Reverse engineering with AI: how to understand a feature and build your own version with REA

How many monthly subscriptions are you paying for tools you use every day? Screen recorders, image editors, browser extensions, CRMs. For years software has worked under a rigid rule: you adapt to the features, formats and prices of whoever built the tool.

AI agents that write code, together with the MCP protocol, are changing that rule. One visible example is REA (Reverse Engineer Anything), an open-source, MIT-licensed project that, according to the GitHub API, had more than 424,000 stars on November 3, 2026. Stars measure popularity, not quality or safety, but they say a lot about the interest the idea is generating.

The idea is not to "clone apps", and the project itself explicitly rules that out. It is something else: understanding how a feature works in software you have the right to analyze, and asking your agent to build your own version from scratch, shaped around your workflow.

In this guide you'll see how to install REA, connect it to your coding agent (Claude Code, Cursor, Codex or OpenCode, among others) and build your first local utility. For the full technical picture, start with the pillar article: REA: how to do reverse engineering with AI (in Spanish).

1. What REA is and how it works

Picture an expert tailor who sees an impeccable suit in a shop window. They study the cut, the seams and the structure, then make a new one with their own fabric, fitted exactly to the client. They don't take the suit from the window.

• It does not recover source code. A commercial application's code is not on your machine in readable form. REA inspects what is there (binaries, JavaScript or Electron packages, .NET assemblies, websites) and returns an explanation of how it behaves.
• The engine is MCP. REA is a CLI and an MCP server: a bridge that gives your agent analysis tools it can call while you talk to it in plain language. For native binaries it uses existing engines such as Hopper, Ghidra, IDA or Kuna.
• Evidence-backed analysis. Every result includes three things: how the part you asked about works, the concrete evidence behind each conclusion (file, function, reference) and the limits of what it could not determine. That last part is what protects you from answers that sound confident but are made up.

One important caveat: the analysis runs on your machine, but the results reach your agent's AI model. If that model runs in the cloud, your provider's data policy applies.

2. Before you start: what you can and can't analyze

This is the part most tutorials skip, and it's the part that matters most.

REA's usage notice says the project is meant for security research, education, interoperability, software preservation and analysis of software you own or are authorized to examine. And it states plainly that it does not support copying proprietary software or reproducing its protected code and assets, or circumventing DRM, license checks or other technical protection measures.

In practice:

• Yes: your own applications, open-source software whose license allows studying it, and third-party software you have written permission to examine.
• No: commercial applications whose terms of use prohibit reverse engineering, and there are many. Having an app installed does not give you permission to analyze it.
• Never: copying brands, logos, text or interfaces, or bypassing licenses or protections.

And some good news: many of the features you pay for need no reverse engineering at all. A screen recorder, for example, can be built with publicly documented browser or operating system APIs. There, REA is unnecessary: your agent and the official documentation are enough.

3. Step-by-step guide: installation and your first local utility

Requirements: Node.js 22.x (22.23.4 or later), 24.x (24.22.1 or later) or 26.12.1+, plus npm, and an MCP-compatible coding agent. The installer recognizes Claude Code, Codex, Cursor, Gemini CLI, Grok Build and OpenCode, among others.

Step 1: install REA and connect it to your agent

You don't need to clone the repository: that's only needed if you want to contribute to the project. The official installation is one command. Run it in your terminal, from a trusted folder that is not the project you're going to analyze:

npx rea-agents setup

The installer asks which agents you want to configure, shows you the changes it will make and asks for your approval. It adds REA's MCP server and its working instructions, and backs up your current configuration. When it finishes, restart your agent so it loads the new configuration.

If you'd rather pin the version this guide was verified against:

npx rea-agents@6.8.0 setup

Only download it from the official sources: the morluto/rea repository, the rea.tools website or the rea-agents npm package. The project itself warns that a similar name or a copied README does not make a download official.

Step 2: check that your agent sees the tools

Open your agent and ask in plain language. This is not a terminal command, it's a chat message:

Which REA tools do you have available? List the ones that can analyze a
JavaScript or Electron application.

If none show up, make sure you restarted the agent and check the official installation guide. On Linux, some features need a procps-compatible ps on the PATH.

Step 3: define the feature you want and write the prompt

Pick one specific feature, not a whole application. "I want something like app X" is too vague; "I want to record my screen and camera at the same time and save the file on my computer" is a specification.

If you need to understand how software you're allowed to analyze (yours or open source) handles that feature, ask for the analysis first:

Use REA to analyze the application in ./target. It is open source and its
license allows studying it. I want to understand how it records the screen and
the camera at the same time. Return how it works, the evidence for each claim
and what you cannot determine. Do not run the app and do not copy code or assets.

Then, or straight away if the feature is documented, ask for the build with your own rules:

Create a local application in a folder called my-recorder. It must include:
a floating, resizable webcam bubble, microphone selection, a 3-second countdown,
tools to draw on the screen and automatic saving of recordings to my computer,
without uploading anything to the internet. Use only documented APIs and
open-source libraries, tell me the license of each dependency and apply this
color palette: [your colors].

Step 4: run, test and adjust

1. First version. The agent creates the project files and tells you the command to launch it. Depending on complexity, this can take anywhere from a few minutes to several rounds of work.
2. Functional test. Run the app, grant the permissions the system asks for (camera, microphone, screen recording) and make a test recording. Check where the file is saved and that nothing is sent off your machine.
3. Iterative tweaks. If something is missing or you want to change the design, ask in the chat: "Add a quick pause button and change the bubble color on hover".
4. Review. Read what the agent wrote, or ask it to explain it to you. It's your software: if it breaks or has a security hole, that's your problem too.

4. The legal and ethical line

It's easy to get excited about building your own tools, so it's worth drawing the line clearly:

• Legal framework. Copying registered trademarks or protected interfaces, or bypassing licenses, can carry serious legal consequences, especially if you sell the result. Rules on reverse engineering and interoperability vary by country and by the software's license. If your case is commercial, check it with a lawyer.
• What REA is built for. Technical auditing, security research, learning, interoperability, software preservation and analysis of software you own or are authorized to examine. Not for making copies.
• Privacy. Don't extract personal data, credentials or trade secrets, and delete your captures when you're done.

5. The real opportunity: custom software

The opportunity isn't in reselling cheap copies. For creators, agencies and small teams, the advantage is custom software: internal utilities that do exactly what you need and nothing more.

We've spent decades bending the way we work to fit rigid, expensive applications. With a coding agent, and with REA when you need to understand how something was solved, the barrier to building your own tools drops dramatically. It doesn't disappear: maintaining, securing and updating what you build is still work. But that work is now yours, and so is the tool.

What's the feature you pay a subscription for today that you could build to your own measure this month?

Keep reading

• Skills for coding agents, so your agent always builds by your rules.
• Claude Skills, connectors and plugins, to turn your processes into a system.
• How to check an AI answer before you use it, to review what the agent hands you.

Sources

• REA repository on GitHub (morluto/rea)
• rea-agents npm package (version 6.8.0, MIT license)
• Installation guide and supported agents
• Responsible use notice (DISCLAIMER)
• REA official website and guides

Verified on November 3, 2026 against the repository's README, installation guide and usage notice, version 6.8.0 published on npm, and the GitHub API star count. Requirements and capabilities change between versions: check the version you install.