By Thorsten Meyer | October 19, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
REA gives Claude Code and Codex a toolbox for looking inside existing programs. Five investigations show where to point it first, what to ask, and how to tell when the answer is wrong.
A developer wanted to know how QuickBooks Desktop really calculates its books. Not what the screens look like, but which records it keeps, how inventory arithmetic works, and which branch a cash-basis report takes. They pointed an AI coding agent at the program, with an open-source tool called Reverse Engineer Anything (REA), and then wrote their own local accounting app. Its profit-and-loss statement, balance sheet and trial balance for Intuit’s official sample company matched the original account by account, to the cent.
That project, Ledger Reborn, is the best illustration I’ve seen of what REA is good for. It is not about copying software. It is about turning a feature you have used for years into decisions you can write down: what gets stored, how a number is calculated, what has to happen when something changes.
If you have ever asked an AI to build an app and watched it fall apart the moment you used it for real, this is the missing step. A convincing screen tells you very little about what should happen behind it. REA helps your agent find out.
What REA is, and what it isn’t
REA is an MIT-licensed open-source project on GitHub (morluto/rea). On October 19 it had about 325,000 stars and 82,000 forks, after a run on GitHub’s trending page in early October. The current version is 6.7.0, released October 18. The maintainer is anonymous.
Technically it is three things:
- A local MCP server that coding agents such as Claude Code, Codex, Cursor or Gemini CLI can call. MCP is the standard way agents connect to tools.
- A command-line tool,
rea, for setup, diagnostics and direct analysis. - An agent skill that teaches the agent how to run an investigation step by step.
Behind that sits a long list of analysis engines. REA can work with:
- native programs, through Ghidra, Hopper or IDA;
- Electron and JavaScript apps;
- .NET and Android apps;
- firmware images and saved network traffic;
- WebAssembly, SQLite databases;
- even 16-bit DOS code.
For websites, it can attach to a Chrome-family browser you control and observe what happens.
Two things matter before you start:
- It runs locally. REA analyses targets on your machine. Your agent receives the results, though, and so does the model provider behind it, under its own data policy.
- It is not a sandbox. In the project’s own words: “This is not a sandbox.” Opening an untrusted program hands it to analysis tools running with your user permissions. Treat unknown binaries the way you would any other untrusted file.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
software reverse engineering tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Investigation 1: Ask a question you can finish
The most common mistake is asking an agent to “figure out how this program works.” That has no end. A good investigation names one behaviour and the decision it informs, so the agent knows where to start and you know when to stop.
Compare these two:
- Weak: “Reverse engineer my accounting software.”
- Strong: “When I record a partial payment on an invoice, how does the program decide the remaining balance and which account it posts to? I need this to design the payment model of my own app.”
Starting prompt: “Using REA, investigate one behaviour of [program]: [behaviour]. I need the answer to decide [decision]. Report the data that is stored, the calculation, and the conditions that change the result. Mark every statement as observed, inferred or unknown, and stop when you can explain one complete example.”
How you know it’s wrong: the agent cannot walk through one concrete example with real inputs and outputs. If it only describes the screen, it hasn’t found the mechanism yet.
As an affiliate, we earn on qualifying purchases.
Investigation 2: Get REA connected and confirmed
Setup is a single command. REA ships a guided installer that detects your agent and asks before it changes anything:
- Guided setup (Claude Code, Codex and about 20 other agents):
npx rea-agents@latest setup - Or ask your agent directly, as the project suggests: “Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.”
- Claude Code, one project only:
claude mcp add --scope local rea -- npx -y rea-agents@6.7.0 mcp
You need Node.js 22.19 or newer. Native analysis also needs a disassembler such as Ghidra, which requires Java, or a licensed copy of Hopper or IDA. Restart your agent after setup.
Then prove that the tools actually loaded. This is the step people skip:
npx rea-agents doctor --client claude_code --skill --json(or--client codex) checks files and prerequisites. The docs are explicit that doctor checks files and prerequisites, “not the live agent connection.”- So confirm inside the agent as well. Ask it to call REA’s
binary_sessiontool with no arguments. It works before any target is opened and reports which analysis tools are available. - As a first real inspection, point it at something harmless you own, such as a small Electron or JavaScript app:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
How you know it’s wrong: your agent answers questions about a program without ever calling an REA tool. That means the connection isn’t live, and you’re reading the model’s guesses.
As an affiliate, we earn on qualifying purchases.
