REA — an MIT-licensed add-on that lets a coding agent take apart apps, binaries and websites and explain how a feature works, with the evidence attached.
Alternative to: Binary Ninja Sidekick, the AI reverse-engineering assistant from the makers of Binary Ninja. Sidekick Basic is $30/month billed monthly or $24/month billed annually. It runs inside Binary Ninja, and commercial use follows the Binary Ninja licence (Commercial: $1,799 one-time, with one year of updates).
Cost to run: REA itself is $0. Deep native analysis needs a decompiler underneath it: Ghidra (free), Hopper (price UNVERIFIED) or IDA Pro (from €1,099/year). You also pay for your own coding agent. The project publishes no inference estimate.
Licence: MIT. Free for commercial use. Commercial engines it drives (IDA, Hopper, JEB) keep their own licences.
Runs on: Windows, macOS and Linux, with limits by target (Windows Ghidra support is experimental). Works through Claude Code, Codex, Cursor, Gemini CLI and other agents that support local MCP servers.
Requires: Node.js 22.19+, 24.11+ or 26+, plus npm. Hopper, Ghidra or IDA for native binaries. A Chrome-family browser for websites. Analysis runs locally, but results go to your agent, and your model provider's data policy applies to them.
Traction: 274,839 stars · 69,220 forks · 3,397 commits · highest issue/PR number referenced in commits: #4274. Open and closed issue counts unknown.
Liveness: very live — 2,677 commits in the last 30 days, latest npm release 6.5.0 on October 14. Last commit October 15, 2026, 11:48 p.m. ET.
Maturity: version 6.5.0. The README warns: "REA changes quickly, and new releases include frequent bug fixes."
Links: repo · site · Hacker News thread, 806 points
Figures as of October 16, 2026.
What it does
REA stands for Reverse Engineer Anything. You install it into a coding agent with one command, npx rea-agents@latest setup. After that you can ask the agent how a feature in some app works, and the agent uses REA's tools to look inside the app and find out.
It works on compiled programs, JavaScript and Electron apps, .NET assemblies, Android APKs, firmware and websites. For a compiled program it hands the agent assembly, pseudocode, strings and call references. For a website it hands over page structure, scripts and network traffic. The agent then explains what it found, and can rebuild the feature in your own project.
The site's demo asks why Windows Calculator gives 220 for 200 + 10%. REA pulls the instructions behind the % button. The agent reads them and finds the rule: after a plus sign, % means a percentage of the first number.
The project started small. The first commit, in April 2026, is titled "Initial commit: betterBinaryMCP - Enhanced MCP server for Hopper Disassembler." A Show HN for it in July drew 3 points and no comments.
What it replaces, and what that costs
REA is not a decompiler. It drives one. That puts it opposite the AI layers the decompiler vendors now sell on top of their own tools.
The closest match is Binary Ninja Sidekick, which does agentic reverse engineering inside Binary Ninja. Its published plans:
Sidekick Free: $0 "with active support"
Sidekick Basic: $30/month monthly, or $24/month billed annually
Sidekick Preferred Pro: $100/month monthly, or $80/month billed annually
Sidekick Max: $300/month monthly, or $240/month billed annually
Sidekick Self-Hosted: $5,000 per floating user per year, minimum three licences
Sidekick's commercial use "is governed by the terms of the Binary Ninja license in use, rather than by the Sidekick plan itself." Binary Ninja Personal is $199 and does not allow commercial use. Binary Ninja Commercial is $1,799, a perpetual licence with one year of updates. So the first year of commercial use at Sidekick's lowest paid plan adds up like this:
Binary Ninja Commercial: $1,799 (one-time, one year of updates)
Sidekick Basic, billed annually: $24 × 12 = $288
First-year total: $2,087, before tax
Two engines REA does drive, IDA and Hopper, have moved the same way. Hex-Rays lists an IDA MCP add-on: "Drive IDA from an AI assistant over the Model Context Protocol." IDA Pro itself starts at €1,099/year (Essential), billed annually only. Hopper's home page says it is "now enhanced with AI capabilities through an integrated MCP server." Hopper's price did not render to a scrape, so no number is given here.
What REA costs instead: $0 for REA, $0 for Ghidra, and whatever your coding agent costs you. That last line never goes away, and the project does not estimate it. These two costs do not subtract. Each hosted Sidekick plan comes with a monthly usage allowance. REA leaves you to bring, and pay for, your own agent.
Is it still alive?
Very. 2,677 of its 3,397 commits landed in the last 30 days. The last one landed at 11:48 p.m. ET on October 15. npm lists 32 published versions of rea-agents, the newest being 6.5.0 on October 14. The repo carries 36 git tags.
Three of those versions were major releases in four days: 4.0.0 on October 5, 5.0.0 on October 7, 6.0.0 on October 8.
It is not a one-person project, though one person still leads it. Merging author identities on shared email, GitHub account ID or matching display name, morluto wrote 1,709 commits (50.3%). Next is N0zoM1z0, who also commits as Ysopwnable, with 563 (16.6%). The two reconstruction repos the README showcases, DX-Ball and TH04, sit under N0zoM1z0's account. Kaoru0822 follows with 494 (14.5%). 234 distinct author emails committed in the last year.
