12 KiB
English · 简体中文 · 日本語 · 한국어 · العربية
REA: Reverse Engineer Anything
One CLI and MCP server for coding agents to reverse engineer anything
See a feature you like. Understand how it works. Build it your way.
Quick start · See the workflow · From app to feature · 46 tools · How it works · FAQ
npx skills add morluto/rea
See a feature in an app that you want in your own product? Give the app to your coding agent—even without its source code. With REA, the agent can investigate the feature, understand how it works, and build a version adapted to your stack, design, and requirements.
REA makes that possible through one CLI and MCP server. Your agent can inspect the compiled app, follow how features work, and use what it learns in its normal coding workflow. REA handles the reverse-engineering tools behind one interface.
Just ask your agent
Install the REA skill:
npx skills add morluto/rea
Then ask:
Set up REA and reverse engineer the Notes app. Explain how search works,
show me how you know, and build a similar feature for my project.
Notes is only an example. Name any app you want to understand, or ask the agent to start with an overview.
From app to feature
|
Decompile Open an app and recover readable code, strings, names, and other clues about how it works. |
Understand Follow the code from one part of the app to another until the agent can explain how a feature actually works. |
Recreate Turn what the agent learned into a feature for your own product, adapted to your stack, interface, and requirements. |
REA shows how it reached its conclusions. It does not claim to recover original source code or automatically clone an application.
Why REA
| Built for agents | Ask what an app does and let your agent inspect it instead of guessing. |
| CLI and MCP | Run the same reverse-engineering capabilities from your terminal or coding agent. |
| Complexity handled | REA installs and manages the reverse-engineering tools behind the scenes. |
| From insight to code | Understand a feature, then build your own version in the same coding session. |
| Local by design | Analysis runs on your Mac. REA does not upload the app to a hosted analysis service. |
| Keeps context | Investigate several apps without starting over for every question. |
Quick start
With a coding agent — recommended
npx skills add morluto/rea
Ask your agent to set up REA. It will check your Mac, explain anything it needs to install, ask for approval, and guide you through system prompts. After setup, restart the agent if it asks you to load the full REA toolset.
From Terminal
npx -y @morluto/rea setup --yes
If macOS or an installer asks for confirmation, complete the prompt and run the same command again. Restart a configured coding agent so it loads REA.
What setup handles
- macOS 12 or newer
- Node.js 22 or newer
You do not need to install the reverse-engineering tools manually. Setup installs Homebrew and Hopper when needed, configures detected Claude Desktop and Cursor installations, and installs the REA skill. Hopper is separate software and requires its own license; setup installs it but does not provide a license.
If something is not working, run:
npx -y @morluto/rea doctor
CLI or coding agent?
| If you want to… | Use |
|---|---|
| Ask an agent to investigate an app and build a feature | Install the skill, then talk to your agent |
| Inspect or decompile one part of an app from the Terminal | rea analyze or rea decompile |
One prompt, a full investigation
Reverse engineer the Notes app. Find how offline search works, explain it,
and build a version for my project using TypeScript and SQLite.
REA gives the agent a clear path from that request to working code:
| Step | What the agent does | REA tools |
|---|---|---|
| 1 | Opens and identifies the binary | open_binary, binary_overview |
| 2 | Finds likely offline-search clues | search_strings, search_procedures, list_names |
| 3 | Connects those clues to executable code | find_xrefs_to_name, xrefs, procedure_callers |
| 4 | Reconstructs the relevant control flow | get_call_graph, procedure_callees, procedure_info |
| 5 | Decompiles the relevant routines | procedure_pseudo_code, procedure_assembly, batch_decompile |
| 6 | Builds the feature in your project | code adapted to your stack, product, and requirements |
REA handles the app analysis in steps 1–5. The agent performs step 6 with its normal file-editing and test tools, using what it learned about the app.
What agents can do
- Investigate a feature you like and build a version tailored to your own product.
- Explain how a feature works when its source code is unavailable.
- Reconstruct an app's authentication, storage, update, or networking flow.
