Just Use REA — Turn Your AI Agent Into a Feature Detective

You’re using a competitor’s app and you notice something clever — a clipboard sync that feels instant, a search that actually understands context, an export that just works. You want to know how they built it. Until recently, “figure it out” meant a week of spelunking through network captures, guessing at architecture, and dead ends. REA cuts that to an afternoon.

REA (“Reverse Engineer Anything”) is an MIT-licensed MCP server that registers with your AI agent — Claude Code, Cursor, Codex, Gemini CLI — and gives it the ability to inspect an installed app without its source code. Version 6.7.0 shipped on October 18, 2026, and the repo has become one of the fastest-growing on GitHub this year, topping the weekly trending chart with over 325,000 stars.

What Happened

REA registers as an MCP server in one command — npx rea-agents setup — and from that point your agent gains a set of inspection skills it can invoke on demand. The 6.7.0 release fixes JSON/JSONC configuration handling so that setup correctly modifies the last repeated member in your MCP client config, matching how clients actually read it. No breaking changes to the analysis capabilities themselves; this is a reliability fix that makes setup work correctly across Claude Code, Cursor, Codex, and Gemini CLI without manual config surgery.

What REA can inspect as of this release:

• JavaScript and Electron apps (Notion, Slack-style desktop apps) — no decompiler needed; REA returns modules, imports, and evidence directly
• Websites — via a Chrome-family browser
• .NET assemblies — inspected natively
• Android APKs — via headless JADX (added in 4.1.0)
• Native binaries — via Ghidra (free), Hopper, or IDA Pro (both paid)
• SQLite databases and network captures

The workflow is: your agent asks REA a question about a feature, REA inspects and traces the app, and returns code locations, references, and explicit unknowns. The agent explains the mechanism and can write and test a comparable implementation in your project. Every answer includes what REA found and what it couldn’t determine — no false confidence.

The Notion clipboard case study at rea.tools/showcase/notion shows exactly how this plays out: REA traces the clipboard bridge from the renderer through the preload script and IPC wrappers, returning the specific locations and call patterns. That’s the level of specificity you’re getting.

Why It Matters

The practical moat most SaaS products enjoy isn’t trade secrets — it’s the effort required to reverse engineer their UX decisions. REA doesn’t eliminate that effort, but it changes who can do it. A solo builder with Claude Code and an afternoon can now get to a working hypothesis about how a feature is architected in the same time a senior engineer used to spend just setting up the analysis environment.

The community reaction on Hacker News (805 points, 337 comments) was split between “this is fascinating” and “is this legal?” — which is the right tension to sit with. The legal question matters and we address it directly below. But the signal under the community reaction is clear: the “too hard to rebuild” argument for closed-source technical complexity is getting weaker. Small teams that treat their architecture as their moat need to be thinking about this.

For builders on the other side of that equation, the opportunity is real. Patterns that previously required either source access or months of observation are now inspectable in an afternoon. That’s a genuine shift in what’s possible for a one- or two-person product team.

The Take

REA is the most practical tool we’ve seen for answering “how did they do that?” — and it’s free, runs locally, and connects to the agents most builders are already using. The setup cost is real (Node.js 22.19+, and native analysis requires a decompiler), but you pay it once. After that, your agent has a new skill it can invoke any time you’re staring at a feature you want to understand.

Use it to learn. Build your own implementation. That’s the entire point of the workflow — REA traces the mechanism, your agent explains it, and you write code that solves the same problem your way. This is not a copy-paste pipeline, and treating it as one is both legally risky and practically pointless (you don’t want their technical debt along with their clever idea).

The legal boundary is sharp and worth stating plainly: REA’s own disclaimer scopes it to “lawful reverse-engineering research, analysis, and reconstruction.” Do not use it to copy proprietary code or assets. Do not use it to bypass license checks, DRM, or authentication. Many EULAs explicitly forbid reverse engineering. In the EU, decompilation is only permitted in narrow interoperability cases. When in doubt, analyze apps you own, open-source software, or your own builds. Community use on Hacker News clusters around preservation, interoperability, and learning — not cloning competitors — and that’s the right frame.

There’s also a provider-policy risk worth naming: as of October 2026, users have reported OpenAI account bans for pointing agents at third-party binaries. That’s an OpenAI usage policy issue, not a REA issue, but it’s a real consequence. If you use Codex for this, read the policy first. Claude Code and Gemini CLI are the cleaner choices for this workflow right now.

Who should skip REA entirely: non-technical users who just want a tool recommendation. This is a developer tool with a real setup curve. If you don’t write code or build automations yourself, nothing in the output will be actionable for you.

If you do build things — products, automations, internal tools — REA changes the answer to “could we figure out how that works?” from “probably not” to “probably yes, this week.”