bestofgithub.dev: the best of GitHub, one command away

Target	What REA returns	Requirements and guide
Desktop installations	Runtime candidates, supporting files, component markers and next probes	Built-in bounded directory/header inspection; desktop applications
Native binaries	Pseudocode, assembly, strings, symbols, calls and references	Hopper, Ghidra, IDA or Kuna; native analysis
Offline ELF layout	Sections, segments, original symbols/relocations and static mitigation candidates	Caller-supplied pwntools on Linux x64; binary diagnostics
Go binaries	Embedded compiler version, modules, replacements and build settings	Built-in static ELF/PE/thin Mach-O inspection; no Go installation required
GPU code objects	CUDA/HIP targets, selected kernel parameters and resources, retained PTX text	Built-in static ELF/PE/fatbin/CUBIN/PTX inspection; GPU code objects
Model artifacts	GGUF / safetensors metadata, tensor declarations and derived totals	Built-in header inspection; optional full-file hash; model files
IL2CPP metadata	Unity global-metadata.dat assembly images, type and method names and index ranges	Built-in static decoding of versions 24, 27, 29, 31 and 39; no Unity required
Godot PCK	Archive inventory and extraction, original header/directory facts and selected content identities	Built-in static formats 2, 3 and 4; no Godot required
Rust binaries	Embedded cargo-auditable crate names, versions, sources and dependency edges	Built-in static ELF/PE/thin Mach-O inspection; Rust binaries
PE certificates	Authenticode WIN_CERTIFICATE entries and PKCS#7 signer/X.509 identity fields	Built-in static PE inspection; PE certificates
PE imports	Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash	Built-in static PE inspection; PE imports
ELF notes	PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields	Built-in static ELF inspection; ELF notes
Apple IPS crashes	.ips metadata, threads, images, registers and documented crash classes	Built-in static JSON inspection; Apple IPS
Linux kernel modules	.modinfo keys, __versions CRCs, this_module presence, and signature trailer	Built-in static ELF inspection; kernel modules
Erlang BEAM	IFF chunks, atoms, exports, imports, lambdas and the Code header	Built-in static BEAM inspection; Erlang BEAM
WASM artifact	Validation, sections, exact import/export WAT forms and decoded WAT	Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`
EVM bytecode	Dispatch selectors, byte offsets, inferred arguments and mutability	Local raw/hex carrier on Linux x64; offline EVM guide
SQLite databases	Tables, columns, indexes, views, triggers and selected ordinary-table rows	Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits
Recorded Linux crashes	Raw notes, every recorded thread's registers/signals and optional mapping candidates	Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; recorded crashes
JavaScript / Electron	Modules, imports, source maps, routes, IPC and native add-on relationships	Node.js and npm; Linux: procps-compatible `ps`; application analysis
Websites	Page structure, scripts, network observations and requested screenshots	A Chrome-family browser; browser analysis
Saved network captures	Requests, responses, exposed payloads and source locations	HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy; capture guide
.NET assemblies	Metadata, CIL instructions, declared native dependencies and build comparisons	None (static only); managed-code guide
Android APKs	Manifest declarations, classes, decompiled methods and references	Headless JADX and a full JDK on Linux/macOS/Windows x64; Android guide
APK signatures	v1/v2/v3/v3.1 signers, certificate fingerprints, key rotation and digest self-consistency	None (static only); `inspect_apk_signature`
Android devices	Devices, packages, processes, logs, dumps, screen captures, and APK/file transfers	Caller-supplied adb (emulator or hardware); ADB guide
JEB projects	Engine-backed project units, artifact digests and type/method pseudo-code	A caller-started JEB client serving MCP, selected with REA_JEB_MCP_URL; JEB guide
Android resources	Decoded manifest, string tables, locales and version facts	Caller-supplied Apktool launcher; resource guide
Flutter apps	Dart snapshot hash, per-ABI library digests and engine build provenance	None (static APK parsing); Flutter guide
Firmware	Regions, extraction results and native-analysis handoffs	Binwalk / Unblob on Linux; firmware guide
Recorded packets	Selected fields, repeated values, filters and decode-as rules	Linux: TShark 4.x + prlimit; capture guide
Packet summaries	Endpoints, DNS, TLS SNI, protocol distribution and HTTP requests	Caller-supplied tshark and capinfos (Linux-verified); pcap guide
Recorded logic signals	Decoder annotations, sample ranges and diagnostics	Linux: sigrok-cli 0.7.2 + prlimit; signal recordings
Packages and resources	File inventories, digests, plists, Apple bundle anatomy and extracted resources	Artifact and JavaScript guide, Apple applications
Process behavior	Terminal output, interactions, exit and filesystem observations, and run comparisons	Linux/macOS with a native PTY; process capture
PyInstaller executables	CArchive members, Python version, entry scripts and extracted bytecode	None (static only); Python packaged applications

morluto/rea

REA: Reverse Engineer Anything

One MCP for reverse engineering across binaries, applications, and runtime behavior.

Quick start

Set up your agent

Ask your agent

Use the terminal

Update REA

How REA works

What you can analyze

Showcases

DX-Ball: reconstruct a sound-pan calculation

Notion: trace the Electron clipboard bridge

TH04: recover a DOS bullet-ring calculation

Build RL environments with REA

Build RL environments

FAQ

Documentation

Star history

Disclaimer

Contributing

License