REA Reverse Engineer Anything MCP Hands-On: Let AI Recreate Games and Software with One Sentence
One sentence to clone a game, one sentence to reproduce a macOS built-in app—REA, the viral GitHub project, pulled this from fantasy to hands-on reality. This article breaks down how it works and where it actually sits in the business landscape.
1. What Is REA: Letting Claude Code Tear Software Apart on Its Own
REA (Reverse Engineer Anything) is an open-source reverse engineering toolkit built for AI coding agents. It plugs into Claude Code, Codex, Cursor and other coding agents through the MCP (Model Context Protocol), wrapping professional decompilers like Hopper and Ghidra into MCP tools that the agent can call. Hand the agent a binary and it can dissect the internals like an analyst.
After installing it in Claude Code, you don’t have to be a “prompt typist” anymore. This aligns with the ideas in the AI Model Internals Walkthrough about letting models truly understand the world rather than pattern-match the surface—encapsulating high-bar capabilities into agent-callable tools and letting the model reason about when to use them.
Just say something like:
1 | Reverse engineer the "Notes" app, describe how the search feature works, |
The agent launches Hopper, runs Ghidra, reads the assembly, walks the call graph, then writes code for your project based on what it learned. The analysis runs locally; no binary ever leaves your machine.
The official repo morluto/rea was created in April 2026, then exploded in early October—pulling in 120,000 GitHub stars in three days.
2. What REA Has Already Pulled Off: Games, Photoshop, macOS All Cloned
REA’s grip on the GitHub Trending top spot ballooned its Showcase ecosystem fast. The community has run REA through several canonical playbooks:
- Hybrid games: splice Minecraft’s blocky world with Naruto’s Shadow Clone and Rasengan, one developer finished the entire pipeline in 20 minutes for $7, and the output is not a demo—it is a real playable game where you can fire Rasengan.
- One-shot Photoshop clone: take the 1:1 Photoshop UI and feature set apart and rewrite it, free for self-use, no subscription needed.
- Replicate macOS built-in apps: open the built-in “Notes” app, analyze the SQLite schema and index strategy behind the offline search feature, then rebuild a TypeScript + SQLite version inside your own project.
- Cross-version diff analysis: open two versions of the same app inside a single agent session and diff their code paths for regression triage or security audits.
These use cases collapse into two main tracks: game developers use REA as a “cross-game mechanics carrier,” and traditional software engineers use it as a “black-box manual generator.”
3. How It Works: Agent → REA → Hopper/Ghidra → Binary
The architecture is clean, three layers:
| Role | Task |
|---|---|
| Coding agent (Claude Code / Codex / Cursor) | Receive natural-language requirements, break the task down, call REA tools, read results, then write product code |
| REA (CLI + MCP server) | Translate requirements into binary analysis actions: open the app, list functions, trace call graphs, decompile, read assembly, maintain session context |
| Hopper / Ghidra | The actual decompilation engine: recover pseudocode, assembly, symbols, strings, metadata |
A typical reverse engineering flow looks like this—the agent hands each step to REA:
| Step | Agent action | REA tools called |
|---|---|---|
| 1 | Open and identify the binary | open_binary, binary_overview |
| 2 | Search for suspicious clues | search_strings, search_procedures, list_names |
| 3 | Connect strings to executable code | find_xrefs_to_name, xrefs, procedure_callers |
| 4 | Rebuild control flow | get_call_graph, procedure_callees, procedure_info |
| 5 | Decompile relevant procedures | procedure_pseudo_code, procedure_assembly, batch_decompile |
| 6 | Write the feature in your project | Agent completes with its standard file editing and testing tools |
The README makes it clear REA “does not promise to recover the original source code,” but it reliably delivers pseudocode, assembly, symbols, strings, metadata, and call relationships—more than enough for the agent to explain how a feature actually works.
4. Install and Get Started: A Whole Toolkit in Ten Minutes
REA’s install experience is engineer-friendly: it supports macOS, Ubuntu 24.04+, Fedora 41+, and 64-bit Arch Linux, pulled in with a single command.
1 | # One-shot install (macOS / Linux) |
The setup subcommand prints the full change plan first and only touches Homebrew or Node.js after you confirm. It auto-detects your installed clients—Claude Code, Claude Desktop, Cursor, Gemini CLI, Windsurf, Devin—and auto-configures MCP for the first six. Devin is reported but untouched because the local MCP boundary is still ambiguous.
After setup, restart the client so REA loads. Then any sentence starting with “use REA to reverse engineer…” sets the agent off.
5. Hands-On: Clone a Full Game in 20 Minutes and $7
The hands-on flow uses the most popular recipe: use Claude Code + REA to clone a Minecraft-meets-Naruto hybrid game.
If you want to anchor on what Claude Code itself can do first, the Codex Six-Month Roundup and the GPT-6.1 Sol vs Opus 5.5 hands-on cover Codex/Claude Code cost and performance benchmarks across different scenarios.
Open Claude Code and feed it one natural-language prompt:
1 | Use REA to build me a game: |
Claude Code initially mistook REA for React’s REA. After one clarification—“REA = Reverse Engineering Anything MCP”—the agent called Hopper, reverse analyzed the Minecraft client for block generation, AI behavior, and physics engine calls, then reverse analyzed the Naruto module’s combat state machine, merged both into one web project (Vue / Three.js style), and launched it with vite --port 5173.
