🔍 Read the full analysis: Use AI To Find Your Bearings In A Project You Didn’t Write on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A ThorstenMeyerAI.com report describes using Reverse Engineer Anything (REA) with AI coding agents to investigate how existing software behaves. Its examples emphasize asking narrow questions, checking that REA is actually connected and treating agent explanations as findings to verify—not as proof.
A October 19 report from ThorstenMeyerAI.com describes how developers can use the open-source Reverse Engineer Anything (REA) project with AI coding agents to investigate software they did not write. The approach is aimed at finding how a program handles a specific behavior—not merely recreating its screens—so developers can turn observations into requirements for their own tools.
REA connects agents such as Claude Code, Codex, Cursor and Gemini CLI to analysis tools through a local MCP server. It also includes a command-line utility and an agent skill that guides investigations. The report says its analysis engines can work with several kinds of targets, including native programs, JavaScript and Electron apps, .NET and Android applications, firmware, databases and WebAssembly. For websites, it can observe behavior in a browser controlled by the user.
The report’s central example is Ledger Reborn, a locally built accounting application whose developer used REA to investigate QuickBooks Desktop for Mac 2024. The report says the developer examined topics including inventory calculations, account-type effects on budget figures, reconciliation balances and cash-basis reporting. It also says Ledger Reborn’s profit-and-loss statement, balance sheet and trial balance matched those of QuickBooks’ official sample company account by account, to the cent. That result is presented by the report; the supplied material does not include independent verification of the comparison.
The proposed workflow begins with one bounded question tied to a design decision. Rather than asking an agent to explain an entire accounting program, a developer might ask how a partial invoice payment changes the remaining balance and which account receives the posting. The report recommends asking for stored data, calculations and conditions, and having the agent label each statement as observed, inferred or unknown. A useful test is whether it can explain one concrete example with inputs and outputs.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Program Behavior to Specifications
For developers joining an unfamiliar project, source code alone may not quickly reveal the behavior users rely on. A focused investigation can help identify business rules and data changes that a surface-level imitation would miss. That matters when replacing an old application, building an integration or documenting a system whose original design decisions are poorly recorded.
The report’s accounting example also shows the limits of treating an AI-generated explanation as a finished specification. Matching statements for one sample company is a useful reported result, but it does not establish that every accounting scenario or edge case has been reproduced. Developers still need to test representative cases and validate the agent’s account of the program against observable outputs and other evidence.
As an affiliate, we earn on qualifying purchases.
How REA Fits Into Agent Workflows
REA is described as an MIT-licensed project on GitHub under the repository name morluto/rea. The report says version 6.7.0 was released October 18, one day before publication. It also reports about 325,000 stars and 82,000 forks as of October 19, following attention on GitHub’s trending page earlier that month. Those figures are a dated snapshot, not a measure of accuracy or adoption in particular industries.
To use the tool, the report gives a guided setup command, npx rea-agents@latest setup, and says the project requires Node.js 22.19 or newer. Some forms of native analysis need additional software, such as Ghidra and Java, or licensed tools such as Hopper or IDA. After installation, the report advises checking prerequisites with REA’s doctor command and separately confirming that the agent can call an REA tool. The diagnostic does not test the live agent connection, according to the report.
““This is not a sandbox.””
— Thorsten Meyer, ThorstenMeyerAI.com report
software reverse engineering software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Tests
The supplied report does not provide an independent audit of Ledger Reborn’s claimed match with QuickBooks or detailed test results across a wide range of accounting scenarios. It is also not clear from the material how often REA’s analysis produces incomplete or incorrect interpretations, or what level of expertise is needed to resolve ambiguous evidence.
REA runs analysis locally, but the report says results are sent to the coding agent and the model provider, subject to that provider’s data policy. The project’s local operation therefore does not, by itself, mean that information stays on the developer’s machine. The report also cautions that unknown programs should be treated as untrusted files; it does not describe REA as a security sandbox.
program analysis tools for developers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify the Connection and Findings
The report’s practical next step for a developer is to install REA, review the setup plan, restart the agent and verify that an REA tool is available before analyzing a target. It recommends starting with a harmless application the developer owns, then choosing a narrow behavior and asking the agent to show its evidence and a complete example.
For the Ledger Reborn case, further confidence would require testing more inputs and edge cases and documenting which conclusions are directly observed, inferred or still unknown. The supplied material does not announce a separate release, independent audit or follow-up timetable. Developers considering REA can refer to its project documentation for current requirements and tool support.
AI-powered code investigation tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source project that connects coding agents to software-analysis tools. The report describes it as a local MCP server, command-line tool and agent skill.
Does REA prove that an agent’s explanation is correct?
No. The report recommends distinguishing observed, inferred and unknown statements, then testing the explanation against concrete inputs and outputs. It does not present agent responses as proof on their own.
Does REA send data to the cloud?
REA runs analysis locally, but the report says results go to the coding agent and its model provider, under the provider’s data policy. Local analysis should not be taken to mean that all information remains on the machine.
Is REA safe to use on an unknown program?
The report says REA is not a sandbox and that its tools run with the user’s permissions. It advises treating unknown binaries as untrusted files.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