- Recover enough structure to document an undocumented format or interface.
- Trace a suspicious behavior from a string or symbol to the code that implements it.
- Compare implementation paths across two app versions by switching targets in one session.
- Turn recovered behavior into product features, tests, migration notes, ports, or interoperable replacements.
- Analyze Swift and Objective-C metadata without manually untangling every mangled symbol.
- Leave names, comments, and bookmarks in Hopper so human and agent analysis reinforce each other.
46 tools for deeper investigation
| Tool family | Count | Examples |
|---|---|---|
| Binary inspection | 33 | procedures, pseudocode, assembly, strings, names, segments, callers, callees, xrefs, annotations |
| Composed analysis | 10 | binary_overview, analyze_function, batch_decompile, get_call_graph, find_xrefs_to_name, Swift and ObjC discovery |
| Binary session | 3 | open_binary, binary_session, close_binary |
Using REA with other coding agents
Setup currently configures Claude Desktop and Cursor automatically. Any coding agent that supports local MCP servers can use REA with the configuration below.
Manual MCP configuration
{
"mcpServers": {
"rea": {
"command": "npx",
"args": ["-y", "@morluto/rea", "mcp"]
}
}
}
How it works
flowchart LR
Agent["Coding agent"] --> REA["REA<br/>CLI + MCP"]
Terminal --> REA
REA --> Hopper["Analysis engine"]
Hopper --> App["Your app"]
The CLI and MCP server use the same analysis engine. Terminal commands close the app when they finish; an agent session keeps it open while the investigation continues.
CLI
The agent workflow above is the easiest way to use REA. For a one-off overview from the Terminal:
npx -y @morluto/rea analyze /Applications/Notes.app
Run npx -y @morluto/rea --help for direct decompilation and other options.
Or install the rea command globally:
npm install --global @morluto/rea
rea --help
rea mcp
REA accepts a Mac .app folder directly. If an agent cannot find an app by name, tell it where the app is installed.
Hopper application behavior
REA starts Hopper when needed; Hopper does not need to be running first. Hopper's launcher internally activates the application, so opening a target may bring Hopper to the foreground. REA asks macOS to start Hopper hidden and in the background when possible, but cannot guarantee that it will remain behind the current application.
REA derives explicit format and architecture arguments to prevent common FAT and ARM selection dialogs. Other Hopper or macOS dialogs may still require a person. REA reports timeouts and remediation through CLI or MCP results instead of attempting to answer UI prompts.
Closing a REA session shuts down its bridge and removes its private socket directory. It does not quit a Hopper application the user may be using.
Security model
REA communicates with Hopper over a private local connection and does not provide a hosted analysis service. This is not a sandbox: Hopper opens apps with your current macOS permissions. Report vulnerabilities through the private process in SECURITY.md.
FAQ
Does Hopper need to be running before I start REA?
No. REA starts Hopper when an operation needs it. An already-running Hopper application is also supported.
Why did Hopper appear in front of my other windows?
Hopper's launcher internally activates the application. REA requests background startup, but macOS and Hopper may still bring a window or dialog forward. See Hopper application behavior.
Does REA include Hopper?
No. Setup can install Hopper for you, but Hopper remains separate software with its own license. REA supplies the CLI, MCP server, and workflows that make it usable by agents.
Does REA upload the app?
REA has no hosted analysis service. It passes local operations to Hopper through a current-user Unix socket. Your coding agent or model provider may have its own data policy, so review that separately.
Can REA recover the original source code?
No decompiler can guarantee the original source. REA gives an agent pseudocode, assembly, symbols, strings, metadata, and relationships that it can use to explain or compatibly recreate observed behavior.
Which agents can use REA?
Any coding agent that can run a local MCP server can use the manual configuration. Setup currently detects and configures Claude Desktop and Cursor automatically.
Development
See CONTRIBUTING.md for setup, architecture, tests, and release instructions. Generated API documentation is available under docs/api.
Project links
npm · Issues · Security · Contributing · Hopper