Key numbers from the run:
- Time spent: 20 minutes (about 15 of those waiting on Hopper analyses)
- API cost: roughly $7 worth of Claude Code tokens
- Output: a playable NarutoCraft web game where Rasengan, Shadow Clone, and water-walking all work
Run the same prompt in Codex or switch to Cursor—the workflow is decoupled from any single coding agent.
6. Phenomenal Showcase: An Open-Source Stack Replacing Adobe
REA’s blast radius is bigger than the tool itself. The community has stood up a getartcraft.com site hosting the open-source clones for free download:
- PhotoCraft: open-source image editor, Photoshop counterpart
- VectorCraft: vector drawing tool rewritten in Rust
- FilmCraft: open-source video editor
- LightCraft: local RAW processing + photo library
- SoundCraft / WordCraft / DeckCraft / CADCraft / GridCraft: counterparts for audio, docs, presentations, CAD, and spreadsheets
For the first time, “Adobe-style” subscription software has a complete, maintainable, community-driven free alternative path.
Note: clone implementation ≠ source-code theft. PhotoCraft and friends look similar because of shared design language; the features look similar because they re-implement documented behaviors. Repackaging the target app’s executable, trademarks, or proprietary assets is still infringement.
7. Business Read: What Kind of Door Does REA Open?
REA’s most legible impact is on the business side. This genuinely does feel like a mobile-platform explosion in miniature—it opens new doors for some and closes old ones for others.
| Angle | Old paradigm | New paradigm (after REA) |
|---|---|---|
| Indie developers | Need source code to clone a feature | Feed any app to the agent, get a “black-box manual” in 30 minutes |
| Small studios | Hire senior reverse engineers for 6-12 months | One agent + one Mac = MVP in a week |
| Large software vendors | Closed-source moat = 20 years of exclusivity | Binary functionality easily recovered, moats move to data + experience + ecosystem |
| Platform apps (WeChat, Alipay, Douyin) | Client + server coupled, black box holds | Client logic recovered, server still black box; accounts and assets not directly compromised, but client vulnerability surface grows |
Lay “capability / target / obstacle” along a time axis and REA pushes capability forward by a big leap, leaves target unchanged, and drops obstacle sharply. That is exactly why many projects that used to be impossible (custom hybrid games, cross-app feature migration) suddenly become small jobs.
Short term:
- Closed-source commercial software’s client-experience advantage will get flattened fast
- Server side, data, ecosystem, brand become the real moats again
- The reverse engineering job market reshapes—more people can do the work, unit prices collapse
8. Security Boundary: Being Able to Reverse Engineer ≠ Being Free to Abuse
REA’s power is exciting but raises unavoidable security questions. The community and the official repo both publish clear boundaries:
- Local execution: binary analysis runs entirely on your Mac, REA never uploads binaries to any cloud
- Authorization risk: using REA to disassemble someone else’s copyrighted closed-source app may violate local reverse engineering exceptions and the software license
- Customer account safety: WeChat, Alipay, Douyin’s core business logic, user assets, and account state all run on the server; REA cannot reach them. Only client code is recovered, so account safety is not directly compromised
- Vulnerability disclosure: if REA helps you uncover a product vulnerability, report through the vendor’s private channel (see REA’s SECURITY.md), do not publish exploitable details publicly
Taking REA to disassemble someone else’s closed-source commercial app and repackaging it still counts as infringement; using REA on open-source software, researching common design patterns for your own projects, or doing compatibility research is the use case it encourages.
9. Limits and Reality: REA Is Not a Universal Cloner
The hands-on run also exposed a few clear edges:
- Complex business logic: the agent can see “what this function does” from the binary, but it rarely recovers “why the entire product does it this way”
- Assets and materials: what comes back is structure, Artwork, sound effects, fonts, and special effects still require legal licensing
- Perfection: a single prompt will not generate a “perfect, money-printing product right away”—it still needs testing, iteration, and design polish
- Long-term maintainability: the reverse-engineered output is a black box to you, and one update from the original author forces you to reanalyze
Treat it as a black-box manual generator + cross-product mechanics carrier and the ROI is fastest; expecting it to one-shot the next WeChat, Notion, or Photoshop is unrealistic.
10. Action List: Three Audiences Who Should Boot REA Today
| Who | How to use it | Startup cost |
|---|---|---|
| Indie game developers | Use REA to port a favorite game’s mechanics into your prototype, validate gameplay in 3 days | Claude Code subscription + Hopper license |
| App developers | Use REA to tear apart macOS built-in Notes, Calculator, Preview, study their interaction details | Existing Claude Code + REA |
| Product managers / founders | Throw a competitor’s app at the agent, get back a “black-box manual + cross-feature migration script” | Claude Code subscription only |
Regardless of which one you are, install REA within two weeks and pick one daily-use app to run through it once. That single session tells you whether it has real value for you far better than reading 100 reviews.
Summary
REA (Reverse Engineer Anything) is not a toy. It is the key step that, for the first time, packages professional reverse engineering capability into a toolkit that coding agents can call. Its viral moment is not an accident—it actually shifted the long-standing “no source code means no cloning” line, letting Hopper and Ghidra—30-year-old tools—find a new home court in the AI era. If you are building a new product, studying a closed-source app’s design, or just wanting to make your own hybrid game, REA is worth installing and trying once.
What is the first thing you do after installing it? Share in the comments.
Further reading