How to Use REA with Coding Agents: Your First Investigation

To use REA with a coding agent, run npx rea-agents@latest setup, approve the configuration changes for your chosen client, and restart that client. Then give the agent a local software target and one specific behavior to investigate; ask for the relevant code, source locations, and limitations before asking it to build anything.

REA is an open-source CLI and MCP server. This article is an independent community guide; rea.tools and the morluto/rea repository are the official project sources.

What do you need before installing REA?

REA requires Node.js 22.x starting at 22.19, Node.js 24.x starting at 24.11, or Node.js 26 and later, plus npm. Node.js 23, 25, and prerelease versions are outside the documented support range. Check the official installation guide when setting up a new machine.

Choose a target you own or have permission to examine. An extracted JavaScript application or Electron ASAR archive is a useful first target because REA's static application analysis does not require Hopper, Ghidra, or IDA. Deep native binary analysis uses one of those engines and has additional platform and version requirements. REA's README lists the supported target families and prerequisites.

What do you want to do?	Recommended starting point	Input	Result
Ask an agent to explain a feature	REA MCP setup	Local target path and a focused question	Findings, evidence, and follow-up investigation
Inspect an app without an agent	REA CLI	Extracted JavaScript app directory or ASAR	Structured application evidence
Manually inspect a web layout or pause JavaScript	Chrome DevTools	Page open in Chrome	Direct DOM/CSS editing and breakpoint control
Explore a binary's functions and graphs yourself	Ghidra	Supported executable or library	Interactive disassembly, decompilation, and analysis project

Chrome DevTools and Ghidra provide strong direct inspection interfaces. REA is useful when you want your agent to help navigate an investigation and turn selected findings into an explanation or implementation. See our Ghidra comparison and Chrome DevTools comparison.

How do you connect REA to a coding agent?

Run the official setup command in a terminal:

npx rea-agents@latest setup

Select the intended client, review the exact configuration and skill paths, and approve the plan. Setup registers REA's local MCP server and installs the matching investigation instructions. Restart the client named in the completion message so the running agent can discover the connection. The official setup documentation explains the preview, backups, and scope controls.

For a Codex registration check, use:

npx -y rea-agents@latest doctor --client codex --json

Replace codex with your supported client ID when appropriate. A healthy doctor result checks registration files and prerequisites; it does not prove that the current agent session has reconnected. If the agent still cannot see REA, restart or reconnect it and inspect its MCP connection error. Installing only the skill from skills.sh supplies instructions, not the MCP connection. Official troubleshooting covers these differences.

What should your first prompt ask REA to find?

Pick one observable behavior rather than asking for an entire application reconstruction. For an application you are authorized to inspect, a focused prompt is:

Use REA to inspect /absolute/path/to/my-notes-app.
Explain how the application exports notes as CSV.
Show the relevant modules, source locations, and evidence.
Separate confirmed behavior from anything you cannot determine.

Replace the path with your real target. REA supplies investigation results; the coding agent interprets them. Before accepting the answer, check whether the result identifies the target files, the relevant code, and any incomplete coverage. A plausible explanation without a supporting location is a hypothesis to investigate further.

If MCP is unavailable, static JavaScript inspection can also run directly:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/my-notes-app --json

The command accepts an extracted application directory or ASAR and returns an Evidence record. Native provider failures in an audit do not automatically prevent this separate JavaScript workflow. REA's scoped readiness guidance recommends checking the task you actually need.

How do you check a result before rebuilding a feature?

Turn the explanation into a small prediction. For a CSV exporter, compare a normal note with a note containing a comma, a quotation mark, or a newline. Ask the agent which branch handles those characters and how the predicted output matches the original application's observed export. Keep the observed output separate from the agent's proposed replacement code.

The official Notes investigation uses a CSV export to teach this process. The official dinosaur example illustrates a different target: REA reads the browser game's loaded script, the agent identifies its acceleration rule, and a small reconstruction makes the speed adjustable. These are project-authored worked examples, not independent user testimonials.

What are the release and privacy limits?

The repository's main branch can document functionality newer than the published npm package. @latest requests the current npm release; persistent MCP registrations are pinned to the exact version that performed setup. Refresh setup and restart the agent when updating. Choose features from the connected server's actual tool list and schemas rather than assuming every main-branch feature is installed. The official release boundary explains this distinction.

REA analyzes targets on your machine. Tool results are sent to your coding agent, whose model provider has its own data policy. Review what a result contains before sharing it, particularly source snippets, local paths, captured requests, or application data. The official FAQ describes this local-analysis and model-provider boundary.

What questions come up after the first investigation?

Can I use REA without Hopper, Ghidra, or IDA?

Yes. Static JavaScript/Electron and .NET inspection do not need a native analysis engine. Deep native analysis does. Choose prerequisites for the target instead of treating every optional provider as mandatory.

Does REA recover the original source code?

Native analysis returns assembly and pseudocode with supporting findings. Pseudocode is an analysis representation, not a promise to reproduce the original source. The agent can use the findings to write a new implementation and test it.

Can I run REA without an AI subscription?

REA's CLI can run analysis workflows directly. Using a coding agent involves that client's own access requirements and model-provider terms. REA's MIT license does not provide model access or a commercial analysis-engine license.

What should I do when a command fails?

Check the documented prerequisites and update REA first. For a globally installed CLI, rea update updates its owning installation; for an npx-based agent setup, rerun npx rea-agents@latest setup and restart the client. If the failure remains, report the REA version, operating system, target type, provider, steps, and error output through the official issue tracker.