REA (Reverse Engineer Anything) is the open-source toolkit that went from 4,500 to over 80,000 GitHub stars in six days this month. It gives your coding agent the ability to inspect software without source code: native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs, firmware, websites, network captures. REA does no decompiling itself. It orchestrates the engines already on your machine, Ghidra, Hopper, or IDA, and attaches the evidence behind every conclusion.
Your agent is what actually reads the pseudocode, follows the call chains, and writes the reconstruction, so the model behind the agent does the heavy lifting. This tutorial runs that stack on Kimi K3, an open-weight reasoning model from Moonshot AI, through Wallaby Token's Anthropic-compatible endpoint. Disclosure: Wallaby Token sells API access to kimi-k3, and the examples below use our endpoint.
What you need
- A Wallaby Token API key. Create an account at wallabytoken.com; new accounts receive $0.50 in free credit, no card required.
- Node.js 22.19 or later; 24.11+ and 26+ also work. You need npm as well.
- Claude Code installed. Refer to the official documentation for installation instructions.
- Optional, for native binaries: an existing Ghidra, Hopper, or IDA installation. Static JavaScript, Electron, and .NET analysis need no extra engine.
Step 1: Point Claude Code at Kimi K3
Claude Code reads its model endpoint from environment variables. Set three of them:
export ANTHROPIC_BASE_URL="https://api.wallabytoken.com"
export ANTHROPIC_AUTH_TOKEN="sk-your-wallaby-key"
export ANTHROPIC_MODEL="kimi-k3"
The base URL has no /v1 suffix: Claude Code appends /v1/messages itself. Persist the three lines in your shell profile, then start a session with claude. The full walkthrough, including verification prompts and the two errors you might hit, is in our Claude Code setup guide; the same three-variable pattern works for Codex and every other terminal tool we have tested.
Step 2: Register REA with your agent
REA ships as an npm package. One command registers its MCP server with your agent and installs matching workflow instructions:
npx rea-agents setup
The setup lists the agents it detects, such as Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, shows the proposed changes, and waits for approval. It backs up existing configuration before touching it. Restart your agent afterward.
Step 3: Run one analysis, check the receipt
Before burning agent tokens on a real target, confirm the pipeline end to end with REA's CLI on any local JavaScript project:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
We ran exactly this against a small three-module sample app on 2026-10-11, using REA 6.4.0 on Node 24.21 and macOS. The run took seconds and returned a sealed evidence object: a SHA-256 digest of the target, a module graph that correctly identified our files as CommonJS modules with their import and export relationships, and a semantic graph where every node, down to a single filter callback, carries a source-range location and an evidence record stating how the conclusion was reached.
That evidence-first shape is what makes REA useful inside an agent loop: the model can cite what it saw instead of asserting. Inside Claude Code, a typical prompt is:
Understand how search works in the Notes app, show me the evidence,
and build a similar feature for my project.
One caveat worth internalizing early: decompiled output is pseudocode, not the original source, and REA says so itself. Treat reconstructions as starting points that need tests. REA's own DX-Ball showcase only counts because the rebuilt function passes 3,205 original test cases.
What you can analyze
| Target | What REA returns | Extra engine needed |
|---|---|---|
| JavaScript / Electron apps | Modules, imports, source maps, routes, IPC channels | None |
| Native binaries: Mach-O, ELF, PE | Pseudocode, assembly, strings, symbols, call graph | Ghidra, Hopper, or IDA |
| .NET assemblies | Metadata, CIL instructions, native dependencies | None |
| Android APKs | Manifest, classes, decompiled methods | JADX + JDK |
| Websites | Page structure, scripts, network observations | Chrome-family browser |
| Firmware, EVM bytecode, captures, process behavior | Region maps, selectors, payloads, run comparisons | Varies: binwalk, WABT, mitmproxy, adb |
Analysis runs locally. Your agent receives the tool results, and your model provider's own data policy applies to what the agent sees.
What a session costs
Reverse-engineering sessions are long, tool-heavy loops. The agent reads pseudocode, asks follow-up questions, and drafts an implementation across many requests. Two things keep that affordable. First, the price; all rates per 1M tokens:
| Wallaby | Official list | |
|---|---|---|
| Input | $2.70 | $3.00 |
| Cached input | $0.27 | $0.30 |
| Output | $13.50 | $15.00 |
Our rate is a standing 10% below the official list; see how our Kimi K3 pricing compares across 18 providers. Second, visibility: billing is itemized per request, so a long REA session shows up as individual line items you can reconcile against actual usage, not one opaque deduction. The $0.50 trial credit covers about 185,000 input tokens, enough for setup, verification, and a first small investigation. The minimum top-up is $20.
Get started
Create an account at wallabytoken.com, receive $0.50 in free trial credit, and generate an API key. Three environment variables point Claude Code at Kimi K3, one npx command wires in REA, and your agent can start pulling apart whatever you are curious about, showing its work as it goes. Stay on the right side of the line while it does: REA's own disclaimer requires lawful, authorized reverse engineering, and so do we.