🔍 Read the full analysis: Exploring Unknown Software: A Workflow For AI Agents on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A report published by ThorstenMeyerAI.com on October 19 describes how the open-source Reverse Engineer Anything (REA) project lets coding agents inspect existing software. It recommends focused questions, verified tool connections and tests against concrete examples, while warning that local analysis does not make an untrusted program safe or keep results from model providers.
ThorstenMeyerAI.com published a workflow on October 19 for using the open-source Reverse Engineer Anything (REA) project with AI coding agents to examine how existing software works. The report says the approach can help developers document underlying data and business rules, while stressing that agent findings need to be checked against observed behavior and that local analysis is not a security sandbox.
REA connects tools for software analysis to agents including Claude Code, Codex, Cursor and Gemini CLI. The report describes it as a local Model Context Protocol (MCP) server, a command-line program for setup and diagnostics, and an agent skill that guides investigations. It says the project supports a range of targets, including JavaScript and Electron applications, .NET and Android software, firmware, databases, WebAssembly and native programs analyzed with tools such as Ghidra, Hopper or IDA.
The suggested workflow starts with a specific behavior and a practical decision, rather than a broad request to explain an entire program. For example, a developer might ask how partial invoice payments affect the remaining balance and account postings. The agent should report what data is stored, how a calculation works and what conditions change the result, while separating observed facts, inferences and unknowns.
The report advises confirming that REA is connected before relying on an agent’s answer. Its command-line doctor checks installation files and prerequisites, but, according to the documentation cited in the report, does not verify a live agent connection. Users should also confirm from inside the agent that REA tools are available, then test the workflow on software they own or are authorized to inspect.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Screens to Software Rules
The method addresses a common gap in AI-assisted development: an agent can produce an interface that looks plausible without reproducing the calculations and rules behind it. Understanding how a mature program handles records, reports or changes can give developers evidence for building compatible features or replacing a tool. That is different from simply copying screens, and the source report presents documentation of behavior—not a guarantee that an agent can reproduce any application accurately.
The report points to Ledger Reborn, a local accounting application whose author investigated QuickBooks Desktop for Mac 2024 using REA 6.4.0 and Ghidra. According to the report, the project’s profit-and-loss statement, balance sheet and trial balance matched Intuit’s official sample company account by account, to the cent. That result is attributed to the project account; the supplied material does not include independent verification of the comparison.
For readers using coding agents, the practical takeaway is to treat reverse engineering as a testable investigation. A useful result should explain a complete example with inputs and outputs. If the agent describes only what appears on screen, or answers without calling REA, the report says its explanation may be based on guesses rather than inspection.
software reverse engineering tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How REA Connects to Agents
REA is identified in the report as an MIT-licensed open-source project hosted on GitHub under morluto/rea. The source says version 6.7.0 was released October 18, one day before the article, and that the project had about 325,000 stars and 82,000 forks on October 19. Those figures are a dated snapshot reported by the source, not a measure of technical accuracy.
Setup depends on the agent and analysis target. The report gives a guided installer command for supported agents and a project-local MCP setup option for Claude Code. It says users need Node.js 22.19 or newer; native program analysis may also require a disassembler, with Ghidra requiring Java. After installation, users should restart the agent and check both setup prerequisites and actual tool availability.
The source’s QuickBooks example focused on a limited set of questions: inventory arithmetic, how account types affect budget number signs, reconciliation balances and branches used for cash-basis reports. The author presents this narrow scope as a way to keep an investigation answerable. The supplied source ends partway through its account of the case study, so it does not provide the full evidence or method described there.
“This is not a sandbox.”
— REA project documentation, as quoted in the ThorstenMeyerAI.com report
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Tests
The supplied material does not include the complete Ledger Reborn case study, the full quotations it references, or independent documentation of the reported account-by-account comparison. The accounting result should therefore be attributed to the report and project author, rather than treated as an independently established benchmark.
It is also unclear from the supplied account how REA’s coverage varies across different software versions, licensing arrangements or protected programs. Analysis results can depend on the target and the available tools; the source does not establish that REA can inspect every program or that an agent’s interpretation will be correct.
REA runs analysis locally, according to the report, but the agent receives the resulting information and the model provider may process it under its own data policy. The source does not specify what data each provider retains. Users should check the applicable provider terms and avoid sending sensitive findings without understanding those policies.
static code analysis tools for developers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Before Building on Findings
The workflow described in the report is to begin with one behavior, confirm the agent can call REA, inspect an authorized and preferably harmless target, and ask for a concrete example with evidence and uncertainties marked. Developers can then compare the agent’s account with observed inputs and outputs before using it to shape a new feature or replacement application.
The supplied material does not announce a new release beyond REA 6.7.0 or identify a scheduled milestone. The next practical step for readers is to consult the project’s current setup instructions, check tool compatibility and security requirements, and validate any conclusions against the software itself.
software debugging and inspection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source project that connects software-analysis tools to AI coding agents through an MCP server, alongside a command-line tool and an agent skill. The report says it supports several kinds of applications and software artifacts.
Does REA make an agent’s explanation reliable?
No guarantee is established in the report. It recommends asking for a complete example with real inputs and outputs and distinguishing observed, inferred and unknown points. Findings should be checked against the program’s behavior.
Is analyzing a program with REA safe?
The project warning quoted in the report says REA is not a sandbox. Analysis tools may run with the user’s permissions, so unknown programs should be treated as untrusted files and inspected only with suitable precautions.
Does local analysis mean data stays private?
Not necessarily. The report says analysis runs locally, but information is passed to the AI agent and may also reach its model provider under that provider’s data policy. The specific handling depends on the provider and is not detailed in the supplied source.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
