REA MCP: reverse engineering with AI assistants

The overview

Ask a question. Follow the evidence.

REA is an open-source reverse-engineering toolkit with an MCP server created by the morluto/rea project. It connects assistants to software-analysis tools on your machine. API to Agents maintains a fork of that project; the version reviewed here inherits its existing MCP implementation. Use it only for lawful, authorized analysis of applications and services whose terms permit the intended work.

Original project and our fork

The original project is morluto/rea. Its authors built the analysis workflows and MCP server. Our repository is apitoagents/rea; it preserves that upstream origin and license.

As reviewed on October 14, 2026, our fork is at commit ca7450b, with no additional fork-specific commits. This page documents its current local MCP setup. It does not announce a hosted REA endpoint or a published ChatGPT or Claude directory listing.

REA-authored code uses the MIT license. Analysis engines and other dependencies have their own requirements; consult the third-party notices before choosing a setup.

What you can investigate

Start with the specific question you need to answer. REA’s wider catalog covers additional formats and workflows, but installing the MCP server does not install every analysis engine or make every capability available on every computer.

JavaScript and Electron applications. Inspect a local application directory or ASAR archive, map modules and process boundaries, and identify static relationships. See the artifact analysis workflow.
Native software. Examine functions, instructions, strings, and references through supported analysis providers such as Ghidra, Hopper, or IDA. Capabilities depend on the target, provider, and host. See native investigation.
Runtime evidence. Compare static application structure with separately collected browser or Electron observations. Keep an observed event distinct from an inferred relationship. See static/runtime reconciliation.

From a question to evidence

Our REA walkthrough develops this illustrative example, including setup and what a useful investigation report should contain.

Define an allowed target. Choose an app you own or are permitted to analyze. Set the files, data, and operations in scope before giving the assistant access.
Connect a local client. Configure REA on the machine with the target and required analysis tools. Check that the selected assistant discovers the server.
Ask a bounded question. For example: “Inspect our Electron build and map the report-export path. Do not execute it or contact any service.” Start with static analysis where it answers the question.
Review the evidence. Ask for source locations, relationships, coverage, and unknowns. Validate the findings before changing your application; a plausible explanation is not proof of runtime behavior.

Connect with ChatGPT or Claude

REA’s reviewed server transport is local stdio: the client starts a process on a host that can access the target. Follow REA’s installation guide, review its proposed client configuration changes, and restart the selected client.

ChatGPT desktop and Codex. OpenAI documents local stdio MCP configuration shared by the ChatGPT desktop app, Codex CLI, and IDE extension on the same Codex host. REA includes Codex setup. Confirm the server is available in your chosen local session; this is a documented setup path, not a claim that we tested every client. See OpenAI’s MCP guide.

Claude Desktop and Claude Code. REA includes setup for these local clients. Claude Code supports local stdio servers; Claude Desktop also supports local MCP connections. Review organization policies and REA’s client-specific notes.

Hosted chat and remote connectors. ChatGPT web’s hosted plugin tools and Claude’s remote connectors follow a different connection path. A GitHub URL or local stdio command is not a remote MCP endpoint. A hosted REA integration would require separate transport, authentication, isolation, and controlled access to analysis targets; our fork does not currently provide that service.

Authorized use, with clear boundaries

Use REA only in a lawful context, with the necessary rights and permission, and with applications or services that allow the intended analysis. Respect applicable terms, privacy obligations, and third-party licenses. Read the project’s responsible-use disclaimer.

An owned test application, an explicitly permitted interoperability investigation, or a scoped internal audit can be a suitable starting point. Access to a file or account alone does not authorize every operation. Do not use this workflow to bypass access controls, licensing, or payment restrictions, or to copy protected code and assets without permission.

Local analysis describes where the tools run. Results returned to the assistant may still be processed by its provider. Use approved data, keep secrets out of captures, and separately approve any execution, device interaction, or network activity required by an investigation.

A few more details

Frequently asked questions

Did API to Agents create REA’s MCP server?

No. MCP support is part of the original morluto/rea project. Our reviewed fork inherits that implementation and currently has no additional fork-specific commits. We credit the original authors and link both repositories.

Can I paste the GitHub URL into a remote connector?

No. The repository URL points to source code. The reviewed REA server runs as a local stdio process. Hosted ChatGPT plugins and Claude remote connectors need an appropriate reachable server and a separate deployment design.

Will every REA capability work on my computer?

Available operations depend on the target format, installed analysis engines, operating system, client configuration, and permissions. Check readiness for the specific workflow instead of assuming that MCP installation makes every tool usable.

Does REA recover the original source code exactly?

Do not assume that. Findings may be partial or inferred, and decompiled output is not a guarantee of original source recovery. Check evidence, coverage, and limitations, then validate the behavior relevant to your question.

Can we get help designing a hosted integration?

You can contact us to discuss an authorized workflow and its requirements. A hosted REA integration would be a separate scoped project; this page does not offer an existing hosted REA service.