Software used to hide. Compiled, minified, stripped, shipped as opaque blobs you could only poke at from the outside. That era ended quietly in April 2026, and by October the whole developer world had noticed.
REA, or Reverse Engineer Anything, has become one of the fastest-growing repositories GitHub has ever hosted: roughly 262,000 stars and 66,000 forks, all on a single MIT-licensed project that did not exist eight months ago. This is not a breached database story or a zero-day panic. It is bigger and stranger than that. REA hands your AI coding agent the keys to inspect any piece of software, down to the raw assembly, and explain how it actually works.
If you build, buy, or defend software, this changes your calculus. Here is what REA actually is, what it can and cannot do, and what it means for your business.
What REA actually is
REA is a CLI and an MCP server. That second part is the important one. The Model Context Protocol is the open standard that lets AI agents like Claude Code, Codex, Cursor, Gemini CLI and Grok Build call external tools. REA plugs into that slot and gives your agent a full reverse engineering toolkit.
Point it at an app, a binary, or a website, and ask a plain-language question. Why does the dinosaur speed up? How does this authenticator generate my login code? REA returns the evidence: pseudocode, assembly, strings, symbols, call graphs and runtime observations. Your agent reads that evidence, explains the behaviour, and can then rebuild the feature for your own project.
Everything runs locally. Nothing gets shipped off to someone else's cloud. And critically, REA returns its evidence and its limitations side by side. It tells you what it found and where the conclusion gets shaky.
The targets it can crack open
This is where the scope gets genuinely wide. REA is not a one-trick decompiler. Its official documentation covers:
- Native binaries: pseudocode, assembly, strings, symbols, calls and references, powered by Hopper, Ghidra or IDA
- JavaScript and Electron apps: modules, imports, source maps, routes and IPC boundaries
- .NET assemblies: metadata, CIL instructions and native dependencies
- Websites: page structure, scripts and network observations from a real browser session
- Android APKs: manifest declarations, classes and decompiled methods
- Go and Rust binaries: embedded module lists, crate names, versions and dependency edges
- Firmware, WASM, EVM bytecode, SQLite databases, Flutter apps and packet captures
Guides, setup steps and worked case studies live on the project site at rea.tools. The site walks through real investigations: why Windows Calculator turns 200 + 10% into 220 (it takes a percentage of the first number after a plus), how Notion copies rich block data to the clipboard, and how a 1996 game calculated left and right sound pan. Each claim links back to the actual instructions and cross-checks against public source.
What it cannot do (read this part twice)
REA does not recover original source code. It reconstructs logic and behaviour. That distinction is the difference between a useful engineering tool and magical thinking, and vendors promising otherwise are selling you a story, not a capability.
It is not friction-free either. Native analysis needs a real engine installed: Hopper, Ghidra or IDA. Some targets need extra tooling such as JADX for Android or TShark for packets. The project moves fast, so you will be updating often.
Then there is the noise. A repository this popular attracts lookalikes and scams. Copycat repositories reuse the name and lift the README, and fake REA downloads have already surfaced. The legitimate sources are narrow: github.com/morluto/rea, rea.tools, and the rea-agents package on npm. Anything else deserves suspicion.
The part every business owner needs to hear
Here is the uncomfortable truth REA just made obvious: if your application ships logic to the user's machine, that logic is no longer a secret.
Not hard to find. Not obfuscated enough. Readable. Minification, packing and stripped symbols slow a human down. They barely slow an AI agent that can follow a call graph across thousands of instructions in seconds.
That does not mean your product is suddenly worthless. It means your moat has to move. The defensible parts of modern software were never really in the client anyway:
- Keep the crown jewels server-side. Pricing rules, scoring algorithms, fraud logic and proprietary data belong behind your API, not compiled into an app someone can unpack.
- Never ship secrets. API keys, tokens and credentials in client code were always a bad idea. REA just turned someone will find them into a certainty.
- Compete on experience and execution, not secrecy. Great UX, reliability, support, integrations and speed of iteration are far harder to clone than a function.
- Sandbox anything untrusted. A reverse engineering tool inspects hostile code by nature. Run it in an isolated virtual machine, never on a machine holding your real data.
- Understand the legal line. Security audits, interoperability, learning and recovering your own lost source are generally fair game. Cloning a competitor's product or bypassing DRM is not, and the tool does not launder the intent.
The takeaway
REA is the clearest signal yet that software transparency is now the default. Your users' agents can read your app. Your competitors' agents can read your app. The question is not whether your logic is visible. It is whether you have built anything that survives being seen.
For developers, that is liberating: study how the best apps work, then build something better. For businesses, it is a prompt to audit what you are actually shipping. Open the client bundle and ask yourself what you would find if a curious agent started pulling at the threads.
Because right now, someone's agent is already pulling.
Sources: the REA project (github.com/morluto/rea and rea.tools), Nate's Newsletter deep-dive on REA, and coverage from Geeky-Gadgets and the REA community guides.