---
title: GitHub's Fifth Most-Starred Project Lets Anyone With an AI Agent Reverse Engineer Software
description: REA went from 10,000 to 451,000 GitHub stars in five weeks. The top AI reverse engineering tools, what UK, EU and US law allows, and the pitfalls.
author: Darie Nani (Editor-in-Chief)
date: 2026-11-11T13:44:52.550Z
updated: 2026-11-11T13:44:52.560Z
canonical: https://www.sovereignmagazine.com/article/reverse-engineering-software-ai-agents-rea
image: https://cdn.nanimediahouse.com/pexels-software-developer-typing-code-on-dual-monitors-at-a-wooden--16129725.jpg
categories: Artificial Intelligence, Startups
content_type: News
publication: Sovereign Magazine
---

REA, a free tool that lets AI coding agents take software apart, had fewer than 10,000 stars on GitHub on 6 October. It has more than 451,000 today, which makes it the fifth most-starred project on the site, behind three curated lists and freeCodeCamp's coding course.

[REA](https://github.com/morluto/rea) does not decompile anything itself. It connects agents such as Anthropic's Claude Code, OpenAI's Codex, Cursor and Google's Gemini CLI to the tools specialists already use, including Ghidra, the free decompiler released by the US National Security Agency, IDA Pro, and the Android tools JADX and Apktool. The user describes the job in plain English. The example in the project's documentation reads: "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project."

In October we reported that [hobbyists were rebuilding Call of Duty with off-the-shelf AI](https://www.sovereignmagazine.com/article/ai-mods-call-of-duty-off-the-shelf-ai) and mixing other games into it. The methods behind that work are now packaged as dozens of [free Claude skills](https://www.sovereignmagazine.com/article/anthropic-s-skills-turn-claude-into-versioned-auditable-microservices-for-enterprise-ai) and connectors aimed at apps, websites, file formats and devices, and most of them come with rules on what their makers allow.

## The Most Popular AI Reverse Engineering Tools on GitHub

**Chart: REA has more than four times as many GitHub stars as Ghidra, one of the decompilers it uses**

GitHub stars for the most popular reverse engineering tools. More stars means more people have bookmarked the project.

| Tool | Stars |
| --- | --- |
| REA | 451,579 |
| Ghidra | 99,491 |
| Craft Anything | 27,760 |
| ida-pro-mcp | 13,442 |
| GhidraMCP | 11,891 |
| mitmproxy2swagger | 9,717 |
| Android reverse engineering skill | 8,701 |
| LLM4Decompile | 7,285 |
| BLA | 5,232 |

Source: GitHub, 11 November 2026

REA was first published in April by a developer who goes by morluto and has given interviews only on condition of staying anonymous. He told Scientific American that the name comes from an old gaming alias and that his interest started with decompiling games. The project went public in early October, gained more than 30,000 stars on 11 October alone, according to Decrypt, and had passed 342,000 by 20 October, according to 404 Media. More than 370 people have since contributed over 7,000 changes to it. Its documentation says it is "for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine", and that cracked copies of paid tools, stolen licence keys and "bypassing license restrictions are not authorized."

Ghidra itself has 99,491 stars. [GhidraMCP](https://github.com/LaurieWired/GhidraMCP), published in March 2025 by the security researcher known as LaurieWired, connects it to AI models so that a model can decompile a program, list its functions and rename them as it works out what they do, and has 11,891 stars. [ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp), made by Duncan Ogilvie, who created the x64dbg debugger, has 13,442 stars and does the same for IDA Pro, the paid tool most professionals use. Its page now points users to an official version released by Hex-Rays, the company that sells IDA.

[Craft Anything](https://github.com/storytold/craft-anything) has gathered 27,760 stars since 31 October. It comes from ArtCraft, the company whose open-source rebuilds of Photoshop and other Adobe apps were widely covered in October. It studies a website, app or game, has a coding agent build a new version and checks the result against the original. Its makers call it "early alpha" and tell users to run it only "on software you own or are allowed to examine", adding that "it never bypasses DRM, logins or anti-cheat."

