REA doesn't clone apps. It explains one feature, with proof.

"AI can copy any app" is how REA reached most web developers this month. The repo, morluto/rea, has been on GitHub Trending since about 2026.10.08, and the GitHub API counted 399,396 stars and 100,197 forks on 2026.10.28 (outlets quote very different numbers depending on the day). What it does is narrower than the hype and more useful: your agent asks how one feature of a shipped app works, and gets an answer with the evidence attached.

Watch the 60-second version on Instagram.

What it is: an MCP server first, a skill second

REA is MIT-licensed and has three parts:

• An MCP server and CLI, published on npm as rea-agents. This is what gives the agent its tools.
• An Agent Skill, reverse-engineer-anything, at .agents/skills/reverse-engineer-anything/SKILL.md. It is instructions only: on its own it registers no MCP server and adds no tools.
• The tools it drives, which it doesn't replace: Ghidra, Hopper, IDA, Rizin, JADX, Apktool, mitmdump, TShark, and a Chrome-family browser for websites.

It reads native binaries (ELF, PE, Mach-O, Go, Rust, .NET), JavaScript and Electron apps (ASAR archives), websites, HAR and pcap captures, APKs, firmware, WASM, SQLite and more. Out come pseudocode, strings and symbols, and for JavaScript apps the modules, routes and IPC channels.

Setting it up

npx rea-agents@latest setup
# approve the plan, restart your agent, then ask:
# "How does this Electron app's export feature work? Show evidence."
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Setup doesn't install Ghidra, IDA, JADX or Java for you. IDA, Hopper and JEB need licences you hold yourself. If you only want the instructions, npx skills add https://github.com/morluto/rea --skill reverse-engineer-anything adds the skill, but without the MCP server your agent gets no new tools. Native Windows support is experimental.

The finding ledger

The skill's workflow is the interesting part. The agent routes the target to the right tools, works summary-first, and only corroborates at runtime when static analysis can't answer. Every finding goes into a finding ledger under an Evidence ID, and at the end each question is marked answered, partial or unresolved.

The rows above are illustrative, not REA output: a made-up export feature where three findings explain the client side and one, what the server does, stays open. That is the honest shape of the answer. Rebuilding a feature from it copies the behaviour, not the look, and not the servers behind the app. The rea.tools example does exactly this at a small scale: it recovers Windows Calculator's percentage rule and rebuilds it.

The skill also says when not to use it: "Skip REA for ordinary source-repository architecture analysis." If you have the source, read the source.

What people get wrong

• "It clones any app." It answers one question about one feature at a time, with evidence and stated limits.
• "It replaces Ghidra and IDA." It drives them. They are decades-old tools and still do the work.
• "Installing the skill is enough." The skill is instructions; the tools come from the MCP server.
• "It's all local, so nothing leaves my machine." The analysis runs locally, but your AI model still sees everything REA finds.
• "Any repo called rea is fine." Lookalike repos exist, such as bryankwandou/rea, which points back to morluto. Use morluto/rea, rea.tools or the npm package rea-agents. The skills.sh listing also shows one audit (Gen Agent Trust Hub) at "Warn".

REA is meant for lawful research, education, interoperability and software you own or are allowed to examine. Licences and EULAs may forbid decompiling, so read them first.

On a client project I'd reach for REA when an integration depends on an undocumented desktop or Electron app we're licensed to use, ask it one question at a time, and treat any finding without an Evidence ID as a guess.

The short version

1. REA (morluto/rea, MIT) is an MCP server and CLI that lets your coding agent drive Ghidra, JADX, a browser and other reverse-engineering tools.
2. The reverse-engineer-anything skill is instructions only; without npx rea-agents@latest setup the agent gets no tools.
3. It answers one question about one feature, and every finding carries an Evidence ID; each question ends answered, partial or unresolved.
4. It doesn't install Ghidra, IDA or JADX, doesn't replace them, and your model still sees what it finds.
5. Use the official sources only, and only on software you own or may examine.

Sources: morluto/rea README · GitHub API, repos/morluto/rea · Lucija Tomšić, The Viral REA GitHub Repo Explained · aitoolly, REA on GitHub Trending · REA SKILL.md · rea.tools · skills.sh listing · bryankwandou/rea