REA MCP Tutorial: Let Your AI Agent Analyze Apps Locally

Introduction

You see a feature in a shipped app, you like it, and you want to understand exactly how it works so you can build something similar. Normally that means hours inside a disassembler. REA (Reverse Engineer Anything) changes the deal: it is a single MCP server that hands your coding agent static-analysis and tracing tools, so you can ask the agent in plain English and get back evidence, not guesses. This tutorial walks you through installing REA, registering it with Claude Code, running a zero-setup JavaScript analysis you can reproduce in five minutes, and wiring up native binary analysis with Hopper or Ghidra.

Use it responsibly: only analyze applications and binaries you own or are authorized to inspect. See our Disclaimer for details.

Quick answer

REA is an MIT-licensed MCP server that gives coding agents like Claude Code static-analysis skills. Install it with npx rea-agents setup, restart your agent, then ask the agent to analyze an app or binary you are authorized to inspect, locally.

Evidence

REA is the fastest-growing developer tool of October 2026. It shipped on October 7, 2026 and pulled in roughly 2,956 GitHub stars in its first 24 hours, passing 10,400 total stars by October 8, according to GitHub trending data reported by startupfortune. By October 9, 2026 the repository had climbed past 34,000 stars with more than 4,600 forks, as reported by bitcoinversus.tech. Few tooling projects move that fast.

The project’s own pitch is direct. From the REA README: “See a feature you like. Understand how it works, down to the binary level.” The architecture is what makes that pitch credible. REA does not reimplement decompilation. It connects your agent to real, established engines: Hopper, Ghidra, or IDA in read-only mode for native binaries, headless JADX for Android APKs, and Binwalk or Unblob for firmware. As the README puts it, “Analysis runs locally, and results include the evidence and limitations behind each conclusion.” Static analysis of JavaScript and Electron apps is the zero-friction entry point: no native engine, no MCP config, no running the application. The official JavaScript analysis guide documents exactly what comes back, modules, imports, source maps, routes, and IPC relationships.

The limits are stated up front, which is why the tool is trustworthy for serious work. REA does not claim to recover original source code or clone whole applications. For native targets the setup docs describe a separate consent step before any existing Hopper, Ghidra, or IDA installation is used, and the official native analysis guide explains provider selection in detail. If you want to understand how MCP servers like this plug into agents at the protocol level, the MCP architecture documentation is the primary reference.

The showcase projects are the strongest proof. In the vendor-published DX-Ball case study, REA traced a sound call into its position-to-pan helper and the reconstruction passed 3,205 original x86 test cases while reproducing all 63 compiled function bytes. A Notion case study traces the Electron clipboard bridge from the renderer through preload and IPC into the main process. Treat both as vendor-reported numbers, but they show the intended workflow: decompile, trace the feature, then recreate the logic in your own stack.

Prerequisites

• Node.js 22.x (22.19 or later), 24.x (24.11 or later), or 26+, plus npm
• macOS 12+, Ubuntu 24.04+, Fedora 41+, or 64-bit Arch Linux
• One supported coding agent: Claude Code, Cursor, Codex, Gemini CLI, Windsurf, or another client from the 18 documented in the installation guide
• For native binary analysis: an existing Hopper, Ghidra, or IDA installation, or willingness to let setup install Hopper with your explicit approval
• A target you have the right to analyze: your own build, an open-source app, or a sample project
• Basic terminal comfort; no reverse engineering background required

Step-by-step guide

Step 1: Verify your Node.js version

REA is strict about the Node floor. Check before anything else:

node --version

You need v22.19+, v24.11+, or v26+. My lab machine runs v24.20.0 on Ubuntu 24.04, comfortably above the floor. If your version is older, upgrade Node first; everything downstream fails in confusing ways on Node 20.

Step 2: Run the setup wizard

With Node and npm in place, run the one-command installer:

npx rea-agents setup

The wizard is deliberately conservative. It shows you the exact paths and the exact changes before applying anything, backs up your existing agent configuration first, and pre-selects only agents that already have a REA registration. Newly detected agents appear in the list but stay unticked, so detection gives context, not permission. Choose your agents, review the proposed changes, approve them, and restart your agent afterward. Restarting matters: most agents only load MCP servers at startup, so the new tools will not appear in a running session.

