morluto/rea

The problem

You want to copy a behaviour you saw in a closed-source app, or understand what a compiled binary actually does. The normal route is to open Hopper, Ghidra or IDA, read assembly, and correlate findings by hand. The agent in your editor knows nothing about any of that, so the knowledge sits in a separate tool and a separate head. REA exposes reverse-engineering tooling over MCP so the agent can drive the investigation, return code, references and explicit unknowns, and then write and test a comparable implementation.

What's different

Most decompiler work is interactive and single-tool: one engine, one file, one human reading the output. REA's premise is that the agent orchestrates the investigation — it can use an existing Hopper, Ghidra or IDA install as a provider, or fall back to static JavaScript/Electron analysis with no native engine at all, and it keeps every conclusion tied to the evidence that produced it. That evidence-first framing is the real differentiator: tool output arrives as findings with stated limitations rather than a confident summary. It also supports a CLI path for the same workflows, so results are scriptable outside the agent. The README is heavy on setup and light on methodology details, so the depth of each analysis backend is something you will discover by using it.

Who it's for

Developers and security researchers who already know their way around disassembly and want an agent to speed up the grunt work: locating the code path for a feature, mapping Electron IPC boundaries, or surveying a .NET assembly. It is a poor fit if you have no native analysis tooling and no budget to install one, if you need a turnkey automated audit with no human reading, or if you work mainly against heavily obfuscated malware where tool trust matters more than agent convenience. Mobile and firmware targets are mentioned but depend on extra external tools.

Cost of adoption

You need Node.js and npm, plus a provider such as Hopper, Ghidra or IDA for native work. On Linux, Ghidra/JADX and firmware launches require a procps-compatible ps on PATH. The install is npx rea-agents setup, which edits your agent configs and workflow instructions (with backups), and you must review and restart your agent. The project moves fast and asks you to update often, which is a maintenance cost. MIT licensed. Recent release emphasis on locking down official download channels suggests copycat packages are a real concern — get it only from the canonical repo, site or npm package.

Verdict

The idea is timely and the MCP plumbing is real, but the signals around this project are strange: 376k stars and 94k forks within roughly six months of creation, and a weekly board gain of +88k that it has never followed up with a daily trending appearance. That pattern rarely reflects organic adoption, so treat the numbers as unreliable. A 100-point HN thread with 38 comments is modest validation of interest, not of correctness. The concept of a shared analysis bridge between agent and decompiler is worth trying if you already own the tooling; go in expecting a young, fast-changing codebase rather than a stable platform.