REA Hits 420k Stars: Local MCP for Agents to Disassemble Binaries with Evidence

Description and use

REA lets agents invoke local reverse‑engineering tools with structured evidence, improving traceability and reducing manual hex copy‑paste.

Problem

Agents need to invoke local reverse‑engineering tools and receive structured evidence instead of unstructured text.

Outcome

REA enables agents to call local reverse‑engineering tools with a structured evidence contract, improving traceability and reducing manual copy‑paste of hex.

Workflow

• 1. Point GHIDRA_INSTALL_DIR to a local Ghidra install.
• 2. Run npx rea-agents setup to register MCP server and install skill files.
• 3. Agent invokes REA tool (e.g., rea analyze-pe --json target.exe).
• 4. REA returns pseudocode, assembly, symbols, strings, callers, callees, cross‑references with evidence and limitations.
• 5. Agent or user consumes structured evidence for further analysis or model input.

Evidence

The project, created 14 April 2026 and written in TypeScript under MIT, is an MCP server plus CLI that lets coding agents (Claude Code, Codex, Cursor, Gemini CLI and others) drive local reverse-engineering tools instead of guessing from screenshots or shell noise.

Source

That last part is the actual engineering contribution. Most agent tool calls dump unstructured text. REA’s contract forces evidence_id, the raw supporting artifact, and a limitations field.

Source

Setup is one command that registers the MCP server and installs matching skill/workflow files for the agent, backing up existing config first.

Source