REA collected 300,000 stars in two weeks. Its most valuable feature is a list of what it doesn't know

The REA project, short for Reverse Engineer Anything, is built on a single sentence. See a feature you like and understand how it works, down to the binary level. In October that sentence turned a little-known repository into the fastest-growing project on GitHub. Behind the “end of software” label, though, sits an honest and useful tool with a fairly narrow job.

From 41 stars to 360,000 in three weeks

The morluto/rea repository was created on April 14, 2026, and for half a year almost nobody noticed it. According to GH Archive data compiled by Moe Lueker, it had 41 stars on October 2. A week later it had more than 45,000, and on October 12 it gained almost 52,000 in a single day. As of October 22, GitHub shows more than 365,000 stars and 91,000 forks. The rea-agents installer package logged more than 100,000 npm downloads a day at its peak. People were actually running it.

Social media started the avalanche. On October 8, Matthew Berman posted on X: “Reverse Engineer Anything 😂 Software is done.” The post has 2.8 million views. Videos with millions of views followed, along with Chinese and Japanese threads calling it the hottest repository on GitHub. Fireship added a video titled “Every app on Earth is now open source.” That one, however, is mostly about clones of Adobe apps, which were built differently and did not need REA. Still, the two stories merged into one impression: closed software is no longer closed.

The author goes by morluto, and their real name has not been made public. The project is openly built with agents. AgentBreaking counted 263 commits between early October and October 12 carrying a co-author credit for Claude Opus 5.5. In eight days the project jumped from version 3.2.1 to 6.4.0, and 6.7.0 is out now.

Ghidra still does the decompiling. REA adds the evidence

REA has no decompiler of its own. For native programs it drives Ghidra, Hopper or IDA, whichever you already have. On top of that it analyzes JavaScript and Electron, .NET, Android apps, firmware, websites and network captures. That gives an agent about 140 tools through one MCP server, and installation is a single command, npx rea-agents setup.

So the novelty is not that AI can drive Ghidra. GhidraMCP and ida-pro-mcp have done that since March 2025. What is new is the packaging and, above all, the shape of the answer. Every finding carries evidence of where it came from, and the agent also records what it could not work out. Instead of a convincing guess, you get a list of unknowns. For a tool that reads machine code, that matters more than the number of supported formats.

The project's own showcases are precise but small. For the 1996 game DX-Ball, an agent rewrote the stereo sound-panning calculation in C. The result passed 3,205 tests against the original x86 code and reproduces all 63 bytes of the compiled function. Nobody has reconstructed a whole program, though, and the README does not promise that. REA returns pseudocode, assembly and relationships between modules, not the original source.

Independent test: on small programs the agent didn't need REA

On October 9, GitTested compared an agent using REA with an agent using ordinary tools such as objdump. The targets were four small stripped binaries and three Electron apps. Answers were scored against facts written in advance from the real source code. On the native programs, the agent without REA scored 74 of 75 points, and with REA 73 of 75. It also used about 2.5 times as many tokens. The reviewers therefore recommend adopting REA with care: code an agent can already read on its own does not need its help.

A viral demo told a similar story. A user called @AIWarper wrote that REA with Opus decompiled a Steam game he had bought and launched it in Unity within 30 minutes. Replies asked whether it was a Mono build. Such games ship C# intermediate code that freely available tools have decompiled for twenty years. No answer came in the thread. Another limit is set by the model, not the tool. Several users described Claude refusing to continue, for example on someone else's battery protocol.

A fake copy with a trojan, and the legal line

Success attracted scammers too. According to a fact-check by Pasquale Pillitteri, a copy of the repository appeared on October 13 under an organization called rea-tools. It added a section with a standalone Windows .exe to the copied README. The archive was downloaded 172 times before it was reported, and Microsoft Defender flagged it as a trojan of the Wacatac family. The official README now warns that a similar name or a copied text proves nothing. Get REA only from github.com/morluto/rea, from rea.tools or from the rea-agents package on npm.

Even the real version is not a sandbox, as its security documentation says explicitly. Setup edits the configuration of every agent you select. Runtime analysis runs the target program with your permissions. And the dependencies change daily, so it pays to pin a specific version.

Legally, what matters most is whose program you are taking apart. In the EU, Directive 2009/24/EC allows decompiling a program when it is indispensable for interoperability and the information is not available otherwise. A contract cannot exclude that right. Using the results to write a program substantially similar to the original, however, is not allowed. REA's disclaimer forbids circumventing DRM and licence checks. Its marketing, meanwhile, invites you to “build a similar feature for your project.” That grey zone is exactly what independent game developers on Reddit are worried about.

Lilith's verdict

REA is a good tool that became a meme. Stars measure virality, not an audit, and the best thing about it is a modest list of things it doesn't know. If you need to see what a program really does, run it in a VM on your own app with a pinned version. If you wanted to “just clone anything,” you'll mostly get pseudocode and a token bill.