System purpose
REA is a TypeScript CLI and local MCP server. It connects an agent to native disassemblers, application static analysis, and runtime observation. The agent uses that evidence to investigate a feature, then write and test its own implementation. Official definition
Use cases:
Trace Electron IPC paths.
Understand bundled JavaScript modules.
Inspect native assembly and pseudocode.
Generated implementations still need tests; static relationships and unresolved findings constrain the conclusions.
Agent or terminal
- MCP
- CLI
Shared analysis workflows
- EnhancedTools
- createWorkflowEvidence
Analysis tools
- Hopper
- Ghidra
- IDA
- JavaScript
- Browser
Analysis results
- Evidence
- locations
- limitations
CLI and MCP share analysis workflows. Each CLI invocation uses an isolated session; MCP retains its session within the connection. CLI implementation; MCP registration
Evidence preserves these facts for tracing and comparison:
Target digest and source locations.
Observations and inferences.
Analysis limitations.
Installation and verification
- Not completed:
Use Node.js 22.x (at least 22.19), 24.x (at least 24.11), or 26 and later, with npm. Node.js 23, 25, and prereleases are unsupported.
- Not completed:
Static JavaScript analysis needs a supported runtime. Native analysis also needs Hopper, Ghidra, or IDA.
- Not completed:
Website observation needs a Chrome-family browser. Prepare Android, firmware, and other toolchains according to the next section.
Start setup with the latest npm release:
npx rea-agents@latest setupSelect clients, review the plan, and approve the changes. Setup adds the MCP registration and matching workflow skill, backs up existing configuration, and requires an agent restart afterward. The support table lists 17 clients. Installation guide
Client examples:
Claude Code and Codex.
Cursor and Gemini CLI.
Pi and Hermes.
Check only the Codex registration, or inspect a repair plan:
npx -y rea-agents@latest doctor --client codex --json
npx -y rea-agents@latest setup --client codex --dry-run --jsonInstall the global CLI when you need a shell command:
npm install --global rea-agents
rea --help
rea providers --json
rea capabilities --jsonCore capabilities
Native
open_binary
Native program analysis
Use Hopper, Ghidra, or IDA for pseudocode, assembly, strings, symbols, and references. Supported formats and hosts depend on the engine.
JavaScript
analyze_javascript_application
JavaScript and Electron structure
Build an application graph from a directory or ASAR, including imports, modules, source maps, and IPC. Static analysis does not execute the application.
Trace
trace_application_feature
Feature path tracing
Start from a route, string, API, IPC channel, or module to trace relationships and native handoffs in an authenticated graph.
Compare
compare_application_versions
Version comparison
Compare two application Evidence records. Duplicate candidates and incomplete coverage remain ambiguous or unknown.
Browser
inspect_web_page
Website structure and observation
Capture page structure, scripts, and network observations. Interactive scenarios use capture_browser_scenario separately and may change website state.
Evidence
inspect_analysis_view
Analysis view projection
Read a summary or module page from completed Evidence. Keep the full record for subsequent tracing and comparison.
MCP names use underscores; corresponding CLI names use hyphens. Specify --provider when multiple engines are available. CLI commands
Native CLI commands:
analyzeandsearch.functionanddecompile.xrefsandtrace.
| Other target | Output | Additional requirements |
|---|---|---|
| .NET assemblies | Metadata, CIL, native dependencies, and build comparisons | Static inspection without a native analysis engine |
| Android APKs, devices, and resources | Manifest, decompiled methods, device observations, and resource tables | JADX and a full JDK; adb for devices, Apktool for resources |
| Firmware | Regions, extraction results, and native-analysis handoffs | Binwalk or Unblob on Linux |
| HAR and network captures | Requests, responses, exposed payloads, and source locations | HAR; Linux and mitmdump for native mitmproxy captures |
| Process behavior | Terminal output, interactions, exit status, and filesystem observations | Linux or macOS with a native PTY |
| ELF and Linux crashes | Static layout, registers, and mapping candidates | Linux x64 and pwntools; GDB or pwndbg for some functions |
| WASM and EVM | WAT, imports/exports, or bytecode dispatch | WABT 1.0.42 for WASM; Linux x64 for EVM carrier analysis |
| JEB projects | Analysis units, digests, and type/method pseudocode | A caller-started JEB MCP client selected through REA_JEB_MCP_URL |
Requirements follow the official capability table. Check the tool's availability and guide for the intended host and format.
