· Translated from the Spanish original

Reverse engineering

REA racks up 143,000 GitHub stars in days and has yet to prove its checkmate on software

The repository pairing AI agents with reverse engineering took off in days. No major company responded directly, and its demos remain unreplicated.

What happened

  • REA, short for Reverse Engineer Anything, is an open-source tool (MIT license) and MCP server that lets an agent such as Claude Code, Codex or Cursor analyze software without having its source code.
  • Its repository showed more than 143,000 stars and 33,000 forks on October 12; external trackers gave it fewer than 10,000 on the 7th. Other outlets reported between 110,000 and 115,000 that same day, so the figure depends on the source and the hour.
  • It brings no new technique: it puts engines with decades of history, such as Ghidra, Hopper and IDA, behind a single interface. Its README states that it does not claim to recover the original source code or clone applications.
  • Its three demonstrations are narrow: the sound panning in DX-Ball, Notion’s clipboard bridge in Electron and a bullet-pattern calculation in a PC-98 game. It is function-level work and none has been independently reproduced.

Why it matters

  • The momentum came from promotion more than from the demos. On October 8, Matthew Berman wrote on X that “software is over,” according to RuntimeWire, and linked to REA alongside ArtCraft, seven open applications equivalent to Adobe programs. He did not document that REA was used to build them. Elias Bachaalany, co-author of Practical Reverse Engineering, shared the promotion with one word: “hype.”
  • For a Chilean team that ships compiled code in desktop or mobile apps, the sober reading is that the time needed to analyze its product has dropped. The usual advice is to move valuable logic to the server and treat obfuscation as a delay, not a barrier. In a test run by Thales itself, an agent found eight of ten vulnerabilities in an unprotected app and none in the protected one, using 970 times more tokens. It is a vendor test, not independently replicated, and predates REA’s rise.
  • Anyone who wants to try it faces an immediate risk. The official project is morluto/rea; another one, rea-tools/rea, has no visible stars and an .exe in Releases. Its origin could not be verified: it is best to install only from the official one.

The number

143,000stars REA had on October 12. None of its three demonstrations has been independently reproduced.https://github.com/morluto/rea

Context

The legal front has not changed. The README limits REA to lawful research and to software that is your own or authorized, and leaves responsibility with the user. Many commercial licenses prohibit reverse engineering, section 1201 of the DMCA restricts circumventing access controls with an interoperability exception, and a reconstruction can infringe copyright without copying a single line. This is general context, not legal advice. As precedents, not as responses to REA, Activision pulled an AI-reconstructed Call of Duty: Modern Warfare 2 video and Bethesda sent a cease-and-desist letter over Fallout: New York. Hex-Rays has its own official MCP for IDA, the one a viral demo used instead of REA.

What’s next

  • No announced timeline for independent evaluations of REA on full applications.
  • No direct response from any major software company in the material reviewed.

Bottom line

On October 9, Maurice Heumann detailed how 16 agents reconstructed 99% of the functions of a C++ game and decided not to publish it. REA does the opposite: it publishes everything, but still has not shown a single complete program rebuilt. Meanwhile, Adobe already offers 70 tools inside Slack over MCP, through the front door.

Sources

Written by Mamífero. Edited by Rodrigo Cornejo. See how we select and verify each note.

Related notes

← All notes