REA Traces an App's Behavior Down to the Binary

Use this skill when a user wants to understand how a feature of an app is implemented and has no source code. It is built on the open-source project REA (Reverse Engineer Anything), licensed under MIT. It connects the agent to a set of analysis tools (native binaries, JavaScript and Electron, .NET assemblies, websites). Analysis runs locally, and every conclusion comes with evidence and limitations.

Triggers

Users say things like "How is search implemented in this app?" "Help me see what this program does." "What IPC does this Electron app have?" "Work out how this feature works." Or they want to understand an installed desktop app, a binary file, or a JS package.

Hard Rules

1. Only analyze your own targets, or targets with explicit authorization. If the scope of authorization is unclear, stop and ask the user before doing anything.
2. Do not scan, attack, bypass payment or access controls, or perform denial of service against live systems. Prefer read-only and local analysis.
3. Tell the user before installing anything or changing configuration. Proceed only after they agree.
4. Sort conclusions into three categories: what was directly observed (with file and location), what was inferred, and what was not found (write "unknown", not "does not exist").
5. Do not output or log the full contents of any keys or tokens found. Report only where they are located.
6. Get REA only from official sources. The official sources are morluto/rea, rea.tools, and the npm package rea-agents. A similarly named repository or a copied README does not count as official.
7. Have the user review the changes setup will make first. Setup writes to the agent's MCP configuration and workflow instructions (the original configuration is backed up first), and the agent needs to be restarted afterward.

Installation

Requirements: Node.js 22.x (≥22.23.4), 24.x (≥24.22.1), or 26.12.1 or later, plus npm. Run from a trusted directory outside the target project:

npx rea-agents setup

Choose the agents to connect (Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and others are supported), review the changes, agree, then restart the agent. To use it long-term from the terminal:

npm install --global rea-agents
rea --help
rea update    # Versions change quickly; update regularly

Usage

Tell the agent:

Figure out how search works in the Notes app, show me the evidence, then build a similar feature for my project.

To analyze an unpacked JavaScript or Electron application directory (or an ASAR) directly from the terminal:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/app --json

What It Can Analyze

Target	What it returns	Extra requirements
Desktop app install directory	Runtime candidates, supporting files, component markers, and next probes	Built in, no extra tools needed
Native binary	Pseudocode, assembly, strings, symbols, calls and references	Requires one of Hopper, Ghidra, IDA, or Kuna
Go binary	Compiler version, modules, build settings	Built-in static analysis, no Go installation needed
JavaScript / Electron	Modules, imports, Electron boundaries, and evidence	Static analysis, no native analysis engine needed
GPU code objects	CUDA/HIP targets, kernel parameters, PTX text	Built-in static analysis

Native analysis requires configuring an analysis engine first (Hopper, Ghidra, IDA, or Kuna). Ask the user before installing an engine such as Hopper.

Output Format

1. A one-sentence conclusion.
2. Evidence: which file, symbol, or string supports each conclusion.
3. Limitations: static reading of code is not the same as observed runtime behavior, and anything not analyzed must be stated.
4. If the user wants to replicate the feature, replicate only the behavior, not the other party's code, resources, or copy.