--- title: REA hit 120K stars in a week, and nobody's asking permission description: REA (Reverse Engineer Anything), an MIT-licensed MCP server from developer morluto, lets coding agents reverse engineer apps without source code, covering... canonical: https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: REA hit 120K stars in a week, and nobody's asking permission | daily.dev og:description: REA (Reverse Engineer Anything), an MIT-licensed MCP server from developer morluto, lets coding agents reverse engineer apps without source code, covering... og:url: https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8 og:image: https://api.daily.dev/og/posts/9PXZfDCi8.png og:image:alt: REA hit 120K stars in a week, and nobody's asking permission og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # REA hit 120K stars in a week, and nobody's asking permission **[Trends](https://daily.dev/sources/trends)** · 2 min read · 1 upvotes · 0 comments ## Summary REA (Reverse Engineer Anything), an MIT-licensed MCP server from developer morluto, lets coding agents reverse engineer apps without source code, covering native binaries, Electron/JS apps, Android APKs, .NET assemblies and websites, using Ghidra, Hopper and IDA under the hood, and working with Claude Code, Codex, Cursor and Gemini CLI. Social media tracked its growth to roughly 120K GitHub stars in about a week, with various observers citing different snapshots (29K, 32K, 80K, 86.7K) along the way, reportedly the third fastest repo to reach 100K stars. Commentary splits between excitement about using it to deconstruct impressive app features (like one developer's LG TV reverse engineering turned Plex client) and unease that the same capability now lets anyone dissect a shipped app, with some noting it surfaces how something works without granting rights to copy it. ## Content The pitch is simple: point your coding agent at any app and it tears it down to the binary, explains how a feature works, and builds its own version. REA (Reverse Engineer Anything) is an MIT-licensed MCP server wired into Ghidra, Hopper and IDA. @Hesamation says it reached 120K stars in 7 days, the third fastest to 100K from repo creation. ## The hype @sanjaygpts: "software engineers are going to have some very interesting conversations with their competitors." Others pitched it as a way to see how Discord does typing indicators and then copy the idea. Plenty of the promo threads read the same, down to the "bookmark this" ending. ## The pushback The sharpest hit is a benchmark. A creator built "Lean REA", an 8KB skill file that maps the same jobs onto shell tools the agent already has (otool, nm, ripgrep). Across four tasks in Claude Code it was 38% faster, 35% cheaper, and used 60% fewer tokens than REA. Accuracy was nearly identical, 74/75 against 75/75. The author also says that with tool search off, REA's 207 tools can eat roughly 400,000 tokens on one trivial message, a $160 bill. InfoQ's writeup says some people question the value over just prompting an agent to use Ghidra. Others say it works better than their earlier attempts. A professional reverse engineer and vulnerability researcher tested it. REA rebuilt GNOME Calculator (a 90MB ELF binary, about 2,000 functions) in Python in 28 minutes. The clone was near-functional with minor UI bugs. His verdict: a well-built harness around existing LLM and decompiler tooling, not a new technique. A guide on the tool warns that decompiled pseudocode can mislead, and another author says one wrong number can pass every check. ## The worry The uncomfortable part is the flip side. @Joshua_WD points out that anyone's agent can now read your shipped app. Indie developers fear easier piracy and IP theft. The reverse engineer raises disposable abandonware and supply chain risk from unaudited AI clones. Both he and some commenters speculate big tech will respond by moving everything to the cloud, where there is no binary to dissect. @celineodier notes it won't hand you the original code, and that knowing how something works doesn't mean you may copy it. @bryantardal's take: skip the cloning and build small tools that fit how you work. ## Questions this post answers ### What is REA and what does it let AI coding agents do? REA, short for Reverse Engineer Anything, is an MIT-licensed MCP server built by developer morluto that lets coding agents like Claude Code, Codex, Cursor, and Gemini CLI reverse engineer apps without access to source code. It analyzes native binaries, Electron and JavaScript apps, Android APKs, .NET assemblies, and websites, integrating with tools like Ghidra, Hopper, and IDA, and runs entirely locally. _Developers tracking AI tooling that changes how shipped apps can be inspected follow tools like REA on daily.dev._ ### How fast did the REA GitHub repository gain stars compared to other viral projects? REA reached roughly 120,000 GitHub stars within about a week, making it the third fastest repository to hit 100,000 stars from creation by one tracked comparison, behind DeepSeek Harness at 2 days and OpenClaw at 67 days, and ahead of OpenAI Codex which took 465 days. Observers posted varying intermediate counts, including 29K, 32K, 80K, and 86.7K stars, as the number climbed. _Anyone evaluating whether a trending AI tool is worth adopting can watch adoption signals like this on daily.dev._ ### Can REA give you the actual source code of a reverse-engineered app? No, REA does not give you an app's original code or let you clone it; it only produces evidence of how something works by digging through the binary. Knowing how a feature works through this evidence does not mean you are allowed to copy it, a distinction raised even by enthusiastic early users of the tool. _Teams weighing