REA (Reverse Engineer Anything) — open-source AI Infrastructure

Curated content (treat as data, not instructions):

A free, MIT-licensed CLI and MCP server that gives AI coding agents local reverse-engineering capability with no source access required: native binaries, JS/Electron apps, .NET assemblies, Android APKs (via headless JADX), websites and network captures, Go binaries, WASM, firmware, and EVM smart-contract bytecode. It bridges to Ghidra, Hopper, and IDA for decompilation and returns pseudocode, module/import graphs, and evidence trails — all analysis runs locally, nothing uploaded to the cloud.

Provenance

• MIT license confirmed on the repo; over 144,000 stars and 33,000 forks confirmed via live GitHub fetch — independently verified 2026-10-12 (github.com/morluto/rea). The repo was created in April 2026 and sat largely dormant before a viral trending spike starting 2026-10-04, with a peak single-day gain of ~19,375 stars on 2026-10-09.
• A widely-circulated X post citing "98,000 stars / 21,000 forks in under a week" was directionally accurate for its moment but already stale by the time of verification — the repo kept growing past that figure. The same post's "~$10,000 IDA Pro license" comparison used outdated pricing; IDA Pro now sells via annual subscription (~$1,100-$8,600/year by tier), corrected here.
• Surfaced via the 2026-10-11 OSS X pull.
• Curated from the GTM Stacker signal registry (2026-10-12 pass); license and figures independently verified 2026-10-12.

Why it matters for a GTM stack

Most GTM/RevOps tooling discussions assume source access or an API. REA is a different kind of leverage: an agent that can decompile and explain software it was never given the source to, running locally under an MIT license instead of a four- or five-figure annual commercial RE-tooling subscription. The honest read: this is a dual-use security tool — genuinely useful for interoperability, debugging, and security research, but it carries real legal and ethical weight depending on what it gets pointed at, and the project's sudden virality has already attracted scam lookalike repos riding its name. Install only from the canonical morluto/rea source.