{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/chrome-devtools-mcp.json", "name": "Chrome DevTools MCP", "score": 77, "shared": [ "browser.control", "browser.debug" ], "slug": "chrome-devtools-mcp" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/browserless.json", "name": "Browserless", "score": 70.4, "shared": [ "browser.control", "browser.debug" ], "slug": "browserless" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/steel.json", "name": "Steel", "score": 70.4, "shared": [ "browser.control", "browser.debug" ], "slug": "steel" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/anchor-browser.json", "name": "Anchor Browser", "score": 67.3, "shared": [ "browser.control", "browser.debug" ], "slug": "anchor-browser" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/agent-browser.json", "name": "agent-browser", "score": 66.6, "shared": [ "browser.control", "browser.debug" ], "slug": "agent-browser" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/skyvern.json", "name": "Skyvern", "score": 63.1, "shared": [ "browser.control", "browser.debug" ], "slug": "skyvern" } ], "tool": { "slug": "rea", "name": "REA", "vendor": "morluto", "vendorUrl": "https://rea.tools", "kind": "mcp", "category": "code", "summary": "REA (Reverse Engineer Anything) is an open-source MCP server and CLI that gives coding agents local reverse-engineering tools for native binaries through Hopper, Ghidra or IDA, plus JavaScript and Electron apps, .NET, Android, websites, network captures and process behaviour.", "url": "https://www.anchorterminal.com/tools/rea", "markdownUrl": "https://www.anchorterminal.com/tools/rea.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/rea.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/rea.json", "repo": "https://github.com/morluto/rea", "license": "MIT (Copyright 2026 morluto). Hopper and IDA are separate commercial products under their vendors' licences; Ghidra is installed by the user.", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "rea-agents" } ], "auth": "none", "authNotes": "Local stdio process with no account or key. REA authenticates its own provider bridges with a random capability token over a current-user Unix socket. Tools act with the permissions of the user running the agent.", "pricing": "free", "pricingNotes": "Free and open source under MIT, with nothing to buy from the project. Deep native analysis needs Hopper, Ghidra or IDA. Ghidra is free; Hopper and IDA are sold by their own vendors, and Hopper can run in demo mode.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "A local stdio server with nothing to buy. No x402, MPP or L402 in the repository or on rea.tools, checked 12 October 2026.", "endpoints": [] }, "toolCount": 172, "popularity": { "githubStars": 98200, "npmWeekly": 73651, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://rea.tools/guides/", "registryName": "io.github.morluto/rea", "capabilities": [ "browser.debug", "browser.control" ], "tags": [ "local", "open-source", "official", "mcp", "cli", "typescript", "stdio", "no-auth", "agent-skills" ], "lastRelease": "2026-10-11", "graded": true, "anchor": { "graded": true, "score": 69.7, "grade": "B", "agentReady": false, "rank": 176, "ranked": true, "rankOf": 965, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 88, "payments": 60, "reliability": 77, "schema": 86, "security": 49, "transparency": 53 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 77, "points": 15.4, "reason": "Scored as a local stdio package. Official npm package rea-agents with Node.js 22.19+, 24.11+ or 26+ stated (20). The CI workflow runs on every push to main and every pull request, with sharded tests over 897 test files, a Windows native build and package checks. GitHub's Actions page served us an older copy, so we couldn't see whether main passes (20 of 25). The issue list we were served was also older than the repository header (55 open against 104), with three bug reports among 25 shown, all about Hopper. We couldn't read current issues, so 15 of 25. Breaking changes are listed under every release, but the always-bump-minor policy ships them in minor versions such as 6.2, 6.3 and 6.4 (7 of 15). Version 6.4.0 (15). Total 77." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 86, "points": 13.98, "reason": "Every tool advertises typed JSON input and output schemas with no recursive references, per docs/mcp-contracts.md (25). No llms.txt on rea.tools. Markdown guides in docs/ and an agent skill installed by setup (5). Descriptions are long and specific. `open_binary` explains formats, provider binding and snapshot rules, and some say when to use them, such as `procedure_assembly` (15 of 20). Inputs are typed, but Evidence passed between tools travels as unconstrained JSON objects (11 of 15). An error-contract JSON Schema with codes, retryable and remediation fields, a user-visible error table and contract examples (15). Release Please versions with a dated changelog and a migration guide (15). Total 86." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "172 tools in the effect audit, and tools/list returns all of them even when a provider is missing (5). A compact schema profile shrinks each input schema below 13,312 bytes for size-capped clients, but there are no toolsets, dynamic loading or read-only subset, so no add-back. Large results return `resource_constraint` with a ready-to-call `inspect_analysis_view` continuation and `next_offset` paging, and `get_evidence_bundle` takes `detail: summary` with filters (18 of 20). Typed errors with category, retryable and remediation (20). Every tool's readOnlyHint, destructiveHint and idempotentHint come from an audited effect record (20). One command sets up 14 clients and the CLI mirrors the tools, but it is TypeScript only and many tools need long structured inputs (10 of 15). Total 73." