Table of Contents
REA: Reverse Engineer Anything with Agents
Source: morluto/rea — "Reverse engineer anything with agents, from app behavior down to native binaries." MIT licensed. The repository currently ranks as the #1 trending repo for reverse engineering on GitHub.
What it is
REA (Reverse Engineer Anything) is an agent-driven framework that replaces manual disassembly with automated code tracing, runtime observation, and binary reconstruction. Rather than spending hours stepping through a debugger or parsing IDA/Ghidra output, an LLM-powered agent can call REA through its MCP server to inspect a target application, trace relevant code paths, and return findings with verifiable evidence.
The core workflow follows three steps:
- Inspect – The agent invokes REA’s CLI or MCP endpoint against a binary or running process.
- Trace – REA captures execution traces, symbol resolution, and memory mappings.
- Reconstruct – The agent consumes the structured output to build a high-level understanding of the app’s logic, data flows, or obfuscation patterns.
Unlike traditional reverse-engineering tools that require deep expertise in a specific disassembler, REA is model-agnostic: you provide the target, and the agent does the legwork of scanning, labeling, and reporting.
How it works (the agentic pipeline)
REA exposes its capabilities through the Model Context Protocol (MCP). An agent sends a prompt such as:
Inspect /path/to/binary and trace the initialization routine.
REA responds with a structured payload that includes:
- Binary metadata (entry point, architecture, imported libraries)
- Execution trace (basic-block sequences, syscall activity)
- Evidence annotations (source-line references, register values, control-flow graphs)
The agent then uses this evidence to answer the original question—e.g., "What function calls WriteFile before the network socket opens?"—without ever opening a disassembler manually.
MCP Prompts (reference)
For a full catalog of guided prompts, see the repo's MCP prompts docs. These cover everything from basic symbol extraction to advanced control-flow deobfuscation.
Concrete usage examples
| Use case | What you get | Typical agent question |
|----------|--------------|------------------------|
| Binary inspection | Imported DLLs, export table, section headers | "Which modules does this.exe load at startup?" |
| Runtime behavior tracing | Syscall sequences, file reads/writes, network connections | "What files does the installer write to %APPDATA% before launching the service?" |
| Obfuscation deobfuscation | Control-flow graph reconstruction, resolved string literals | "Can you recover the original string table from this packed binary?" |
| Agent-in-the-loop debugging | Incremental trace updates as the agent narrows the scope | "Tell me the exact API call that triggers the anti-debug check." |
These examples are drawn from the repo's skill definition and the showcases on the docs site.
Why it matters
Manual reverse engineering is time-intensive, error-prone, and requires specialized expertise. REA shifts the burden to the agent, allowing security researchers, QA teams, and product security groups to:
- Speed up incident response by quickly identifying the binary's behavior on a suspect sample.
- Automate code audits across large codebases or third-party components.
- Reduce the learning curve for new hires who need to understand a legacy system's logic.
The framework's openness (MIT license, publicly available MCP prompts) also means the community can extend prompts for domain-specific tasks—malware analysis, firmware auditing, or game modding—without waiting for a vendor to ship a new feature.
Getting started
- Install –
source .claude/setup.sh && npm install(per the repo's setup guide) or use the install script. - Launch the MCP server – Point your agent at the REA endpoint; the repo docs include a quick-start for Claude Code and other LLM runners.
- Run a prompt – Example:
Inspect ./sample.bin and extract all imported function names. - Iterate – Narrow the scope with follow-up prompts until you have the level of detail you need.
Key source links
- Repository: https://github.com/morluto/rea
- Documentation site: https://morluto.github.io/rea
- MCP prompts: https://github.com/morluto/rea/blob/main/docs/mcp-prompts.md
- Skill definition: https://github.com/morluto/rea/blob/main/skills/reverse-engineer-anything/SKILL.md
- Releases / breaking notes: https://github.com/morluto/rea/releases (e.g., PR #1064 adds frozen checkpoint version guards)
- Profile / readme: https://github.com/morluto/morluto
Interested in integrating REA into your own security or QA pipeline? Reach out to TCubed for a consultation on agentic reverse-engineering workflows.