Reverse Engineer Anything passes 299K stars, drives Ghidra from a coding agent

A developer who wants to know how a feature in someone else's app works can now point a coding agent at the compiled binary and get an answer with the evidence attached. The project is called Reverse Engineer Anything, or REA, and it reached 299,114 stars on GitHub by the morning of 17 October 2026. InfoQ's Renato Losio covered it the same day.

REA is a single MCP server, published under the MIT licence by an author who uses the handle morluto, that gives a coding agent read access to the standard reverse engineering stack. On native binaries it drives Ghidra, Hopper or IDA, returning pseudocode, assembly, strings, symbols, calls and cross-references. For Electron desktop apps and JavaScript bundles, it works statically, with no analysis engine, and returns modules, imports, source maps, routes, IPC calls and native add-on relationships. The project README lists sixteen other target kinds, including Go and Rust binaries, WebAssembly, EVM bytecode, SQLite databases, recorded Linux crashes, .NET assemblies, Android APKs, Flutter apps, firmware images, recorded packet captures and process behaviour.

What a developer actually asks the agent

The README gives one line as the canonical prompt: "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project." The agent then calls REA's tools through MCP, inspects the compiled app, follows the trace, and reports what it finds alongside the evidence that supports each conclusion. The sample showcase on the repository traces Notion's Electron clipboard implementation, reconstructs a sound-panning function from the classic game DX-Ball with tests matching all 3205 original x86 cases, and recovers bullet-ring angle calculations from the 16-bit code of the DOS game Touhou 4.

Setup is one command, npx rea-agents setup, which registers the MCP server with the agents on the local machine and installs the matching workflow instructions. The README names Claude Code, Codex, Cursor, Gemini CLI and Grok Build as supported hosts. Analysis runs locally, and the project says it does not try to recover original source code: it reports what the binary actually does, with evidence.

Where it stops

REA has limits the README states on its face. Native binary inspection needs an existing Hopper, Ghidra or IDA installation on the local machine. Android APKs need headless JADX and a full JDK. Firmware extraction needs Binwalk or Unblob on Linux. Recorded packets need TShark on Linux. The project's licence covers the tool, not the question of whether the reader has the right to decompile a given binary: the project says users are responsible for obtaining authorisation and complying with applicable laws.

The InfoQ piece quotes mixed reactions. On Hacker News, some commenters question what REA adds over asking a coding agent to install Ghidra directly, and others report better results than their previous attempts. On Reddit, independent developers raise the concern that AI-assisted reverse engineering could lower the bar for cloning features out of paid apps. The agent is still bounded by what the host operating system will let it touch, but a reader whose product is distributed as a compiled binary now has a widely used tool that reads it.

Source

• Primary: morluto/rea on GitHub
• Reporting: InfoQ, Renato Losio
• Project website: rea.tools