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 49, "points": 8.57, "reason": "Local software with no credentials to leak. Provider bridges use a random capability token over a current-user Unix socket, so the middle band (20). Annotations mark destructive tools, and Windows Ghidra is read-only, but docs/mcp-contracts.md says REA requires no permission grants or per-call approval. Process, Electron, browser and adb install or uninstall tools run once the client allows them (6). Strings, bundles and pages from the target reach the model. Only WebMCP declarations are labelled untrusted, and cookies and authorisation headers are dropped from captures. No prompt-injection guidance (4). Every call is retained as an Evidence record in an exportable session bundle (10). SECURITY.md with private reporting and a written security boundary, npm trusted publishing with SLSA provenance. No security.txt, bug bounty or published advisories (9). Total 49." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Free, self-hosted, MIT, nothing to buy from the project, so 20 + 20 + 20. No payment protocol (0). Hopper and IDA are paid products from other vendors and are optional, since Ghidra is free. Total 60." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 88, "points": 7.7, "reason": "6.4.0 on 11 October 2026, one day before this check (30). 23 npm versions since 14 July 2026, nine of them between 3 and 11 October (20). The 6.4.0 notes record 336 commits and 163 merged pull requests from outside contributors, and the 6.x changelog closes 27 issues. We couldn't read current reply times on issues (15 of 25). In the official MCP registry as io.github.morluto/rea, latest 6.4.0 (15). Exact-pinned dependencies, MCP SDK 2.3.1, CI on push, no Dependabot config (8 of 10). Total 88." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 53, "points": 4.64, "note": "editorial 78, provenance 27", "reason": "MIT (30). Local software. The README says targets are analysed locally and the model provider's own policy applies to tool results. SECURITY.md describes what the Ghidra session keeps and deletes, and browser captures drop cookies and authorisation headers. No privacy statement beyond that (20 of 30). Breaking changes are dated in the changelog with a 6.2 migration guide, but the policy says minor versions carry no compatibility promise and security fixes go to the latest only (8 of 20). No telemetry in the source, which names no outside host except github.com and Hopper's download origin. There's no written statement (20). Total 78." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "172 tools in the effect audit, and tools/list returns all of them even when a provider is missing (5). A compact schema profile shrinks each input schema below 13,312 bytes for size-capped clients, but there are no toolsets, dynamic loading or read-only subset, so no add-back. Large results return `resource_constraint` with a ready-to-call `inspect_analysis_view` continuation and `next_offset` paging, and `get_evidence_bundle` takes `detail: summary` with filters (18 of 20). Typed errors with category, retryable and remediation (20). Every tool's readOnlyHint, destructiveHint and idempotentHint come from an audited effect record (20). One command sets up 14 clients and the CLI mirrors the tools, but it is TypeScript only and many tools need long structured inputs (10 of 15). Total 73.", "maintenance": "6.4.0 on 11 October 2026, one day before this check (30). 23 npm versions since 14 July 2026, nine of them between 3 and 11 October (20). The 6.4.0 notes record 336 commits and 163 merged pull requests from outside contributors, and the 6.x changelog closes 27 issues. We couldn't read current reply times on issues (15 of 25). In the official MCP registry as io.github.morluto/rea, latest 6.4.0 (15). Exact-pinned dependencies, MCP SDK 2.3.1, CI on push, no Dependabot config (8 of 10). Total 88.", "payments": "Free, self-hosted, MIT, nothing to buy from the project, so 20 + 20 + 20. No payment protocol (0). Hopper and IDA are paid products from other vendors and are optional, since Ghidra is free. Total 60.", "reliability": "Scored as a local stdio package. Official npm package rea-agents with Node.js 22.19+, 24.11+ or 26+ stated (20). The CI workflow runs on every push to main and every pull request, with sharded tests over 897 test files, a Windows native build and package checks. GitHub's Actions page served us an older copy, so we couldn't see whether main passes (20 of 25). The issue list we were served was also older than the repository header (55 open against 104), with three bug reports among 25 shown, all about Hopper. We couldn't read current issues, so 15 of 25. Breaking changes are listed under every release, but the always-bump-minor policy ships them in minor versions such as 6.2, 6.3 and 6.4 (7 of 15). Version 6.4.0 (15). Total 77.", "schema": "Every tool advertises typed JSON input and output schemas with no recursive references, per docs/mcp-contracts.md (25). No llms.txt on rea.tools. Markdown guides in docs/ and an agent skill installed by setup (5). Descriptions are long and specific. `open_binary` explains formats, provider binding and snapshot rules, and