Cypherpunks write code, and now agents read it

What REA is

REA is an open-source MCP server and command line tool, MIT licensed, that gives a coding agent the tools to reverse engineer software ^[1]. Native binaries through Hopper, Ghidra or IDA, JavaScript and Electron apps, Android, websites, network captures and what a process does while it runs. "REA gives your agent the tools to inspect a program and explain what it does", and the analysis runs on your own machine ^[2].

You install it with one command, npx rea-agents setup, pick the agents you use (Claude Code, Codex, Cursor, Gemini CLI and most others that take a local MCP server), and then you just ask. The examples on its site are a game rebuilt from its executable and "Clone this website for me" ^[2]. The agent reads the thing, explains how it works with the evidence, and writes its own version.

The numbers

The first version went up on npm on 12 July, and the latest, 6.4.0, on 11 October ^[3]. In the week to 10 October it was downloaded 73,651 times, out of 79,095 all year ^[4]. That's not a curve, it's a wall. The repository is past 100,000 stars ^[1], which is more than most of the tools we list will get in their lifetime.

Why I think it's what the cypherpunks wanted

Eric Hughes wrote "Cypherpunks write code" in 1993, and in the same paragraph, "We know that software can't be destroyed and that a widely dispersed system can't be shut down" ^[5]. Bitcoin came out of that world, which is how I ended up spending twelve years in it.

The idea was that you don't ask permission, you build the thing, and once it's out it stays out. What closed software always had going for it was that you couldn't see inside it. You rented the behaviour and got a licence that said don't look. REA makes looking cheap. An agent can open any program on your machine, tell you how it works and build you your own, and a hundred thousand people have starred the tool that does it, which tells me a lot of people wanted exactly that.

The explosion of software is just starting

If an agent can rebuild an app's feature in an afternoon, software stops being scarce. There'll be far more of it, a lot of it written by agents for one person or one team, and the value moves to what can't be copied, the data, the trust and getting found. That's the same thing I wrote about decision models and about APIs being the whole story.

We see a small version of it in our own directory. We listed 295 tools in September and 680 more since 1 October ^[6], and the list of things we haven't got to yet only grows.

The catch

Taking software apart is legal in a lot of places for things like interoperability and security research, and not everywhere, and licences and terms add their own rules. It's on you to have the right to look inside what you're looking inside.

And an MCP server that can read any binary on your machine is a lot of reach to hand an agent. Run it where you'd run a debugger, not next to your production keys, and if you're adding any MCP server you don't know yet, check it first. We've listed REA and graded it like everything else, B at 69.7, with security its weakest score because nothing asks you before it acts.

References

Read on 12 October 2026.

1. [1]REA on GitHub, morluto/rea. Source for what REA is, its licence, what it can analyse and the star count. github.com
2. [2]REA, rea.tools. Source for the quote, local analysis and the examples on the site. rea.tools
3. [3]npm registry, rea-agents. Source for the first release on 12 July 2026 and version 6.4.0 on 11 October. npmjs.com
4. [4]npm download counts for rea-agents, 2026. Source for the weekly and yearly downloads. api.npmjs.org
5. [5]Eric Hughes, A Cypherpunk's Manifesto, 9 March 1993, as kept on LocalGhost. Source for both quotes. localghost.ai
6. [6]Anchor Terminal, the directory, 12 October 2026, and our listing of REA. Source for the tools listed in September and since 1 October, by the day each joined. anchorterminal.com