🔍 Read the full analysis: The First Questions To Ask An AI Agent About A Codebase on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
ThorstenMeyerAI.com published a guide on October 19, 2026, describing how developers can use the open-source Reverse Engineer Anything (REA) project with AI coding agents to inspect existing software. It recommends asking narrow, decision-focused questions, confirming that REA is connected, and checking the agent’s findings against concrete examples; the source also warns that analysis results go to the model provider and that REA is not a sandbox.
ThorstenMeyerAI.com published a guide on October 19 to using the open-source Reverse Engineer Anything (REA) project with AI coding agents to investigate how existing software behaves. The guide’s central advice is to ask about one specific behavior tied to a concrete decision, then verify that the agent actually used REA and can explain a worked example.
The guide describes REA as a local MCP server, command-line tool and agent skill that can connect with coding agents including Claude Code, Codex, Cursor and Gemini CLI. It lists analysis support for native programs, JavaScript and Electron apps, .NET and Android applications, firmware, saved network traffic, WebAssembly, SQLite databases and older DOS software. For websites, it says REA can observe activity in a user-controlled Chrome-family browser.
Setup depends on the user’s environment. The source says REA requires Node.js 22.19 or newer; native-program analysis may also require Ghidra and Java, or licensed disassembly software such as Hopper or IDA. After installation, the guide recommends checking prerequisites with REA’s doctor command and separately confirming the live connection inside the agent. It says the doctor checks setup files and prerequisites, but not whether the agent’s connection is working.
As an example of the method, the article describes Ledger Reborn, a local accounting application built after its developer investigated QuickBooks Desktop. According to the source, the developer used REA to examine such matters as inventory arithmetic and cash-basis reporting, then compared the app’s statements for Intuit’s official sample company with QuickBooks. The source reports that the profit-and-loss statement, balance sheet and trial balance matched account by account, to the cent. That result is reported by the article; it is not an independent evaluation of the software or the comparison.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Usable Specifications
The guide addresses a common gap in AI-assisted development: an agent can generate an interface without accurately modeling the rules behind it. Asking how a program handles a partial payment, for example, can surface the stored data, calculation and conditions that affect the result. Those details can inform a specification before a developer builds a similar feature.
The recommended checks also help distinguish tool-supported findings from model guesses. A plausible explanation is not proof that the agent inspected the program. The guide says to confirm tool use and require a concrete example with inputs and outputs; if the agent only describes what appears on screen, it may not have identified the underlying mechanism.
There is a privacy and security trade-off. REA performs analysis locally, according to the source, but its results are passed to the coding agent and the model provider under that provider’s data policy. The article also cautions that REA is not a sandbox: opening an untrusted program exposes it to analysis tools running with the user’s permissions.
software reverse engineering tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How REA Fits Into Agent Workflows
REA connects analysis utilities to coding agents through Model Context Protocol (MCP), a way for agents to call external tools. The source identifies the GitHub project as morluto/rea and reports that version 6.7.0 was released on October 18, 2026. It also says the project appeared on GitHub’s trending page earlier in October. These details describe the project’s status as reported by the article, rather than independently verified measures of adoption.
The guide presents a focused investigation as an alternative to an open-ended request such as “figure out how this program works.” It suggests specifying the behavior, the decision the answer will inform, and the evidence needed: what data is stored, how a calculation works, and which conditions change it. It also recommends labeling statements as observed, inferred or unknown, and stopping once one complete example can be explained.
In the QuickBooks case study cited by the source, the investigation covered a limited set of accounting behaviors, including inventory calculations, budget signs by account type, reconciliation balances and cash-basis report paths. The source says the developer used REA 6.4.0 and Ghidra. The example illustrates a possible workflow; it does not establish that every REA investigation will yield the same accuracy.
“This is not a sandbox.”
— REA project, as quoted in the ThorstenMeyerAI.com guide
code analysis software for developers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Results
The source provides one reported accounting-app case study, not independent testing across different programs or agents. It does not include enough information in the supplied excerpt to assess the complete comparison method, reproduce the reported account-by-account match, or determine how the result was checked. The case study’s quoted description is cut off mid-sentence.
It is also unclear from the source how reliably REA performs across its listed target types, what data each model provider receives in a particular configuration, or what safeguards users should apply beyond treating unknown programs as untrusted. The reported GitHub star and fork counts are dated to October 19, 2026, and do not establish active use or accuracy.
As an affiliate, we earn on qualifying purchases.
Verify the Agent Before Relying on It
The guide’s immediate next step is a local, low-risk test: install REA, review the setup plan before approving changes, restart the coding agent, and confirm that REA tools are available from within that agent. It recommends first inspecting a harmless application the user owns rather than beginning with an unknown binary.
For a substantive investigation, the user should define one behavior and the decision it affects, ask the agent to distinguish observed evidence from inference and unknowns, and request a complete example. Before using results to implement business logic, developers would need to check the explanation against the program’s behavior and relevant records. The source does not announce a further release or independent validation; the outcomes of any individual investigation remain to be tested.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source project described as an MCP server, command-line tool and skill for helping coding agents analyze existing software. The guide lists support for several program and file types, though actual analysis depends on available tools and setup.
What should I ask an AI agent first?
Choose one specific behavior and explain what decision its answer will inform. Ask the agent to identify stored data, the calculation involved and conditions that change the outcome, then have it walk through one concrete example.
How can I tell whether REA is connected?
The guide recommends checking prerequisites with REA’s doctor command, then confirming tool availability from inside the coding agent. A setup check alone does not verify the live agent connection; the source suggests calling REA’s binary_session tool without arguments.
Does REA keep all analysis private on my computer?
REA analyzes targets locally, according to the guide, but the results are sent to the coding agent and the model provider, subject to that provider’s data policy. The source also warns that REA is not a sandbox, so users should treat unknown programs as untrusted.
Does the QuickBooks example prove REA is always accurate?
No. The source reports that Ledger Reborn’s key accounting statements matched QuickBooks for an official sample company, account by account, to the cent. It presents a single case study, not independent, broad testing of REA’s accuracy across software and investigations.
Source: ThorstenMeyerAI.com
Evergreen bestsellers Picks
bestsellers
As an affiliate, we earn on qualifying purchases.
