Note on links: this article links to reaguide.online, a small independent learning hub (Phase 1 is live). It is third-party, non-affiliated educational material.

The one-paragraph version

REA is an open-source (MIT) MCP server + CLI, written in TypeScript, that sits between your AI coding agent and the binary-analysis tools you already have. It decompiles nothing itself — you bring your own Hopper, Ghidra, IDA, JADX, Binwalk, or one of ~26 supported providers — and REA orchestrates them for agents like Claude Code, Codex, Cursor, or Gemini CLI (14 agent integrations at the time of writing).

The mental model that helps: REA is an orchestration layer over decompilers, not a decompiler. If your agent is the intern, REA is the desk that hands the intern properly labeled folders instead of raw hex dumps.

The evidence contract is the interesting part

Most agent-tooling demos stop at "look, it runs a command." REA's core design choice: every tool result returns three fields:

• result — the actual output

• evidence_id — a pointer to where the claim came from

• limitations — what the tool could not determine

And it's fail-closed: if evidence can't be produced, the result is marked incomplete rather than silently guessed. For anyone who has watched an LLM confidently hallucinate a function name from a mangled decompilation, this is the difference between "fun demo" and "tool you can put in a review workflow." Your agent is forced to cite its work.

Legitimate use cases (the whole list, unsensationalized)

Staying squarely inside software you have the right to inspect — your own builds, open-source binaries, the project's published demo targets, legacy apps you maintain:

• Onboarding archaeology — inherited a service with no docs? Point an agent at the binary you deploy and ask it to map module boundaries.

• Dependency due diligence — know what a vendor-shipped binary links against and exports before signing.

• Malware analysis / CTF education — structured triage with an evidence trail, in your isolated lab.

• Legacy interop — recovering interface definitions from your own old builds.

What it's not: a "point at any app" magic wand. The project's SECURITY.md says it plainly — "This is not a sandbox" — the operator owns authorization. Read that as common sense, not fine print.

5-minute setup sketch

# prerequisites: an MCP-capable agent (Claude Code, Cursor, Codex, …)
# and at least one analysis engine you're licensed to use

npm install -g rea-agents   # v5.x, ~139 MCP tools / 94 CLI commands

# register with your agent's MCP config (example: Claude Code)
claude mcp add rea -- rea mcp

# sanity check
rea doctor

From there it's natural language in your agent: "list the exports of ./build/liblegacy.so and summarize entry points with evidence." Agent → REA → your decompiler → a cited answer, instead of a 4,000-line dump pasted into chat.

Where it sits vs. the alternatives

REA isn't competing with Ghidra the way a new GUI would. It's competing with the copy-paste-into-ChatGPT workflow you were doing last month.

Honest caveats (what launch-week posts skip)

1. Velocity risk. ~40 → 128K+ stars in six days (Oct 4–12, 2026). That fast a curve means API churn — pin your version, expect breaking changes.

2. Pseudonymous author (morluto) with a fleet of small "for agents" repos. Not disqualifying with MIT code you can read, but know it before piping confidential binaries through.

3. Privacy is local-then-leaky. Analysis is local; results flow through your agent to your model provider. Confidential binary? That's a data-governance question first.

4. The learning curve has no map yet. Developer-published docs are thin; third-party material is hype or ethics threads. Structured beginner content is the gap — why this article exists.

On responsible framing

"AI reverse engineering" content attracts two bad framings: breathless "reverse engineer anything" hype, and assume-criminalistic tutorials. Both miss the real audience — professional developers who need to understand binaries they're legitimately responsible for, and want their AI assistant to stop hallucinating. REA's evidence contract matters because it's built for that serious case: fail-closed, cited, limitations declared. That's the framing worth amplifying.

What's next

This is the first piece of a small independent effort to build structured beginner material around AI-assisted binary analysis — setup guides, tool comparisons, legality explainers.

• ✅ REA setup guide (step-by-step, real terminal sessions) → realearn setup guide

• ✅ REA vs. Ghidra-MCP workflows → REA vs. Ghidra-MCP

• ✅ "Is AI-assisted reverse engineering legal?" plain-English explainer → Is Reverse Engineering Legal?

Anchor URLs above point to the live companion site, reaguide.online.

Written by an independent contributor. Not affiliated with the REA project or morluto. Facts (star counts, npm numbers, provider counts) verified 2026-10-12 and will age — re-check the repo before quoting. Use every tool discussed only on software you have the right to analyze.

Tags: ai, reverse-engineering, mcp, ai-agents, devtools