# REA (slim)

> REA (Reverse Engineer Anything) is an open-source MCP server and CLI that gives coding agents local reverse-engineering tools for native binaries through Hopper, Ghidra or IDA, plus JavaScript and Electron apps, .NET, Android, websites, network captures and process behaviour.

- Full: https://www.anchorterminal.com/tools/rea.md (~5,700 tokens) · this version ~1,530 tokens · JSON https://www.anchorterminal.com/tools/rea.json · canonical https://www.anchorterminal.com/tools/rea
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**B · 69.7/100 · rank #176 of 965 · #3 in Code & developer platforms · not agent-ready · confidence medium**


Assessment: REA covers native, JavaScript, .NET, Android and web targets from one local MCP server, with typed schemas, effect-derived annotations and typed errors on every tool. Its 172 tools are all advertised at once, breaking changes arrive in minor releases about daily, and tools that run targets or change Android devices have no built-in approval step.

## Facts

- Kind: MCP server · vendor: morluto · category: Code & developer platforms · legal entity: not named · provenance 27/100
- Local only (stdio): npm `rea-agents`
- Auth: None · pricing: Free · x402: no · licence: MIT (Copyright 2026 morluto). Hopper and IDA are separate commercial products under their vendors' licences; Ghidra is installed by the user.
- Probe metrics: not measured yet (probes haven't run)
- Surface graded: The rea-agents 6.4.0 stdio MCP server and CLI, read from the repository at commit 880a603 (11 October 2026), npm, the MCP registry and rea.tools on 12 October 2026. The server was not run.
- Targets: Native binaries (pseudocode, assembly, strings, symbols, references), offline ELF layout, WASM, EVM bytecode, recorded Linux crashes, JavaScript and Electron apps, websites, HAR and mitmproxy captures, .NET assemblies, Android APKs and devices, JEB projects, firmware, Apple bundles and process behaviour.
- Native providers: Hopper, Ghidra or IDA, chosen per session. Ghidra runs headless in an isolated temporary project. Windows Ghidra support is experimental and read-only.
- Runtimes: Node.js 22.19 or later on 22.x, 24.11 or later on 24.x, or 26 and later. Other tools such as JADX, adb, Apktool, Binwalk, pwntools or a Chrome-family browser are needed per target.
- Results: Evidence records with `normalized_result`, `evidence_id`, limitations and unknowns, retained in a session bundle that can be exported. Results are capped at 10 MiB by default (`REA_MCP_MAX_RESPONSE_BYTES`).
- Errors: A JSON Schema at docs/error-contract.schema.json with codes such as invalid_request, access_denied, artifact_changed, capability_unavailable and resource_constraint, each with retryable and remediation fields.
- Release policy: Release Please with always-bump-minor. Breaking changes are listed under each release in CHANGELOG.md. Security fixes go to the latest version only.
- Clients set up: Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, Qwen Code, VS Code and Grok Build, per docs/installation.md.

- Scores: Reliability 77, Performance pending, Schema & documentation 86, Agent ergonomics 73, Security & auth 49, Payments & pricing 60, Task success pending, Maintenance & community 88, Transparency & trust 53 · total over the 7 assessed categories
- Why: Reliability, Scored as a local stdio package. · Schema & documentation, Every tool advertises typed JSON input and output schemas with no recursive references, per docs/mcp-contracts.md (25). · Agent ergonomics, 172 tools in the effect audit, and tools/list returns all of them even when a provider is missing (5). · Security & auth, Local software with no credentials to leak. · Payments & pricing, Free, self-hosted, MIT, nothing to buy from the project, so 20 + 20 + 20. No payment protocol (0). · Maintenance & community, 6.4.0 on 11 October 2026, one day before this check (30). · Transparency & trust, MIT (30).
- Sources: 15, open questions: 6, both in the full twin
- Capabilities: browser.debug, browser.control
- JSON: https://www.anchorterminal.com/api/v1/tools/rea.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/rea.svg` or a link to https://www.anchorterminal.com/tools/rea from a page on rea.tools or one of its subdomains, or the README of github.com/morluto/rea, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Pin an exact version such as rea-agents@6.4.0 in the MCP config, because minor releases change result shapes
2. Read `structuredContent.normalized_result` and `evidence_id` from results, and check `isError` before reading success fields
3. When a result returns `resource_constraint`, call the `inspect_analysis_view` request in `details.reported_limits.continuation` and follow `next_offset`
4. Call `binary_session` to see which tools and providers are available before opening a native target
5. Set `REA_MCP_INPUT_SCHEMA_PROFILE=compact` for clients that reject large tool schemas, such as Kimi

## Connect

```bash
npx rea-agents setup
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/rea

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Chrome DevTools MCP | BB | 77 | browser.control, browser.debug | https://www.anchorterminal.com/tools/chrome-devtools-mcp.min.md |
| Browserless | BB | 70.4 | browser.control, browser.debug | https://www.anchorterminal.com/tools/browserless.min.md |
| Steel | BB | 70.4 | browser.control, browser.debug | https://www.anchorterminal.com/tools/steel.min.md |
| Anchor Browser | B | 67.3 | browser.control, browser.debug | https://www.anchorterminal.com/tools/anchor-browser.min.md |
| agent-browser | B | 66.6 | browser.control, browser.debug | https://www.anchorterminal.com/tools/agent-browser.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)