----------------

🛠️ Tool: REA (Reverse Engineer Anything)
===================

Overview

REA is an MIT-licensed MCP server, distributed as the rea-agents package on npm, that exposes a reverse engineering toolset to any MCP-capable agent. The framing in the morluto/rea README is direct: inspect native binaries, JavaScript and Electron applications, .NET assemblies, and websites without their source code, and get explanations that carry supporting evidence and stated limitations rather than bare model summaries.

Key features
• One MCP surface across several target types: native binaries, JavaScript and Electron apps, .NET assemblies, websites
• Native analysis can build on an existing Hopper or Ghidra installation, instead of shipping yet another disassembly pipeline
• The same tools stay usable directly from the terminal, so agent access is optional, not mandatory
• Analysis runs locally; conclusions ship with their evidence and limitations, which is the right counterweight to overconfident agent output
• A generated tool catalog is published in the repository docs (mcp-contracts.md), so the exact tool surface an agent will see can be reviewed before wiring it up

Technical notes

The npm distribution and Node.js requirements suggest a standard Node-based MCP server. Setup registers REA with the agent and installs matching workflow instructions. The screenshots show an analysis bridge launching inside Hopper while it inspects a native binary, which implies the server drives the installed tooling rather than replacing it. The exact bridge mechanics, supported agent clients, and per-tool contracts remain unverified; the contracts document is where that check should start.

Use cases
• Feature archaeology: the flagship scenario from the README, ask the agent how another application implements a feature, get a documented, evidence-backed explanation. Worth noting that rebuilding a proprietary feature lives in uncertain legal territory.
• Triage support for unknown files when static analysis with receipts matters more than a quick verdict
• Terminal-only use for scripted pipelines where an agent adds nothing

Limitations
• Claims come from the project README only; nothing here has been independently tested
• Capability depth depends on which underlying tools are installed and licensed, particularly for native analysis
• The README is polished and badge-heavy, so treat the published tool contracts, not the landing page, as the source of truth for what the server actually exposes
• One sensible warning is included: fetch REA only from the official repository, the rea.tools website, or the rea-agents npm package, since lookalike repository names or copied readmes do not make a download official. For anything plugged into an agent, that is a baseline requirement, not paranoia.

References

Repository: morluto/rea. Website: rea.tools. Package: rea-agents on npm. Tool contracts: docs/mcp-contracts.md in the repository.

🔹 tool #MCP #ReverseEngineering #BinaryAnalysis #Ghidra

🔗 Source: https://github.com/morluto/rea