1. Prepare your computer
Use the computer where your target files are stored. A local coding agent can read those files and run tools for you.
How do I open a terminal?
- Windows: open the Start menu, type PowerShell and press Enter.
- macOS: press ⌘ Space, type Terminal and press Enter.
- Linux: press Ctrl Alt T on most desktops.
Paste a command with Ctrl V (macOS: ⌘ V; Linux terminals: Ctrl Shift V), then press Enter.
Commands go in the terminal. Prompts labeled “Your coding agent” go in the agent's chat.
You'll need Node.js 22 (22.19+), 24 (24.11+) or 26+. npm comes with Node.js.
Don't have Node.js, or not sure?
Open a terminal and check:
node -v
npm -v
If node -v prints v22.19+, v24.11+ or v26+, you're
ready. If it prints an older version or "not recognized" /
"command not found", install
Node.js 24 LTS:
Windows (PowerShell)
winget install --exact --id OpenJS.NodeJS.LTS
Type Y if asked to accept the terms. Close PowerShell, open it
again, then run node -v.
Download the Node.js installer if winget is unavailable.
If PowerShell later says
"running scripts is disabled on this system" when you
run npx, use npx.cmd instead. For
npm, use npm.cmd:
npx.cmd rea-agents@latest setup
macOS
For a first installation, download the Node.js 24 LTS macOS installer (.pkg), open it and follow the installer. Then reopen Terminal.
Already use Homebrew?
brew install node
Linux
Install curl and unzip first if they are missing. On Debian or
Ubuntu, run sudo apt install curl unzip; on other
distributions, use your package manager.
curl -fsSL https://fnm.vercel.app/install | bash
Close the terminal, open it again, then:
fnm install 24
fnm use 24
fnm default 24
Your distribution's own nodejs package is often
older than 22.19, so check node -v if you use it
instead.
Prefer a regular installer? Download the LTS version from nodejs.org.
Make a working folder for your agent
In your terminal, make a folder for the exercise, then move into it:
mkdir rea-work
cd rea-work
Keep this terminal open for the next step. If you already have a working folder, open it instead.
2. Choose a coding agent
Your agent is the AI you talk to. REA supplies the inspection tools it uses. Pick one client below; open its instructions if you haven't used it before.
Codex · use your ChatGPT account
Install Codex using the command for your operating system:
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
curl -fsSL https://chatgpt.com/codex/install.sh | sh
After installation, reopen your terminal and return to the working folder. Then start Codex:
codex
Choose “Sign in with ChatGPT”, complete the browser sign-in, then return to the terminal. When the message box appears, continue to step 3.
Cursor, Windsurf or VS Code · use an editor
- Install the editor for your operating system and sign in.
- Open the rea-work folder you made in step 1.
- Open its AI chat and choose Agent mode. In Windsurf or Devin Desktop, open the agent chat; in VS Code, set up GitHub Copilot first.
Cursor setup · Windsurf / Devin Desktop setup · VS Code and Copilot setup
Claude Code · use your Claude account
Install using the command for your operating system:
irm https://claude.ai/install.ps1 | iex
curl -fsSL https://claude.ai/install.sh | bash
Reopen your terminal, return to your working folder and run
claude. Follow the sign-in prompts. Access uses an
eligible Claude subscription or a configured API account.
Claude Desktop · use a desktop chat
Install Claude Desktop on Windows or macOS and sign in. Quit it completely, then run this command in a terminal you opened outside Claude:
npx rea-agents@latest setup --client claude_desktop
Review and approve the plan, reopen Claude, then check the connection in step 3.
OpenCode · choose an AI model
npm install --global opencode-ai
Run opencode in your working folder. Use
/connect in its chat to connect your model account,
then select a model.
