Open-Source MCP Server REA Gives AI Agents Access to Ghidra, IDA, and Frida in One Package

An open-source MCP server called REA — Reverse Engineer Anything — crossed roughly 240,000 GitHub stars by October 14, 2026, up from fewer than 10,000 on October 6, making it one of the fastest-growing repositories on the platform this year. The project, published under the GitHub account morluto, does not ship a decompiler. What it does is connect AI coding agents to the professional reverse-engineering tools that already exist on a researcher's machine, and then hold those results to a verifiable standard.

The repository, published in April 2026 and initially overlooked, gained more than 31,000 new stars on a single day in early October as coverage of its architecture spread. Version 6.5.0, released October 13, is the latest release. It adds Frida runtime instrumentation — letting agents trace and modify live processes, not only read static binaries — and expands client-setup support for Kimi Code, DeepSeek's agent harness, Qoder, Trae, and several other coding environments.

What REA Actually Does

REA is a Node.js package (rea-agents) that runs a local Model Context Protocol server and a command-line interface. Once installed — npx rea-agents setup writes the configuration for whichever agents a user selects — the server exposes tools an AI coding agent can call as it would call any other MCP tool. The agent asks; REA calls the appropriate local binary; REA formats the result and returns it.

The architecture means the decompiler never changes. Ghidra, the disassembler that the U.S. National Security Agency released publicly in 2019, remains Ghidra. IDA Pro remains IDA Pro. REA adds a structured interface and a contract about what each result means.

Routing depends on the target. Android packages go to JADX or Apktool. Firmware images go to Binwalk or Unblob. WebAssembly modules go to WABT. Packet captures go to TShark. Logic-analyzer recordings go to sigrok. IDA Pro, Hopper, and JEB are supported alongside Ghidra for native binaries; REA's documentation stresses that commercial tools must be properly licensed by the user.

The Evidence Contract

Every analysis tool in REA returns a structured record that the project calls an evidence object. Each result includes a normalized interpretation, the raw output from the underlying tool, a stable identifier, and an explicit coverage declaration that says either complete — the tool handled the entire binary section — or unknown. That last field matters: it tells the calling agent whether a gap in coverage is the tool's limitation or a genuine absence of content.

The project describes this as the distinction between a claim and a result. An agent that calls analyze_function through REA receives not only the decompiled C-like output but the provenance chain that lets it assess what the decompiler actually processed. This is the architecture REA's documentation describes as making analysis "cheap where code can be checked" — the inverse being that results the agent cannot verify against the binary should not be trusted as facts.

Three Public Showcases

REA's showcase page documents three end-to-end reconstructions that can be independently reproduced.

The first is a 63-byte sound-panning function from DX-Ball, a 1996 Windows shareware game compiled with Visual C++ 4.0. The agent followed a sound call to a helper routine at memory address 0x00406400, identified the floating-point constants 1.5625, 500.0, and 1.0, and produced a C equivalent. N0zoM1z0, a game-reconstruction reverse engineer and REA contributor, built the reconstruction repository. The tests cover five pan-scale values and required a reviewed relocation step; wiring the recovered function into the game's live sound system is noted as future work.

The second showcase covers a 2,139-byte bullet-ring routine from TH04, a 1994 PC-98 DOS shoot-em-up compiled with Turbo C++ 4.0J. The full executable is 156,258 bytes. The agent matched the section and recompiled it; the output is byte-identical to the original. The TH04 section sits inside ReC98, an ongoing human-led decompilation project that has been running for years. REA's showcase notes that independent provenance for the game image is still an open item.

The third showcase traces Notion's desktop clipboard write from the Electron renderer through the preload script and an IPC channel into the main process, using REA 4.1.0. The agent identified the notion:clipboard:write channel, the ipcRenderer.invoke call, and the ipcMain.handle registration on the other side.

What these three examples share is a verification oracle: the methodology of recompiling with a pinned historical compiler and comparing the output to the original binary byte-by-byte. DX-Ball has 3,205 test cases. TH04 has 2,139 matched bytes. The Notion trace can be re-run against a fixed version of the application. In each case, the claim is not that the agent understood the code; the claim is that the output compiles to the same bytes.

Context in the MCP Ecosystem

Tool integrations connecting disassemblers to AI agents are not new. LaurieWired published GhidraMCP in March 2025. Duncan Ogilvie released an IDA Pro MCP plugin in the same month. Both are focused integrations: one tool, one AI interface.

REA's approach is to unify the tool set under a single server with a common evidence format. At the time of writing the server exposes more than 170 tools across the range of analysis types described above; the full changelog has moved from version 0.2.1 to 6.5.0 between April and mid-October 2026.

Ogilvie, whose IDA plugin has its own following, has argued that handing a model a larger set of tools does not automatically improve performance — model context can become a limiting factor before tool breadth does. REA addresses this with a compact profile that reduces the full tool-definition payload from approximately 496 KB (roughly 120,000 tokens) to roughly 290 KB, and with a bundled agent skill that selects tools based on the task at hand rather than exposing everything simultaneously.

Elias Bachaalany, co-author of the textbook Practical Reverse Engineering and a former Hex-Rays employee, characterized the reaction to REA as "hype" when reposting early coverage. His practical note was that developers should keep critical logic on their servers rather than in client-side code that can be analyzed. The observation cuts both ways: it is a caution for developers who rely on obfuscation, and a confirmation that REA-class tooling can reach that logic.

Security researcher Maurice Heumann demonstrated AI-assisted decompilation of a PC game at scale — running parallel coding agents through a Hex-Rays MCP integration to recover a large portion of the game's functions to readable C++. The project attracted the attention of the game's publisher.