The star curve is the part people stop and stare at. Trendshift's daily log shows 88 stars in total before October 1, then 274,278 after it. The busiest day was October 12, at 52,186 stars. REA ranked #1 across all languages on Trendshift on six days between October 5 and October 13, and #1 among TypeScript repos on nine of its ten listed days. Between two reads about twelve and a half hours apart, on October 15 and 16, the star count went from 262,989 to 274,839.
npm counted 231,579 downloads of rea-agents in the week of October 6–12.
No security advisories are published on the repo.
What people say
The main Hacker News thread, posted the evening of October 9 (ET), has 806 points and 338 comments. Reddit is blocked from the research sandbox, so no vote counts from it are claimed.
The top skeptical question, and the most useful answer to it. ethin asked: "How exactly is this better than telling Claude for example to 'install and set up a full RE environment including Ghidra' on my local system and get to work?" tptacek replied: "Everybody has their own set of skills and specific scripts and tools to do this stuff. You might use Ghidra as the the kernel of those workflows, but you still want something more than just Claude freestyling, at least for now." He added: "(Who knows if this'll be true 6 months from now.)"
On output quality, InvisibleUp looked at the TH04 reconstruction: "it's a lot better quality than a lot of AI decomps I've seen. It's matching, the variables are named sensibly, comments are sparse and comprehensible, and there's not much in the way of unaddressed Ghidra jank." The same comment worries about the hobby: "It kinda just... totally eliminates that as a hobby entirely."
On the stars, 5ak3t laid out the jump from "~4,226 to 54,614 stars in ~5 days" and called the fork growth "even stranger." cedws replied: "Reeks of botting, some comments here also look artificial." That is one commenter's read. This entry found no evidence either way and makes no claim about it.
The catch
It is a layer, not an engine. Deep native analysis needs Hopper, Ghidra or IDA installed. Setup can install Hopper with your approval; Ghidra and IDA must already be on the machine. The README is blunt about commercial engines: "REA grants no tool license, key, or activation entitlement."
Your findings can leave your machine. REA's own FAQ: "REA analyzes targets on your machine. Your agent receives the results, and its model provider's data policy applies to those results." Unless you run a local model, code pulled from a binary goes to whichever model provider your agent uses.
Your model may say no. One HN commenter, Meleagris, wrote: "In my experience, even just hinting at reverse engineering to models from Anthropic or OpenAI leaves them extremely sensitive to refusals."
Setup edits your agent's config. It shows a plan first and keeps backups, per the install docs. But the site's first install option is a prompt you paste into your agent, and at least one HN commenter compared that to curl | bash.
The legal line is yours to walk. The project's DISCLAIMER says it "will not help with" circumventing DRM or licence checks, building game cheats, bypassing authentication on systems you are not authorized to test, or "copying proprietary software or reproducing its protected code and assets." It also says reverse engineering "may be restricted in your jurisdiction or by the license of the software you analyze." The tool's own demos rebuild features of other people's software. Whether your use is allowed depends on what you point it at.
It moves fast. Three major versions in four days. The README tells users who hit a bug to update first, and warns that "a similar repository name or copied README does not establish that a download is official." Get it from the repo, rea.tools or the rea-agents npm package only.
My read
Point it at your own stack first. I run businesses on a pile of software I didn't write and can't see inside. When a vendor tool does something weird, I file a ticket and wait. REA turns "why does it do that?" into a question I can actually ask. The tools I own or am allowed to inspect are the obvious first targets.
It's a wrapper, and that's fine. The best HN pushback was, basically, that Claude can already install Ghidra and go. True. REA's pitch isn't a better decompiler. It's a repeatable workflow with the evidence attached. tptacek put it well: you want "something more than just Claude freestyling." Whether that gap survives the next six months is the real question.
Watch the star counter. It's growing so fast you can watch the numbers climb while you hit refresh. Trendshift logged 88 stars before October. Then it logged 274,278. One HN commenter thinks that smells like bots. I don't know. I'm reporting the curve, not calling it.
The legal line is the product. The demos rebuild features from apps you don't own. The disclaimer says the project won't help with copying "protected code and assets." Both are true at once. If REA survives that tension, there's a field report in it.
Credits
Maintainer: morluto (GitHub). Project account @reatools on X.
Top contributors (all-time commits): N0zoM1z0 / Ysopwnable (563, plus the DX-Ball and TH04 reconstructions), Kaoru0822 (494), Rudy Mizrahi Celekli (91). All three committed in the last 30 days.
Voices quoted: ethin, tptacek, InvisibleUp, 5ak3t, cedws and Meleagris on Hacker News.
Data sources: the REA repository (git history, README, LICENSE, DISCLAIMER, install docs), rea.tools and its FAQ, ungh.cc, the npm registry and npm download API, Trendshift, the Hacker News Firebase and Algolia APIs, the repo's GitHub security advisories page, the Binary Ninja and Sidekick pricing pages, the Hex-Rays pricing page, and the Hopper home page.