some say when to use them, such as `procedure_assembly` (15 of 20). Inputs are typed, but Evidence passed between tools travels as unconstrained JSON objects (11 of 15). An error-contract JSON Schema with codes, retryable and remediation fields, a user-visible error table and contract examples (15). Release Please versions with a dated changelog and a migration guide (15). Total 86.", "security": "Local software with no credentials to leak. Provider bridges use a random capability token over a current-user Unix socket, so the middle band (20). Annotations mark destructive tools, and Windows Ghidra is read-only, but docs/mcp-contracts.md says REA requires no permission grants or per-call approval. Process, Electron, browser and adb install or uninstall tools run once the client allows them (6). Strings, bundles and pages from the target reach the model. Only WebMCP declarations are labelled untrusted, and cookies and authorisation headers are dropped from captures. No prompt-injection guidance (4). Every call is retained as an Evidence record in an exportable session bundle (10). SECURITY.md with private reporting and a written security boundary, npm trusted publishing with SLSA provenance. No security.txt, bug bounty or published advisories (9). Total 49.", "transparency": "MIT (30). Local software. The README says targets are analysed locally and the model provider's own policy applies to tool results. SECURITY.md describes what the Ghidra session keeps and deletes, and browser captures drop cookies and authorisation headers. No privacy statement beyond that (20 of 30). Breaking changes are dated in the changelog with a 6.2 migration guide, but the policy says minor versions carry no compatibility promise and security fixes go to the latest only (8 of 20). No telemetry in the source, which names no outside host except github.com and Hopper's download origin. There's no written statement (20). Total 78." }, "sources": [ { "what": "Repository header, stars, forks, open issues and pull requests", "url": "https://github.com/morluto/rea", "seen": "2026-10-12" }, { "what": "README, targets, setup, FAQ and disclaimer", "url": "https://github.com/morluto/rea/blob/main/README.md", "seen": "2026-10-12" }, { "what": "CHANGELOG, releases 0.2.0 to 6.4.0 and breaking changes", "url": "https://github.com/morluto/rea/blob/main/CHANGELOG.md", "seen": "2026-10-12" }, { "what": "MCP runtime contracts, results, response budget, request scope and annotations", "url": "https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md", "seen": "2026-10-12" }, { "what": "Tool effect audit and annotation derivation", "url": "https://github.com/morluto/rea/blob/main/src/contracts/toolEffects.ts", "seen": "2026-10-12" }, { "what": "Error contract JSON Schema", "url": "https://github.com/morluto/rea/blob/main/docs/error-contract.schema.json", "seen": "2026-10-12" }, { "what": "Security policy and security boundary", "url": "https://github.com/morluto/rea/blob/main/SECURITY.md", "seen": "2026-10-12" }, { "what": "Installation, supported clients and manual MCP config", "url": "https://github.com/morluto/rea/blob/main/docs/installation.md", "seen": "2026-10-12" }, { "what": "6.1 to 6.2 migration guide", "url": "https://github.com/morluto/rea/blob/main/docs/migration-6.2.md", "seen": "2026-10-12" }, { "what": "CI workflow", "url": "https://github.com/morluto/rea/blob/main/.github/workflows/ci.yml", "seen": "2026-10-12" }, { "what": "npm registry, version history, maintainer and provenance", "url": "https://registry.npmjs.org/rea-agents", "seen": "2026-10-12" }, { "what": "npm downloads, 4 to 10 October 2026", "url": "https://api.npmjs.org/downloads/point/2026-10-04:2026-10-10/rea-agents", "seen": "2026-10-12" }, { "what": "Official MCP registry entries", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.morluto/rea", "seen": "2026-10-12" }, { "what": "Published security advisories (none)", "url": "https://github.com/morluto/rea/security/advisories", "seen": "2026-10-12" }, { "what": "Project website, X and Discord links", "url": "https://rea.tools/", "seen": "2026-10-12" } ], "openQuestions": [ "unchecked: whether CI passes on main. GitHub's Actions page served a copy from around PR #1213, well before 6.4.0.", "unchecked: current open issues and reply times. The issues page we were served listed 55 open issues up to #497, while the repository header showed 104 and the changelog cites issues past #1400.", "The repository header showed 98.2k stars and 21.8k forks for a project first published on npm on 12 July 2026. The README celebrates 90,000. We recorded the header figure and did not assess how the stars accrued.", "No capability key in data/categories.json covers reverse engineering. The listing uses browser.debug and browser.control for its website tools, and its main job (binary and app analysis) has no key.", "No legal entity is named. The project is maintained by the GitHub account morluto.", "The server was not run, so the tool count (172) comes from the effect audit in source and the context cost of the tool list was not measured." ] }, "negative": 0, "verdict": "REA covers native, JavaScript, .NET, Android and web targets from one local MCP server, with typed schemas, effect-derived annotations and typed errors on every tool. Its 172 tools are all advertised at once, breaking changes arrive in minor releases about daily, and tools that run targets or change Android devices have no built-in approval step.", "bestFor": "Agents asked to work out how an existing