REA: Reverse Engineer Anything

Before you use REA: Reverse Engineer Anything

Context cost warning: its tools/list is about 181,430 tokens (207 tools), 554% of a 32k context window and 91% of a 200k window, before you send a single message (raw tools/list payload 805,228 tokens). Load only the tools you need, or expect most of the context to go to tool definitions. Measured by counting the tokens in this server's tool list on 2026-10-24. How MCP context cost adds up

95/100
Last tested 2026-10-24 (Fresh: tested within 30 days) Working (tool call tested 2026-10-24) No key needed for the tools we called

No advisories in range for tested 6.7.0 (checked 2026-10-27)

Security review: not tested

Score = points from 5 automated checks. Not a quality or security rating. Methodology

  • Install20/20
  • Handshake30/30
  • Maintenance25/25
  • Docs10/15
  • License10/10

Editor's pick (editorial, not paid). Featuring does not change its score or rank.
GitHub stars: 377,343 as of 2026-10-24 12:54 CT. Count is GitHub's own stargazer counter as of the time shown; not independently checked. X News (AI-generated summary) reported growth from ~10k to over 200k stars in a week. Press and social reports of its growth (X): https://x.com/i/trending/2110328387881345185
Lawful use: Analyze only software you own or have permission to analyze.
Tool-call test (2026-10-24, direct MCP stdio client, no LLM): pass (core tools). 3 of 5 calls passed: objdump file headers and disassembly (found main) and open_binary worked out of the box; inspect_binary_layout and list_strings returned a clear provider_unavailable error because they need optional local tools that were not installed. Evidence: recorded tool-call log, Oct 24, 2026.

Transport (tested 2026-10-24): stdio

Score 95/100 · Tools 207 · Token cost ~181,430 · Compare · Last tested 2026-10-24 · Version tested 6.7.0 · Package rea-agents · Repo morluto/rea

Summary: REA: Reverse Engineer Anything completed an MCP handshake without credentials and exposed 207 tools.

Evidence summary

Handshake
pass
Tools listed
207
Context cost
181,430 model-visible tokens (name, description, inputSchema; tiktoken cl100k_base)
Extra payload (sent by the server, usually not read by the model): 623,798 tokens (largest: outputSchema ≈616,900); raw tools/list total 805,228. Clients differ in what they forward. Almost all outputSchema (~617k tokens): returned by tools/list but not normally sent to the model by clients. ranking · add up your servers' context cost
API key
No key needed for the tools we called
Tested
2026-10-24

Test results

TestResultPointsEvidence
installpass20npm install rea-agents (Node 20, Linux) succeeded in 13s.
handshakepass30MCP initialize + tools/list over stdio succeeded with no credentials; 207 tools listed in 2.4s.
maintenancepass25Repo pushed 0 days before test; 377,343 GitHub stars (as of 2026-10-24 12:54 CT).
docspartial10README over 3,000 chars; install instructions present. Automated check of the package's own README (README shipped in npm package).
licensepass10MIT (OSI-approved).

Local-model readiness

Schema context cost: ~181,430 tokens for 207 tools (773,173 bytes) · about 2215% of an 8k context. Method: tiktoken cl100k_base over compact JSON of name+description+inputSchema (approximate).

Small-model friendly (schema heuristic, not a model result): low.

Small-model task runs: Not yet tested.

What we tested and what we didn't

Tested on 2026-10-24

  • Install from the registry
  • We connected with no credentials and asked for its tool list: it listed 207 tools (Method details: MCP initialize then tools/list)
  • Maintenance signals (last push, archived/deprecated status)
  • Docs (README length, install and config example)
  • License (OSI-approved or not)
  • Tool-schema token cost (estimate)

Not tested

  • Security: not audited (no code review, no permission or data-flow analysis)
  • Real tasks (no functional task runs yet)
  • Behaviour with real credentials or a real account
  • Performance, rate limits or load
  • Correctness of results beyond the listed tasks

Methodology: how we test. A high score means it installs and responds, not that it is safe to give it access to your data.

Known security issues

Checked on 2026-10-27 for version 6.7.0 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.

No published advisories found in OSV and GitHub advisories for rea-agents 6.7.0 as of 2026-10-27. This is not a security audit.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

Baseline recorded from the 2026-10-24 test run; changes appear after the next test.

Snapshot hash (fingerprint of the tool list)

d6f6295af3cd: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.

Feeds: RSS · JSON.

Raw test record (JSON)
{
  "name": "rea-agents",
  "version": "6.7.0",
  "registry": "npm",
  "status": "working",
  "tested": "2026-10-24",
  "tools_count": 207,
  "tools_schema_tokens_est": 181430,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`npm install rea-agents` (Node 20, Linux) succeeded in 13s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 207 tools listed in 2.4s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 0 days before test; 377,343 GitHub stars (as of 2026-10-24 12:54 CT)."
    ],
    "docs": [
      "partial",
      10,
      "README over 3,000 chars; install instructions present. Automated check of the package's own README (README shipped in npm package)."
    ],
    "license": [
      "pass",
      10,
      "MIT (OSI-approved)."
    ]
  }
}

Install

npx -y rea-agents mcp

Tools listed

annotate_native_function, inspect_native_load_image, inspect_native_data_type, inspect_native_instruction, resolve_native_call_targets, address_name, comment, current_address, current_procedure, current_document, goto_address, inline_comment, list_bookmarks, list_documents, list_names, list_procedures, list_segments, list_strings, next_address, prev_address, procedure_address, procedure_assembly, procedure_callees, procedure_callers, procedure_info, read_function_instructions, search_bytes, read_bytes, address_to_file_offset, procedure_references, procedure_pseudo_code, resolve_containing_procedure, search_procedures, search_strings, set_address_name, set_addresses_names, set_bookmark, set_comment, set_inline_comment, unset_bookmark

Quick config

{
  "mcpServers": {
    "rea-reverse-engineer-anything": {
      "command": "npx",
      "args": [
        "-y",
        "rea-agents",
        "mcp"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

Setup

  1. Install. Run npm install rea-agents (Node 20). This is the exact command we ran on 2026-10-24.
  2. Configure. Add the mcpServers entry below to your MCP client config.
  3. Verify. Restart the client and check that tools/list returns tools (207 in our test).
{
  "mcpServers": {
    "rea-reverse-engineer-anything": {
      "command": "npx",
      "args": [
        "-y",
        "rea-agents",
        "mcp"
      ]
    }
  }
}

Test history

No dated events yet.

Follow this server (RSS) · Monthly changelog

FAQ

Is REA: Reverse Engineer Anything deprecated?

No. rea-agents was not deprecated or archived when we last tested it on 2026-10-24.

What replaces REA: Reverse Engineer Anything?

Nothing; REA: Reverse Engineer Anything is not deprecated as of 2026-10-24.

Does REA: Reverse Engineer Anything need an API key?

No. It completed an MCP handshake with no credentials and listed 207 tools.

Embed the badge

TestedMCP: 95/100, tested 2026-10-24

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue