REA stands for Reverse Engineer Anything, and the repo is morluto/rea. It plugs into agents like Claude Code, Codex, Cursor, Gemini CLI and a few others through MCP, which is just the standard way agents call outside tools. When I checked, it had 88.9k stars and 19.5k forks. Those are big numbers for something most developers I know haven’t heard of.
In my last article I wrote about an Adobe app being open sourced, and I said it could turn into a big threat for software applications. I still think that. But REA changes how I see it, because Adobe opening a codebase was one company making one decision. REA needs nobody’s permission.
What REA actually does
Setup is one command only: npx rea-agents setup. It registers REA with your agent, installs some workflow instructions, and after a restart the agent can call REA's tools on whatever you point it at.
The list of targets is long. Native binaries through Hopper, Ghidra or IDA. JavaScript and Electron apps. .NET assemblies, Android APKs, websites, and even firmware and Ethereum bytecode. What comes back depends on the target. For native code you get pseudocode and assembly, for Electron apps you get modules, imports and IPC routes, and the README says every result carries the evidence and limits behind it. Analysis runs on your machine. Your agent’s model provider still sees the tool results though, so its data policy applies.
Two of the case studies on the project site made me sit up. In the Notion one, the agent finds the renderer’s clipboard API, follows it through the preload script and IPC into the main process, and then inspects the rich clipboard format. That’s a real feature of a real paid product, traced without Notion’s source.
And the DX-Ball one is stranger. An agent followed a sound call down to a small helper that turns a position into a stereo pan value, read the instructions, and rebuilt it in C. The rebuilt code passes 3,205 test cases against the original x86 and reproduces all 63 bytes of the compiled function.
Now the limits, because there are several. REA gives you pseudocode and module relationships, not the original source with its comments and variable names. Deep native work still needs Hopper, Ghidra or IDA installed on your machine. DX-Ball is a DOS-era game, so the binary is tiny compared with anything shipping today. I should also say I haven’t run REA on a paid app myself. I opened repo, read the README twice and went through the case studies, so my read is secondhand in that way. The project also moves fast. When I looked there were 101 open issues and 50 open pull requests, and the README tells you to update often because new releases fix bugs. I’d guess some of what I describe here will behave differently in a month, and I can’t tell you which parts.
Why the SaaSpocalypse makes this feel different
If you missed it, “SaaSpocalypse” is the word Jeffrey Favuzza, an equity trader at Jefferies, used for the software selloff in early February 2026. On February 3 a Goldman Sachs basket of US software stocks fell 6% in one session, the worst day since April, going by Bloomberg’s reporting as repeated in Outlook Business. Around $285 billion disappeared from software, financial services and asset management shares over those days. The trigger was Anthropic’s Cowork plugins, and legal software got hit first.
India felt it the next morning. The Nifty IT index dropped 6.84% on February 4, with HCLTech down 5.76% and Wipro down 4.52%.
Then it happened again on March 24, after a Bloomberg report that Amazon was building agents for sales and technical roles. Salesforce fell 5.8% and ServiceNow 5.9% that day, according to SentiSense.
Between those two dates the stocks bounced a little, and The Batch from DeepLearning.AI pointed out why. Anthropic had started partnering with some of the same software companies that were being sold off, so investors saw that the story wasn’t only replacement. They never got back the full drop though.
So the fear so far has been one specific fear. Agents will do the work people used to do inside software, seats will shrink, and per-seat pricing stops making sense. That’s real, and I think it’s mostly right for the seat model.
REA is the other half. The coverage I read didn’t talk much about agents copying the product itself, only about agents replacing the people who use it. The threat isn’t that your app gets used less, it’s that your best feature gets rebuilt by someone who never saw your code.
Put the Adobe story next to this. When a company opens its code, it still chooses what to release and when. With REA that choice moves to whoever has a free tool and an agent, and the company finds out later or never.
Who’s actually exposed
Electron is the clearest case. These apps ship their JavaScript to every user’s machine, so people could always read it. It was just boring. Minified, scattered across hundreds of modules, and that boredom was the only protection. REA’s JavaScript analysis maps modules, imports, source maps, routes and IPC, which is the exact boring part. A lot of popular desktop apps are built on Electron, so that’s a big group of products whose client logic got cheaper to read overnight.
Mobile apps with logic on the device are in the same spot, and so are browser extensions and small paid desktop tools. If the clever part of your product lives on the user’s machine, assume an agent can find it.
Server-heavy products are much safer, and this is where I land about 70/30 against the doom version. The Notion case study traces a clipboard bridge. Great, but a clone of that gives you a clipboard trick and none of Notion’s workspace data and none of the integrations built around it. Someone will say agents will clone everything. They’ll clone interfaces, sure, but a company’s data and contracts don’t sit inside the binary. That same Batch piece said the lesson isn’t that software is dead, and I agree with that more than with the headlines.
Which is the part I keep coming back to for Indian IT services. Those firms spend years migrating old .NET and native apps for clients, and a tool that explains a legacy binary to an agent is directly useful for that work. It also shrinks the billable hours that work used to need. I think both things are true and I don’t know which one wins.
The legal part people skip
The README has a disclaimer. REA is for lawful research, and you’re responsible for getting any authorization you need. I’m not a lawyer, so take this as a layman’s reading only. Many software licenses ban reverse engineering outright. Rules also differ by country. As I understand it, copyright covers code and assets and not the idea of a feature, so learning how something works and writing your own version sits in a different place than copying its code. But where the line falls depends on your country and on the contract you clicked through, and I wouldn’t bet a company on my reading.
What I really don’t know is how courts will treat agent-assisted cloning. As far as I can tell, nobody does yet.
Vendors have a few moves. They can push more logic to the server, obfuscate harder, or tighten licenses. I think the first one works and the second only slows people down, while the third works mostly on paper.
One more thing, since I got stuck on it. The README thanks everyone for 80,000 stars, but the live page shows 88.9k. I spent a few minutes trying to work out which number was right before I decided the README is probably just behind. The strangest line in there is the disclaimer saying the project hasn’t issued any cryptocurrency, and that tokens using the REA name aren’t connected to it. You know a repo is popular when scam tokens show up.
What I’d do this week
If you build and sell software that ships to user devices, point REA or something like it at your own latest release before someone else does. See which features an outsider could explain, which routes show up, what’s sitting in plain view. Then move the valuable logic to your server where you can.
You Can access the Github Repo here: https://github.com/morluto/rea
If your product is mostly a server and a login, REA is a smaller worry for you than per-seat pricing is, and that’s a separate fight.
Run it on a copy, not your production build. The README says runtime capture runs the target with your user permissions, and each runtime guide spells out what that does to your machine.