app, binary or website behaves without its source, on a machine where the owner can install Ghidra, Hopper or IDA and accepts local execution.", "strengths": [ "MIT licence, one npm package, and setup that registers the server with 14 named agent clients", "Every one of 172 tools carries readOnlyHint, destructiveHint and idempotentHint derived from an audited effect record", "Errors follow a published JSON Schema with code, category, retryable and remediation fields", "Oversized results return a ready-to-call continuation for paged views instead of a truncated payload", "Listed in the official MCP registry under a GitHub-verified namespace, with releases published with npm provenance" ], "weaknesses": [ "172 tools are advertised at once, including those whose provider is not installed, with no toolsets or read-only subset", "Breaking changes ship in minor versions, and 6.0 to 6.4 were released between 8 and 11 October 2026", "No per-call approval. Process, browser, Electron and Android install or uninstall tools run as the user once the client allows them", "Text recovered from binaries, bundles and web pages reaches the model with no documented prompt-injection guidance", "Deep native analysis depends on Hopper, Ghidra or IDA being installed, and Windows Ghidra support is marked experimental" ], "agentNotes": [ "Pin an exact version such as rea-agents@6.4.0 in the MCP config, because minor releases change result shapes", "Read `structuredContent.normalized_result` and `evidence_id` from results, and check `isError` before reading success fields", "When a result returns `resource_constraint`, call the `inspect_analysis_view` request in `details.reported_limits.continuation` and follow `next_offset`", "Call `binary_session` to see which tools and providers are available before opening a native target", "Set `REA_MCP_INPUT_SCHEMA_PROFILE=compact` for clients that reject large tool schemas, such as Kimi" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 88, "payments": 60, "reliability": 77, "schema": 86, "security": 49, "transparency": 78 }, "provenanceScore": 27 }, "connect": { "install": "npx rea-agents setup", "config": { "mcpServers": { "rea": { "args": [ "-y", "rea-agents@6.4.0", "mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/browser.debug", "tool": "https://letme.dev/rea" }, "notable": [ "The repository page showed 98.2k stars, 21.8k forks, 104 open issues and 64 open pull requests on 12 October 2026. The README celebrates 90,000 stars (https://github.com/morluto/rea)", "npm counted 73,651 downloads of rea-agents from 4 to 10 October 2026 (https://api.npmjs.org/downloads/point/2026-10-04:2026-10-10/rea-agents)", "rea-agents was first published on 12 July 2026, and 6.4.0 on 11 October 2026 is its 31st npm version. 6.4.0 is published by GitHub Actions trusted publishing with SLSA provenance (https://registry.npmjs.org/rea-agents)", "The effect audit in src/contracts/toolEffects.ts covers 172 tools, and MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) are derived from it for every tool (https://github.com/morluto/rea/blob/main/src/contracts/toolEffects.ts)", "The project uses an always-bump-minor release policy, so 6.2, 6.3 and 6.4 each carry breaking changes listed in the changelog, with a migration guide for 6.1 to 6.2 (https://github.com/morluto/rea/blob/main/docs/migration-6.2.md)", "Listed in the official MCP registry as io.github.morluto/rea, with 6.4.0 marked latest on 11 October 2026 (https://registry.modelcontextprotocol.io/v0/servers?search=io.github.morluto/rea)", "SECURITY.md says the provider bridge is not a sandbox, and opening an untrusted binary hands parsing to the chosen provider with the user's permissions (https://github.com/morluto/rea/blob/main/SECURITY.md)", "rea.tools links the X account @reatools and a Discord server (https://rea.tools/)" ], "area": "developer", "details": [ { "label": "Surface graded", "value": "The rea-agents 6.4.0 stdio MCP server and CLI, read from the repository at commit 880a603 (11 October 2026), npm, the MCP registry and rea.tools on 12 October 2026. The server was not run." }, { "label": "Targets", "value": "Native binaries (pseudocode, assembly, strings, symbols, references), offline ELF layout, WASM, EVM bytecode, recorded Linux crashes, JavaScript and Electron apps, websites, HAR and mitmproxy captures, .NET assemblies, Android APKs and devices, JEB projects, firmware, Apple bundles and process behaviour." }, { "label": "Native providers", "value": "Hopper, Ghidra or IDA, chosen per session. Ghidra runs headless in an isolated temporary project. Windows Ghidra support is experimental and read-only." }, { "label": "Runtimes", "value": "Node.js 22.19 or later on 22.x, 24.11 or later on 24.x, or 26 and later. Other tools such as JADX, adb, Apktool, Binwalk, pwntools or a Chrome-family browser are needed per target." }, { "label": "Results", "value": "Evidence records with `normalized_result`, `evidence_id`, limitations and unknowns, retained in a session bundle that can be exported. Results are capped at 10 MiB by default (`REA_MCP_MAX_RESPONSE_BYTES`)." }, { "label": "Errors", "value": "A JSON Schema at docs/error-contract.schema.json with codes such as invalid_request, access_denied, artifact_changed, capability_unavailable and resource_constraint, each with retryable and remediation fields." }, { "label": "Release policy", "value": "Release Please with always-bump-minor. Breaking changes are listed under each release in CHANGELOG.md. Security fixes go to the latest version