10 GitHub REA Repositories for AI Agent Reverse Engineering and Claude Integration Tips

Technical creator Hanako (@hanakoxbt) on X has shared a curated collection of 10 GitHub open-source repositories—centered on REA (Reverse Engineer Anything)—that enable frontier AI coding agents such as Anthropic's Claude to analyze and reverse engineer closed-source applications, games, and developer utilities across multiple operating systems.

Image source: Hanako (@hanakoxbt) / X

Historically, reverse engineering has required manual expertise across complex tools like Ghidra, demanding hours spent tracing calling conventions, memory offsets, and decompiled code. With the adoption of the Model Context Protocol (MCP) and agentic interfaces, engineers can now grant language models direct access to disassemblers and decompilers, backing analytical claims with concrete binary addresses.

10 Core Open-Source Reverse Engineering Repositories

The 10 recommended repositories span every critical layer of modern software analysis: native binary disassembly, container unpacking, .NET decompilation, encrypted API traffic interception, and dynamic runtime hooking.

01. REA (morluto/rea) · 130K Stars

• Role: An all-in-one Model Context Protocol (MCP) server for reverse engineering across binaries, Electron, .NET, Android, and websites.
• Key Feature: Provides a single MCP interface allowing AI agents to run reverse engineering queries across diverse targets.
• Repository: morluto/rea

02. Ghidra (NationalSecurityAgency/ghidra) · 84K Stars

• Role: The National Security Agency's (NSA) free decompiler and software reverse engineering framework.
• Key Feature: Serves as the decompiler engine underlying most AI reverse engineering setups.
• Repository: NationalSecurityAgency/ghidra

03. ImHex (WerWolv/ImHex) · 55K Stars

• Role: A hex editor with an MCP server for file inspection.
• Key Feature: Features a dedicated MCP server that enables AI agents to inspect files.
• Repository: WerWolv/ImHex

04. mitmproxy (mitmproxy/mitmproxy) · 45K Stars

• Role: A traffic interceptor that captures network requests and maps the hidden APIs behind them.
• Key Feature: Intercepts application traffic to map undocumented backend APIs.
• Repository: mitmproxy/mitmproxy

05. ILSpy (icsharpcode/ILSpy) · 27K Stars

• Role: An open-source decompiler that converts .NET assemblies back into readable C#.
• Key Feature: Restores compiled .NET binaries to readable C# code for AI agent analysis.
• Repository: icsharpcode/ILSpy

06. Frida (frida/frida) · 22K Stars

• Role: A runtime hooking toolkit for desktop and mobile environments.
• Key Feature: Enables runtime dynamic hooking and supports CLI scripting for automated agent control.
• Repository: frida/frida

07. GhidraMCP (mcp-community/GhidraMCP) · 11K Stars

• Role: A bridge connecting the Ghidra decompiler to AI agents via MCP.
• Key Feature: Supports both headless and GUI modes, offering flexibility for CLI or graphical agent integration.
• Repository: mcp-community/GhidraMCP

08. Android RE Skill · 8K Stars

• Role: An agent skill for converting Android APK packages into decompiled code and API endpoint lists.
• Key Feature: Enables AI agents to decompile APKs and extract exposed API endpoints.

09. Universal Modder · 7K Stars

• Role: A collection of agent skills designed for modding PC games.
• Key Feature: Provides specialized agent skills to analyze PC games and create game mods.

10. Cpp2IL · 3K Stars

• Role: A tool that converts Unity C++ (IL2CPP) code back into .NET for analysis with ILSpy.
• Key Feature: An active work-in-progress (WIP) undergoing architectural rewrites in its development branch.

---

Claude Integration and Address-Grounded Verification Principles

Hanako recommends feeding this curated tool catalog directly into Claude (specifically recommending pairing with Claude Opus 5.5) as reference context to empower the AI agent with direct reverse engineering capabilities.

• Direct Binary-Level Inspection: By wiring a genuine disassembler and decompiler engine (via REA and MCP bridges) directly into the agent, the model inspects closed-source binaries and application bundles down to machine instructions rather than relying on high-level guesswork.
• Address-Grounded Assertions: A core principle highlighted by Hanako is that every algorithmic claim made by the AI agent must be grounded in concrete evidence—citing the exact binary address behind each finding.
• Structured Methodology: Hanako referenced an 8-step breakdown in the original thread linking REA's disassembly capabilities to an end-to-end analysis workflow.

---

Sandbox Isolation, Security Hygiene, and Real-World Limitations

While coupling LLM reasoning with automated reverse engineering accelerates architectural analysis, security practitioners and reverse engineers highlighted critical operational guardrails:

• Enforce Sandbox Isolation: Security practitioner @ChrisLee207 in China-based AI tool circles noted that tools like REA and GhidraMCP carry system permissions equivalent to half a reverse engineer, emphasizing that they must only be installed within isolated sandboxes.
• Default Read-Only MCP Endpoints: MCP endpoints should remain read-only by default, requiring explicit human confirmation for any disk writes or runtime process hooking.
• Skill Allowlist Governance: Regardless of how high a repository's star count is, agent skills must pass a formal allowlist before deployment and should never be loaded into a default production agent unvetted.
• Evaluate Tool Maturity Realistically: For tools undergoing active rewrites—such as Cpp2IL, where current branch refactoring leaves certain output formats and processing layers unfinished—field analyst @Rennix7t stressed that attaching an AI agent will not magically fill in upstream tool gaps.
• Pragmatic Starter Stack: Community member @ItsWonda_ noted that pairing mitmproxy (to intercept traffic and map hidden APIs) with Frida (for runtime hooking) covers most of what a beginner needs to start.

---

Original source

• Hanako (@hanakoxbt) X Post: https://x.com/hanakoxbt/status/2110849274774970486