REA tops GitHub: coding agents can now read every app you ship

Why it matters

【Key points】

The open-source project REA (Reverse Engineer Anything) is a local MCP server and CLI that connects Ghidra, IDA, Hopper, JADX and similar tools to coding agents such as Claude Code, Codex, Cursor and Gemini CLI, so an agent can inspect binaries, Electron apps, APKs, .NET programs, websites and firmware without source code, then build a similar feature. Matthew Berman's Oct 9 post "Reverse Engineer Anything. Software is done." has about 1.73M views and 32K likes; about 660 related posts appeared on X in 48 hours, at 10 to 38 per hour.

【Verifiable】

The MIT-licensed repo morluto/rea, created in April, had about 61K stars and 12K forks on Oct 10. Daily npm downloads of rea-agents rose from 418 on Oct 3 to 9,000 on Oct 8. The README says analysis runs locally with evidence and limits for each finding; showcases include rebuilding DX-Ball's sound-pan logic (passing 3,205 x86 tests) and tracing Notion desktop's clipboard bridge. On authorization it has one line: users must get permission and follow the law.

【Our read】

REA adds no new reverse-engineering technique; what changed is the barrier. Days of assembly work now start with one request to an agent. First, assume shipped client code will be read: logic, hidden endpoints and embedded keys in apps should be designed for that, since obfuscation only slows agents down. Second, products that win on interface details will be copied faster, so moats shift to servers, data and networks. Third, defenders gain cheaper audits too, but with responsibility left to a disclaimer, the legal limits will be tested in app-store rules and courts. After this week's ARTEX case, where one person breached Korean banks with open-source agent tooling, REA shows expert skills being packaged as agent tools faster than either side has priced in.