only." }, { "label": "Clients set up", "value": "Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, Qwen Code, VS Code and Grok Build, per docs/installation.md." } ], "provenance": { "legalEntity": "", "domain": "rea.tools", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/morluto/rea/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No company or legal entity is named on rea.tools or in the repository. The licence names morluto, the GitHub account that maintains the project.", "rea.tools has no terms or privacy page and returns 404 for /.well-known/security.txt and /llms.txt.", "SECURITY.md asks for private reports through GitHub's Report a vulnerability form. No published advisories on 12 October 2026.", "Domain registration date was not checked." ], "score": 27, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "rea.tools, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT (Copyright 2026 morluto). Hopper and IDA are separate commercial products under their vendors' licences; Ghidra is installed by the user. licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/rea.json", "live": { "slug": "rea", "versions": [ { "registry": "mcp-registry", "name": "io.github.morluto/rea", "version": "6.4.0", "seenAt": "2026-10-12T03:41:01.347399174Z" } ], "updatedAt": "2026-10-12T03:41:01.347399174Z" } }, "verify": { "accepts": "a page on rea.tools or one of its subdomains, or the README of github.com/morluto/rea", "badgeUrl": "https://www.anchorterminal.com/badges/rea.svg", "body": { "slug": "rea", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/rea", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/rea\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/rea.svg\" alt=\"REA on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![REA on Anchor Terminal](https://www.anchorterminal.com/badges/rea.svg)](https://www.anchorterminal.com/tools/rea)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/rea\"\u003eREA on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/rea", "json": "https://www.anchorterminal.com/tools/rea.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/rea.md", "slim": "https://www.anchorterminal.com/tools/rea.min.md" }, "markdown": "## Overview\n\n**Grade B · 69.7/100 · rank #176 of 965 · #3 in Code \u0026 developer platforms · not agent-ready · confidence medium**\n\n\n## Assessment\n\nREA covers native, JavaScript, .NET, Android and web targets from one local MCP server, with typed schemas, effect-derived annotations and typed errors on every tool. Its 172 tools are all advertised at once, breaking changes arrive in minor releases about daily, and tools that run targets or change Android devices have no built-in approval step.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | morluto (https://rea.tools) |\n| Kind | MCP server |\n| Category | Code \u0026 developer platforms (https://www.anchorterminal.com/categories/code) |\n| Transport | stdio |\n| Auth | None · Local stdio process with no account or key. REA authenticates its own provider bridges with a random capability token over a current-user Unix socket. Tools act with the permissions of the user running the agent. |\n| Pricing | Free (Free · OSS) · Free and open source under MIT, with nothing to buy from the project. Deep native analysis needs Hopper, Ghidra or IDA. Ghidra is free; Hopper and IDA are sold by their own vendors, and Hopper can run in demo mode. |\n| x402 | No · A local stdio server with nothing to buy. No x402, MPP or L402 in the repository or on rea.tools, checked 12 October 2026. |\n| Licence | MIT (Copyright 2026 morluto). Hopper and IDA are separate commercial products under their vendors' licences; Ghidra is installed by the user. |\n| Tools exposed | 172 |\n| Packages | npm: `rea-agents` |\n| MCP registry name | `io.github.morluto/rea` |\n| Source | https://github.com/morluto/rea |\n| Docs | https://rea.tools/guides/ |\n| llms.txt | not found |\n| Last release | 2026-10-11 |\n| GitHub stars | 98,200 (as of 2026-10-12) |\n| npm downloads / week | 73,651 |\n| Surface graded | The rea-agents 6.4.0 stdio MCP server and CLI, read from the repository at commit 880a603 (11 October 2026), npm, the MCP registry and rea.tools on 12 October 2026. The server was not run. |\n| Targets | Native binaries (pseudocode, assembly, strings, symbols, references), offline ELF layout, WASM, EVM bytecode, recorded Linux crashes, JavaScript and Electron apps, websites, HAR and mitmproxy captures, .NET assemblies, Android APKs and devices, JEB projects, firmware, Apple bundles and process behaviour. |\n| Native providers | Hopper, Ghidra or IDA, chosen per session. Ghidra runs headless in an isolated temporary project. Windows Ghidra support is experimental and read-only. |\n| Runtimes | Node.js 22.19 or later on 22.x, 24.11 or later on 24.x, or 26 and later. Other tools such as JADX, adb, Apktool, Binwalk, pwntools or a Chrome-family browser are needed per target. |\n| Results | Evidence records with `normalized_result`, `evidence_id`, limitations and unknowns, retained in a session bundle that can be exported. Results are capped at 10 MiB by default (`REA_MCP_MAX_RESPONSE_BYTES`). |\n| Errors | A JSON Schema at docs/error-contract.schema.json with codes such as invalid_request, access_denied, artifact_changed, capability_unavailable and resource_constraint, each with retryable and remediation fields. |\n| Release policy | Release Please with always-bump-minor. Breaking changes are listed under each release in CHANGELOG.md. Security fixes go to the latest version only. |\n| Clients set up | Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, Qwen Code, VS Code and Grok Build, per docs/installation.md. |\n| Capabilities | browser.debug, browser.control |\n| Tags | local, open-source, official, mcp, cli, typescript, stdio, no-auth, agent-skills |\n| JSON | https://www.anchorterminal.com/api/v1/tools/rea.