REA Review: What a 433k-Star MCP Can Actually Replace in a Decompiler Workflow, and What It Cannot

The fastest-growing MCP project on GitHub is morluto/rea. Created on April 14, 2026, the repository stood at 432,900 stars and 107,500 forks as of November 5, 2026, and in MCP Trends' weekly count that same day it added 33,525 stars in seven days to take first place in momentum.

Before writing an installation review, I collected four outside hands-on reports and one code-analysis piece to answer what those 433k stars actually mean. The conclusion is simple. REA does not replace a decompiler. It is the front layer that puts a decompiler under the agent's discipline.

1. What REA Is

REA is a local MCP server and a CLI. Running npx rea-agents setup registers the MCP server and matching workflow instructions with Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and other agents, backing up any configuration it touches. It registers 139 tools.

The flow has three steps. The agent asks a question, REA calls its analysis tools, and it returns the result together with Evidence: what it saw, what the limits are, and what remains unknown. The agent follows up, explains, or implements from that record. The rea CLI uses the same workflows.

The core point is that REA is not a new decompiler. Deep native analysis requires you to supply Hopper, Ghidra, IDA, or Kuna. Setup can install Hopper with your approval; Ghidra and IDA use your existing installs. JavaScript/Electron and .NET static inspection, on the other hand, run without any extra engine.

The environment requirement is Node.js 22.x (22.23.4 or later), 24.x (24.22.1 or later), or 26.12.1 or later.

2. The Scale, in Numbers

Star counts differ slightly by tracker. mcp.market recorded 429,558 the same day. The direction is the same.

The downloads are the number worth watching. rea-agents was pulled down more than 300,000 times in a single week, and mcp.market puts weekly downloads at 520,000. That is installs, not stars.

3. What You Can Analyze

The point of the table is that every target gets its own purpose-built extractor. Rather than handing everything to a single generic decompiler, it pulls compiler versions and modules out of Go binaries, decodes IL2CPP metadata directly, and reads PE certificates and ELF notes statically.

4. Install and Use

npx rea-agents setup
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
npm install --global rea-agents
rea update

Setup shows you the changes it wants to make, writes the configuration after you approve, and you restart your agent afterward. Asking it a question is straightforward.

Understand how search works in the Notes app, show me the evidence, and
build a similar feature for my project.

5. Four Outside Hands-On Reports

5-1. YouTube network observation: the inventory is right, the deep analysis fails

In a test on josegarrido.dev, REA collected 81 requests in 28 seconds, matching the paths and order of a log the author kept through DevTools. analyze-web-bundle counted 50 scripts and 13.7 MB of JavaScript, and the two files that matter, the site core at 9.7 MB and the player base.js at 2.6 MB, matched byte for byte against copies fetched with curl, hashes included.

It could not answer the actual question. With the default 30-second-per-script limit it timed out on exactly the two scripts holding the decision logic. Raising the limit to 10 minutes and the memory to 6 GB produced the same result after 20 minutes. observe-web-execution recorded 1,022 functions running in a 15-second window, but all that came back were minified names like uHa, pz, and Dz.

The network inventory is accurate, and the meaning of minified code is not recoverable.

5-2. Rebuilding FocuSee's feature: a working clone in eight minutes

A comparison on genaiunplugged produced three versions. The original FocuSee zoomed on 25 of 25 clicks but cut off the note box while typing. The clone built with REA and Ghidra zoomed twice, kept the whole box in view, took eight minutes, and passed seven tests. The clone built with plain Claude Code zoomed five times, took 5 minutes 46 seconds, and passed zero tests.

The difference was that REA could explain why the typing zoom was off, because it read the compiled program through Ghidra. The added cost was about nine minutes.

5-3. Code analysis: you are buying a dossier, not a decompilation

An analysis by ai.thesatyajit put the scale in numbers: 139 registered tools, about 167,000 lines of TypeScript excluding tests, 119,000 lines of tests, and a 3,321-line Java script that runs inside Ghidra.

The verdict is blunt. Nearly every tool returns a result together with a content-addressed record of where it came from. What this shop sells is not decompilation, it is the dossier: pseudocode and assembly together, callers and data references in one call, and an Evidence id you can quote back when the agent's explanation sounds too sure.

It does rate the Ghidra bridge as more complete than the Hopper bridge, and recommends Ghidra partly on licensing grounds.

5-4. The case that read the code and skipped the install

SMF Clearinghouse read the repository as it stood on October 18, 2026 and declined to install it. At that point it had 317,541 stars, 80,525 forks, 668 open issues, and 556 open pull requests.

Three objections. First, it is a wrapper. Opening an untrusted binary hands parsing to a decompiler running with your permissions, and there is no sandbox, only a DISCLAIMER.md. Second, the sentence "analysis runs locally" is incomplete: the agent still receives the tool results, and the model provider's data policy applies to them. The Obsidian example in the CLI guide produces a 334 MB Evidence file.

Third, what is worth keeping is not the tool but the habit. A judgment arrives with its evidence, its limits, and its unknowns attached. Decompilers have never worked that way, and neither have the agents built on them.

6. Limits and Risks

1. There is no decompiler. Deep native analysis is impossible without Hopper, Ghidra, IDA, or Kuna. REA supplies no license or key for commercial tools, and it explicitly forbids cracked copies and shared keys.

2. There is no sandbox. It drives Ghidra, mitmproxy, pwndbg, and adb with your permissions. That is a far larger blast radius than a typical read-only MCP, and the moment you open an untrusted binary, parsing belongs to that tool.

3. Interpretation quality depends on the model. REA gathers facts and draws no conclusions. Which tool to pick, and how far to trust the result, is the agent's call. A zero on minified code is a signal to open the files yourself, not proof of absence.

4. Speed becomes debt. 853 open issues and 751 open pull requests. The README celebrates 400,000 stars while issues and PRs pile up faster than that. When something breaks, the official advice is to update first.

5. Copying is a legal question. DISCLAIMER.md refuses to support illegal or unauthorized access, DRM or license circumvention, or reproduction of protected code and assets. The instruction "I saw their feature, build me a similar version" runs straight into that sentence. The legitimate scope is limited to software you own or are authorized to analyze.

7. Who Actually Needs This

The valuable combination is clear: an authorized binary, an existing decompiler, and work that has to leave evidence. Where those three overlap, REA widens the agent's hands with 139 tools.

JavaScript and Electron static inspection starts in seconds with no engine at all. If that is the only path you plan to use, the entry cost is close to zero.

If all you need is an explanation of what an app does, standard browser automation usually answers it. There is no reason to carry a large toolchain and a 334 MB Evidence file for that.

The order matters most. The legal question comes before the tool question. 433k stars do not answer it for you.

Related posts

• Wiring Up Memory MCP Myself: Bolting a Local Knowledge Graph Onto an AI's Session Amnesia
• Giving AI Hands and Feet — The System Control MCP Trio