REAReverse Engineer Anything

Home / Get started

Set up REA.

Connect REA to your coding agent, or inspect a local app from your terminal.

You'll need Node.js 22 (22.19+), 24 (24.11+) or 26+, and npm.

Connect your coding agent

Run setup to connect REA to your coding agent. Client choices include Claude Code, Codex, Cursor, Gemini CLI, Windsurf and other supported MCP clients.

Your coding agent

Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.

Or run setup yourself
Terminal 
npx rea-agents@latest setup

Choose your client and review the setup plan. REA adds its MCP connection and the matching investigation skill, keeping a backup of existing configuration. It asks before applying the changes.

Restart your client when setup finishes. Give your agent a target path and a specific question. For a JavaScript or Electron app, you might start with:

Look at /absolute/path/to/app and find how it exports data. Show the entry points, calls and dependencies involved, with the source locations for your findings.

Replace the path with your local target.

Use the CLI

Analyze a JavaScript or Electron application folder or ASAR archive without running the app:

Static application analysis 
npx -y rea-agents@latest analyze-javascript-application \
  /absolute/path/to/app --json

Replace the path with your extracted app directory or .asar file. On Windows, a path such as "D:/apps/example" works here.

The result identifies the app, shows connections between modules and gives their source locations. Connections REA cannot resolve are marked in the result.

If you'd like a permanent rea command in your shell:

Install the CLI 
npm install --global rea-agents

Continue with the JavaScript application guide

Set up native analysis

Native binaries need a local analysis tool. Choose and configure one below, then give REA your executable or library.

Choose a tool: Ghidra, Hopper or IDA

Ghidra

Use an existing Ghidra 12.1.x installation and a 64-bit JDK 21 or newer on Linux x64 or macOS x64/arm64. Set the paths before running setup:

Connect your Ghidra installation
Ghidra connection · macOS / Linux 
export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

Replace both paths with your existing installations. Setup checks them and records valid settings for your selected client. On macOS, use a Ghidra package with the native decompiler matching your host architecture.

Hopper

Connect Hopper on macOS or Linux. Run the setup command above; it detects an existing installation or offers an installation plan for your approval.

On macOS, complete Hopper's first-run choice of demo mode or license activation before an unattended analysis.

IDA

The verified IDA setups use Windows, with an existing MCP registration for an attached GUI or a headless database. Linux and macOS headless analysis remains unverified.

Connect an existing IDA MCP registration

Keep the upstream server's working command, args and optional env in a JSON file. An existing mcpServers object with an ida-pro-mcp entry is also accepted. Point REA at that file before setup:

IDA connection · Windows PowerShell 
$env:REA_IDA_MCP_CONFIG = "C:/analysis/ida-mcp.json"
$env:REA_ANALYSIS_PROVIDER = "ida"
npx -y rea-agents@latest doctor --provider ida --json
npx rea-agents@latest setup

The attached profile uses upstream legacy 1.4.0 tools with the original binary already open in IDA. The headless profile uses the upstream database-supervisor API and a registration with "mode": "headless"; real verification covers an IDA 9.3 Windows x64 supervisor. Doctor checks the registration without starting IDA.

Give REA the original executable path, with --provider ida in a CLI query. For an agent, include REA_IDA_MCP_CONFIG in the REA registration's environment and select IDA when opening the binary.

For an existing Ghidra setup, inspect a function with:

Function analysis 
npx -y rea-agents@latest function /absolute/path/to/program main \
  --provider ghidra --json

Replace main with the function name or address you want to inspect.

How native analysis sessions work

Each CLI command imports and analyzes the binary, then closes its session. Your agent's MCP queries reuse the imported binary while that session is open.

Follow a native analysis example to see how the function result leads to a recovered calculation.

Getting help

If your agent doesn't see REA

Restart or reconnect the client after setup. Check its REA connection with doctor; for Codex:

Check one client 
npx -y rea-agents@latest doctor --client codex --json

If a provider needs attention

Check the provider you're using. For Ghidra:

Check one provider 
npx -y rea-agents@latest doctor --provider ghidra --json

The report gives the failed check and a suggested next step.

Top