All supported clients and setup IDs
The npm 6.4.0 release supports the clients below. Use the ID
with --client when choosing a client explicitly.
| Client | Setup ID |
|---|---|
| Claude Code | claude_code |
| Claude Desktop | claude_desktop |
| Codex | codex |
| Cursor | cursor |
| Gemini CLI | gemini_cli |
| Windsurf | windsurf |
| Devin | devin |
| OpenCode | opencode |
| Antigravity | antigravity |
| GitHub Copilot CLI | copilot_cli |
| Command Code | commandcode |
| Qwen Code | qwen_code |
| VS Code | vscode |
| Grok Build | grok_build |
| OMP | omp |
| Pi | pi |
| Hermes | hermes |
Qoder (qoder), Factory Droid (droid),
Trae (trae), ZCode (zcode) and
DeepSeek Harness (dsh) are available on repository
main; use a source build or a release containing those
integrations.
Client configuration and troubleshooting · Release availability
Grok Bot · connect on its hosted computer
In Grok Bot's chat, ask it to add a custom MCP server named
rea using this command on the Bot's computer:
npx -y rea-agents@6.4.0 mcp
3. Connect REA
Copy this into your coding agent:
Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.
Or run setup yourself
npx rea-agents@latest setup
For one specific client, add its setup ID:
npx rea-agents@latest setup --client codex
If npm asks to download the package, type y and
press Enter. In REA's client list, use the arrow keys to move,
Space to select your client and Enter to continue.
Choose your client and review the setup plan. REA adds its MCP connection and the matching investigation skill, keeping a backup of existing configuration. It asks before applying the changes.
MCP is the connection that lets your agent call REA. The skill gives it a workflow for investigating software.
For the first exercise, you can skip the optional Hopper installation. Restart your client when setup finishes.
How do I restart my client?
Desktop apps (Claude Desktop, Cursor, Windsurf, VS Code): quit the app completely, then open it again. Closing the window isn't enough. On macOS press ⌘ Q; on Windows, also quit from the tray icon if there is one.
Terminal agents (Claude Code, Codex, Gemini CLI): exit the session and start it again.
npx -y rea-agents@latest doctor --client codex --json
Replace codex with your client's setup ID. A
successful check reports "healthy": true. Then ask
your agent:
Check that REA is connected and show me which REA tools you can use.
4. Try your first investigation
The example is a six-file Electron app with an Export notes button. Your agent can inspect its code without installing or launching Electron.
Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes. Show where notes.csv is written, which fields it contains, and the relevant files and lines.
Look for a short explanation with file and line references:
The button sends a
notes:exportmessage. The main process formats the notes as CSV and writesnotes.csvin the user’s Downloads folder. The columns areidandtitle.
Check a prediction in the guided exercise →
Download the example yourself, or use your own app
If your agent can’t download files, unzip this archive yourself.
Give it the path to the notes-example folder and
the same export question.
Use REA to inspect the app at
/absolute/path/to/app. Find how it exports data and show the relevant files and lines.
How do I get a folder's full path?
- Windows: in File Explorer, right-click the folder and choose Copy as path. On Windows 10, hold Shift while right-clicking.
- macOS: in Finder, right-click the folder, hold Option and choose Copy "…" as Pathname.
- Any system: drag the folder into a terminal window and its path appears.
In a terminal, put quotes around a path that contains spaces.
Analyze another kind of software
Choose the section for your target. A provider is the local analysis tool REA uses for that kind of software.
Native executables and libraries · Hopper, Ghidra or IDA
Install one analysis tool on the computer running REA. The host is your operating system; the target is the program you want to inspect.
| Provider | Windows | macOS | Linux |
|---|---|---|---|
| Hopper | Unavailable | 12+ | Supported distributions |
| Ghidra | x64 · experimental | x64 / arm64 | x64 / arm64 |
| IDA | Verified profiles | Verified headless profile | See provider guide |
Hopper · let setup install or connect it
Connect Hopper on macOS or Linux. Run the setup command above; it detects an existing installation or offers an installation plan for your approval.
Choose Hopper in setup and review its separate installation plan. On macOS, choose demo mode or activate your license when Hopper first opens. On Linux, setup prepares the supported demo and its private display.