Version 6.5 and the Frida Addition

The 6.5.0 release notes describe Frida support as a significant expansion of what REA can reach. Static decompilation reads a binary as it sits on disk. Frida instrumentation runs code inside a live process: the agent can inject a caller-supplied script, select a local or remote target, capture the messages the script emits, and retrieve diagnostic information about the script's read state.

REA's release notes include a warning that accompanies the Frida integration: instrumentation executes foreign code and is destructive, not read-only. The tool is appropriate for analyzing software the user owns or is authorized to instrument; using it against software under a restrictive license or without authorization raises the same legal questions that apply to any form of reverse engineering.

Earlier security commentary noted that agents handled straightforward unpacked programs but were less reliable on heavily obfuscated or virtualized code — a limitation that Frida's dynamic tracing capability partially addresses by observing behavior at runtime rather than inferring it from static bytes.

The Broader AI Decompilation Wave

REA's growth coincides with a wave of AI-assisted software reconstruction projects that have drawn responses from publishers.

Brandon Thomas, a developer with fifteen years of programming experience, released ArtCraft: seven free, open-source applications modeled on Photoshop, Illustrator, Premiere, Lightroom, Acrobat, After Effects, and InDesign, written in Rust with Claude Opus 5.5. Thomas described the project as a clean-room reimplementation. He did not use REA. The Photoshop counterpart, PhotoCraft, accumulated around 49,000 GitHub stars in a week. Thomas initially promised 100 percent functionality parity within a month, later revised to 99 percent within a year; current estimates from outside reviewers put functional parity closer to 25–35 percent. One early tester, a pixel artist, described the Photoshop clone as "completely unusable" in early testing, according to Decrypt.

Adobe, for its part, agreed to a $150 million settlement with the U.S. Justice Department in March 2026 over allegations that it hid early-termination fees in its subscription plans in violation of consumer-protection law. Adobe denied wrongdoing. The company stated: "While we disagree with the government's claims and deny any wrongdoing." The settlement's timing — coming as open-source alternatives began attracting tens of thousands of stars in a week — has been noted by observers tracking the competitive dynamics of creative software.

Activision used a copyright report to disable footage of an AI-assisted decompilation project targeting a PC game. Bethesda sent a cease-and-desist letter to the creator of an AI-built Fallout browser game. A browser-playable version of Grand Theft Auto V appeared on October 6 and was taken offline within hours.

What the Law Permits and What It Does Not

REA's disclaimer states that the project will not help users copy proprietary software or reproduce protected code and assets. The legal landscape it operates in is jurisdiction-dependent.

Under U.S. law, the Digital Millennium Copyright Act bars circumventing technical protection measures. A statutory exception exists for interoperability research, and the Copyright Office has granted periodic exemptions for security research. Courts have also held that license terms can override the statutory reverse-engineering permissions: in Bowers v. Baystate Technologies (2003), the Federal Circuit enforced a license clause that prohibited reverse engineering.

The EU Software Directive (2009/24/EC) takes a more permissive approach: it permits decompilation for interoperability and voids contractual terms that attempt to forbid it. China's Supreme People's Court issued a 2020 trade-secret interpretation holding that reverse engineering of a lawfully obtained product does not constitute trade-secret misappropriation.

AI introduces a structural question that existing law does not answer directly. Traditional clean-room methodology requires a firewall between the engineers who analyze the original code and the engineers who write the replacement. When a single AI agent both decompiles the original and writes the reimplementation in the same session, the firewall does not exist. Whether courts will treat AI-assisted reimplementation as equivalent to a traditional clean-room process, or as a violation of it, remains an open question.

Who Is Running REA, and What Reaches the Cloud

REA analysis runs locally. The binary being examined does not leave the user's machine as part of the REA process. What does travel to a cloud model provider is the decompiled output and any prompt context the agent constructs from it — and that provider applies its own data policy to what it receives.

For a security team examining vendor software under a nondisclosure agreement, transferring decompiled code to a cloud inference endpoint can itself be a contractual problem, regardless of what REA's own documentation says. Some model providers also apply content restrictions that may interrupt analysis of certain software categories. REA's security policy is explicit that the local bridges are not a sandbox: opening an untrusted binary hands parsing responsibility to Ghidra or Hopper with the user's full permissions.

REA marks results derived from target content with an untrusted_content provenance flag and instructs agents to treat such text as data rather than instructions, reporting any apparent prompt-injection attempts. That flag does not prevent a malicious binary from attempting injection; it signals that the agent should be skeptical of what the tool returns.

Early performance assessments found the gap between REA-equipped agents and plain agents to be narrow on simple targets, with REA running slower on some tasks. On complex targets — heavily layered applications, obfuscated code, multi-format firmware — the structured tool routing and coverage declarations are the differentiating factor. According to a review summarized by Apidog, one early test found minimal advantage over a standard agent on a simple Mac application, while structured analysis of more complex binaries showed the evidence contract's value more clearly.

The Version Number as Signal

REA moved from version 0.2.1 to 6.5.0 in six months. The version number reflects release cadence rather than a formal compatibility commitment — but the pace signals active development. N0zoM1z0, who contributed the DX-Ball showcase and has written about game-reconstruction reversing as a practice, has made the point that what manual reverse engineering leaves behind is not knowledge of the binary but the skill of verifying results against the binary itself. That verification skill — the ability to confirm that a decompiled function actually recompiles to the original bytes — is the layer REA is trying to systematize.

Whether the 240,000 stars represent sustained adoption or a momentary spike, the architecture REA proposes — professional tools, structured evidence, explicit coverage limits — is a concrete answer to a question that plain AI decompilation has left open: not whether the agent can read a binary, but whether the reader can trust what the agent says it found.