🔍 Read the full analysis: How To Let An AI Agent Explore A Project You Didn’t Build on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
An October 19 article on ThorstenMeyerAI.com describes how Reverse Engineer Anything (REA) connects coding agents to tools for inspecting existing programs. Its central example is Ledger Reborn, whose author reports matching several QuickBooks Desktop reports to the cent after investigating the software’s accounting behavior. The article presents a practical workflow, while warning that agent findings need evidence and that REA is not a security sandbox.
Thorsten Meyer published a guide on October 19 to using the open-source Reverse Engineer Anything (REA) toolkit with coding agents to inspect programs a developer did not build. The report focuses on a practical question: how to move from an application’s visible features to evidence about the data, calculations and rules behind them before designing another app.
REA connects agents such as Claude Code, Codex, Cursor and Gemini CLI to analysis tools through a local MCP server. It also includes a command-line tool and an agent skill that guides investigations. The article says REA supports several kinds of targets, including native programs, Electron and JavaScript applications, .NET and Android software, firmware, saved network traffic, WebAssembly and SQLite databases. Which analysis tools are available depends on the target and the user’s installed software.
The guide recommends defining one behavior and the decision it informs, rather than asking an agent to explain an entire application. For example, an investigation might ask how a partial invoice payment changes the remaining balance and which account receives the posting. Meyer advises asking the agent to distinguish what it observed from what it inferred or could not establish, and to explain a complete example using concrete inputs and outputs.
For setup, the article gives a guided installation command, notes a Node.js 22.19-or-newer requirement, and recommends checking both the installation and the live agent connection. A diagnostic command can verify files and prerequisites, but, the guide says, it does not establish that the agent can actually call REA. The user should confirm tool access inside the agent before relying on its analysis.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Build Specs
For developers recreating a workflow or replacing a legacy tool, a screen is not a specification. The behavior behind it may depend on stored records, calculations and conditional rules that are not visible in ordinary use. An agent-assisted investigation can help turn those questions into a written model that can be tested before a replacement is built.
The guide’s most concrete example is Ledger Reborn, a local accounting application whose author says its profit-and-loss statement, balance sheet and trial balance matched QuickBooks Desktop’s official sample company account by account, to the cent. Meyer says the project’s author used REA to investigate the original software. That reported result illustrates a possible use of the method; it is not independent verification that REA will produce equivalent results for other programs or projects.
As an affiliate, we earn on qualifying purchases.
How REA Fits Into Agent Work
REA is described as an MIT-licensed open-source project hosted on GitHub. Meyer reports that version 6.7.0 was released October 18, 2026, and that the project had about 325,000 stars and 82,000 forks on October 19, following attention on GitHub’s trending page earlier in October. Those figures are observations reported by the article, not evidence by themselves of analysis quality.
The proposed workflow combines an AI agent with established analysis software, including options such as Ghidra, Hopper or IDA for native programs. The agent can help ask questions and interpret returned evidence, while the analysis tools inspect the target. The user still needs to check whether a conclusion follows from that evidence and whether the investigation has covered the relevant cases.
“This is not a sandbox.”
— Reverse Engineer Anything project documentation, as quoted by Thorsten Meyer
software reverse engineering toolkit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Findings
The article’s accounting example is a project author’s reported result; the supplied material does not include an independent replication, full test data or a complete description of the comparison. It also does not establish how reliably REA performs across different software types, versions or analysis questions.
It remains unclear from the supplied material how much of a typical investigation can be automated, how often agents reach incorrect conclusions, and what safeguards or review process the Ledger Reborn author used beyond comparing the named reports. The source text also ends during a sentence about the case study, limiting what can be reported about its stated method and conclusions.
REA runs analysis locally, according to Meyer, but the guide warns that results are sent to the agent and its model provider, under that provider’s data policies. The specific handling of each provider’s data, and the confidentiality risks for a particular target, depend on the user’s setup and provider terms.
As an affiliate, we earn on qualifying purchases.
Verify Before Building Further
The guide’s next step for readers is to install REA, confirm that the agent can call its tools, and begin with a harmless program they own. From there, they can investigate one bounded behavior, ask for evidence and a worked example, and check whether the answer supports the design decision they need to make.
For Ledger Reborn, the supplied article does not identify a forthcoming release, independent audit or additional test milestone. Further verification would require access to the underlying case study and its evidence, along with repeatable comparisons against the relevant software and test cases.
AI programming investigation software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source toolkit that connects coding agents to software-analysis tools through a local MCP server. It also provides a command-line tool and an agent skill, according to Meyer’s guide.
Can REA prove that an AI agent’s explanation is correct?
No such guarantee is established in the report. Meyer recommends asking for observed, inferred and unknown findings separately, then checking that the agent can explain a complete example with concrete inputs and outputs.
Does local analysis mean no information leaves my machine?
No. The guide says the analysis runs locally, but results are sent to the agent and its model provider. Their data handling depends on the provider’s policy and the user’s configuration.
Is REA safe to use on unknown software?
The project warning quoted in the article says REA is not a sandbox. Unknown programs should be treated as untrusted files because analysis tools run with the user’s permissions.
What does the Ledger Reborn example show?
The project author reports that Ledger Reborn matched three QuickBooks Desktop reports for an official sample company account by account, to the cent. That is a reported case study, not independent proof that the same result will follow in other projects.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
