skills / rea-mcp.md
skills / rea-mcp.md
rea-mcp (LM Studio) to reverse engineer thingsrea-mcp gives you reverse-engineering tools through MCP. You can use them to
understand how something works, down to the binary level. It wraps the original
morluto/rea ("Reverse Engineer Anything").
You can analyze:
All analysis runs locally. REA returns observations, limits, and unknowns — so "not found" or "not supported" is a real answer, not a bug.
Each rea-mcp tool has the same shape:
name: the tool name (for example procedure_pseudo_code).description: what the tool does. Read it before every call.parameters: the input. The tool tells you which fields are required.There are 170+ tools. Most names start with a verb:
If you are unsure which tool to use, read the description. Names starting with
inspect_, list_, read_, and resolve_ cover most first steps.
A call has a name and arguments. For example, to decompile one procedure:
The tool returns text (the decompiled code, or an error). Read it, then decide the next step.
list_strings → list string objects (optionally by address).find_xrefs_to_name / xrefs → find which code uses a string.procedure_pseudo_code at that code → read the context.analyze_javascript_application / analyze_web_bundle → analyze the app.compare_web_screenshots / compare_web_captures → diff two versions.export_web_scripts / → save the evidence.list_adb_devices → list connected devices.install_adb_package / pull_adb_package → install or extract an APK.| Goal | Tools |
|---|---|
| Confirm the target + engine | binary_session, binary_overview |
| List symbols / functions / strings | list_names, list_procedures, list_strings |
| Read / decompile one function | procedure_pseudo_code, read_function_instructions, batch_decompile |
| Follow calls and references | resolve_native_call_targets, procedure_callees, procedure_callers, xrefs |
| Read bytes / instructions | read_bytes, inspect_native_instruction |
| Record findings | set_comment, set_address_name, set_bookmark |
| Watch live behavior | trace_*, observe_*, capture_* |
| Save the evidence | export_evidence_bundle, build_reconstruction_obligation_ledger |
rea-mcp is a lightweight LM Studio plugin that re-declares REA's tools and
forwards each call to the original REA MCP server (spawned as a child process).
It does not re-implement REA. The original source lives in ./REA
and is left untouched, so it stays updatable with git pull.
Original: morluto/rea — "Reverse Engineer
Anything." Licensed MIT, matching this plugin.
rea-mcp (LM Studio) to reverse engineer thingsrea-mcp gives you reverse-engineering tools through MCP. You can use them to
understand how something works, down to the binary level. It wraps the original
morluto/rea ("Reverse Engineer Anything").
You can analyze:
All analysis runs locally. REA returns observations, limits, and unknowns — so "not found" or "not supported" is a real answer, not a bug.
Each rea-mcp tool has the same shape:
name: the tool name (for example procedure_pseudo_code).description: what the tool does. Read it before every call.parameters: the input. The tool tells you which fields are required.There are 170+ tools. Most names start with a verb:
If you are unsure which tool to use, read the description. Names starting with
inspect_, list_, read_, and resolve_ cover most first steps.
A call has a name and arguments. For example, to decompile one procedure:
The tool returns text (the decompiled code, or an error). Read it, then decide the next step.
list_strings → list string objects (optionally by address).find_xrefs_to_name / xrefs → find which code uses a string.procedure_pseudo_code at that code → read the context.analyze_javascript_application / analyze_web_bundle → analyze the app.compare_web_screenshots / compare_web_captures → diff two versions.export_web_scripts / → save the evidence.list_adb_devices → list connected devices.install_adb_package / pull_adb_package → install or extract an APK.| Goal | Tools |
|---|---|
| Confirm the target + engine | binary_session, binary_overview |
| List symbols / functions / strings | list_names, list_procedures, list_strings |
| Read / decompile one function | procedure_pseudo_code, read_function_instructions, batch_decompile |
| Follow calls and references | resolve_native_call_targets, procedure_callees, procedure_callers, xrefs |
| Read bytes / instructions | read_bytes, inspect_native_instruction |
| Record findings | set_comment, set_address_name, set_bookmark |
| Watch live behavior | trace_*, observe_*, capture_* |
| Save the evidence | export_evidence_bundle, build_reconstruction_obligation_ledger |
rea-mcp is a lightweight LM Studio plugin that re-declares REA's tools and
forwards each call to the original REA MCP server (spawned as a child process).
