reverse-engineer-anything

REA (Reverse Engineer Anything) in a Docker image, with everything it needs to tear apart Android APKs already inside, and a Streamable HTTP MCP endpoint in front of it.

REA is morluto's MCP server and CLI that lets an AI agent inspect software it has no source for: decompile APKs, trace references, read resources, poke at devices over adb, dig through Electron bundles, .NET assemblies, Go and Rust binaries. Upstream ships it as the rea-agents npm package that talks MCP over stdio and expects you to install a JDK, JADX and Apktool yourself. This image does that part for you.

This is an unofficial packaging. REA itself lives at morluto/rea and is MIT-licensed. Bugs in REA's tools go there; bugs in the image or the HTTP bridge go here.

Table of contents

• What's in the image
• Quick start
• Ways to run it
• Documentation
• Agent integrations
• Development
• Sponsor
• License

What's in the image

REA (rea-agents) 6.4.0 with its 170 MCP tools, a full OpenJDK 21, the exact jadx-headless-mcp jar REA pins, Apktool 3.0.3, adb and Node.js 24, for linux/amd64 and linux/arm64. APK analysis works out of the box, and so do REA's static JavaScript/Electron, .NET, Go, Rust, WASM, SQLite and capture tools.

Native decompilation needs Ghidra, which adds about 900 MB, so it is not baked in: set REA_INSTALL=ghidra and the container fetches it on first start, checked against a pinned SHA-256 (amd64 only). The image page has the versions and the update policy, and opt-in tools covers Ghidra, IDA and JEB.

Quick start

export REA_BRIDGE_TOKEN="$(openssl rand -hex 32)"
mkdir -p targets
cp /path/to/app.apk targets/

docker run -d --name rea \
  -e REA_BRIDGE_TOKEN \
  -p 127.0.0.1:8080:8080 \
  --read-only \
  --tmpfs /tmp:rw,nosuid,size=4g \
  --tmpfs /home/rea:rw,nosuid,size=256m \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -v "$PWD/targets:/work:ro" \
  psyb0t/reverse-engineer-anything:latest

claude mcp add --transport http rea http://localhost:8080/mcp \
  --header "Authorization: Bearer $REA_BRIDGE_TOKEN"

Then ask your agent something like "decompile the login flow in /work/app.apk and show me where the token gets stored". Paths are container paths: whatever you mount at /work is what REA sees.

REA can run, drive and instrument the software it looks at, and does no permission checks of its own. The container is the boundary, so keep every hardening flag above. Only analyze software you own or are authorized to examine. Security explains each flag and what to do before exposing the bridge beyond localhost.

Ways to run it

The entrypoint takes one argument:

The bridge gives each MCP session its own REA process and passes messages through untouched. Running the image has a full example for each mode.

Documentation

The full documentation lives at psyb0t.github.io/docker-reverse-engineer-anything.

Agent integrations

• Skill for Claude Code, Codex and OpenClaw: claude plugin install reverse-engineer-anything@psyb0t (after claude plugin marketplace add psyb0t/agents), codex plugin add reverse-engineer-anything@psyb0t, or from ClawHub. It teaches the agent the APK workflow and ships a locked-down CLI wrapper.
• OpenClaw plugin @psyb0t/reverse-engineer-anything: a stdio bridge to a running container. Set REA_URL and REA_BRIDGE_TOKEN.
• MCP registry: io.github.psyb0t/reverse-engineer-anything.

Details are on the agent integrations page.

Development

The host needs Docker, Make, Git and a shell. Everything else runs in containers.

make help                       # every target
make lint                       # tsc, eslint, prettier, shellcheck, hadolint
make test                       # bridge unit tests + the image against a real APK
make build                      # build psyb0t/reverse-engineer-anything locally
make run                        # run the bridge on 127.0.0.1:8080 (needs REA_BRIDGE_TOKEN)
make docs                       # build the documentation site into .testing/docs-site
make pkg-update PKG=rea-agents  # move to the newest REA that clears the age gate

The development page covers the dependency rules, the tests and CI. Agents working on the code start at AGENTS.md.

Sponsor

License

WTFPL for this repository's code. REA is MIT, and the bundled tools keep their own licenses: see THIRD_PARTY_NOTICES.md.