+ Run setup to connect REA to Claude Code, Codex, Cursor or another
+ supported client.
+
+
+
+ Terminal
+
+
npx rea-agents@latest setup
+
+
+ Choose your client and review the setup plan. REA adds its MCP
+ connection and the matching investigation skill, keeping a backup
+ of existing configuration. It asks before applying the changes.
+
+
+ Restart your client when setup finishes. Give your agent a target
+ path and a specific question. For a JavaScript or Electron app,
+ you might start with:
+
+
+
+ Look at /absolute/path/to/app and find how it
+ exports data. Show the entry points, calls and dependencies
+ involved, with the source locations for your findings.
+
+
+
+ Replace the path with your local target. Read the findings, then
+ ask a narrower follow-up about a function or connection you want
+ to understand.
+
+
+
+
+
From the terminal
+
+ You can start with a JavaScript or Electron application folder or
+ ASAR archive. This path uses Node.js and npm and reads the app
+ without running it.
+
+ Replace the path with your extracted app directory or
+ .asar file. On Windows, a path such as
+ "D:/apps/example" works here.
+
+
+ The result includes the application's identity, recovered module
+ relationships and evidence locations. It also records
+ relationships that remain unresolved. Use those findings to choose
+ where to investigate next.
+
+
+ If you'd like a permanent rea command in your shell:
+
+ For an existing Ghidra setup, inspect a function with:
+
+
+
+ Function analysis
+
+
rea function /absolute/path/to/program main \
+ --provider ghidra --json
+
+
+ Replace main with the function name or address you
+ want to inspect. The first query imports and analyzes the target,
+ so it can take longer than later requests.
+
+
+
+
+
Getting help
+
If your agent doesn't see REA
+
+ Restart or reconnect the client after setup. To check its
+ registration, use a client-scoped report; for Codex:
+
+
+
+ Check one client
+
+
npx -y rea-agents@latest doctor --client codex --json
+
+
If a provider needs attention
+
Check the provider you're using. For Ghidra:
+
+
+ Check one provider
+
+
npx -y rea-agents@latest doctor --provider ghidra --json
+
+
The report gives the failed check and a suggested next step.
+ REA gives your coding agent tools to inspect apps, binaries and
+ runtime behavior. Ask a question, follow the code, and use what you
+ learn in your own project.
+
+ Connects REA to your agent and installs its investigation workflow.
+
+
+
+
+
+
+
+
+
+
+
+ REA connects your agent to analysis tools. The findings guide the
+ next question, explanation or implementation.
+ Open figure
+
+
+
+
+
+
+
+
+
Case study
+
Rebuilding DX-Ball
+
+ DX-Ball is a 1996 Windows game. The project is reconstructing it
+ in C, using REA to inspect the executable and independent tests to
+ check the recovered behavior.
+
+
+ To recover a sound-pan calculation, the agent used REA to inspect
+ the instructions, follow a caller and read the constants. Those
+ findings led to a C function checked against the original behavior
+ and all 63 compiled bytes.
+
+ Use REA from your terminal or through your agent's MCP connection.
+ Analysis runs locally, and results include the source locations,
+ evidence and open questions you need to continue.
+
+
+
+
Use your analysis tools
+
+ Connect a local analysis provider for native binaries. Static
+ JavaScript analysis runs with Node.js and npm.
+
+ The goal is a maintainable C version of the 1996 Windows game. REA
+ helps the agent inspect the original, one function at a time.
+
+
Windows i386 · C · REA
+
+
+
+
+
+
+ One function, from executable to checked C. REA supplies the
+ instructions, callers and data reads; the reconstruction project
+ implements and tests the result.
+ Open figure
+
+
+
+ The recovered code covers board and resource handling, brick hits,
+ animations, particles and bonus production. Current builds provide
+ inspection utilities and an analysis library. Work on the playable
+ game continues with ball and paddle physics, power-up handling and
+ Windows integration.
+
+
+ The analysis starts from the DX-Ball 1.07 executable. REA returns
+ function code, instructions, callers and state references. These
+ findings guide the C implementation; execution of the original x86
+ functions and compiler replay check the result.
+
+
+
+
+
Finding the sound-pan calculation
+
+ When a brick is hit, its horizontal position is passed to the
+ sound code. The investigation needed to recover how that screen
+ coordinate becomes a left/right panning value.
