reaBLOCK
Reverse engineer anything with agents, from app behavior down to native binaries.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano
One MCP for reverse engineering across binaries, applications, and runtime behavior.
See a feature you like. Understand how it works, down to the binary level.
[](https://www.npmjs.com/package/rea-agents) [](https://github.com/morluto/rea/actions/workflows/ci.yml) [](docs/mcp-contracts.md#generated-catalog) [](#what-you-can-analyze) [](https://skills.sh/morluto/rea/reverse-engineer-anything) [](LICENSE) [](https://discord.gg/GkcryMnJDM)
**[W
271def47ba70OBSERVED · 2026-10-10Install
Commands as the repository documents them. They are shown, not run.
npm install --global rea-agents
npm install --global rea-agents
npm install --global rea-agents
npm install --global rea-agents
npm install --global rea-agents
npm install --global rea-agents
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| claude-desktop | mentioned | |
| codex | mentioned | |
| copilot | mentioned | |
| cursor | mentioned | |
| gemini-cli | mentioned | |
| windsurf | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: rea-tool-design description: Design or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics. --- # REA tool design Use the [tool-design guide](../../../docs/tool-design.md) for tool boundaries, contract semantics, provider ownership, and discoverability. Inspect the current contract and nearest existing tool relevant to the analyst question; source, documentation, and live catalogs may describe different versions. For a design request, return the proposed boundary, input/result shape, Evidence semantics, nearest alternative, and verification approach. Implement when requested, preserving the user's scope and existing authorization. For implementation or verification, consult [testing](../../../docs/testing.md) for the affected consumer and provider lanes, and [contributing](../../../CONTRIBUTING.md) for generated-file ownership. Read provider/workflow guides only as the task requires.
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
exec(compile(Path(entry).read_bytes(), entry, "exec"), {"__name__": "__main__", "__file__": entry})exec(compile(source, implementation, "exec"), {exec(compile(runtime_path.read_bytes(), str(runtime_path), "exec"), runtime)
command = "python exec(compile(open(" + repr(bridge) + ", 'rb').read(), " + repr(bridge) + ", 'exec'), {'__name__':'__main__','__file__':" + repr(bridge) + "})"exec(compile(source, implementation, "exec"), {### یک MCP برای مهندسی معکوس فایلهای باینری، برنامهها و رفتار زمان اجرا.
**قابلیتی دیدهاید که دوستش دارید؟ سازوکارش را تا سطح باینری درک کنید.**
**[وبسایت](https://rea.tools/) · [راهنماها](https://rea.tools/guides/) · [نمونههای عملی](https://rea.tools/showcase/)**
[شروع سریع](#شروع-سریع) · [REA چگونه کار میکند؟](#rea-چگونه-کار-میکند) · [چه چیزهایی را میتوان تحلیل کرد؟](#چه-چیزهایی-را-میتوان-تحلیل-کرد) · [نمونههای عملی](#نمونههای-عملی) · [پرسشهای متداول](#پرسشها
قابلیتی در یک برنامه دیدهاید که میخواهید در محصول خودتان داشته باشید؟ از ایجنت خود بخواهید با REA آن را بررسی کند. ایجنت میتواند بدون دسترسی به کد منبع برنامه، نحوهٔ کار قابلیت را بررسی و توضیح دهد، ش
"trace=%process,%network,%file,ptrace,process_vm_readv,process_vm_writev",
`Inspection attempted ptrace: ${file}`,body: JSON.stringify({ token: "request-body-secret-value", active: true })socket.addEventListener("open", () => socket.send(JSON.stringify({ token: "websocket-secret-value" })));const token = "fixture-authentication-token";
const token = "secret-token-that-must-not-leak";
result: { ok: true, token: "response-body-secret" },.gitmodules
.jscpd.json
.oxfmtrc.json
.oxlintrc.json
.release-please-manifest.json
file_hash: createHash("sha1").update(bytes).digest("hex"),createHash("sha1").update(bytes).digest("hex") === release.file_hash;: createHash("sha1").update(this.archive).digest("hex"),Gates applied: no_behavioural_pass.
271def47ba70full audit observations/trust-audit/skill/morluto__rea.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 271def47ba70 | BLOCK | F | 41 | first audit |
Questions
What does the rea skill do?
Reverse engineer anything with agents, from app behavior down to native binaries.
Is rea safe to install?
No — not without reading the findings first. The audit graded it F (41/100) and found 10 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can rea access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does rea work with?
Its documentation mentions claude-code, claude-desktop, codex, copilot, cursor, gemini-cli and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (271def47ba70), read on 2026-10-10. The repository is watched, and a new audit runs when it changes — this is the first audit.