If you are registering Claude Code specifically, this is the same MCP registration pattern covered in our Claude Code MCP setup guide, except REA does the config editing for you.

Step 3: Verify the installation with rea doctor

REA ships a self-diagnostic command. Run it:

npx -y rea-agents@latest doctor

On a fresh machine with no engines installed you will see something like this real output from my lab:

healthy: false
environment_healthy: false
scope:
  mode: audit-wide
  clients: []
  providers: []
  skill: false
  target: null
scope_checks[7]:
  - name: node
    ok: true
    classification: healthy
    detail: 24.20.0
  - name: host
    ok: true
    classification: healthy
    detail: ubuntu 24.04
  - name: hopper
    ok: false
    classification: missing_analysis_engine
    remediation: "Run rea setup to install Hopper, or set HOPPER_LAUNCHER_PATH."
  - name: ghidra
    ok: false
    classification: missing_analysis_engine
    detail: GHIDRA_INSTALL_DIR is not set
    remediation: Set GHIDRA_INSTALL_DIR to an extracted Ghidra 12.1.x release directory.

Do not panic at healthy: false. It means no native analysis engine and no agent registration are configured yet, which is expected right after install. The remediation strings are exact and actionable: point GHIDRA_INSTALL_DIR at an extracted Ghidra 12.1.x directory, or rerun rea setup and approve the optional Hopper install.

Step 4: Run a zero-setup JavaScript analysis

This is the fastest way to see REA working, with no MCP config and no decompiler. Point the CLI at an extracted JavaScript or Electron app directory:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The path must be absolute. I tested this on a tiny two-file Express app in my lab. The command streamed progress lines like Parsing and projecting index.js (1/2), then sealed an evidence bundle:

{"rea_progress":{"phase":"analyze_javascript_application","completed":1,"total":1,
"message":"Application graph and Electron boundaries reconstructed","terminal":true,"sequence":15}}
{"evidence_id":"ev_9ab0b05973afd4f6d57e79c40b1753f2d9f8d88a9813ad9c5c8182867af8e26c",
"subject":{"name":"rea-test-app",
"digest":{"sha256":"640386a2bda5da2d39edc974ccc38ad03e2282178a8381c628c6f71188f4328f"},
"format":"directory","architecture":null,"local_path":"/tmp/rea-test-app"},
"provider":{"id":"rea-javascript-application","name":"REA JavaScript application analyzer","version":"1"},
"predicate_type":"rea.javascript-application-analysis",
"parameters":{"format":"auto","integrity_policy":"fail"}}

Note the shape: every result is an immutable, hashed Evidence JSON bundle with a predicate type, not a chatty verdict. The four fields the tool promises are evidence, a recovered graph, limitations, and unknowns. That structure is the whole design philosophy, and it is what keeps an agent honest when it explains what it found.

Step 5: Ask your agent through MCP

With setup complete and your agent restarted, the REA tools appear in the agent’s tool list automatically. Ask in plain language:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Replace Notes with your target. The agent calls REA over MCP to inspect the target and trace relevant code, REA returns findings with evidence, and the agent uses them to ask follow-up questions, explain the behavior, or write and test an implementation. If you use Cursor or Windsurf instead of Claude Code, the same prompt works; the registration mechanics for those clients are covered in our Cursor MCP guide and our Windsurf MCP guide.

For regular terminal use, install the persistent command instead of going through npx every time:

npm install --global rea-agents
rea --help

The help output lists the full catalog, currently dozens of commands from analyze and decompile to capture-browser-scenario and extract-firmware.

Step 6: Enable native binary analysis (optional)

JavaScript analysis needs no engine. Native binaries are a different problem, and REA does not pretend otherwise: deep native analysis rides an existing Hopper, Ghidra, or IDA installation. You have three paths:

1. Let setup install Hopper. Rerun rea setup, and approve the optional Hopper installation when it is proposed. Hopper can run in free demo mode; on macOS a first-run dialog may ask you to choose demo mode or activate a license, which you must complete in the same user session before your first CLI or MCP operation.
2. Bring your own Ghidra. Extract Ghidra 12.1.x and set GHIDRA_INSTALL_DIR to that directory. Setup can also save verified paths for an existing Ghidra installation.
3. Bring your own IDA. IDA works in read-only GUI or headless provider modes, configured via REA_IDA_MCP_CONFIG pointing at your IDA MCP registration JSON.

