REA Gains 120K GitHub Stars in Three Days: AI Agents Can Clone Software Without Source Code

As of October 12, the repository page of the GitHub project named REA (Reverse Engineer Anything) showed 120,000 stars. For comparison, at the start of the year OpenClaw accumulated 60,000 new stars by its third day of breakout. Both figures come from the repository page or article retellings, and the article does not state whether there was independent third-party verification, so they are better read as "attention signals" rather than an audited growth curve.

REA's GitHub README states its goal plainly: "Reverse engineer anything through an Agent, going all the way from application behavior down to the native binary level." The reason this sentence sparked discussion is that it touches a premise the software industry has held for decades: source code is unobtainable, so you have to buy. When AI can read binaries, trace call chains, and generate reconstructed code, this premise itself begins to loosen.

REA's mechanism is not mysterious: it uses AI coding agents such as Claude Code and Codex to connect to reverse-engineering tools like Ghidra and Hopper through MCP, letting the Agent analyze software without source code, trace clues to feature implementation, and attempt to write similar functionality. It is itself an open-source tool written in TypeScript, uses the MIT license, and can be used with AI coding assistants such as Claude Code, Cursor, Codex, Gemini CLI, Windsurf, and Claude Desktop.

The key point is that the reverse-engineering tools REA calls are themselves nothing new: Ghidra was open-sourced in 2019, Hopper's history dates back to 2011, and IDA has been used by reverse engineers since the 1990s. What REA does is connect these tools into the coding workflow, let the Agent call them, and automate the analysis steps that previously had to be chained together manually. In other words, what it provides is a scheduling layer, not a new reverse-engineering engine.

In terms of coverage, REA's support for native binaries is the deepest, covering Mach-O, ELF, PE, and macOS .app packages (including Swift and Objective-C metadata), packages and archives such as ZIP/APK/IPA/ASAR, Electron and JavaScript applications, websites, and .NET managed PE/CLI, and it supports version-difference analysis. Among these, website analysis relies on a local Chrome DevTools endpoint and is a passive observation of a browser the user already controls; .NET analysis requires no program execution and only inspects metadata, members, and native code boundaries; Electron and JavaScript application analysis is static review and requires no running of the application. These constraints show that it is not "one-click dismantling of everything," but a toolchain with clear boundaries.