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-12 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 77 | 15.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 86 | 14.0 |\n| Agent ergonomics | 13% | 16.2 | 73 | 11.9 |\n| Security \u0026 auth | 14% | 17.5 | 49 | 8.6 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 88 | 7.7 |\n| Transparency \u0026 trust (editorial 78, provenance 27) | 7% | 8.8 | 53 | 4.6 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **69.7 → B** |\n\n### Why each score\n\n- Reliability 77: Scored as a local stdio package. Official npm package rea-agents with Node.js 22.19+, 24.11+ or 26+ stated (20). The CI workflow runs on every push to main and every pull request, with sharded tests over 897 test files, a Windows native build and package checks. GitHub's Actions page served us an older copy, so we couldn't see whether main passes (20 of 25). The issue list we were served was also older than the repository header (55 open against 104), with three bug reports among 25 shown, all about Hopper. We couldn't read current issues, so 15 of 25. Breaking changes are listed under every release, but the always-bump-minor policy ships them in minor versions such as 6.2, 6.3 and 6.4 (7 of 15). Version 6.4.0 (15). Total 77.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 86: Every tool advertises typed JSON input and output schemas with no recursive references, per docs/mcp-contracts.md (25). No llms.txt on rea.tools. Markdown guides in docs/ and an agent skill installed by setup (5). Descriptions are long and specific. `open_binary` explains formats, provider binding and snapshot rules, and some say when to use them, such as `procedure_assembly` (15 of 20). Inputs are typed, but Evidence passed between tools travels as unconstrained JSON objects (11 of 15). An error-contract JSON Schema with codes, retryable and remediation fields, a user-visible error table and contract examples (15). Release Please versions with a dated changelog and a migration guide (15). Total 86.\n- Agent ergonomics 73: 172 tools in the effect audit, and tools/list returns all of them even when a provider is missing (5). A compact schema profile shrinks each input schema below 13,312 bytes for size-capped clients, but there are no toolsets, dynamic loading or read-only subset, so no add-back. Large results return `resource_constraint` with a ready-to-call `inspect_analysis_view` continuation and `next_offset` paging, and `get_evidence_bundle` takes `detail: summary` with filters (18 of 20). Typed errors with category, retryable and remediation (20). Every tool's readOnlyHint, destructiveHint and idempotentHint come from an audited effect record (20). One command sets up 14 clients and the CLI mirrors the tools, but it is TypeScript only and many tools need long structured inputs (10 of 15). Total 73.\n- Security \u0026 auth 49: Local software with no credentials to leak. Provider bridges use a random capability token over a current-user Unix socket, so the middle band (20). Annotations mark destructive tools, and Windows Ghidra is read-only, but docs/mcp-contracts.md says REA requires no permission grants or per-call approval. Process, Electron, browser and adb install or uninstall tools run once the client allows them (6). Strings, bundles and pages from the target reach the model. Only WebMCP declarations are labelled untrusted, and cookies and authorisation headers are dropped from captures. No prompt-injection guidance (4). Every call is retained as an Evidence record in an exportable session bundle (10). SECURITY.md with private reporting and a written security boundary, npm trusted publishing with SLSA provenance. No security.txt, bug bounty or published advisories (9). Total 49.\n- Payments \u0026 pricing 60: Free, self-hosted, MIT, nothing to buy from the project, so 20 + 20 + 20. No payment protocol (0). Hopper and IDA are paid products from other vendors and are optional, since Ghidra is free. Total 60.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 88: 6.4.0 on 11 October 2026, one day before this check (30). 23 npm versions since 14 July 2026, nine of them between 3 and 11 October (20). The 6.4.0 notes record 336 commits and 163 merged pull requests from outside contributors, and the 6.x changelog closes 27 issues. We couldn't read current reply times on issues (15 of 25). In the official MCP registry as io.github.morluto/rea, latest 6.4.0 (15). Exact-pinned dependencies, MCP SDK 2.3.1, CI on push, no Dependabot config (8 of 10). Total 88.\n- Transparency \u0026 trust 53: MIT (30). Local software. The README says targets are analysed locally and the model provider's own policy applies to tool results. SECURITY.md describes what the Ghidra session keeps and deletes, and browser captures drop cookies and authorisation headers. No privacy statement beyond that (20 of 30). Breaking changes are dated in the changelog with a 6.2 migration guide, but the policy says minor versions carry no compatibility promise and security fixes go to the latest only (8 of 20). No telemetry in the source, which names no outside host except github.com and Hopper's download origin. There's no written statement (20). Total 78.