Set up REA. Start with one good question.

REA has three distinct pieces.

REA (Reverse Engineer Anything) gives your coding agent structured access to software analysis tools. The name describes a broad investigation workflow; the tools you actually need depend on the target.

Keep these pieces separate when following a REA setup tutorial. A skill alone does not establish a running connection, and a connection alone does not install every analysis engine.

Static JavaScript and Electron inspection can work without Ghidra, Hopper, or IDA. Native analysis needs a supported provider. Android and other targets have their own prerequisites, so check the official guide for the task you plan to perform.

Install the official package and review setup.

The REA documentation lists supported Node.js release ranges. At this review, these are Node 22.19 or later within 22.x, Node 24.11 or later within 24.x, or Node 26+. Check your local runtime first, then use the official rea-agents npm package.

node --version
npm --version

npx rea-agents@latest setup

Choose your coding agent, read the proposed configuration changes, and approve the intended setup. REA can register its MCP server and install matching workflow instructions. Restart or reconnect the agent afterward so the new tools appear in the active session.

You can inspect a scoped setup plan without applying it. This example targets the client ID codex; choose the ID documented for your own client.

npx rea-agents@latest setup --client codex --dry-run --json

Verify the registration, then the connection.

REA’s doctor command checks configuration and prerequisites. It does not prove that an already-running agent has reloaded its tools. Inspect the registration first; then confirm the tools are actually available inside your agent.

npx rea-agents@latest doctor --client codex --json

For a first Electron investigation, choose a small extracted app directory or an ASAR archive. The CLI can inspect it even while you are working through an MCP connection issue.

npx rea-agents@latest analyze-javascript-application \
  "/absolute/path/to/app.asar" --json

Replace the path with your own local file. The REA result contains evidence and explicit limitations. A native-provider warning does not necessarily block an unrelated JavaScript inspection.

Ask about a behavior, not an entire application.

“Reverse engineer anything” is a useful invitation, but a focused task is a better starting point. Choose an export action, a clipboard format, or one settings value. Tell the agent what you want to understand and what would count as evidence.

Use REA to inspect my local Electron application.
Trace what happens when I export a note as CSV.
Cite the entry point, IPC channel, and file-writing code.
Separate static findings from verified runtime behavior.
List unknowns and suggest one small verification step.

The ASAR inspector can help identify a starting file and prepare this task. Our Electron reverse engineering guide walks through the renderer, preload, and main-process boundaries.

When setup doesn’t stick.

“I installed the skill, but there are no tools.”

Skill installation supplies instructions. Confirm MCP registration with doctor, review a setup plan if needed, and reconnect the agent. Reinstalling instructions repeatedly does not refresh an existing connection.

“The repository documents a feature I cannot use.”

Check the released package and your server registration. REA’s main branch can include features that have not reached npm. Release 6.4.0 was the latest release checked for this guide; later releases may change the available clients and operations.

“The context fills up before analysis begins.”

Some client and model configurations load large tool definitions eagerly. The official documentation explains supported compact-schema settings and client-specific limitations. Check that guidance before applying a generic fix; changing a provider timeout does not increase a model’s context window.

Sources: installation reference, release drift investigation, context-window report. Reviewed October 12, 2026. These instructions are documentation-based; they are not a claim that every provider/client combination was tested by this site.