Open-source REA links AI coding agents to disassemblers

MIT-licensed REA lets coding agents query Ghidra, IDA, and Hopper locally; Hacker News later linked the GitHub project.

REA (Reverse Engineer Anything) is an MIT-licensed open-source project that connects AI coding agents to reverse-engineering tools through a local Model Context Protocol server. Native analysis can use Ghidra, IDA Pro, or Hopper and return pseudocode, assembly, strings, symbols, calls, and references, with stated limits; JavaScript, Electron, and .NET inspection do not require an installed disassembler, while Android APKs use JADX, firmware uses Binwalk or Unblob, and coverage also includes WebAssembly, network captures, browser inspection, and selected runtime activity. Setup via npx supports Claude Code, Cursor, Codex, Gemini CLI, and Grok Build, and GBHackers reports a Node.js requirement of 22.19+, 24.11+, or 26+, experimental Windows Ghidra support, and a warning that runtime capture can launch targets. Cyber Security News said a DX-Ball demo matched 63 compiled function bytes and passed 3,205 tests, while GBHackers described the reconstruction as passing 3,205 original x86 cases and did not mention the byte match. Both earlier sources say results sent to the agent follow the model provider’s data policy. A later Hacker News listing identified the GitHub project as morluto/rea, reported 40 points and 8 comments, and named no models, benchmarks, CVEs, or exploitation.

• REA (Reverse Engineer Anything), GitHub morluto/rea, is an MIT-licensed open-source bridge that lets coding agents query tools through a local Model Context Protocol server.
• Native analysis uses Ghidra, IDA Pro, or Hopper and can return pseudocode, assembly, strings, symbols, calls, and references; Windows Ghidra support is experimental, and JavaScript, Electron, and .NET inspection do not need an installed…
• Coverage also includes Android APKs via JADX, firmware via Binwalk or Unblob, WebAssembly, network captures, browser inspection, and selected runtime activity that can launch targets.
• Setup via npx supports Claude Code, Cursor, Codex, Gemini CLI, and Grok Build; GBHackers reports Node.js 22.19+, 24.11+, or 26+.
• Cyber Security News said a DX-Ball demo matched 63 compiled function bytes and passed 3,205 tests; GBHackers said the reconstruction passed 3,205 original x86 cases and did not mention the byte match.
• Results sent to the agent follow the model provider’s data policy.
• A 2026-10-12 Hacker News thread had 40 points and 8 comments and named no models, benchmarks, CVEs, or exploitation.