\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/rea.md (JSON https://www.anchorterminal.com/fixes/rea.json)\n\n### What we couldn't check\n\n- unchecked: whether CI passes on main. GitHub's Actions page served a copy from around PR #1213, well before 6.4.0.\n- unchecked: current open issues and reply times. The issues page we were served listed 55 open issues up to #497, while the repository header showed 104 and the changelog cites issues past #1400.\n- The repository header showed 98.2k stars and 21.8k forks for a project first published on npm on 12 July 2026. The README celebrates 90,000. We recorded the header figure and did not assess how the stars accrued.\n- No capability key in data/categories.json covers reverse engineering. The listing uses browser.debug and browser.control for its website tools, and its main job (binary and app analysis) has no key.\n- No legal entity is named. The project is maintained by the GitHub account morluto.\n- The server was not run, so the tool count (172) comes from the effect audit in source and the context cost of the tool list was not measured.\n\n### Sources\n\n- Repository header, stars, forks, open issues and pull requests: \u003chttps://github.com/morluto/rea\u003e (seen 2026-10-12)\n- README, targets, setup, FAQ and disclaimer: \u003chttps://github.com/morluto/rea/blob/main/README.md\u003e (seen 2026-10-12)\n- CHANGELOG, releases 0.2.0 to 6.4.0 and breaking changes: \u003chttps://github.com/morluto/rea/blob/main/CHANGELOG.md\u003e (seen 2026-10-12)\n- MCP runtime contracts, results, response budget, request scope and annotations: \u003chttps://github.com/morluto/rea/blob/main/docs/mcp-contracts.md\u003e (seen 2026-10-12)\n- Tool effect audit and annotation derivation: \u003chttps://github.com/morluto/rea/blob/main/src/contracts/toolEffects.ts\u003e (seen 2026-10-12)\n- Error contract JSON Schema: \u003chttps://github.com/morluto/rea/blob/main/docs/error-contract.schema.json\u003e (seen 2026-10-12)\n- Security policy and security boundary: \u003chttps://github.com/morluto/rea/blob/main/SECURITY.md\u003e (seen 2026-10-12)\n- Installation, supported clients and manual MCP config: \u003chttps://github.com/morluto/rea/blob/main/docs/installation.md\u003e (seen 2026-10-12)\n- 6.1 to 6.2 migration guide: \u003chttps://github.com/morluto/rea/blob/main/docs/migration-6.2.md\u003e (seen 2026-10-12)\n- CI workflow: \u003chttps://github.com/morluto/rea/blob/main/.github/workflows/ci.yml\u003e (seen 2026-10-12)\n- npm registry, version history, maintainer and provenance: \u003chttps://registry.npmjs.org/rea-agents\u003e (seen 2026-10-12)\n- npm downloads, 4 to 10 October 2026: \u003chttps://api.npmjs.org/downloads/point/2026-10-04:2026-10-10/rea-agents\u003e (seen 2026-10-12)\n- Official MCP registry entries: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=io.github.morluto/rea\u003e (seen 2026-10-12)\n- Published security advisories (none): \u003chttps://github.com/morluto/rea/security/advisories\u003e (seen 2026-10-12)\n- Project website, X and Discord links: \u003chttps://rea.tools/\u003e (seen 2026-10-12)\n\n## Who's behind it (provenance 27/100, checked 2026-10-12)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | not found | 0/20 |\n| Domain age | rea.tools, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | nothing hosted, so the MIT (Copyright 2026 morluto). Hopper and IDA are separate commercial products under their vendors' licences; Ghidra is installed by the user. licence stands in | 10/10 |\n| Privacy policy | nothing hosted, not scored | n/a |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nNo company or legal entity is named on rea.tools or in the repository. The licence names morluto, the GitHub account that maintains the project.\n\nrea.tools has no terms or privacy page and returns 404 for /.well-known/security.txt and /llms.txt.\n\nSECURITY.md asks for private reports through GitHub's Report a vulnerability form. No published advisories on 12 October 2026.\n\nDomain registration date was not checked.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The MIT (Copyright 2026 morluto). Hopper and IDA are separate commercial products under their vendors' licences; Ghidra is installed by the user. licence stands in and the check scores in full.\n\n\n**Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored.\n\n\n## Live (updated 2026-10-12 03:41 UTC)\n\n- mcp-registry `io.github.morluto/rea` 6.4.0\n- Always current: https://www.anchorterminal.com/api/v1/live/rea.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- MIT licence, one npm package, and setup that registers the server with 14 named agent clients\n- Every one of 172 tools carries readOnlyHint, destructiveHint and idempotentHint derived from an audited effect record\n- Errors follow a published JSON Schema with code, category, retryable and remediation fields\n- Oversized results return a ready-to-call continuation for paged views instead of a truncated payload\n- Listed in the official MCP registry under a GitHub-verified namespace, with releases published with npm provenance\n\n## Weaknesses\n\n- 172 tools are advertised at once, including those whose provider is not installed, with no toolsets or read-only subset\n- Breaking changes ship in minor versions, and 6.0 to 6.4 were released between 8 and 11 October 2026\n- No per-call approval. Process, browser, Electron and Android install or uninstall tools run as the user once the client allows them\n- Text