One email. No follow-up unless I ship something that fits.
Read firstREA is short for Reverse Engineer Anything, an MIT licensed project at github.com/morluto/rea (379,538 stars on 25 Oct 2026). Setup facts come from its README and installation guide, read that day. The three prompts are my wording. I ran REA's terminal command on a small demo app of my own, and the output below is real. I did not run the prompts through an agent for this guide. This is not legal advice.
THE PERMISSION RULES
Read this before you run anything
REA's own README says you must legally obtain and be authorised to use commercial tools, and that cracked copies, stolen keys and bypassing licence restrictions are not authorised. Its disclaimer adds that public availability of software, or having a file, does not by itself give you permission. Here is that in plain English:
Yesown itSoftware you wrote or own. Your app, your old project, your own build.
YesallowedSoftware you are authorised to examine. Written permission, or a licence that clearly allows it.
AsklicensedA tool you license. A licence to use is not always a licence to examine. Read the terms first. This line is my reading of the disclaimer, not REA's wording.
NocrackedCracked copies and stolen keys. Never.
NobypassGetting around licence checks, DRM, anti cheat or logins. REA says it will not help with these.
NocopyingCopying someone's protected code or assets into your own product. Build your own version from what you learned.
Also checkREA's disclaimer says reverse engineering may be restricted where you live or by the licence of the software. Some REA workflows run programs, and permission to inspect a file does not necessarily cover running it. Everything in this guide uses static analysis, which reads files and does not run them.
WHAT YOU NEED
Node.js and npm. REA's README requires Node 22.x (22.23.4 or newer), 24.x (24.22.1 or newer) or 26.12.1 or newer. Node 23 and 25 are unsupported. Check with node --version.
A coding agent. REA's setup supports Claude Code, Codex, Cursor, Gemini CLI and others.
An app you may examine. For your first run use one you wrote. A small Electron or JavaScript app is ideal.
Nothing else for JavaScript apps. The README says static JavaScript analysis needs no Hopper, Ghidra or IDA. Those are for native binaries.
SETUP
One command, in two safe steps
Setup registers REA with your agent and installs its workflow instructions. Preview first. A dry run changes nothing:
Read the plan. When it looks right, run the real thing, pick your agent, review the exact changes and approve them:
terminal2. setup
npx rea-agents setup
Then restart your agent. Per the README, setup backs up existing configuration and asks before it changes anything. Swap claude_code for your own agent's ID if you use another.
Check itTo keep the command around, install it globally with npm install --global rea-agents. Then rea doctor reads your setup and reports what is missing, and rea update updates it. On Linux, REA's docs note a prerequisite: a procps compatible ps on the path.
TRY IT FIRST
A demo run with no agent
The README gives a terminal command for an extracted JavaScript or Electron app. Point it at a folder you own. I ran it on a tiny notes app I wrote, with one window, one search box and one search function:
The result is a long JSON file. Here is what mine said, condensed. I used REA 6.7.0 on 25 Oct 2026.
REA outputcondensed, real
WHAT IT FOUNDWindows: 1 BrowserWindowPage bridge: notes (1 member)Message channel: notes:searchSent by the page: 1. Handled by main: 1. Paired.Files: 5 relevant, 3 JavaScript parsedWHAT IT SAID IT COULD NOT SEEMissing findings do not prove absence.Static references do not prove runtime execution.1 inline script in index.html not analysed.
That last block matters most. REA lists its limits next to its findings. If an agent tells you something about an app and cannot point to evidence like this, treat it as a guess.
SAFE PROMPT 1
Explain a feature in an app you own
The README's example is: Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project. Start with the first half only:
paste into your agentexplain
Use REA to investigate how [feature] works in [app name], which I wrote. The files are at [path].Use static analysis only. Do not run the app.Explain the feature in plain English. For each claim show the evidence, and say what you could not see.Change no files.
Describe one feature, not the whole app. Small questions get checkable answers.
SAFE PROMPT 2
Audit a tool you license
This is the one to slow down on. Before you paste anything, tick all three:
I have a valid licence to use the tool, bought or granted legitimately.
I read its terms, and they allow examining how it works, or I have written permission from the maker.
I am examining files I already have. I am not getting around any licence check or protection.
If you cannot tick all three, stop. Ask the maker, or pick another tool. If you can:
paste into your agentaudit
I hold a licence for [tool name] and I have checked its terms allow this examination. The files are at [path].Use REA with static analysis only. Do not run the tool, and do not bypass or modify any licence check or protection.Tell me how it handles [feature, for example my data or its network use]. Show the evidence and the limits of what you could see.Do not build anything. I only want to understand it.
SAFE PROMPT 3
Document a legacy app before a rebuild
For an old app of your own that nobody can explain, even when the source is gone. Documentation first, rebuild second.
paste into your agentdocument
This is an old app that my company owns, and the source code is lost. The files are at [path].Use REA with static analysis only. Write a plain English document: the screens, the data it reads and writes, any network addresses it uses, and how the main features work.Mark each statement as proven, inferred or unknown, with the evidence.Then list the features we would need to rebuild. Write the list in your own words and copy no code.
The README says REA can also build a version of a feature for your project. Use that only for your own software, and from a specification in your own words. Never reproduce protected code or assets.
WHEN SOMETHING LOOKS OFF
Problems, and the fix
Setup says Node is unsupported
Check node --version. Node 23 and 25 are not supported. Move to 22.23.4 or newer, 24.22.1 or newer, or 26.12.1 or newer.
You are not sure you got the real REA
The README names its official sources: github.com/morluto/rea, rea.tools and the rea-agents package. A similar name or a copied README is not proof.
The agent tool does not show REA
Restart the agent after setup, then run rea doctor to see which registration is missing.
The agent states things with no evidence
Ask: show the evidence for each claim and mark what is inferred. Drop any claim it cannot back.
The agent offers to run the app
Say no unless you own it and understand the risk. Run unknown software only in a throwaway environment.
The tool you want to examine is not yours
Stop. Get written permission, or leave it alone.
NOT VERIFIED
What I could not confirm
The prompts through an agent. I ran REA's terminal command myself. I did not run these prompts in an agent session, so test them on a throwaway app first.
Your legal position. Rules differ by country and by licence. If the stakes are real, ask a lawyer.
Stars. The star count is popularity, not a safety review. Read what setup proposes before you approve it.
That is the whole starter
Check permission, preview setup, run it on your own app, ask for evidence. Sources: REA's README, installation guide and disclaimer, read on 25 Oct 2026.
I'm Raj Singh. I've led ecommerce at two Fortune 100 companies, and at one of them I ran about $8M a year in ads for four years. I've worked with AI since 2019. Now my engineering team and I ship AI products, including debtops.ai. Each guide here is written from a real install, with the output dated.
