aicodeking/leanrea

The problem

When an agent is asked to figure out how a closed-source desktop app works — what an Electron asar bundle actually does, what a stripped Go binary was built with, what a native addon exports — it usually either flails with generic shell commands or relies on a heavyweight tool layer that exposes dozens of specialized wrappers. Both paths waste context and time. leanrea is a single 8 KB skill file that instead teaches the agent which command is fastest for each target type, hands it paste-ready recon commands, and lists the traps so the agent drives the real tools (otool, nm, asar, jadx, go version -m) directly.

What's different

The obvious comparison is REA, the MCP-based reverse-engineering toolkit this project openly benchmarks against. REA ships a server, 207 tool definitions and tens of kilobytes of instructions; leanrea ships zero tools and tells the agent to use Bash. The README's own benchmark claims about 38% less wall time, 35% lower cost and 60% fewer tokens than REA at comparable accuracy, plus a smaller but real gain over no skill at all (roughly 19% faster, 32% fewer turns). The trade-off is explicit: leanrea has no code handling edge cases for you, so its value is the routing table and the gotcha list, not guaranteed behavior. If a command isn't in the skill, the agent is on its own.

Who it's for

Developers who already know their way around Mach-O, ELF, asar and disassemblers, and who use a skill-capable agent (Claude Code, Codex, Cursor, Gemini CLI) for forensics, security review, malware triage or interoperability work. It is also reasonable for teams that want less MCP context overhead. Look elsewhere if you need a programmatic API you can call from your own scripts — this is instructions, not a library — or if you work on Windows/Linux targets; the benchmark and first-move commands are macOS-centric and other platforms are only partially covered.

Cost of adoption

Very low in setup: npx skills add aicodeking/leanrea, or copying one Markdown file into a skills directory or system prompt. No runtime, no dependencies beyond the native tools you already have. The real cost is trust: this is a 7-day-old project with a single author, and its accuracy claims rest on 3 reps per cell, one model, one machine, hand-made answer keys tied to specific app and gh versions, and a test run where Ghidra, Hopper and jadx were not even installed. MIT licensed, so there is no legal friction, but also no maintenance track record.

Verdict

This is a brand-new project riding a sharp spike — created a week ago and already averaging +263 stars a day into the trending board at #24 — and the distribution of that attention comes almost entirely from the head-to-head benchmark against a known incumbent. The idea is sound and the file is small enough to audit in one sitting, but the evidence is thinner than the numbers suggest. Try it if you already do this kind of work and want to trim agent cost; do not treat it as a replacement for a maintained toolkit in a production security workflow yet.