reverse engineering tools against legal and ethical lines can keep up with this debate on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 16 comments across x (as of 2026-10-18). **TL;DR:** Replies are mostly impressed by using AI plus binary analysis to reverse engineer apps, but repeatedly warn that a single wrong constant or unresolved edge case can silently produce a convincing yet incorrect rebuild. **Sentiment:** 15% positive · 65% mixed · 20% skeptical **The case for** - Lets an agent learn from working examples when target API documentation is sparse, speeding up the learning curve. - Seen as a powerful new workflow combo that's gaining rapid adoption. **The pushback** - Passing tests doesn't prove the rebuild is actually correct — verification is the real bottleneck, not the reverse engineering itself. - A single wrong constant or miscalculation can produce a convincing but incompatible copy. - The binary reveals what the code does but not why edge cases exist, so intent is lost in the rebuild. - Reverse engineering without a proper test harness is dismissed as just 'vibes'. **By community** - x (mixed): Excitement about the AI-driven reverse engineering workflow is tempered by repeated warnings that unverified rebuilds can look right while being subtly wrong. **Hottest debate:** Whether a rebuilt app that passes tests can actually be trusted to match the original's true behavior. **Open questions** - How do you validate a rebuild's correctness beyond just passing the existing test suite? **Highlights** > @N01ennn The reverse-engineering capability is fascinating, but the real challenge is verification.Rebuilding an app is one thing; proving every behavior matches the original is another. In AI engineering, passing tests isn’t the same as being correct. > — [PromptDockAI on x](https://x.com/PromptDockAI/status/2110332976601133447) > @N01ennn Clean-room rebuilds are powerful, but the failure mode is the silent wrong constant that passes every test. How do you validate the rebuild beyond the test suite? > — [paulopierrondi on x](https://x.com/paulopierrondi/status/2110324403171135966) > @N01ennn The binary gives you ground truth but no intent. You're rebuilding what it does without the context of why those edge cases exist. > — [henkjan on x](https://x.com/henkjan/status/2110334140184965156) > @N01ennn Reverse engineering is like tracing a machine from its sound: one wrong measurement can still produce a convincing but incompatible copy. > — [catmanyau on x](https://x.com/catmanyau/status/2110343597229003231) > @N01ennn been using this since 4.5, oracle validation is the step everyone glosses over then wonders why it falls apart. reverse engineering without a test harness is just vibes. built a lightweight version for api work last month, can share if fancy a look > — [dancolta on x](https://x.com/dancolta/status/2110322942081208455) **Source threads** - [x](https://x.com/N01ennn/status/2110319993128706208) · 63 points · 16 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"REA hit 120K stars in a week, and nobody's asking permission","url":"https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8"},"datePublished":"2026-10-12T13:07:50.046Z","dateModified":"2026-10-18T03:11:05.119Z","description":"REA (Reverse Engineer Anything), an MIT-licensed MCP server from developer morluto, lets coding agents reverse engineer apps without source code, covering...","image":"https://pbs.twimg.com/media/HUbrKtIXAAATeW2.jpg","thumbnailUrl":"https://pbs.twimg.com/media/HUbrKtIXAAATeW2.jpg","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,mcp,reverse-engineering","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"REA hit 120K stars in a week, and nobody's asking permission"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rea-hit-120k-stars-in-a-week-and-nobody-s-asking-permission-9pxzfdci8#faq","mainEntity":[{"@type":"Question","name":"What is REA and what does it let AI coding agents do?","acceptedAnswer":{"@type":"Answer","text":"REA, short for Reverse Engineer Anything, is an MIT-licensed MCP server built by developer morluto that lets coding agents like Claude Code, Codex, Cursor, and Gemini CLI reverse engineer apps without access to source code. It analyzes native binaries, Electron and JavaScript apps, Android APKs, .NET assemblies, and websites, integrating with tools like Ghidra, Hopper, and IDA, and runs entirely locally. Developers tracking AI tooling that changes how shipped apps can be inspected follow tools like REA on daily.dev."}},{"@type":"Question","name":"How fast did the REA GitHub repository gain stars compared to other viral projects?","acceptedAnswer":{"@type":"Answer","text":"REA reached roughly 120,000 GitHub stars within about a week, making it the third fastest repository to hit 100,000 stars from creation by one tracked comparison, behind DeepSeek Harness at 2 days and OpenClaw at 67 days, and ahead of OpenAI Codex which took 465 days. Observers posted varying intermediate counts, including 29K, 32K, 80K, and 86.7K stars, as the number climbed. Anyone evaluating whether a trending AI tool is worth adopting can watch adoption signals like this on daily.dev."}},{"@type":"Question","name":"Can REA give you the actual source code of a reverse-engineered app?","acceptedAnswer":{"@type":"Answer","text":"No, REA does not give you an app's original code or let you clone it; it only produces evidence of how something works by digging through the binary. Knowing how a feature works through this evidence does not mean you are allowed to copy it, a distinction raised even by enthusiastic early users of the tool. Teams weighing reverse engineering tools against legal and ethical lines can keep up with this debate on daily.dev."}}]} ```