Claude REA: Reverse Engineering with Claude Code

What is Claude REA?

Claude REA describes using the open-source Reverse Engineer Anything toolkit with Claude Code. REA supplies inspection tools; Claude Code chooses relevant calls and explains their results. This guide is an independent community resource, rather than an official Anthropic product announcement or a separate model download.

A Claude REA investigation starts with an observable question about software. You might ask where an export is written, which condition changes a calculation, or how a game increases its speed. The useful output from the investigation is a supported explanation, with enough detail to check it yourself.

Three parts of a Claude REA workflow

Keep the responsibilities clear in Claude REA work. You provide a target and a question. REA exposes available evidence through its tools. Claude Code interprets that evidence and proposes the next step. The workflow becomes more useful when you ask for the evidence alongside the explanation.

1. You askChoose one behavior and a repeatable input.
2. REA inspectsReturn relevant scripts, functions or observations.
3. Claude explainsConnect the evidence to a testable prediction.

For Claude REA, MCP is the connection between the agent and the tool server. Installing a workflow skill alone does not establish that connection. Start with the REA Claude Code setup guide when you need registration, restart and connection checks.

What can Claude REA help you understand?

Claude REA for browser behavior

A browser question is a good starting point because you can often reproduce the visible behavior quickly. Choose a control, record its input, and identify the code affecting the result. Ask Claude REA to explain the specific rule before requesting a new implementation.

Our dinosaur example illustrates a Claude REA style of investigation: find the speed update, identify the starting value and limit, then reproduce the acceleration. The interactive speed lab lets you explore that recovered rule. A browser reconstruction should be checked against changed inputs, not just a similar screenshot.

Claude REA for desktop applications

For a desktop target, Claude REA may involve examining an application folder, JavaScript modules or native libraries. The correct route depends on the application. Ask the agent to identify the target format before choosing an engine; an Electron archive and a compiled library need different evidence.

Deep native analysis in Claude REA requires an appropriate configured engine, such as Ghidra, Hopper or IDA. Availability depends on the provider and platform. Use the native analysis guide for that route. A successful MCP connection does not establish that every optional analysis engine is ready.

Claude REA for a focused reconstruction

Use Claude REA to recover one behavior before attempting a larger rebuild. For a calculator, the question might concern percentage handling after addition versus multiplication. The agent should identify both branches and suggest inputs that distinguish them, rather than assuming the same percentage formula applies everywhere.

A helpful Claude REA result includes what was inspected, the proposed rule, and the remaining uncertainty. You can then implement a small independent test. Expanding a verified behavior is easier to assess than accepting a large generated project whose relationship to the original has never been checked.

A small Claude REA investigation: Notes CSV export

The following Claude REA walkthrough is a suggested investigation using the existing Notes example on this site. It is not a transcript of a newly executed Claude session. Follow the first investigation guide for the sample and its context, then apply these questions in your own environment.

Give Claude REA one observable question

Begin your Claude REA session with a temporary note containing a distinctive sentence. Export it once and keep the resulting file. This gives the agent a concrete action to trace and gives you a baseline for checking any explanation about the destination, filename and exported fields.

Use REA to inspect the Notes example. Trace the CSV export action.
Show the relevant handler and explain how the destination is chosen.
Separate observed evidence from assumptions. Suggest one changed input
that would test your explanation before rebuilding anything.

Ask Claude REA for the entry point connecting the export control to the write operation. Request a short chain of relevant functions instead of a complete application dump. A small evidence trail is easier to review and reproduce than an unsupported summary.

Check the Claude REA explanation

Have Claude REA identify which parts of the answer come from code and which come from observing the exported file. A filename rule, a field order and an escaping rule are separate claims. The explanation should connect each claim to its own evidence or clearly leave it unresolved.

Next, give Claude REA a changed input such as a note containing a comma or a line break. Ask for the predicted CSV representation before exporting again. Compare that prediction with the actual file. This check can expose a missing quoting rule that a simple sentence would never reveal.

