REA is the open-source tool that exploded on GitHub this fall. We installed version 6.8.0 and ran a real test on our own website code — here is what it actually found, what it missed, and the safety rules before you try it.
REA stands for Reverse Engineer Anything. It is a free, open-source tool (MIT licence) published by GitHub user morluto. Technically it is an MCP server plus a command-line tool that connects professional reverse-engineering tools — Ghidra, IDA, Hopper, JADX and others — to AI coding agents such as Claude Code, Codex, Cursor and Gemini CLI. You ask your agent a question like "how does this app's search feature work?", REA inspects the target, and the agent gets back structured findings with evidence and stated limitations. It can look at native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, firmware, websites and more. Static analysis runs locally on your machine.
The repository was created in April 2026 and sat quietly for months. Then it went viral: contemporaneous reporting counted fewer than 10,000 stars on October 6, and when we opened the repo on November 7, 2026 it showed 438,118 stars — one of the fastest climbs in GitHub history. Hype that big deserves a hands-on check instead of a summary of other people's videos, so we ran one.
Requirements (from the official README): Node.js 22.x (≥ 22.23.4), 24.x (≥ 24.22.1) or 26.12.1+, plus npm. Our test machine ran Node v24.22.1 — exactly the minimum for the 24.x line — with npm 10.9.4 on Ubuntu Linux.
We installed REA locally in one folder (no admin rights, nothing system-wide). Before installing, we verified the package identity: npm view rea-agents showed version 6.8.0 with maintainer "morluto", matching the GitHub repo owner. Then:
npm init -y npm install rea-agents@6.8.0 ./node_modules/.bin/rea --version # → 6.8.0
The install took about 40 seconds. We also ran rea doctor: it confirmed Node was healthy and reported that no native analysis engines (Hopper, Ghidra, IDA) were installed — which is fine for what we tested, because the official FAQ states that static JavaScript and .NET inspection work without a native engine. Deep native-binary analysis does need an existing Hopper, Ghidra, IDA or Kuna installation, and REA does not provide licences for those tools.
One note: the README's quick start for agent users is npx rea-agents setup, which registers REA with your AI agent. We deliberately tested the standalone command-line path below instead, because it needs no agent registration and shows exactly what REA itself produces.
Target: our own Social Image Sizes tool — a free page on this site that turns one uploaded image into eight social-media sizes. We know its source code line by line, so we could score REA's answers honestly. Two questions:
We ran the documented command (rea analyze-javascript-application <folder> --json) on the tool's page plus its two linked scripts. REA fully parsed both external scripts, inventoried the page, spotted the external AdSense script reference, and even found a cookie-consent localStorage key in our site script. But it did not analyse the tool itself, because the tool's code lives in an inline <script> block inside the HTML — and, to REA's credit, its report said so in plain words: "2 inline JavaScript bodies … that were not analyzed." Lesson one: for ordinary web pages, extract the scripts first (or use REA's browser-capture workflow), and always read the limitations section of its report.
We copied the page's two inline scripts, byte for byte, into separate .js files and re-ran the same command. This time REA parsed everything (4 files, 15,835 bytes, zero parse failures). Here is its evidence, checked line by line against the real source:
| What REA reported | Verified against our source |
|---|---|
A function drawPreset() creates a canvas, gets its 2D context, draws the image with drawImage, encodes it with canvas.toBlob, and hands the result out via URL.createObjectURL; a PRESETS table drives the sizes. | Correct. That is exactly the export pipeline. REA placed drawPreset() at byte offset 2921 of the script — we checked: exact to the character. |
Background fill calls (fillStyle/fillRect) for the "fit whole image" mode, the exact warning text "Upscaled from a smaller original — may look soft.", and a setInterval timer of 400 ms. | Correct. The 400 ms timer is a real quirk in our code: a polling fallback for Android browsers that don't fire file-picker events properly. |
Across all four files, its request extraction found zero network calls — no fetch, no XMLHttpRequest, no WebSocket. The only storage found was the cookie-consent flag in a different file (app.js line 63 — also exact). | Correct. That answers Q2: the image is loaded with an object URL and processed entirely in the browser. It is never uploaded — which is what the tool promises on its page. |
| The eight preset dimensions (1080×1080, 1080×1350, 1080×1920, …) and the crop-vs-fit scaling formulas. | Missed. REA identified the PRESETS table and the drawing calls, but did not surface the table's values or the Math.max/Math.min fit math as structured findings. The output format and quality values also live in the page's HTML dropdowns, outside the script it analysed. |
Our verdict: as a structural map, REA is precise — mechanisms, call chains and source locations were right every time we checked. As a mind-reader, it is partial: it tells you what the code does and where, not every data table and formula inside it. Notably, it labels what it could not resolve as "unknown" instead of guessing — our run reported 654 such unknowns across the app, which is the honest way to present partial coverage.
morluto/rea, the website rea.tools, and the npm package rea-agents. The README warns that a similar repository name or a copied README does not make a download official — fake look-alike repos appeared within days of the hype. We verified the npm maintainer name matched the repo owner before installing.We don't offer reverse-engineering services, and nothing on this page is a how-to for inspecting other people's software.
Yes — it is open source under the MIT licence. Your AI agent subscription (if any) is separate, and commercial engines like IDA or Hopper need their own paid licences.
No. Per the official FAQ, REA analyses targets locally. Your agent receives the tool results, and your model provider's own data policy applies to those.
Not for static JavaScript or .NET analysis — those worked in our test with no engine at all. Native binaries need an existing Hopper, Ghidra, IDA or Kuna installation.
Node.js 22.x (≥ 22.23.4), 24.x (≥ 24.22.1) or 26.12.1+, plus npm. We tested on Ubuntu Linux with Node v24.22.1.
No — technically it can't (no source recovery, partial coverage) and legally you shouldn't try. See the safety section above.
Nothing it stated was false — its citations were exact. Its weaknesses were omissions: the preset dimension table and the scaling formulas weren't extracted, and it skipped inline page scripts until we extracted them (a gap it disclosed in its own report).
The page REA analysed is one of our free browser tools — it resizes one image into every social-media size at once, locally in your browser, and now you have third-party-style evidence that it really doesn't upload anything: Social Image Sizes. Browse the rest of our free tools — QR codes, invoices, colour tools and more, all running locally the same way.
We can put your design on T-shirts, hoodies, mugs, posters and more — printed to order in Quebec, no minimums, with a free preview before you pay.
Contact us for a free quote