REA (Reverse Engineer Anything) is an MCP server for reverse-engineering workflows. It connects an AI assistant to tools that inspect software artifacts and behavior, then returns structured results with evidence records and identifiers. That lets an assistant investigate how a binary, application, or website works, trace findings to supporting evidence, and report where an analysis has limits. REA can also capture behavior during a run, so an investigation can compare observed output and filesystem effects with the target’s static structure.
The analysis runs locally. Which targets can be examined, and what supporting software is needed, depends on the workflow. REA’s tools can be accessed through MCP or its command-line interface.
What can REA (Reverse Engineer Anything) do?
For native binaries, REA can inspect pseudocode, assembly, strings, symbols, calls, and references through supported external analysis providers. For JavaScript and Electron applications, it can examine modules, imports, source maps, routes, IPC, and relationships with native add-ons. These findings help an assistant trace a feature through the structure of an application rather than relying only on a description of its behavior.
Other workflows inspect website structure, scripts, network observations, and requested screenshots using a Chrome-family browser. Static inspection also covers formats including IL2CPP metadata, Godot PCK archives, PE imports and certificates, ELF notes, Android APKs, SQLite, and firmware. Runtime capture can record terminal output, interactions, exit status, filesystem observations, and comparisons between runs. Requirements vary by format and workflow; returned records can include limitations.
How REA (Reverse Engineer Anything) connects and authenticates
REA supports MCP over standard input/output, and its documentation describes an opt-in HTTP listener. Analysis runs locally. The verified facts do not specify an authentication method, so this description does not claim that the server uses an API key, OAuth, or no authentication. The verified facts also do not establish a complete current list of compatible MCP clients. They describe use with coding agents, but client-specific support should be checked in current setup documentation.
Who is REA (Reverse Engineer Anything) best for?
REA suits people investigating how software works from its binary, application files, website structure, or observed runtime behavior. It may be useful when examining native programs, JavaScript or Electron applications, and supported static formats, or when comparing captured process runs. The repository is MIT-licensed, and the verified REA plan is free. Some native analysis workflows may require a separately installed provider; external provider licensing or access requirements can differ and were not established here.
What REA (Reverse Engineer Anything) can access and change
REA’s access depends on the tools and credentials available to the local process and the chosen workflow. It can inspect supplied files and, for runtime capture, run or interact with a target using the caller’s permissions. That means runtime activity may affect the local environment; the verified facts do not enumerate a general set of reversible or irreversible actions. Native analysis can require a separate provider, while Android and website workflows can need additional tools. Format support and coverage vary, and results may state limitations rather than provide complete coverage.
Alternatives to REA (Reverse Engineer Anything)
For investigations centered on a browser and its page activity, Playwright MCP is a related option. For examining code hosted in repositories, GitHub MCP offers a different source-focused route. For database inspection, SQLite MCP is a narrower alternative. These listings address adjacent tasks; their specific capabilities are not established by the REA facts summarized here.