Operating principles
Sessions and engines
Check current tool availability with binary_session. A native session binds to the selected engine; an explicit selection failure does not trigger fallback to another engine.
MCP runtime contracts
Static inference and runtime observation
A reachable code relationship does not prove execution. Dynamic names, obfuscation, and unsupported syntax remain unknown; missing relationships do not establish behavioral absence.
JavaScript application workflows
Complete Evidence and readable summaries
Save the complete JSON, then use inspect_analysis_view for a summary. Separate CLI calls need saved Evidence; retained MCP references belong to one connection.
CLI and Evidence
Coverage in version comparisons
A one-sided absence is added or removed only when the opposite graph has complete coverage. Incomplete inputs remain unknown.
JavaScript application workflows
Before reconstruction, ask the agent for:
Source locations.
Relationship bases.
Unresolved findings.
Record these evidence types separately to preserve what each establishes. Graph workflows; MCP contracts
Static inference.
Runtime observation.
Reconstruction tests.
Worked example
Create a small Electron source fixture with a notes:search channel. This example was tested on macOS with Node.js 22.23.1 and REA 6.4.0. It analyzes files without starting Electron.
mkdir -p /tmp/rea-report-fixture
cat > /tmp/rea-report-fixture/package.json <<'JSON'
{"name":"rea-report-fixture","version":"1.0.0","main":"main.cjs"}
JSON
cat > /tmp/rea-report-fixture/main.cjs <<'JS'
const { ipcMain } = require('electron');
const { normalizeQuery } = require('./search.cjs');
ipcMain.handle('notes:search', (_event, query) => normalizeQuery(query));
JS
cat > /tmp/rea-report-fixture/search.cjs <<'JS'
exports.normalizeQuery = query => String(query).trim().toLowerCase();
JS
npx -y rea-agents@6.4.0 analyze-javascript-application /tmp/rea-report-fixture --json > /tmp/rea-report-evidence.jsonWith jq installed, select fields from the saved result:
jq '{operation, relevant_files: .normalized_result.statistics.relevant_files, parsed_javascript_files: .normalized_result.statistics.parsed_javascript_files, main_handlers: .normalized_result.summary.ipc.main_handlers, literal_channels: .normalized_result.summary.ipc.literal_channels}' /tmp/rea-report-evidence.json{
"operation": "analyze_javascript_application",
"relevant_files": 3,
"parsed_javascript_files": 2,
"main_handlers": 1,
"literal_channels": 1
}Project a readable summary while retaining the complete Evidence file:
jq -c '{source: {kind: "inline", evidence: .}, view: {kind: "summary"}}' /tmp/rea-report-evidence.json > /tmp/rea-report-view.json
npx -y rea-agents@6.4.0 inspect-analysis-view /tmp/rea-report-view.jsonThe result identifies the fixture's static IPC structure. These behaviors remain unverified:
Electron startup.
Channel registration.
Query results.
Permission checks.
Run the application and test those behaviors separately. Example contracts
Limitations and cautions
| Boundary | Action |
|---|---|
| Local analysis and model data policies | REA analyzes locally. The agent receives tool results, and its model provider's data policy still applies. |
| Large results and resources | Complete application Evidence can reach hundreds of MB. Save it, project a summary, then select relevant modules. |
| Native tools and platforms | Hopper has a separate commercial license and demo limits. Windows Ghidra support is experimental; check the engine's host and format requirements. |
| Timeouts and cleanup | A client timeout may leave engine analysis running. Check analysis_activity and cleanup_incomplete to determine process state. |
| Inference and missing data | Preserve limitations in static relationships and decompilation. Incomplete data cannot establish behavioral absence or reconstruction equivalence. |
| Test coverage | The project provides several verification depths and toolchain lanes. Client tests using local model fixtures do not establish live model API compatibility. |
See the security policy for permissions, MCP contracts for session state, and verification guide for test boundaries.
Next steps
Complete the static fixture analysis and check the version, Evidence, and summary projection.
Select a real target, one feature, and the expected output. Add a native engine or browser according to tool availability.
Save Evidence and source locations, then trace the feature. Keep complete inputs for both versions when comparing builds.
Put the reconstruction and acceptance tests in your own project. Test input boundaries and the observed behavior.
Start with the static CLI to evaluate REA without changing agent configuration. Configure MCP for ongoing investigation through an agent, then add the appropriate capture tools when you need execution evidence.