Linux hosts: Ubuntu 24.04+, Fedora 41+, Nobara 44+, Arch Linux, CachyOS or Omarchy. Hopper is commercial software; its demo has vendor-defined limits.
npx -y rea-agents@latest doctor --provider hopper --json
If macOS asks for Automation permission, allow the app that starts REA in System Settings → Privacy & Security → Automation, then retry.
Ghidra · install the free analysis tool and Java
- Install a 64-bit JDK 21 or newer, including the Java compiler. Choose the package matching your computer's architecture.
-
Download Ghidra 12.1.4 from the release's Assets list and
extract the
ghidra_…_PUBLIC_….ziparchive. Choose the release archive, not “Source code”. -
Find the extracted folder containing
ghidraRunorghidraRun.bat. Use that folder forGHIDRA_INSTALL_DIR.
Download a JDK · Download Ghidra 12.1.4
Check Java. The first command prints java.home;
use that folder for JAVA_HOME. The second
confirms the compiler is installed:
java -XshowSettings:properties -version
javac -version
Connect Ghidra on Windows
Windows x64 has experimental, read-only support for native x86 and x64 PE applications and DLLs on fixed local NTFS drives. Use an existing Ghidra 12.1.x installation and a 64-bit JDK 21 or newer:
$env:GHIDRA_INSTALL_DIR = "C:/tools/ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:/tools/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup
Replace the two paths with your installations, then review setup's plan.
Connect your Ghidra installation
export GHIDRA_INSTALL_DIR="/absolute/path/to/ghidra_12.1.4_PUBLIC"
export JAVA_HOME="/absolute/path/to/jdk-21"
Replace both paths with your existing installations. For a fresh macOS or Linux arm64 installation, build the native decompiler for your computer before continuing.
Build Ghidra's native decompiler
On macOS, the build needs Xcode Command Line Tools, make and bison. Use the guide for your computer:
Then check Ghidra and save its paths for your client:
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup
Keep these commands in the same terminal session. Rerun setup after setting the paths, approve the updated client configuration, then restart your agent.
Ghidra setup and architecture requirements · Windows Ghidra guide
IDA · connect an existing installation
Use the IDA provider guide to prepare an upstream MCP registration. Choose an attached GUI with the original binary open, or a headless supervisor that opens a private database.
Verified profiles include the Windows legacy GUI and headless supervisor, plus a macOS arm64 headless supervisor with IDA Professional 9.1. The optional native GUI bridge has its own version and platform requirements.
The macOS headless profile and native GUI bridge require a
REA source build
or a release containing those changes. npm
6.4.0 does not include them.
From the built checkout, run
node scripts/rea.mjs doctor --provider ida --json
and node scripts/rea.mjs setup instead of the
npx commands below.
Prepare the IDA registration file
Install and configure the upstream server using the IDA
guide below. Then save its working registration as
ida-mcp.json in a text editor. On Windows,
choose “All files” when saving in Notepad so it doesn't add
.txt.
For a headless supervisor providing
idb_open, idb_list and
idb_close, the file can look like this:
{
"command": "idalib-mcp",
"args": ["--stdio", "--max-workers", "1"],
"mode": "headless"
}
For an attached legacy 1.4.0 GUI server, copy its working
command, args and optional
env into the file. Open the original binary in
IDA and start its upstream plugin before asking REA to
inspect it.
$env:REA_IDA_MCP_CONFIG = "C:/analysis/ida-mcp.json"
$env:REA_ANALYSIS_PROVIDER = "ida"
npx -y rea-agents@latest doctor --provider ida --json
npx rea-agents@latest setup
export REA_IDA_MCP_CONFIG="/absolute/path/to/ida-mcp.json"
export REA_ANALYSIS_PROVIDER="ida"
npx -y rea-agents@latest doctor --provider ida --json
npx rea-agents@latest setup
Use the JSON registration file you prepared with the provider guide, then rerun setup and restart your agent.
Once connected, give your agent the original executable's full path and name your provider:
Use REA with my configured provider to inspect
/absolute/path/to/program. List its functions and strings, then explain the part that handles user input with references to the code.