A [Claude Code skill by Simone Avogadro](https://github.com/SimoneAvogadro/android-reverse-engineering-skill), with 8,701 stars, decompiles Android apps and lists the web APIs they use to talk to their servers. [mitmproxy2swagger](https://github.com/alufers/mitmproxy2swagger), released in 2022 and now at 9,717 stars, turns recorded network traffic into a standard description of an API, and [reverse-api-engineer](https://github.com/kalil0321/reverse-api-engineer), with 3,396, browses a site, records its traffic and has a model write code that calls the same API. [LLM4Decompile](https://github.com/albertan017/LLM4Decompile), a research project led by a doctoral researcher at Hong Kong Polytechnic University, has 7,285 stars and trains language models to turn machine code back into readable C.

[BLA](https://github.com/qybaihe/bla), one of the newest projects, published on 25 October and now at 5,232 stars, says it protects software releases against "AI reverse-engineering agents", naming REA, by filling them with material meant to mislead an agent and run up its costs.

## What Cheap Reverse Engineering Means for Software Companies

> "If code is magic, then we are all capable of it."
> — morluto, the creator of REA

Reading compiled code used to take years of practice with assembly language and tools like Ghidra. An agent connected to REA or GhidraMCP can now do the first pass of that work for anyone who can describe what they want. 404 Media reported people using REA to replace the operating system on a smart TV and to take apart smart picture frames, baby monitors and a Lululemon fitness mirror.

Software makers have relied on that difficulty to keep the workings of their products to themselves. In February, Anthropic published a post saying Claude Code could take on the most expensive part of modernising old COBOL systems, which is understanding what the code does. IBM's shares fell about 13% in a day, their largest one-day fall since October 2000, according to CIO. In October, Digital Sun, the studio behind Moonlighter, cancelled a public test of its next game, saying it was "concerned by recent news of games being reverse-engineered, cloned, and published before the original is even out."

## Reverse Engineering Law in the UK, EU and US

In Britain and the EU, the right to study software is written into law and cannot be removed by a licence. The Copyright, Designs and Patents Act lets anyone with a right to use a program observe, study and test it to find the ideas behind it, and decompile it when that is necessary to make an independent program work with it. [Section 296A](https://www.legislation.gov.uk/ukpga/1988/48/section/296A) makes any licence term that forbids those acts void. The EU's Software Directive gives the same rights in Articles 5 and 6 and voids contrary contract terms in Article 8. Neither law allows copying. Information obtained by decompiling cannot be used to make a program substantially similar to the original, or for any purpose other than making programs work together.

In the US a licence can ban reverse engineering, as a federal appeals court ruled in Bowers v. Baystate in 2003. The Digital Millennium Copyright Act forbids getting around technical protections, with a narrow exception for work done solely to make programs interoperate. Courts accepted disassembly as fair use in Sega v. Accolade in 1992 and Sony v. Connectix in 2000, where it was the only way to reach the parts of a program that copyright does not protect, and each ruling depended on its facts. Trade secret law in the US and the EU treats reverse engineering a lawfully obtained product as a fair way to learn how it works, although in the EU a valid contract that limits it removes that protection.

Whether an AI rebuild counts as a clean room has not been tested. In a clean room, the method Phoenix used in the 1980s to copy the IBM PC's BIOS, one team writes a specification from the original and a second team that has never seen it writes the new code. "No court has ruled on whether AI-assisted reimplementation qualifies as a legitimate clean room process," the US law firm Bean, Kinney & Korman wrote in April, after a developer used an AI tool to [rewrite Claude Code's leaked source](https://www.sovereignmagazine.com/article/anthropic-claude-code-source-code-leak), a case in which the same tool read the original and wrote the new version. The UK firm Marks & Clerk wrote the same month that AI clean rooms have "not actually been tested in court". A clean room also deals only with copyright. Independent invention is no defence against a patent.

Anthropic's terms forbid reverse engineering its own services, and around 27 October it added two sentences about games to Claude Code's instructions. Addy Osmani, a member of Anthropic's technical staff, wrote that the change was meant "to steer it away from recreating someone else's specific game because using Claude to infringe IP is against our usage policy." The rule mentions games only.