Keep the Claude REA result reviewable

Record the target version, input note, export action, output location and observed content. Ask Claude REA to update its explanation when the prediction differs from the file. The value of Claude REA is the connection between evidence and behavior, including a clear account of what remains unexplained.

Only after that check should Claude REA help create a minimal export function. Give the reconstruction the same example inputs and compare outputs. Matching those cases supports the tested export behavior; it does not demonstrate that Claude REA recovered the complete original application or its original source files.

What should a Claude REA answer contain?

A Claude REA evidence trail

Ask Claude REA to name the file, module, function or runtime observation supporting the explanation. Where available, retain identifiers that let you revisit the evidence. Conclusions become easier to maintain when another person can follow the same trail without repeating every exploratory tool call.

Readable pseudocode is useful in Claude REA, but it is an interpretation of inspected behavior. Variable names may be inferred and decompiled structure may differ from the original implementation. Ask the agent to distinguish exact strings or constants from labels introduced merely to make its explanation readable.

A Claude REA prediction you can test

A strong Claude REA explanation predicts an outcome for a case you have not yet tried. Change one variable while keeping the rest stable. For example, ask Claude REA whether an empty note exports a header, an empty record or no file; then perform that specific check.

When comparing results in Claude REA, preserve unexpected outcomes instead of rewriting the expected answer after the fact. A mismatch can mean the rule is incomplete, the target changed, or another branch matters. The agent should narrow that uncertainty with a follow-up investigation, rather than claim success automatically.

A bounded Claude REA conclusion

Finish a Claude REA investigation by listing the behaviors tested and the cases not covered. Include environmental details that could affect the result, such as the selected application build or output directory. Findings should remain tied to the inspected target rather than becoming a universal claim about similar software.

If Claude REA proposes a reconstruction, keep the new implementation and the evidence separately identifiable. That distinction helps you review the reasoning, replace a mistaken assumption and rerun the tests later. It also makes a useful report possible even when a complete rebuild would be unnecessary.

Claude REA capabilities and practical limits

What Claude REA does not guarantee

Claude REA does not guarantee recovery of original source code, comments, names or a complete build system. Obfuscation, unavailable dependencies and missing runtime context can limit an investigation. Ask Claude REA to describe those limits early so your next question matches the evidence that is actually accessible.

Using Claude REA also does not mean every question requires native decompilation. A JavaScript route, browser script or exported document may answer the question directly. Let the agent identify the least complicated sufficient evidence, then add another inspection method only when a specific uncertainty calls for it.

Choosing a useful Claude REA target

Start Claude REA with software you can inspect in an environment you control. Prefer a small, repeatable feature with an output you can compare. Save broad questions about an entire product until Claude REA has demonstrated that the selected tools can inspect the part relevant to your goal.

For a first Claude REA session, the Notes walkthrough is easier to evaluate than an unfamiliar commercial application with many background services. A limited target gives Claude REA a clear stopping point: explain the export, test the prediction and document the result. You can choose a harder question afterward.

Claude REA questions before getting started

Is Claude REA a separate Claude model?

No. Claude REA is the workflow discussed here: Claude Code working with REA tools. Your Claude access and your local REA configuration are separate concerns. This community guide does not supply a Claude subscription, and the homepage setup section points to the existing open-source REA installation workflow.

Can I use Claude REA without reading assembly?

You can ask Claude REA questions in plain English and request readable explanations. Reviewing the evidence still matters, especially when native code is involved. Start with our interactive examples to see how a rule can be explained and tested. Deeper Claude REA investigations may require more technical judgment.

Where should a new Claude REA user go next?

Use the setup guide if you need Claude REA connected to Claude Code. Choose the investigation guide if the tools are already available and you need a first task. The analysis guides organize target-specific workflows, while the FAQ covers common REA questions.

Ready for Claude REA? Open the homepage setup section, review the installer prompt, and follow the proposed local setup. Then return to the REA Claude Code setup guide for connection checks. Keep your first question small enough that you can verify the answer yourself.