How to Use REA MCP with Claude Code for Binary Analysis

Introduction

You have a binary, maybe your own build or an open-source release, and you want to know what it does at the function level. This tutorial wires REA (Reverse Engineer Anything), a reverse-engineering MCP server, into Claude Code specifically for binary analysis: registering the server, picking an authorized target, and having the agent identify functions, trace logic, and annotate what it finds, with decompiler evidence behind every claim.

Quick answer

Register REA with Claude Code using npx rea-agents setup, restart the agent, then ask in plain English to analyze a binary you own. REA hands Claude Code real decompiler tools (Ghidra, Hopper, or IDA) and returns evidence-backed function breakdowns.

Evidence

REA earned attention at a speed few developer tools match. It shipped on October 7, 2026 and collected roughly 2,956 GitHub stars in its first 24 hours, passing 10,400 total stars by October 8, according to GitHub trending data reported by startupfortune. By October 9, 2026 the repository had climbed past 34,000 stars with more than 4,600 forks, as reported by bitcoinversus.tech. For a niche reverse-engineering tool, that is an exceptional launch.

The project’s pitch is direct. From the REA README: “See a feature you like. Understand how it works, down to the binary level.” The architecture behind that line is what makes it credible for serious work: REA does not reimplement decompilation. It connects your agent to established engines, Hopper, Ghidra, or IDA in read-only mode, and returns results the way a careful analyst would. Again from the README: “Analysis runs locally, and results include the evidence and limitations behind each conclusion.”

The official native analysis guide shows the intended workflow through a DX-Ball case study: given the game’s executable, REA surfaced the sound-pan function at address 0x00406400, its brick-hit caller, and the referenced constants 1.5625 and 500.0, which together reconstructed the formula pan = (x × 1.5625 − 500.0) × scale. The vendor-published numbers claim the reconstruction passed 3,205 original x86 test cases while reproducing all 63 compiled function bytes. Treat those as vendor-reported, but the workflow is the point: decompile, trace the feature, verify against evidence.

Use it responsibly: only analyze binaries you own or are authorized to inspect. See our Disclaimer for details.

Prerequisites

• Node.js 22.x (22.19 or later), 24.x (24.11 or later), or 26+, plus npm
• Claude Code installed and working in your terminal
• For native binaries: Hopper, Ghidra 12.1.x, or IDA, or willingness to let the setup wizard install Hopper with your explicit approval. Ghidra also needs a 64-bit JDK 21 or newer.
• An authorized target binary (your own build or an open-source release)
• Basic terminal comfort; no reverse engineering background required

Step-by-step guide

Step 1: Confirm your Node.js version

REA enforces a Node floor. Check first:

node --version

You need v22.19+, v24.11+, or v26+. My lab machine runs v24.20.0 on Ubuntu 24.04. On Node 20 or older, the setup wizard fails in confusing ways, so upgrade Node before proceeding.

Step 2: Register REA with Claude Code via the setup wizard

REA’s installer edits your agent configuration directly, so you do not have to hand-write an MCP registration. Run:

npx rea-agents setup

The wizard shows the exact paths and changes before applying anything, backs up your existing agent configuration first, and only pre-selects agents that already have a REA registration; newly detected agents stay unticked. Select Claude Code, review the proposed config changes, approve them. The wizard documents this conservative behavior in its setup docs, and it is the same registration mechanic described in our Claude Code MCP setup guide, except the wizard does the editing for you.

When it finishes, restart Claude Code completely. Agents load MCP servers at startup, so a registration made while the agent runs is invisible until restart. This single step is the most common cause of “it installed but nothing works”.

Step 3: Verify REA tools are visible to Claude Code

After restarting, open a Claude Code session and run the built-in /mcp command to list registered servers; REA should appear with its tools. Independently, confirm the environment is healthy from the terminal:

npx -y rea-agents@latest doctor

On a machine with no analysis engines yet you will see healthy: false with per-engine remediation lines, for example telling you to set GHIDRA_INSTALL_DIR to an extracted Ghidra 12.1.x directory or to rerun setup to install Hopper. That state is expected and honest: JavaScript and .NET analysis work anyway, native binaries wait for an engine. For the full engine setup path, see our REA MCP server setup tutorial, which walks the doctor output and all three engine options step by step.

For regular terminal use alongside Claude Code, install the persistent command so you stop paying the npx startup cost:

npm install --global rea-agents
rea --help

Step 4: Prepare an authorized sample binary

You need a target you have the right to analyze. For a fully reproducible walkthrough, compile one yourself. A tiny C program with two or three recognizable functions is ideal, because you already know the ground truth and can check whether the agent’s findings match:

cat > sample.c <<'EOF'
#include <stdio.h>

int double_it(int x) {
    return x * 2;
}

int main(void) {
    printf("result: %d\n", double_it(21));
    return 0;
}
EOF
gcc -o sample sample.c

Use the absolute path of the resulting sample binary in every later prompt. REA requires absolute paths, and a relative path is the classic silent-failure case. If you prefer a real-world target, use an open-source release you compiled from source, never someone else’s proprietary binary.

Step 5: Ask Claude Code to identify the binary’s functions

With REA registered, Claude Code can call the decompiler over MCP. Start with function identification, the core binary-analysis task:

Use REA to list the functions in /absolute/path/to/sample. Identify the entry
point, name each function by what it does, and show me the evidence behind
each identification.

