The AI Reverse-Engineering Studio: 20 Open-Source Tools Around REA, Explained

A post calling it "f*cking dangerous" has been doing the rounds: the creator of REA (Reverse Engineer Anything) lists 20 GitHub repos that together make "a reverse-engineering studio." Point it at any app, the pitch goes, "and watch it explain itself." Strip away the hype and it is a genuinely useful map of the open-source reverse-engineering toolchain, plus one new ingredient that does change the game. Here is what each piece is, how they fit, what we could not verify, and what it means for defenders. (New to REA itself? Start with our REA explainer.)

What is actually new: the MCP glue

Almost every tool in the list has existed for years. Ghidra was released by the NSA in 2019; radare2, Frida, jadx and x64dbg have been staples for a decade. The shift is the Model Context Protocol (MCP) bridges — REA, GhidraMCP and ida-pro-mcp — that let an AI coding agent drive a decompiler, read pseudocode, rename functions, set breakpoints and query the results itself. Work that took an analyst hours of clicking now happens in a conversation. REA installs with npx rea-agents setup, registers with agents such as Claude Code, Codex, Cursor and Gemini CLI, and installs matching workflow instructions.

The 20 tools, layer by layer

How it chains together

The post's one-liner is binary → REA → SPEC.md → rebuild → oracle → retry. In practice a session looks like this:

1. Triage. The agent identifies what the target is (native, .NET, Electron, APK) and picks the right tool — jadx for an APK, ILSpy for a .NET DLL, Ghidra or IDA for native code.
2. Static analysis. Through GhidraMCP or ida-pro-mcp the agent reads decompiled pseudocode, follows cross-references and renames functions as it understands them; angr can answer "what input reaches this branch?" questions.
3. Dynamic confirmation. Frida hooks, x64dbg or RAD Debugger breakpoints, and mitmproxy traffic capture confirm what the code actually does at runtime.
4. Explanation. The agent writes up behaviour with the evidence it gathered — which is where REA's README stops: it explains, it does not recover source.
5. (Optional) Rebuild. The clean-room loop turns the explanation into a behavioural spec and an independent implementation checked against the original as an oracle. That step is where most of the legal risk lives.

Is it "f*cking dangerous"?

It is a capability shift, not a new class of attack. Determined reverse engineers could always do this; the cost just dropped from days of expert time to an afternoon with an agent. That cuts both ways:

• For defenders it is a gift. Malware triage, patch diffing, firmware audits and third-party binary reviews all get dramatically faster.
• For software vendors it is a warning. Anything shipped to a client — API keys, license checks, pricing or fraud logic, proprietary algorithms — should now be assumed readable by anyone with a laptop.
• For the agent operator it is a new attack surface. An agent reading a hostile binary is reading attacker-controlled strings, so prompt injection from inside a sample is a real risk. Dynamic tools execute the target, so isolation is mandatory.

How to use it responsibly

1. Authorization first. Only analyze software you own, have written permission to test, or are researching under a legal exception. Read the EULA — many prohibit reverse engineering.
2. Isolate. Run dynamic analysis in a disposable, network-restricted VM. Never debug unknown samples on your workstation.
3. Narrow the agent. Give the MCP agent only the tools it needs, no ambient credentials, and review its actions — treat sample content as untrusted input.
4. Keep evidence. Log what was analyzed, why, and under what authority. It protects you if questions come later.
5. Turn it on yourself. Point the studio at your own release builds and see what an attacker would learn. Move whatever you find to the server.

These are third-party open-source projects; PlayCISO is not affiliated with any of them. Tool descriptions reflect public repositories as of October 2026. Not legal advice.