🔍 Read the full analysis: How To Investigate An Unknown Codebase With AI on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
An October 19, 2026, article describes Reverse Engineer Anything (REA), an open-source toolkit that lets AI coding agents inspect existing software, and offers a five-investigation method for using it. The source reports that one developer used REA to reproduce QuickBooks Desktop sample-company financial statements account by account, but that result is a case study, not proof that AI analysis is reliable for every program.
A ThorstenMeyerAI.com report published October 19 outlines how developers can use Reverse Engineer Anything (REA) with AI coding agents to inspect unfamiliar software, test specific behaviors and turn findings into implementation requirements. The article’s central example is a developer who used REA to study QuickBooks Desktop and build a local accounting app whose reports, according to the source, matched the official sample company’s figures account by account and to the cent.
REA is described as an open-source project hosted on GitHub that provides a local Model Context Protocol (MCP) server, a command-line tool and an agent skill. Those components let agents such as Claude Code, Codex, Cursor and Gemini CLI call analysis tools. The source says REA can examine several kinds of software and artifacts, including native applications, Electron and JavaScript apps, .NET and Android programs, firmware, saved network traffic, WebAssembly and SQLite databases. For websites, it can observe activity in a Chrome-family browser controlled by the user.
The report recommends investigating one behavior at a time, tied to a decision the developer needs to make. Instead of asking an agent to explain an entire accounting program, a developer might ask how a partial invoice payment affects the balance and which account receives the posting. The article advises asking for stored data, calculations and conditions that change the result, while marking each conclusion as observed, inferred or unknown.
For setup, the source lists a guided installer and a project-specific Claude Code command. It says the current version is REA 6.7.0, released October 18, and that Node.js 22.19 or newer is required. Native-program analysis may also require a disassembler such as Ghidra, Hopper or IDA. The guide advises checking prerequisites and then confirming inside the agent that REA tools are actually available; a successful file check alone does not prove the agent is connected.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Testable Rules
The approach matters to developers trying to maintain or replace software whose internal rules are poorly documented. A screen can show what a program displays without revealing how it stores records, calculates amounts or handles exceptions. The report argues that an agent-assisted investigation can help turn those hidden behaviors into a specification that a developer can test before building a substitute.
The QuickBooks example illustrates both the potential and the limits. The source says the developer used REA and Ghidra to examine selected accounting behaviors, then compared the resulting application’s profit-and-loss statement, balance sheet and trial balance with Intuit’s sample company. A reported match is evidence about that project and those outputs; it does not establish that the recreated application matches every QuickBooks feature, or that REA will produce equally accurate results on another target.
For teams, the practical payoff is a more disciplined review process: ask for a concrete example with inputs and outputs, check whether the agent used the analysis tools, and separate direct observations from interpretations. That can make errors easier to spot before findings become database designs, calculations or business rules in new software.
disassembler software for reverse engineering
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How REA Connects Agents to Analysis Tools
The report presents REA as a bridge between a coding agent and established software-analysis programs, rather than as a replacement for them. Its MCP server exposes tools to the agent; its command-line utility supports setup and diagnostics; and its skill is intended to guide an investigation. The source says the project is MIT-licensed and reports about 325,000 GitHub stars and 82,000 forks as of October 19, following a period on GitHub’s trending page in early October. Those figures describe activity at that time, not a measure of accuracy.
The featured accounting case concerns QuickBooks Desktop for Mac 2024. According to the source, its author examined the trial version with REA 6.4.0 and Ghidra, focusing on inventory arithmetic, budget sign conventions, reconciliation balances and cash-basis report paths. The report says the resulting local app matched the official sample company’s three financial statements. The supplied source text cuts off while quoting the case study’s description of REA’s role, so it does not provide the full passage or enough detail to independently assess the comparison method.
“This is not a sandbox.”
— ThorstenMeyerAI.com report
Accuracy, Safety and Scope Still Need Checks
The source provides one reported replication example, but does not include independent verification, a complete test plan or enough detail to establish how broadly the result applies. It is unclear which QuickBooks behaviors were tested beyond the listed areas, whether every relevant edge case was covered, and how the match was measured outside the named statements for the sample company. The article should therefore be read as a method and case report, not as a general accuracy guarantee.
There is also a data-handling distinction: REA runs analyses locally, the report says, but results are passed to the AI agent and may also reach its model provider under that provider’s data policy. The source does not specify the policies of each provider. It also warns that analysis tools run with the user’s permissions, leaving the risks of opening an unknown program dependent on the environment and precautions used. The supplied article excerpt is incomplete, so its remaining investigations and the full case-study evidence are not available here.
Verify the Connection Before Investigating
The guide’s immediate next step is to verify the installation before trusting an agent’s account of a program. It recommends running REA’s diagnostic command for the chosen client, then asking the agent to call the binary_session tool to confirm that REA tools have loaded. A harmless application the developer owns can serve as an initial test target. If an agent answers questions without calling an REA tool, the report says, its response may be based on model knowledge rather than an inspection of the target.
After that check, developers are advised to frame a narrow question, request a complete example and label findings as observed, inferred or unknown. Before opening unfamiliar binaries, they should account for the report’s warning that REA is not a sandbox and review how their agent provider handles submitted results. The source gives no date for a future release or follow-up; it is not clear whether the publisher will provide additional verification of the QuickBooks comparison.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source toolkit described in the report as an MCP server, command-line utility and agent skill for connecting AI coding agents to software-analysis tools.
Does REA prove that an AI agent’s explanation is correct?
No. The report recommends checking that the agent actually called REA, asking it to walk through a concrete example and separating observed findings from inferences and unknowns. Its QuickBooks account is one reported project, not a general guarantee.
Does REA run software analysis in a sandbox?
The source explicitly says it does not. It warns that analysis tools run with the user’s permissions, so developers should treat an unknown binary as an untrusted file and consider the risks before opening it.
Does local analysis mean no data reaches an AI provider?
Not necessarily. The report says REA analyzes targets locally, but the results go to the agent and may be sent to its model provider under that provider’s data policy. The policies vary and are not detailed in the source.
What does the QuickBooks example show?
According to the report, a developer used REA and Ghidra to investigate selected QuickBooks Desktop behaviors and built a local app whose profit-and-loss statement, balance sheet and trial balance matched the official sample company account by account and to the cent. The source does not establish that the app reproduces every feature or edge case.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