Investigation 3: Turn a business rule into a spec
This is where Ledger Reborn shines, and it is worth reading its published case study in full. The author investigated the official QuickBooks Desktop for Mac 2024 trial with REA 6.4.0 and Ghidra. The focus was narrow:
- inventory arithmetic;
- how account types change the sign of numbers in budgets;
- the paths behind reconciliation balances;
- the branches for cash-basis reports.
Two sentences from the case study describe the method better than any summary: “REA supplied evidence and imperfect pseudocode. We independently wrote the Python/SQLite engine and frontend.” The agent’s job was to explain the rules. A human decided what to build.
Verification is the part to copy:
- Against the original: reports exported from Intuit’s sample company were compared with an independent reconstruction. Net profit was $113,560.69, total assets $630,033.93, and trial-balance debits and credits $1,081,718.48 each, all matched to the cent.
- In public: synthetic test data with expected amounts in cents, frozen independently of the engine, plus an HTTP smoke test.
The author is also clear about the limits. The result covers report reconstruction, not every feature, and full pixel-and-interaction equivalence “has not passed.” No binary was patched, and no licensing or security controls were bypassed.
Starting prompt: “Using REA, find how [program] calculates [one number, e.g. the inventory value after a return]. Write the rule as a short spec: inputs, stored fields, formula, edge cases. Then give me three test cases with expected results that I can check against the original program’s own output.”
How you know it’s wrong: your implementation and the original disagree on the test cases, even by a cent. A spec that hasn’t been checked against real output is still a hypothesis.
As an affiliate, we earn on qualifying purchases.
Investigation 4: See what has to survive a copy
REA’s own showcase includes a neat example of a feature that looks trivial and isn’t: copy and paste in the Notion desktop app. When you copy blocks and paste them back, Notion keeps headings, to-dos and nesting, yet other apps receive plain text and HTML.
The investigation, run on Notion Desktop 7.6.1, shows how:
- Two formats at once: Notion writes ordinary text and HTML to the clipboard, so any app can paste something sensible.
- A hidden marker: the HTML carries a hidden comment,
notionvc, with a copy ID. - The real data stays local: Notion stores the full block structure on your machine under that ID, with its own data type,
text/_notion-blocks-v3-production. - On paste: Notion looks up the ID. If it matches, the full blocks come back. A stale entry falls back to text and HTML.
That is a design lesson, not a secret to copy. If you are building an editor, it tells you exactly what has to survive a copy: plain text for everyone else, rich structure for yourself, and a way to tell whether the two still belong together.
Starting prompt: “Using REA on [an app whose copy/paste you admire], find out what it writes to the clipboard and what it stores elsewhere when I copy [a specific element]. Then propose a copy/paste design for my editor that keeps [structure] when pasting into itself and degrades cleanly into other apps.”
How you know it’s wrong: paste your copied content into a plain text editor, an email client and your own app. If the explanation doesn’t predict what appears in each one, the agent has missed a format.
Infographic 02 · Two investigations, two lessons
A screen is not a spec. Two investigations show what sits behind one.
Ledger Reborn rebuilt accounting rules from QuickBooks and checked them to the cent. Notion's copy and paste shows what has to survive when content leaves an app.
Ledger Reborn: QuickBooks rules, checked to the cent
QuickBooks Desktop for Mac 2024 trial, investigated with REA 6.4.0 and Ghidra.
| Intuit sample company report | Matched |
|---|---|
| Net profit, 2023 P&L | $113,560.69 |
| Total assets, 31 Dec 2023 | $630,033.93 |
| Trial balance, debits = credits | $1,081,718.48 |
account by account, to the cent
- REA supplied evidence and imperfect pseudocode.
- The author wrote a new Python/SQLite engine independently.
- Expected amounts were frozen independently of the engine and tested.
Scope: report reconstruction. Full pixel and interaction equivalence has not passed. No binary patched, no licensing or security controls bypassed.
Notion: how copied blocks keep their structure
Notion Desktop 7.6.1, from REA’s published showcase.
- You copy blocks. Notion writes plain text and HTML to the clipboard, so every app can paste something.
- The HTML carries a hidden marker:
<!-- notionvc: copy-id --> - The full block structure stays on your machine under that ID, as
text/_notion-blocks-v3-production. - On paste, matching IDs restore the blocks. A stale entry falls back to text and HTML.
Design lesson for your own editor: plain text for everyone, rich structure for yourself, and a check that the two still belong together.
Sources: Ledger Reborn case study (12 Oct 2026); REA showcase: Notion. Not affiliated with Intuit or Notion.