## The Pitfalls of Reverse Engineering With AI

Within days of REA going viral, a lookalike project called rea-tools appeared on GitHub offering a Windows download. A user reported in REA's issue tracker that the file carried a trojan and had been downloaded 172 times, and the copy has since disappeared from GitHub. REA's page now lists its official sources. In April, The Register reported a fake "leaked Claude Code" repository that installed the Vidar password-stealing malware.

These agents run with the user's own permissions. Claude Code's documentation advises running scripts and tool calls in a virtual machine, "especially when interacting with external web services", and warns that a command the user approves can write anywhere the user's account can unless its sandbox is switched on. Taking apart an unknown program means handling untrusted files, and researchers have found [sandbox-escape flaws in every major AI coding agent](https://www.sovereignmagazine.com/article/ai-coding-agents-sandbox-escape-security-2026) this year.

A developer who has had 14 changes merged into REA published [preregistered tests of it](https://github.com/pablodiazjorge/rea-lab) with Claude Code. On ten small practice programs made for reverse-engineering exercises, Claude Code solved 28 of 30 runs with REA and 28 of 30 without it, and REA made each run about twice as slow and expensive. On four real open-source programs the results were 68 of 72 with REA and 71 of 72 without, a difference the tests found not significant. The author says the results "are not a general assessment of any product." In its 2024 paper, LLM4Decompile's largest model produced code that compiled 87% of the time but ran correctly about 21% of the time.

## Easy Wins for Businesses That Reverse Engineer Their Own Software

The safest use is on software a company already owns or licenses, and old business systems are the clearest case. Morgan Stanley's in-house tool, DevGen.AI, has worked through more than 17 million lines of COBOL, Natural and Perl and saved more than a million hours, the bank told CIO Dive in July. Gartner expects more than 70% of AI-led mainframe exit projects started in 2026 to miss their targets, because companies overestimate how much generative AI can convert automatically. IBM's Rob Thomas said after Anthropic's COBOL post that "translation captures almost none of the actual complexity."

Many companies pay for software whose API is undocumented or leaves out what they need. Tools such as mitmproxy2swagger and reverse-api-engineer can map that API from the company's own traffic, so the system can be connected to others. The service's terms still apply, and the work should stay within the company's own accounts and data.

Security teams can use the same methods on their own programs and on the software their suppliers ship. Anthropic said in April that its Mythos Preview model had found [a 27-year-old bug in OpenBSD](https://www.sovereignmagazine.com/article/claude-mythos-27-year-bug-cost), that the model is "extremely capable of reverse engineering", and that it had used it on stripped, closed-source programs under bug-bounty rules.

Making products work together is the use the law protects most clearly. [LibrePods](https://github.com/librepods-org/librepods), with 30,703 stars, reverse engineers the protocol Apple's AirPods use so that noise cancellation, ear detection and battery readings work on Android phones and Linux computers. The same exception can cover a program written to read a company's own data from an old file format or to make old equipment work with new systems.

## FAQ

**Q: Is it illegal to reverse engineer software?**
It depends on where you are and what you do with the results. In the UK and EU, anyone with a right to use a program may study how it works, and may decompile it when that is needed to make another program work with it, whatever the licence says. In the US, a licence can forbid reverse engineering, and getting around copy protection is illegal except in narrow cases such as interoperability and good-faith security research. No law allows using what you learn to copy the program, its code or its assets, and REA, Craft Anything and several other tools in this article say they are for software the user owns or is allowed to examine.

**Q: Can AI do reverse engineering?**
Yes, with limits. Coding agents such as Claude Code and Codex can drive decompilers like Ghidra and IDA Pro through connectors such as GhidraMCP and REA, read the output and explain what a program does. Anthropic says its Mythos Preview model can turn a stripped program back into plausible source code. Independent tests show mixed results: REA did not raise Claude Code's success rate on one set of tasks, and code decompiled by language models often fails to run correctly.

**Q: What is reverse engineering in software?**
Reverse engineering means working out how a program works from the program itself, without its source code. That can mean watching what it does, recording the data it sends, or decompiling its machine code back into a form people can read. It is used to find security flaws, make products work together, recover knowledge about old systems and preserve software that is no longer sold.