REA: Reverse Engineer Anything
Before you use REA: Reverse Engineer Anything
- Its 207-tool list is about 181k tokens (tools/list, cl100k_base, measured 2026-10-24), which is bigger than many models' context windows.
- 3 of 5 tool calls passed in our test (2026-10-24, direct MCP stdio client); the 2 failures needed optional local tools we had not installed.
- Use it only on software you own or have permission to analyze.
Context cost warning: its tools/list is about 181,430 tokens (207 tools), 554% of a 32k context window and 91% of a 200k window, before you send a single message (raw tools/list payload 805,228 tokens). Load only the tools you need, or expect most of the context to go to tool definitions. Measured by counting the tokens in this server's tool list on 2026-10-24. How MCP context cost adds up
Score = points from 5 automated checks. Not a quality or security rating. Methodology
- Install20/20
- Handshake30/30
- Maintenance25/25
- Docs10/15
- License10/10
Editor's pick (editorial, not paid). Featuring does not change its score or rank.
GitHub stars: 377,343 as of 2026-10-24 12:54 CT. Count is GitHub's own stargazer counter as of the time shown; not independently checked. X News (AI-generated summary) reported growth from ~10k to over 200k stars in a week. Press and social reports of its growth (X): https://x.com/i/trending/2110328387881345185
Lawful use: Analyze only software you own or have permission to analyze.
Tool-call test (2026-10-24, direct MCP stdio client, no LLM): pass (core tools). 3 of 5 calls passed: objdump file headers and disassembly (found main) and open_binary worked out of the box; inspect_binary_layout and list_strings returned a clear provider_unavailable error because they need optional local tools that were not installed. Evidence: recorded tool-call log, Oct 24, 2026.
Transport (tested 2026-10-24): stdio
Score 95/100 · Tools 207 · Token cost ~181,430 · Compare · Last tested 2026-10-24 · Version tested 6.7.0 · Package rea-agents · Repo morluto/rea
Summary: REA: Reverse Engineer Anything completed an MCP handshake without credentials and exposed 207 tools.
Evidence summary
- Handshake
- pass
- Tools listed
- 207
- Context cost
- 181,430 model-visible tokens (name, description, inputSchema; tiktoken cl100k_base)
Extra payload (sent by the server, usually not read by the model): 623,798 tokens (largest: outputSchema ≈616,900); raw tools/list total 805,228. Clients differ in what they forward. Almost all outputSchema (~617k tokens): returned by tools/list but not normally sent to the model by clients. ranking · add up your servers' context cost - API key
- No key needed for the tools we called
- Tested
- 2026-10-24
Test results
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | npm install rea-agents (Node 20, Linux) succeeded in 13s. |
| handshake | pass | 30 | MCP initialize + tools/list over stdio succeeded with no credentials; 207 tools listed in 2.4s. |
| maintenance | pass | 25 | Repo pushed 0 days before test; 377,343 GitHub stars (as of 2026-10-24 12:54 CT). |
| docs | partial | 10 | README over 3,000 chars; install instructions present. Automated check of the package's own README (README shipped in npm package). |
| license | pass | 10 | MIT (OSI-approved). |
Local-model readiness
Schema context cost: ~181,430 tokens for 207 tools (773,173 bytes) · about 2215% of an 8k context. Method: tiktoken cl100k_base over compact JSON of name+description+inputSchema (approximate).
Small-model friendly (schema heuristic, not a model result): low.
Small-model task runs: Not yet tested.
What we tested and what we didn't
Tested on 2026-10-24
- Install from the registry
- We connected with no credentials and asked for its tool list: it listed 207 tools (Method details: MCP
initializethentools/list) - Maintenance signals (last push, archived/deprecated status)
- Docs (README length, install and config example)
- License (OSI-approved or not)
- Tool-schema token cost (estimate)
Not tested
- Security: not audited (no code review, no permission or data-flow analysis)
- Real tasks (no functional task runs yet)
- Behaviour with real credentials or a real account
- Performance, rate limits or load
- Correctness of results beyond the listed tasks
Methodology: how we test. A high score means it installs and responds, not that it is safe to give it access to your data.
Known security issues
Checked on 2026-10-27 for version 6.7.0 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.
No published advisories found in OSV and GitHub advisories for rea-agents 6.7.0 as of 2026-10-27. This is not a security audit.
Monthly roundup: MCP security issues, October 2026.
Tool list changes
Baseline recorded from the 2026-10-24 test run; changes appear after the next test.
Snapshot hash (fingerprint of the tool list)
d6f6295af3cd: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.
Raw test record (JSON)
{
"name": "rea-agents",
"version": "6.7.0",
"registry": "npm",
"status": "working",
"tested": "2026-10-24",
"tools_count": 207,
"tools_schema_tokens_est": 181430,
"deprecated": false,
"archived": false,
"tests": {
"install": [
"pass",
20,
"`npm install rea-agents` (Node 20, Linux) succeeded in 13s."
],
"handshake": [
"pass",
30,
"MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 207 tools listed in 2.4s."
],
"maintenance": [
"pass",
25,
"Repo pushed 0 days before test; 377,343 GitHub stars (as of 2026-10-24 12:54 CT)."
],
"docs": [
"partial",
10,
"README over 3,000 chars; install instructions present. Automated check of the package's own README (README shipped in npm package)."
],
"license": [
"pass",
10,
"MIT (OSI-approved)."
]
}
}Install
npx -y rea-agents mcp
Tools listed
annotate_native_function, inspect_native_load_image, inspect_native_data_type, inspect_native_instruction, resolve_native_call_targets, address_name, comment, current_address, current_procedure, current_document, goto_address, inline_comment, list_bookmarks, list_documents, list_names, list_procedures, list_segments, list_strings, next_address, prev_address, procedure_address, procedure_assembly, procedure_callees, procedure_callers, procedure_info, read_function_instructions, search_bytes, read_bytes, address_to_file_offset, procedure_references, procedure_pseudo_code, resolve_containing_procedure, search_procedures, search_strings, set_address_name, set_addresses_names, set_bookmark, set_comment, set_inline_comment, unset_bookmark
Quick config
{
"mcpServers": {
"rea-reverse-engineer-anything": {
"command": "npx",
"args": [
"-y",
"rea-agents",
"mcp"
]
}
}
}Add to config Opens the config generator with this server selected.
Setup
- Install. Run
npm install rea-agents(Node 20). This is the exact command we ran on 2026-10-24. - Configure. Add the mcpServers entry below to your MCP client config.
- Verify. Restart the client and check that tools/list returns tools (207 in our test).
{
"mcpServers": {
"rea-reverse-engineer-anything": {
"command": "npx",
"args": [
"-y",
"rea-agents",
"mcp"
]
}
}
}Test history
No dated events yet.
FAQ
Is REA: Reverse Engineer Anything deprecated?
No. rea-agents was not deprecated or archived when we last tested it on 2026-10-24.
What replaces REA: Reverse Engineer Anything?
Nothing; REA: Reverse Engineer Anything is not deprecated as of 2026-10-24.
Does REA: Reverse Engineer Anything need an API key?
No. It completed an MCP handshake with no credentials and listed 207 tools.
Embed the badge
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.