Powered by Thorsten Meyer AI
Investigation 5: Point REA at your own app, your equipment, or an old program
The richest stories so far come from the community. They are self-reported, so treat them as inspiration rather than proof.
- Your own app. One developer pointed REA at their own production portal, built on Next.js and Stripe, as an outside-in check. It turned up one real issue: the login page was also served over plain HTTP. This is the safest place to start, because it is your software. It is also the most useful one if your app was built quickly with an AI. Ask REA what your app actually does and compare it with what you think it does.
- Your equipment. Someone made a cheap Bluetooth thermal printer work as a normal Windows printer by working out its handshake from the vendor’s app. Configuration tools for devices you own are a common use case, and the reason interoperability law exists.
- An old program. Abandoned games from the 1990s and a reader for an old design-tool file format have been rebuilt this way. It is the natural route when software you rely on has no maintainer left and your data is stuck in its format.
Starting prompt: “Using REA, investigate [my app / the vendor tool for my device / the old program] to answer one question: [what does it send, store or calculate when I do X?]. Show the evidence for each claim. Before writing any code, tell me what you still don’t know.”
How you know it’s wrong: the new version only works for the example you watched. For your own app, write one test from the agent’s findings and run it. For a device, start with a read-only command and confirm the reply before you send anything that changes settings. For an old file format, open a file you didn’t use during the investigation.
Where it goes wrong
REA’s maintainers are refreshingly direct about the limits. Decompilation and reconstruction “may be incomplete or incorrect,” and the community reports match:
- one JavaScript analysis ran for more than 20 minutes and used about 3.5 GB of memory on a small web bundle;
- compressed or packed programs limit what the tools can see;
- some app formats, such as Hermes bytecode in React Native apps, still need other tools.
Browser sessions need care. Use a separate browser profile, never expose the debugging port beyond your own machine, and remember that captured evidence can contain secrets. And the criticism from the Hacker News launch thread is fair: much of this could be done by telling an agent to install Ghidra. REA’s value is that it bundles the tools and teaches the agent a method. That is enough to make it more consistent. It doesn’t make it infallible.
The legal line
This is not legal advice, but the rough landscape is clearer than many people think:
- In the EU, the Software Directive lets a lawful user “observe, study or test” how a program works (Article 5(3)). It permits decompilation where that is needed for interoperability with an independently created program (Article 6). Contract clauses that override these rights are void (Article 8). The European Court of Justice has held that a program’s functionality and its file formats are not protected by copyright (SAS Institute v WPL, 2012). Code and assets are protected.
- In the US, copyright law allows circumventing protection measures for interoperability in narrow cases (17 USC §1201(f)). Courts have treated disassembly as fair use when it is the only way to reach the functional elements (Sega v. Accolade, 1992). Trade-secret law explicitly does not count reverse engineering as improper means. But licence agreements can still bind you: US courts have enforced anti-reverse-engineering clauses (Bowers v. Baystate, 2003).
- REA’s own rules exclude help with circumventing DRM or licence checks, and with copying proprietary code or assets.
The practical rule follows from all three: learn how it works, then build your own. Write your own code from a written spec, don’t copy theirs, and keep the investigation notes. Ledger Reborn did exactly that and documented it.
Verdict
REA turns an AI coding agent from a writer of plausible code into an investigator of real behaviour. That is a bigger shift than it sounds. The hardest part of building software was never typing the code. It was knowing precisely what the software has to do.
Start small and start with something you own: your own app, a device on your desk, a file format your data is stuck in. Ask one question you can finish, insist on evidence, and check every answer against real output. A screen is not a spec. With REA, your agent can find the spec behind it.
Sources
- REA: GitHub repository morluto/rea and rea.tools (version 6.7.0, star count read October 19, 2026)
- REA: Installation guide and Security policy
- REA showcase: Notion clipboard investigation
- Ledger Reborn: Repository and case study (October 12, 2026)
- REA community discussions: own production portal, Bluetooth thermal printer, awesome-reverse-engineer-anything list
- InfoQ: Reverse Engineer Anything (October 17, 2026)
- Hacker News: launch discussion (October 10, 2026)
- EU: Directive 2009/24/EC on the legal protection of computer programs; CJEU, SAS Institute v WPL, press release
- US: 17 USC §1201; US Copyright Office summary of Sega v. Accolade; EFF reverse engineering FAQ
- Nate B. Jones: REA: Reverse Engineer Anything (October 15, 2026)
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