On my lab binary the agent came back with the entry point, main, and the helper (which REA’s decompiler showed as a simple x * 2 arithmetic body), each backed by an evidence bundle: recovered pseudocode, instruction excerpts, and cross-references. The evidence-first shape is what keeps the agent honest. A vendor-side analogue is the official native analysis guide, whose example prompt is: “Use REA to find how DX-Ball calculates sound panning. Explain the calculation and show the code.”

Step 6: Trace a specific behavior with follow-up questions

Function enumeration is reconnaissance. The real value comes from follow-ups that chain evidence together. Good second questions:

Which function calls double_it, and what value does it pass? Show the caller
instructions and the constants it references.

Trace the program's output path from main to the printed string. Which
library call produces the output?

Each answer should cite REA evidence: instruction excerpts, caller relationships, referenced bytes. In the DX-Ball guide the agent combined three evidence types, instructions showing an integer load, a caller adding 0x14 (20) to 30 × tile_x, and bytes decoding to the doubles 1.5625 and 500.0, to recover one formula. When Claude Code answers without citing evidence, ask it to: “Show me the REA evidence for that claim.” The habit is worth building.

Step 7: Have the agent annotate and save the findings

Raw analysis evaporates when the session ends. Ask Claude Code to write up the findings so they persist and stay reviewable:

Write your analysis to /absolute/path/to/sample-analysis.md: one section per
function with its address, what it does, the evidence, and anything still
unknown or uncertain. Mark guesses as guesses.

Review the file against your ground truth (you compiled the sample, so you know what double_it does). Then, as a final check, ask the agent what it could not prove: unrecovered data references, ambiguous indirect calls. REA’s stated limitations exist for exactly this step. The output file becomes a checkable artifact instead of a chat transcript.

Troubleshooting

Problem 1: Claude Code does not list any REA tools after setup

Cause: The registration happened while the agent was running. MCP servers load at startup, so the new tools are invisible to any session started before the change. rea doctor flags this as config_drift when the installed skill identity is missing.

Fix: Quit Claude Code completely and start a new session, then run /mcp to confirm REA appears. If tools are still missing, rerun npx rea-agents setup to refresh the registration, restart again, and recheck with rea doctor.

Problem 2: rea doctor reports missing engines and healthy: false

Cause: Fresh install with no Hopper, Ghidra, or IDA present. This is the expected state on a new machine, not a broken install.

Fix: Follow the remediation strings exactly. To approve the optional Hopper install, rerun rea setup. For Ghidra, extract a Ghidra 12.1.x release and export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.1. JavaScript, Electron, and .NET analysis work fine while engines are missing; only native binary analysis waits.

Problem 3: Ghidra-based analysis fails to start

Cause: Usually one of two things: the JDK is wrong, or the install directory variable points somewhere invalid. The official native guide is specific: Ghidra needs an existing 12.1.x installation and a 64-bit JDK 21 or newer.

Fix: Verify with java -version that you are on JDK 21+ (64-bit), and confirm GHIDRA_INSTALL_DIR points at the extracted Ghidra directory containing ghidraRun. Rerun rea doctor after fixing either; the Ghidra scope check turns green when the provider can launch.

Problem 4: Analysis of a large binary times out

Cause: Decompiler providers have startup deadlines, and a big binary can exceed the default. The symptom is a provider timeout error rather than an analysis result.

Fix: Raise the deadline with the documented environment variables: REA_GHIDRA_STARTUP_TIMEOUT_MS for Ghidra or REA_HOPPER_STARTUP_TIMEOUT_MS for Hopper, set to a larger millisecond value before starting Claude Code. Restart the agent session after changing the value.

Problem 5: Hopper operations fail on macOS with a licensing prompt

Cause: A first-run Hopper dialog is waiting for you to choose demo mode or activate a license, and unattended MCP operations cannot click through it.

Fix: Open Hopper manually once in the same user session, choose demo or enter your license, then retry from Claude Code. REA starts Hopper itself when an operation needs it after that first activation.

FAQ

Which agents can use REA?

Any agent that supports local MCP servers. The setup wizard documents the supported clients, including Claude Code, Codex, Cursor, Gemini CLI, and others; unsupported clients can fall back to manual MCP registration. For the protocol fundamentals behind tools like REA, our MCP server tutorial is the starting point.

Do I need Hopper, Ghidra, or IDA?

Only for native binary analysis. JavaScript and Electron apps need nothing but Node.js, and .NET assemblies are inspected statically with no engine. For native targets, setup installs Hopper after your explicit approval, or points at your existing Ghidra or IDA installation. The wizard keeps each engine consent separate from the agent registration consent.

Is my target binary uploaded anywhere?

No. Analysis runs entirely on your own machine. REA’s documentation states this explicitly, which is the main trust difference versus uploading a sample to a cloud analysis API.

Can REA recover original source code?

No, and the project is upfront about it. You get decompiler pseudocode, assembly, strings, and references with evidence and stated limitations, not the original source. Treat every recovered snippet as behavior evidence, not as the author’s code.

Can this handle packed or heavily obfuscated binaries?

Poorly, and you should assume so until proven otherwise. REA connects your agent to real decompilers, and decompilers struggle with packers and obfuscators. Start with clean targets you compiled yourself; if the agent reports mostly unrecovered regions, believe the limitations section of the evidence bundle.

Conclusion

REA turns Claude Code from a code assistant into a binary-analysis assistant: the agent identifies functions, traces callers, and reads referenced constants through real decompiler engines, and the evidence bundles keep every claim checkable. Build the habit of asking for evidence on every finding, analyze only software you have the right to inspect, and save annotated results instead of chat transcripts. If you want to put this workflow into a production automation afterward, the n8n automation pillar guide shows how to wire MCP servers into scheduled agent workflows.

Frequently asked questions