+
+
+ The agent used REA to inspect the function, follow its brick-hit
+ caller and read the constants from the executable. Those results
+ supplied the input and arithmetic needed to write the C function
+ below.
+
+
+ The first function result for 0x406400 included
+ pseudocode declaring FUN_00406400(void) and calling
+ __ftol(). Its instruction view showed a stack input
+ and floating-point operations. That discrepancy gave the agent a
+ concrete reason to keep investigating.
+
+ The function result includes instructions alongside pseudocode
+ and callers. Here, [EBP+8] exposes the integer
+ input missing from the decompiler view.
+
+ REA identified this caller in the first result. Its preceding
+ instructions scale tile_x by 30; adding 20 gives
+ the brick's screen coordinate, 20 + 30 × tile_x.
+
+ The returned bytes establish the two arithmetic constants and
+ initial pan scale. The agent now has the values needed for the
+ C expression.
+
+
+
+
+ REA exposes these operations through CLI and MCP, with target
+ identity and Evidence IDs in the results. The agent can follow up
+ on a caller or data address directly, then use the findings to
+ write maintained C.
+
+
+
From REA's findings to C
+
+ Follow the five steps below. Each selection highlights the
+ original instructions and the C lines they informed.
+
DxBallInt dxball_screen_pan(DxBallInt x)
+{
+ double pan;
+ pan = (double)x;
+ pan = pan * 1.5625;
+ pan = pan - 500.0;
+ pan = pan * dxball_pan_scale;
+ return (DxBallInt)pan;
+}
+
+
+
+
+ 01 · Read the input.
+ The instruction view in REA's function result reads
+ [EBP+8] and uses FILD to load the
+ integer. Following its caller through REA establishes the
+ screen-coordinate meaning of the C parameter x.
+
+
+ 02 · Multiply by 1.5625.
+ FMUL reads the double at 0x420068.
+ The bytes returned by REA's read_bytes decode to
+ 1.5625; the C uses the same constant.
+
+
+ 03 · Subtract 500.0.FSUB reads
+ the double at 0x420070. REA's byte result decodes
+ to 500.0, shifting the calculation's center to
+ screen coordinate 320.
+
+
+ 04 · Apply the stored scale. The second
+ FMUL reads 0x4210a0. That global is
+ named dxball_pan_scale in the maintained source.
+ REA's second byte read establishes its initial value of
+ 1.0.
+
+
+ 05 · Return an integer. The call at
+ 0x406430 reaches __ftol, identified
+ in REA's callee results. The C casts the result to
+ DxBallInt; original-x86 comparisons check the
+ returned value.
+
+
+
+
+ The assembly excerpt selects the input, arithmetic and return
+ instructions. The full listing below also includes the intervening
+ stores and function setup and cleanup.
+
+ The input, caller context and constant values returned through REA
+ guided the maintained C implementation. The project then checked
+ it against the original x86 function and the pinned compiler. For
+ this function, both checks pass.
+
+
+
+
3,205 behavior cases
+
+ The tests execute the original x86 function and compare its
+ return value with the maintained C. They cover every integer
+ position from 0 to 640 at five pan scales: 0, 0.5, 1, 20 and
+ −1.
+
+
+
+
63 matching bytes
+
+ The C function is compiled with the pinned VC4.0 toolchain.
+ Compiler replay matches the complete function after applying
+ the reviewed relocations and checking the referenced
+ constants.
+
+
+
+
+ At a scale of 1, the recovered calculation returns −500 at the
+ left edge, 0 at the center and 500 at the right edge. The next
+ part of the audio work is integrating that value with the game's
+ sound backend.
+
+ The same approach is being used for particle updates, explosion
+ queues and bonus generation: inspect the relevant functions,
+ recover their state and dependencies, then compare the
+ implementation with the original.
+
+
+ To inspect the sound-pan function yourself, follow the DX-Ball
+ project's setup instructions and supply its matching original
+ target. Then run:
+
+
+
+ In the DX-Ball checkout
+
+
scripts/rea function original/DXBALL.EXE 0x00406400 \
+ --snapshot .analysis/rea/dxball.snapshot.json --json
+ 
+