Websites, Android, .NET, firmware and other targets
Open the guide for the target you have. Each guide gives the additional tools, supported hosts and first command.
| Target | Tools to prepare | Guide |
|---|---|---|
| JavaScript / Electron | Node.js + npm | Open guide |
| Website | Chrome / Chromium / Edge | Open guide |
| .NET / Flutter / packages | Node.js + npm | Open guide |
| Android APK | JADX + JDK 17+ | Open guide |
| Android device | adb | Open guide |
| Android resources | Apktool + Java | Open guide |
| JEB project | JEB + MCP | Open guide |
| Firmware | Binwalk / Unblob · Linux | Open guide |
| WASM | WABT | Open guide |
| SQLite database | Node.js 24.15+ / 26+ | Open guide |
| EVM bytecode | Node.js · Linux x64 | Open guide |
| ELF / Linux crash | pwntools / GDB / pwndbg | Open guide |
| HAR / SAZ / mitmproxy | Node.js / mitmdump | Open guide |
| PCAP / PCAPNG | TShark / capinfos · Linux | Open guide |
| Logic signals | sigrok-cli · Linux | Open guide |
| Process behavior | PTY · Linux / macOS | Open guide |
Flutter guide · Packages and resources · EVM bytecode · All investigation guides
Use REA from a terminal
CLI commands, global installation and curl
Analyze a JavaScript or Electron application folder or ASAR archive without running the app:
npx -y rea-agents@latest analyze-javascript-application "/absolute/path/to/app" --json
Replace the path with your extracted app directory or
.asar file. On Windows, a path such as
"D:/apps/example" works here.
Where do I find an app's .asar file?
Electron apps usually keep it in a
resources folder:
-
Windows:
C:\Users\<you>\AppData\Local\Programs\<App>\resources\app.asar -
macOS:
/Applications/<App>.app/Contents/Resources/app.asar(right-click the app and choose Show Package Contents) -
Linux: often
/opt/<App>/resources/app.asar
Some apps install elsewhere. Search the app's folder for
app.asar.
The result identifies the app, shows connections between modules and gives their source locations. Connections REA cannot resolve are marked in the result.
If you'd like a permanent rea command in your
shell:
npm install --global rea-agents
Continue with the JavaScript application guide
npx -y rea-agents@latest function "/absolute/path/to/program" main --provider ghidra --json
Replace main with a function name or address from
the target's function list. Ghidra must be configured first.
On macOS or Linux, you can also use the curl installer after preparing Node.js:
curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash
Follow the setup prompts to connect your agent. If they don't
appear, run rea setup.
If your shell can't find rea, use the executable
path printed by the installer. On Linux, the default setup
command is "$HOME/.local/bin/rea" setup.
Getting help
If your agent doesn't see REA
Restart or reconnect the client after setup. Check its REA
connection with doctor; for Codex:
Use the client check in step 3 with your setup ID. In editor clients, enable REA in MCP settings and allow its tools in the agent chat.
If a provider needs attention
Check the provider you're using. For Ghidra:
npx -y rea-agents@latest doctor --provider ghidra --json
The report gives the failed check and a suggested next step.
Windows, WSL and paths with spaces
Use Windows PowerShell for Windows clients and analysis tools. If your agent runs inside WSL, install Node.js and REA inside that Linux environment and use Linux paths there. Headless providers run on the same host as REA.
In a terminal, put quotes around a path that contains spaces.
Windows setup command:
npx.cmd rea-agents@latest setup
Update or remove REA
To refresh your agent connection, run the latest setup command again, review its plan and restart your client.
npx rea-agents@latest setup
If you installed the global CLI, update it with
rea update. Use
npx rea-agents@latest uninstall to remove REA's
client configuration and skill.
- REA FAQQuick answers on updates, agents and analysis.
- Choose an investigation guideWorked examples for a binary, an Electron app and a browser.
- GitHub issuesReport a problem with the command and diagnostics.
- REA communityQuestions, investigations and work in progress.
