REA Reverse Engineer Anything — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Dated implementation activity and relevant MCP role justify continued Radar monitoring.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Investigate applications and binaries with local agent-driven reverse engineering

What we know

Local reverse-engineering CLI/MCP that analyzes binaries, JavaScript/Electron, websites and more using selected inspection providers.

Maintenance / activity evidence

GitHub REST repository pushed_at 2026-10-09T23:03:57Z for morluto/rea

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Local analysis and setup-generated integrations Complete write authority is not verified.
Local analysis providers; licensing may apply to Hopper
Sensitive access: Application binaries, Local code, Binary metadata

Analysis runs locally but model host may receive extracted evidence
Local reverse-engineering processes and external model providers may receive extracted material; respect legal rights, secrets and code confidentiality.
Reverse-engineering operates with local user permissions and can launch untrusted targets; local authenticated sockets are not full sandbox.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

44,895 repository stars · 10.7k package downloads / 30 days

Stars observed Oct 9, 2026. Downloads observed Oct 9, 2026.

Repository total for morluto/rea.

Exact npm package rea-agents; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

At the next review, has this exact implementation gained new releases, changed setup/security scope, or become suitable for Shortlist?

No verified blocker to PUBLIC RADAR TRACKING within the bounded first-party evidence reviewed; material permissions and mitigations are explicitly disclosed.

Analysis runs locally but model host may receive extracted evidence
Local reverse-engineering processes and external model providers may receive extracted material; respect legal rights, secrets and code confidentiality.
Reverse-engineering operates with local user permissions and can launch untrusted targets; local authenticated sockets are not full sandbox.
Local analysis and setup-generated integrations
Local analysis providers; licensing may apply to Hopper
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Sensitive access: Application binaries, Local code, Binary metadata
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.
full exact tool inventory or deployment-specific access configuration
package/registry version may differ from HEAD; pin before production install
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Must have rights/authorization to inspect target
Native deep analysis requires supported provider tools
CLI setup modifies agent integrations only after approval
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

GitHub REST repository pushed_at 2026-10-09T23:03:57Z for morluto/rea

Technical identity

github.com/morluto/rea

Exact implementation source: https://www.npmjs.com/package/rea-agents ↗
Reviewed resource type: MCP Server
Repository identity: morluto/rea
Package identity: npm:rea-agents

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

GitHub repository ↗
morluto/rea
Recorded repository material and project history.
Package registry ↗
rea-agents
Recorded package identity, distribution or download evidence.

Setup · Watchlist

Install & Agents

agent-installer

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
REA reverse engineering tooling includes agent setup wizard for MCP plus workflow instructions.
client registration · Publisher instructions
npx rea-agents setup
Configure / authenticate
Publisher instructions
REA uses `npx rea-agents setup`; native analysis providers require explicit installed tools, while JavaScript static analysis needs no native provider. Setup may optionally install Hopper with approval.
Check connection
Suggested check
Check installation and help; analyze only a harmless local test sample if desired.
Remove / uninstall / revoke
MCP100 setup guide
Unregister REA from the selected agent and review generated workflow/skill instructions independently before deleting; global package uninstall does not wipe analysis projects.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
npm uninstall --global rea-agents

Official Documentation & Sources

What it does

Local reverse-engineering CLI/MCP that analyzes binaries, JavaScript/Electron, websites and more using selected inspection providers.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Investigate applications and binaries with local agent-driven reverse engineering

Representative uses

Inspect app binaries
Trace symbols and references
Analyze JavaScript apps
Compare reverse-engineering evidence

Limitations

Must have rights/authorization to inspect target
Native deep analysis requires supported provider tools
CLI setup modifies agent integrations only after approval
Analysis runs locally but model host may receive extracted evidence
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Local analysis providers; licensing may apply to Hopper
Permissions: Local analysis and setup-generated integrations
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Analysis runs locally but model host may receive extracted evidence

Access scope and cautions

Write actions: Not verified
Sensitive access: Application binaries Local code Binary metadata
Risk level: moderate
Security notes: Local reverse-engineering processes and external model providers may receive extracted material; respect legal rights, secrets and code confidentiality. Reverse-engineering operates with local user permissions and can launch untrusted targets; local authenticated sockets are not full sandbox.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inspect app binaries; Trace symbols and references; Analyze JavaScript apps; Compare reverse-engineering evidence.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y rea-agents mcp. Recorded transport: stdio. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local analysis providers; licensing may apply to Hopper

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. Recorded permission context: Local analysis and setup-generated integrations

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Application binaries; Local code; Binary metadata.

What limitations and risks should I check before use?

Analysis runs locally but model host may receive extracted evidence. Must have rights/authorization to inspect target. Native deep analysis requires supported provider tools. CLI setup modifies agent integrations only after approval. No independent release lifecycle audit; do not claim precise activity date. Local reverse-engineering processes and external model providers may receive extracted material; respect legal rights, secrets and code confidentiality. Reverse-engineering operates with local user permissions and can launch untrusted targets; local authenticated sockets are not full sandbox. Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.