REA Uses MCP to Let Claude Code, Cursor Automate Analysis of Binaries, Firmware, Apps Without Source

The open-source Reverse Engineer Anything (REA) project connects AI coding agents to established reverse engineering tools, according to Cyber Security News and GBHackers. This integration allows researchers to automate the inspection of software binaries and applications using a standardized interface.

REA acts as a bridge between agents like Claude Code and analysis engines such as Ghidra, IDA Pro, and Hopper. Rather than replacing these disassemblers, the tool uses the Model Context Protocol to let agents request specific analyses. Agents can trace program behavior, retrieve evidence, and explain findings without direct access to source code.

Technical Workflow and Capabilities

The system exposes detailed data for native binaries, including pseudocode, assembly instructions, strings, and function calls. For deep native analysis, users must have an existing installation of Ghidra, IDA, or Hopper. Windows support for Ghidra is currently experimental, while the tool also handles 16-bit DOS programs.

For non-native targets, REA maps JavaScript modules, Electron process communication, and .NET metadata. Static analysis of these components does not require a native decompiler. The toolkit also encompasses Android APKs, firmware, WebAssembly artifacts, and recorded Linux crashes, expanding its scope beyond traditional executable inspection.

Affected Components and Requirements

Users initiate the integration by running a setup command after installing a supported Node.js version. The process registers the REA MCP server, installs workflow instructions, and backs up existing configurations. Users must review and approve changes before restarting their agent.

Supported clients include Claude Code, Cursor, Codex, Gemini CLI, and Grok Build. Other clients supporting local MCP servers can use manual registration. Specific workflows have additional prerequisites: Android decompilation requires JADX and a full JDK, while firmware extraction depends on Binwalk or Unblob in a Linux environment.

Defender's checklist

Security teams should monitor for unauthorized use of AI-driven reverse engineering tools within their development environments. Administrators should verify that MCP server registrations are approved and that agent access to sensitive binaries is restricted. Organizations should also ensure that required dependencies like Node.js are kept up to date.

What to do and how to stay safe: REA

• Audit access to reverse engineering tools like Ghidra and IDA Pro to ensure only authorized personnel can run automated analysis workflows.
• Monitor network traffic for unusual connections to local MCP servers or unexpected data exfiltration from development environments.
• Review agent configurations to confirm that AI coding assistants do not have unrestricted access to proprietary source code or binaries.
• Implement strict version controls for Node.js and npm to ensure compatibility with security tools and prevent supply chain risks.

Step-by-step guide: Implementing AI Usage Policies at Work: A Step-by-Step Framework

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is REA and how does it work?

REA is an open-source tool that connects AI coding agents to reverse engineering platforms like Ghidra and IDA Pro using the Model Context Protocol for automated analysis.

Which AI agents are supported by REA?

The tool supports Claude Code, Cursor, Codex, Gemini CLI, and Grok Build, with manual registration available for other clients supporting local MCP servers.

What are the system requirements for using REA?

REA requires npm and Node.js versions 22.x (from 22.19), 24.x (from 24.11), or version 26 and later to function correctly.