🔍 Read the full analysis: Which Parts Of An Unfamiliar App Should AI Explore First? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A report published by ThorstenMeyerAI.com on Oct. 19 describes how the open-source Reverse Engineer Anything (REA) toolkit can help coding agents inspect unfamiliar software. Its practical recommendation is to investigate one concrete behavior at a time, confirm the agent is actually using REA, and distinguish observed evidence from inference and unknowns.
REA is described as a local Model Context Protocol (MCP) server, command-line utility and agent skill. It can connect coding agents—including Claude Code, Codex, Cursor and Gemini CLI—to analysis tools for several kinds of software, such as JavaScript and Electron apps, .NET applications, Android apps, firmware and databases. The report says its version 6.7.0 was released on Oct. 18.
The report’s core recommendation is to replace broad prompts such as “figure out how this program works” with a bounded question about a behavior and the decision it informs. For example, an investigation might ask how an app handles a partial invoice payment, which information it stores, how it calculates the remaining balance and what conditions affect the result. The report advises asking the agent to label findings as observed, inferred or unknown, and to explain a complete example with inputs and outputs.
As an illustration, the report describes Ledger Reborn, a local accounting app whose author investigated QuickBooks Desktop for Mac 2024 using REA 6.4.0 and Ghidra. The stated focus included inventory calculations, budget signs, reconciliation balances and cash-basis reporting. According to the report, the new app’s profit-and-loss statement, balance sheet and trial balance for Intuit’s sample company matched the original account by account, to the cent. That is a result reported by the project’s author, not an independent audit presented in the source.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
Why Narrow App Investigations Help
The approach matters to developers using AI agents to build replacements, integrations or companion apps. A screen can show what a program looks like without explaining its data model, calculations or decision rules. If an agent works from appearance alone, its implementation may fail when users encounter less common cases, such as partial payments or changes to inventory.
Investigating a single behavior gives the work a testable endpoint: the agent should explain the stored records, calculation and conditions, then walk through a concrete case. That makes it easier for a developer to spot unsupported assumptions before turning them into code. The reported QuickBooks example suggests this method can inform a detailed implementation, but one case study does not establish that REA or an AI agent will reproduce other software reliably.
The report also highlights a practical reliability check: confirm that the coding agent actually calls REA. Its setup diagnostic checks files and prerequisites, the project documentation says, but does not verify the live agent connection. If the agent answers without using an REA tool, its response may be based on model-generated guesses rather than an inspection of the target.
software reverse engineering toolkit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How REA Connects Agents to Apps
REA is presented as an MIT-licensed open-source project hosted on GitHub. The report says it had about 325,000 stars and 82,000 forks on Oct. 19, after appearing on GitHub’s trending page earlier in October. Those figures are dated observations from the source, not a measure of the software’s accuracy or adoption in production.
The toolkit can use different analysis engines depending on the target, including Ghidra, Hopper or IDA for native programs. For website investigations, the report says REA can attach to a Chrome-family browser controlled by the user and observe its behavior. It recommends installing the tools, restarting the coding agent and checking that REA tools are available before beginning an investigation.
There is also a data and security distinction: REA runs analysis locally, but the agent receives its results, and the model provider may receive them under its own data policy. The project warns, “This is not a sandbox.” The report says opening an untrusted program gives analysis tools access under the user’s permissions, so unknown binaries should be handled with the same caution as other untrusted files.
“The project’s profit-and-loss statement, balance sheet and trial balance matched the original account by account, to the cent.”
— Ledger Reborn case study author, as summarized by ThorstenMeyerAI.com
code analysis tools for app investigation
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Evidence
The source presents a practical report and a project case study, not a controlled evaluation of REA’s accuracy across different apps. It does not provide an independent audit of the Ledger Reborn comparison, detailed test results for other software, or evidence that an agent’s conclusions will be correct without human review. The reported matching of accounting statements should therefore be treated as the case study author’s result.
It is also not clear from the supplied material how reliably the toolkit handles every supported format, which analysis steps were fully automated, or how much specialist knowledge was needed to interpret the outputs. REA can provide evidence to an agent, but the report does not establish that it can resolve ambiguous behavior or guarantee a complete reconstruction. Data handling beyond the local analysis stage depends in part on the coding agent and model provider.
AI coding assistant for app exploration
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Tools Before Investigating
The report recommends beginning with a narrow question, installing REA through its guided setup and checking both prerequisites and the live connection. It gives a diagnostic command for checking setup files, while stressing that users should also ask the agent to call REA’s binary_session tool to confirm available analysis tools. A harmless app the user owns can serve as an initial test target.
For each investigation, developers can ask the agent to identify stored data, calculations and conditions, mark statements as observed, inferred or unknown, and stop after explaining one complete example. The next useful test is whether those findings hold across additional inputs and edge cases. The source does not announce a future release or independent study, so further validation of the case study’s results and REA’s broader performance remains open.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source toolkit described as a local MCP server, command-line tool and agent skill. It connects coding agents to software-analysis tools for inspecting existing programs.
What should an AI agent investigate first?
Start with one specific behavior tied to a design decision, such as how an app handles a partial payment. Ask for the relevant data, calculation, conditions and a worked example instead of requesting a general explanation of the whole app.
How can a developer tell whether the agent used REA?
Check that REA tools are available and confirm the agent makes a tool call, such as the project’s binary_session call. The report says the setup diagnostic checks files and prerequisites but does not confirm a live agent connection.
Does the Ledger Reborn example prove REA can reproduce accounting software?
No. The source reports that Ledger Reborn’s author matched three accounting statements for QuickBooks’ sample company, but it does not describe an independent audit or show that the result generalizes to other programs.
Is REA safe to use on an unknown program?
The project warns that REA is not a sandbox. The report says analysis tools run with the user’s permissions, while results may also be sent to the agent and model provider under their policies. Treat unknown programs as untrusted files.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