It does not re-implement REA. The original source lives in ./REA
and is left untouched, so it stays updatable with git pull.
Original: morluto/rea — "Reverse Engineer
Anything." Licensed MIT, matching this plugin.
inspect_* — look at one thing (instruction, type, class, package...)list_* — list many things (names, procedures, strings, segments, devices)read_* — read bytes, instructions, logcat, settingsset_* / comment / set_comment — write a name or commentopen_* / close_* — open or close a target (binary, project)analyze_* / decompile_* / extract_* — deep worktrace_* / observe_* / capture_* — dynamic / live behaviorresolve_* / find_* / xrefs — follow references and call sitesbinary_session / binary_overview — start: confirm the target and providerdescription before each call. It tells you exactly what the tool
needs and what it returns.binary_session or binary_overview
to confirm the target and the provider (Hopper / Ghidra / IDA / ...). Then
list_names, list_procedures, then procedure_pseudo_code.0x.... Ask the model to name the address before
calling again.Working...) and wait.binary_session → confirm the file and the provider.list_procedures → get the list of functions.list_names → get symbols / entry points.procedure_pseudo_code with procedure: "main" → read the decompiled main.procedure_callees / procedure_callers → see who main calls and who calls it.resolve_native_call_targets → follow a specific call.set_comment / set_address_name → record what you learned.export_evidence_bundleobserve_web_execution / trace_javascript_semantics → watch live behavior.inspect_android_package / inspect_android_class → inspect classes.capture_adb_screen / capture_native_ui_scenario → capture the UI.trace_android_references / read_adb_logcat → trace and read logs.inspect_evm_interface, analyze_*, trace_*.inspect_managed_members, batch_decompile, compare_managed_members.extract_firmware, inspect_firmware_regions.inspect_macho, inspect_objc_classes, inspect_objc_protocols,
decode_interface_builder.list_*inspect_*read_*export_evidence_bundle to save what you found.{
"name": "procedure_pseudo_code",
"arguments": {
"procedure": "main",
"provider": "ghidra"
}
}
inspect_* — look at one thing (instruction, type, class, package...)list_* — list many things (names, procedures, strings, segments, devices)read_* — read bytes, instructions, logcat, settingsset_* / comment / set_comment — write a name or commentopen_* / close_* — open or close a target (binary, project)analyze_* / decompile_* / extract_* — deep worktrace_* / observe_* / capture_* — dynamic / live behaviorresolve_* / find_* / xrefs — follow references and call sitesbinary_session / binary_overview — start: confirm the target and providerdescription before each call. It tells you exactly what the tool
needs and what it returns.binary_session or binary_overview
to confirm the target and the provider (Hopper / Ghidra / IDA / ...). Then
list_names, list_procedures, then procedure_pseudo_code.0x.... Ask the model to name the address before
calling again.Working...) and wait.binary_session → confirm the file and the provider.list_procedures → get the list of functions.list_names → get symbols / entry points.procedure_pseudo_code with procedure: "main" → read the decompiled main.procedure_callees / procedure_callers → see who main calls and who calls it.resolve_native_call_targets → follow a specific call.set_comment / set_address_name → record what you learned.export_evidence_bundleobserve_web_execution / trace_javascript_semantics → watch live behavior.inspect_android_package / inspect_android_class → inspect classes.capture_adb_screen / capture_native_ui_scenario → capture the UI.trace_android_references / read_adb_logcat → trace and read logs.inspect_evm_interface, analyze_*, trace_*.inspect_managed_members, batch_decompile, compare_managed_members.extract_firmware, inspect_firmware_regions.inspect_macho, inspect_objc_classes, inspect_objc_protocols,
decode_interface_builder.list_*inspect_*read_*export_evidence_bundle to save what you found.{
"name": "procedure_pseudo_code",
"arguments": {
"procedure": "main",
"provider": "ghidra"
}
}