance, uncertainty, and session semantics across both adapters. Its layers keep domain and contract semantics separate from provider adapters and application workflows.

AGENTS.md (Product and Authority; Architecture and Cleanup); README.md (How REA works)

MCP server
Creates the evidence-oriented MCP server and optional target session tools.
src/server/createServer.ts
Reverse-engineering workflow
Runs caller-selected provider commands with timeouts, output limits, cleanup, and evidence.
src/application/reverse/ReverseEngineeringService.ts
Binary sessions
Manages provider clients and safely recreates failed binary analysis sessions.
src/application/binary/BinarySession.ts
Ghidra bridge
Exposes read-only Ghidra procedures, decompilation, references, and assembly through an authenticated bridge.
bridge/ghidra/ReaGhidraBridge.java

Built with

TypeScriptNode.js 22.19+Model Context Protocol SDK 2.3.1Zod 4.4.3Ghidra Java bridgePino 10.4.0xterm headless 6.0.0Turbo

Generated 2 hours ago

Analyze another repo