REA 如何連接 AI 智能體與逆向分析工具

What is REA?

Ever looked at an app and wondered, “How does that feature actually work?” REA gives an AI agent tools to investigate. It can examine native binaries, JavaScript and Electron apps, websites, and other software, then return evidence the agent can use to explain what it found or help build something similar.

The part that caught my eye is that REA is meant to show its work. It returns supporting details and notes where the evidence has limits. That’s a lot more useful than getting a confident answer with no way to check it.

REA connects to an agent through the Model Context Protocol (MCP). The agent asks REA to run an analysis, REA returns findings and evidence, and the agent uses those results to answer questions or guide implementation. The same analysis workflows can also be run from REA’s command-line interface.

Choosing an analysis tool

REA can connect to Ghidra, Hopper, or IDA for native binary analysis. It does not install all three, and I only need one. The right choice depends on the target software, my operating system, and the tools I already have.

Ghidra

Ghidra is where I’d start. It’s free and open source under the Apache License 2.0. It is not MIT-licensed. For REA’s documented setup, I need a 64-bit JDK 21 or newer, including the Java compiler, as well as a Ghidra installation.

The basic install is:

Install a 64-bit JDK 21 or newer.
Download the Ghidra release archive from the release’s Assets section. Don’t choose “Source code.”
Extract the archive.
Set JAVA_HOME to the JDK directory and GHIDRA_INSTALL_DIR to the extracted Ghidra directory.
Run REA’s readiness check, then run REA setup for the agent I want to connect.

For example, in macOS or Linux:

export JAVA_HOME="/path/to/jdk-21"
export GHIDRA_INSTALL_DIR="/path/to/ghidra_12.1.4_PUBLIC"

npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup --client copilot_cli

Replace the example paths and client ID with the values for my machine and agent. On some macOS and Linux arm64 systems, Ghidra’s native decompiler needs an additional build step. REA’s Ghidra instructions cover that case.

Hopper

Hopper is a commercial reverse-engineering application. It runs on macOS and supported Linux distributions, but REA’s current guide lists it as unavailable on Windows. Its demo has limits set by the vendor.

REA setup can detect an existing Hopper installation or offer to install it. Installing Hopper is a separate choice in setup, and REA asks for approval before proceeding. After setup, I can check whether REA can use it:

npx rea-agents@latest doctor --provider hopper --json

I would review REA’s current Hopper installation plan and requirements before approving an install.

IDA

IDA is another option, especially if I already use IDA Pro or have an IDA configuration that works with REA. IDA Pro is commercial software. IDA Free is also available, with its own feature and licensing limits.

IDA requires more manual setup than the other options. REA does not install IDA or its upstream MCP server. I first install and configure IDA and a compatible upstream MCP connection. Then I save that working connection’s command and arguments in a JSON configuration file and point REA to it:

export REA_IDA_MCP_CONFIG="/absolute/path/to/ida-mcp.json"
export REA_ANALYSIS_PROVIDER="ida"

npx -y rea-agents@latest doctor --provider ida --json

The exact setup depends on whether IDA is already open with the target or will use a headless profile. I’d follow REA’s IDA provider guide, which documents the supported connection modes and their requirements, rather than reuse a generic MCP configuration.

Connecting REA to AI agents

The analysis engine and the AI agent are separate parts of the setup. I install or configure an analysis engine when my target needs one, then register REA with each agent I want to use. REA’s setup command previews the changes and asks for approval before applying them. It registers the MCP server and installs REA’s workflow instructions by default. I restart the agent after setup.

REA requires Node.js 22.19 or newer in the 22.x line, 24.11 or newer in the 24.x line, or 26 or newer, along with npm.

GitHub Copilot CLI

To connect REA to GitHub Copilot CLI:

npx rea-agents@latest setup --client copilot_cli

Review and approve the proposed changes, then restart Copilot CLI. If I meant Copilot in VS Code rather than the CLI, REA also documents VS Code as a supported client. Its setup ID is vscode:

npx rea-agents@latest setup --client vscode

Claude Code

To connect REA to Claude Code:

npx rea-agents@latest setup --client claude_code

Review and approve the setup plan, then restart Claude Code. Setup registers REA for the client and installs the bundled workflow instructions. For Claude Desktop, the client ID is different, so I’d use the appropriate client entry from REA’s installation guide.

Grok Bot

Grok Bot works differently from clients that REA setup configures directly. Its MCP connector is stored in the signed-in account and runs on Grok Bot’s hosted computer. REA setup does not write to that account-level connector store.

In Grok Bot chat, I’d ask it to add a custom MCP server named rea that runs this command on the Bot’s computer:

npx -y rea-agents@<version> mcp

Replace <version> with the REA release I want to run. I would not put credentials in the command or its arguments. Since this server runs in Grok Bot’s hosted environment, it cannot automatically access files on my Mac. The target needs to be available from that environment.

What using REA looks like

Once connected, I can ask an agent a question about a target. The agent calls the relevant REA tools, REA performs the available analysis, and the findings come back with supporting evidence and limitations. I can then ask follow-up questions or use the results to guide an implementation.

For example:

Copilot CLI: “Use REA to trace how this Electron app handles deep links. Show the relevant modules and note any limits in the evidence.”
Claude Code: “Use REA to investigate this app’s search feature. Explain how it works, then suggest how I could build something similar in this project.”
Grok Bot: “Using the REA MCP server available in your environment, inspect this application’s login flow and show the evidence you find.”

REA can also be used from the terminal. For example, to analyze a JavaScript or Electron application directory:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The available analysis depends on the target. Static JavaScript and Electron analysis does not require a native analysis engine. Native binary analysis requires a configured provider such as Ghidra, Hopper, or IDA. Website analysis requires a Chrome-family browser. Other workflows may have their own dependencies.

My take

I’d start with Ghidra if I wanted a free, open-source native analysis tool and was comfortable installing the JDK it requires. If I already had Hopper or IDA configured, I’d use the tool that fits my workflow and target.

REA’s most compelling idea is bringing analysis tools into the same conversation where I’m asking questions about software. Its evidence-focused results are a good fit for reverse engineering, where it matters to know not just what an agent concluded, but what it observed and where it is uncertain.

There are some setup details to plan for. REA needs a supported Node.js version, native analysis needs an external provider, and Grok Bot’s hosted connector cannot inspect local Mac files by default. Also, when REA runs locally, its analysis happens on my machine, but the results are passed to the connected agent. I’d check the agent’s data-handling terms before analyzing sensitive software.

This is a documentation-based review, not a hands-on evaluation. Installation instructions, supported clients, and tool requirements can change, so I’d check the current guides before setting it up: