I came across Awesome REA, a list of projects where an AI agent "reverse-engineered and rebuilt" closed software: old games, a Bloomberg-style terminal, a macOS calendar, a voice dictation app. My first question was the usual one: what can I use from this? This time I tried to answer it properly instead of starring the repo and moving on.
What REA is
REA (morluto/rea) is an MCP server. It does not decompile anything itself. It lets an agent like Claude Code drive Ghidra, IDA, Hopper or JADX and read what they return.
flowchart LR
B["Closed app<br/>or binary"] --> D["Ghidra, IDA,<br/>Hopper, JADX"]
D --> R[REA MCP server]
R --> A[Coding agent]
A --> M["Model provider<br/>sees the decompiled code"]
A --> X[Rebuild]
The list has 46 cases. Each one has a tag that says how much proof there is: REA, AI-RE when another AI tool was used, or Claim? when nobody can confirm it.
Read the small print first
The best thing about the list is that it is honest. It has its own section on evidence, and that section reads like an argument against the rest of the page.
| Study | Runs | Result |
|---|---|---|
| rea-lab, five preregistered studies | 482 | No significant gain in solve rate. About twice the time and cost |
| rea-lab, study 2 | 48 | 11 of 24 solved without REA, 4 of 24 with it (p = 0.092) |
| leanrea | 36 | A plain CLI skill scored 74/75, REA 75/75, at 38% less time and 35% less cost |
The showcase cases also get smaller when you look closer. "Rebuilt DX-Ball" means one function checked byte by byte against the original, not the whole game. Most entries are ports of old games or demos for a write-up, not tools you would open on a Monday.
The list flags three more problems itself. The same agent reads the decompiled code and writes the rebuild, so it is not a real clean room. The decompiled code goes to the model provider, and REA's own security note says it is not a sandbox. IDA, Hopper and JEB need paid licences, and the terms of Anthropic and OpenAI forbid reverse engineering their own services.
What I tried on my Mac
From the 46, I picked the three that looked useful for day-to-day work, plus one defensive tool. Claude read each repo before I ran anything: what it installs, what it downloads, where it sends data. That review alone ruled out most of them.
123 lines of Python. Windows only, an English-only Whisper model, no licence file. A demo for a write-up, not a tool.
Needs Linux, Podman, SELinux and an x86_64 machine. It does not run on Apple Silicon.
Runs on Docker Desktop with the network off and read-only mounts. Static analysis only, and the image build pulls a jar from an unknown GitHub account.
MIT Node CLI with no dependencies and no telemetry. The only one I kept.
The useful part is defence
reaproof turns the question around. It does not ask what you can pull out of someone else's app. It asks what an agent can pull out of yours. It checks shipped builds for source maps that contain your source, server keys, .env values, stray .git or keystore files, and debug builds. It reads web build folders, APK and IPA files, native binaries, or a live URL.
node bin/reaproof.mjs https://example.com --no-open
I ran it from a local clone, not with npx, because npx pulls whatever npm publishes at that moment. On mtl.dev it returned "baseline": no source maps exposed, no leaks found. A plain scan changes nothing. The only fix it offers is moving .map files to a backup folder, and only after you type yes.
It does not check Django or any Python backend. A Flutter app gets only generic APK and IPA checks, with no Dart analysis. It is also very young: all its releases came out in one week in October 2026.
What it took
Most of the time went into reading, not running. Reading each repo before installing it saved me from three setups that would never have worked on this machine. Next time a list like this lands in my feed, I will read the evidence section first and the showcase second, and I will add reaproof to the release checklist for the web builds I ship.
Related notes
A vision model scored my swim videos, and it liked almost everything
I ran the vision step of my reels-finder skill on 21 hours of action camera video. The scene descriptions were good. The 1 to 5 reel score was not, so I filter by tags and setting instead.
Analytics showed nothing although cookies were accepted
GA4 on mtl.dev stayed empty after I accepted my own cookie banner. The banner stored the choice but never told gtag about it on the next page load, so every hit went out as a denied ping. One consent update on mount fixed it.