REA Open-Source Project Plugs Claude Code and Codex Into Ghidra, IDA for Binary Analysis

A GitHub project called Reverse Engineer Anything (REA) is wiring AI coding agents directly into the tools security researchers and developers use to take apart compiled software. The open-source release links agents including Claude Code and Codex to disassemblers and debuggers such as Ghidra, Hopper and IDA, according to a report by Renato Losio. The repository has already passed 200,000 stars, a figure that puts it among the most-followed projects on the platform.

The practical change is the interface. Instead of clicking through Ghidra's decompiler view or hand-writing IDA scripts, a developer can ask an agent to trace a function call chain or explain how a program implements a particular feature. The agent drives the reverse-engineering tool, pulls out the relevant assembly or decompiled output, and reports back in plain language. That compresses a workflow that has traditionally demanded years of familiarity with binary formats and processor instruction sets.

REA arrives as agent frameworks have grown comfortable calling external tools. Claude Code and Codex both support tool invocation, which lets a model treat Ghidra or IDA as just another capability to reach for. Ghidra, maintained by the NSA and released publicly in 2019, and IDA, the commercial standard sold by Hex-Rays, expose scriptable interfaces that make this kind of integration feasible. Hopper fills the same role on macOS.

The audience extends past professional reverse engineers. Developers who need to understand a third-party library with no source, or check whether a vendor binary behaves as documented, can now get an agent to walk through the disassembly. Security teams doing malware triage and vulnerability research are the more obvious beneficiaries, since function-call tracing and feature identification are routine parts of that work. The 200,000-star count suggests the appeal is broad rather than confined to a niche.

None of this removes the hard parts. Agents can misread obfuscated code, confuse similar-looking functions, or confidently describe behaviour that the binary does not actually exhibit. Reverse engineering output feeds directly into security decisions, so a plausible-sounding but wrong summary carries real cost. How REA handles that risk, and whether it surfaces the underlying evidence for each claim, will determine whether it becomes a trusted tool or a demo.

The project's next test is adoption by people who already know the tools well. If experienced reverse engineers fold REA into their Ghidra and IDA sessions, the agent becomes a genuine accelerator. If it stays a way for newcomers to get quick, unverified answers, its value is narrower. Watch for forks that add verification steps and for whether the major disassembler vendors respond with their own agent hooks.

The broader question is what happens when AI agents become the default front end to low-level tooling. Binary analysis has resisted automation precisely because it requires judgement about intent, not just pattern matching. REA is an early bet that a capable model plus a scriptable disassembler can approximate that judgement closely enough to be useful.