The consent boundary is real: Hopper installation and Ghidra/IDA registration each require their own explicit approval during setup, separate from the agent registration step. For large binaries, raise the provider startup deadline with REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.

Step 7: Keep REA updated

REA changes quickly and new releases carry frequent bug fixes. For a globally installed CLI:

rea update

Then rerun the setup command the updater prints, review the changes, and restart your agent. If you use npx:

npx rea-agents@latest setup

Troubleshooting

Problem 1: The first npx rea-agents run seems to hang

Cause: The first invocation downloads the full package, which took about 34 seconds on my lab machine before printing anything. It looks frozen but is just fetching.

Fix: Wait it out, or skip npx entirely with npm install --global rea-agents so every later command starts instantly. Use npx -y rea-agents@latest <command> when you want a pinned, reproducible version for scripts.

Problem 2: rea doctor reports healthy: false and missing engines

Cause: Fresh install with no Hopper, Ghidra, or IDA present. This is the expected state, not a broken install.

Fix: Follow the remediation strings exactly. For Hopper: rea setup, approve the optional install. For Ghidra: extract Ghidra 12.1.x and export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.1. For IDA: set REA_IDA_MCP_CONFIG to your IDA MCP registration JSON. JavaScript and .NET analysis work fine while engines are missing.

Problem 3: My agent does not list any REA tools

Cause: Agents load MCP servers at startup, so a registration made while the agent was running is invisible until restart. rea doctor flags this as config_drift when the installed skill identity is missing.

Fix: Restart the agent completely, then ask it to list available tools. If tools are still missing, rerun rea setup to refresh registrations and the bundled skill, restart again, and recheck with rea doctor.

Problem 4: Hopper operations fail on macOS with a licensing prompt

Cause: A first-run Hopper dialog is waiting for you to choose demo mode or activate a license, and unattended CLI or MCP operations cannot click through it.

Fix: Open Hopper manually once in the same user session, choose demo or enter your license, then retry. REA starts Hopper itself when an operation needs it after that first activation.

Problem 5: GitHub Copilot CLI refuses to chat with the full REA tool profile

Cause: A known issue (morluto/rea #1554): on Copilot CLI 1.0.95, the gpt-4.1 model metadata can block ordinary chat before a model request is sent when REA’s full input-schema profile is loaded.

Fix: Use a distinct provider model ID such as rea-gpt-4.1 with COPILOT_PROVIDER_WIRE_MODEL=gpt-4.1, and select it via copilot --model rea-gpt-4.1. This keeps every full schema and the actual wire model intact.

FAQ

The most common reader questions are answered in the front matter quick-reference above; the on-page section below expands on the practical ones.

Which agents can use REA?

Any agent that supports local MCP servers. The setup wizard documents 18 clients, including Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Qwen Code, and VS Code. Clients without documented local config files can use manual registration.

Do I need Hopper, Ghidra, or IDA?

Only for deep native analysis. JavaScript/Electron and .NET analysis need no engine at all. If you do native work, setup installs Hopper after your explicit approval, or points at your existing Ghidra or IDA.

Is my target binary uploaded anywhere?

No. Everything runs on your machine, which is the core trust argument versus cloud analysis APIs.

Can REA recover original source code?

No. It returns pseudocode, assembly, strings, references, and evidence with stated limitations. The project says this upfront, which is a good sign.

Conclusion

REA puts a real decompiler behind a plain-English question, and the evidence-first output keeps the agent honest about what it actually proved. Start with the zero-setup JavaScript analysis to learn the workflow, add Hopper or Ghidra when you need native binaries, and always analyze only software you have the right to inspect. If you are setting up more MCP tooling afterward, read how to connect an MCP server to Claude Desktop next, or our MCP server tutorial for the protocol fundamentals behind tools like REA. If you work in Claude Code specifically, our REA MCP walkthrough for binary analysis covers the Claude Code setup.

Frequently asked questions