recovered from binaries, bundles and web pages reaches the model with no documented prompt-injection guidance\n- Deep native analysis depends on Hopper, Ghidra or IDA being installed, and Windows Ghidra support is marked experimental\n\n## Before you call it (notes for agents)\n\n1. Pin an exact version such as rea-agents@6.4.0 in the MCP config, because minor releases change result shapes\n2. Read `structuredContent.normalized_result` and `evidence_id` from results, and check `isError` before reading success fields\n3. When a result returns `resource_constraint`, call the `inspect_analysis_view` request in `details.reported_limits.continuation` and follow `next_offset`\n4. Call `binary_session` to see which tools and providers are available before opening a native target\n5. Set `REA_MCP_INPUT_SCHEMA_PROFILE=compact` for clients that reject large tool schemas, such as Kimi\n\n## Connect\n\nInstall:\n\n```bash\nnpx rea-agents setup\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"rea\": {\n \"args\": [\n \"-y\",\n \"rea-agents@6.4.0\",\n \"mcp\"\n ],\n \"command\": \"npx\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/rea. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Chrome DevTools MCP | BB | 77 | 24 | browser.control, browser.debug | no | https://www.anchorterminal.com/tools/chrome-devtools-mcp.md |\n| Browserless | BB | 70.4 | 154 | browser.control, browser.debug | no | https://www.anchorterminal.com/tools/browserless.md |\n| Steel | BB | 70.4 | 156 | browser.control, browser.debug | yes | https://www.anchorterminal.com/tools/steel.md |\n| Anchor Browser | B | 67.3 | 259 | browser.control, browser.debug | no | https://www.anchorterminal.com/tools/anchor-browser.md |\n| agent-browser | B | 66.6 | 288 | browser.control, browser.debug | no | https://www.anchorterminal.com/tools/agent-browser.md |\n| Skyvern | B | 63.1 | 415 | browser.control, browser.debug | no | https://www.anchorterminal.com/tools/skyvern.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The repository page showed 98.2k stars, 21.8k forks, 104 open issues and 64 open pull requests on 12 October 2026. The README celebrates 90,000 stars (source: \u003chttps://github.com/morluto/rea\u003e)\n- npm counted 73,651 downloads of rea-agents from 4 to 10 October 2026 (source: \u003chttps://api.npmjs.org/downloads/point/2026-10-04:2026-10-10/rea-agents\u003e)\n- rea-agents was first published on 12 July 2026, and 6.4.0 on 11 October 2026 is its 31st npm version. 6.4.0 is published by GitHub Actions trusted publishing with SLSA provenance (source: \u003chttps://registry.npmjs.org/rea-agents\u003e)\n- The effect audit in src/contracts/toolEffects.ts covers 172 tools, and MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) are derived from it for every tool (source: \u003chttps://github.com/morluto/rea/blob/main/src/contracts/toolEffects.ts\u003e)\n- The project uses an always-bump-minor release policy, so 6.2, 6.3 and 6.4 each carry breaking changes listed in the changelog, with a migration guide for 6.1 to 6.2 (source: \u003chttps://github.com/morluto/rea/blob/main/docs/migration-6.2.md\u003e)\n- Listed in the official MCP registry as io.github.morluto/rea, with 6.4.0 marked latest on 11 October 2026 (source: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=io.github.morluto/rea\u003e)\n- SECURITY.md says the provider bridge is not a sandbox, and opening an untrusted binary hands parsing to the chosen provider with the user's permissions (source: \u003chttps://github.com/morluto/rea/blob/main/SECURITY.md\u003e)\n- rea.tools links the X account @reatools and a Discord server (source: \u003chttps://rea.tools/\u003e)\n\n- #3 of 9 in Best code, repository and documentation tools for AI agents: https://www.anchorterminal.com/best/code/index.md\n- All 8 code comparisons: https://www.anchorterminal.com/compare/code/index.md\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on rea.tools or one of its subdomains, or the README of github.com/morluto/rea. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"rea\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/rea\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/rea.svg\" alt=\"REA on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![REA on Anchor Terminal](https://www.anchorterminal.com/badges/rea.svg)](https://www.anchorterminal.com/tools/rea)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/rea\"\u003eREA on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say REA is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/rea-dark.png\n- Light: https://www.anchorterminal.com/assets/share/rea-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Code \u0026 developer platforms", "url": "https://www.anchorterminal.com/categories/code" }, { "name": "REA", "url": "" } ], "description": "REA (Reverse Engineer Anything) is an open-source MCP server and CLI that gives coding agents local reverse-engineering tools for native binaries through Hopper, Ghidra or IDA, plus JavaScript and Electron apps, .NET, Android, websites, network captures and process behaviour.", "facts": [ "rank #176 of 965", "None auth", "0 desk reviews" ], "h1": "REA", "image": "https://www.anchorterminal.com/assets/og/tools-rea.png", "path": "/tools/rea", "published": "2026-10-01", "section": "tools", "title": "REA review (2026): pricing, alternatives and grade B | Anchor Terminal", "toc": null, "updated": "2026-10-12", "url": "https://www.anchorterminal.com/tools/rea" }, "tokens": { "markdown": 5700, "slim": 1530 }, "version": 1 }