🔍 Read the full analysis: Exploring Software You Didn’t Write: Start With An AI Agent on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reverse Engineer Anything (REA), an open-source toolkit for coding agents, helps investigate how existing software behaves. A published QuickBooks Desktop project describes using REA and Ghidra to study accounting rules and build a local app whose reports matched the sample company’s figures account by account, to the cent. The account is based on the project author’s report; REA does not establish that its findings are automatically correct or safe.
A developer used Reverse Engineer Anything (REA) with an AI coding agent to investigate accounting behavior in QuickBooks Desktop and build a local accounting app whose reports, according to the project author, matched an official sample company’s figures account by account, to the cent. The example shows how REA can help developers examine software they did not write, but the reported match comes from the author’s account and does not independently verify the app’s correctness.
REA is an MIT-licensed, open-source project that connects coding agents to software-analysis tools. Its components include a local Model Context Protocol (MCP) server, a command-line program for setup and analysis, and an agent skill that guides investigations. The source article lists Claude Code, Codex, Cursor and Gemini CLI among the agents it can work with. REA’s project page identified version 6.7.0 as released on October 18, 2026.
The QuickBooks example, called Ledger Reborn, examined selected rules in QuickBooks Desktop for Mac 2024, including inventory arithmetic, budget signs for different account types, reconciliation balances and cash-basis report logic. The author says they used REA 6.4.0 and Ghidra for the investigation, then built a local app and compared its financial statements with those from Intuit’s official sample company. The source reports matching profit-and-loss, balance-sheet and trial-balance figures; it does not provide independent testing or verification.
REA supports several kinds of targets, including native applications, Electron and JavaScript apps, .NET and Android software, firmware, WebAssembly and SQLite databases. It can also observe activity in a Chrome-family browser controlled by the user. Native analysis may require a disassembler such as Ghidra, Hopper or IDA, while the setup instructions specify Node.js 22.19 or newer.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Specifications
For developers replacing or integrating with an older program, the visible interface is only part of the problem. A screen may show an invoice balance, for example, without revealing how the amount is calculated, what data is stored or which accounting rules change the result. REA offers a way to use an AI agent to investigate those mechanics before writing a new implementation.
The practical value depends on the quality of the investigation. A focused question—such as how a partial payment changes an invoice balance and which account receives the posting—can lead to a testable description of a business rule. A broad request to explain an entire program may produce an answer that sounds plausible but is difficult to check. The source’s main lesson is to ask for one behavior, a concrete example and a distinction between what was observed, inferred and remains unknown.
The QuickBooks case is relevant because accounting software can affect financial records and reporting. A reported match on one sample company is useful evidence for that specific test, but it is not proof that a replacement handles every transaction, configuration, version or edge case. Users should not treat the account as a general validation of Ledger Reborn or other generated software.
software reverse engineering toolkit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How REA Fits Into Agent Work
REA is designed to give coding agents access to analysis tools rather than relying only on their existing knowledge of a program. Its MCP server lets an agent call those tools; the command-line interface supports setup and diagnostics, and the included skill provides a step-by-step investigation process. The source article said REA had about 325,000 GitHub stars and 82,000 forks on October 19, 2026, following visibility on GitHub’s trending page earlier that month. Those are counts reported for that date, not measures of accuracy or adoption.
The article recommends narrowing each investigation to a behavior and the decision the findings will inform. It also suggests asking the agent to explain stored data, calculations and conditions that change an outcome, and to label statements as observed, inferred or unknown. One way to test whether the analysis is substantive is to ask the agent to walk through a specific example using real inputs and outputs, rather than merely describe the screens.
Setup alone does not prove an agent is using REA. The project’s diagnostic command checks files and prerequisites, according to its documentation, but not whether the live agent connection works. The source recommends confirming the connection within the agent and checking that it actually calls an REA tool before relying on its answers.
AI coding agent software analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Match
The reported accounting results come from the Ledger Reborn author’s case study, not from an independent audit described in the source material. The material does not specify the full range of transactions or configurations tested, whether the comparison was repeated across different QuickBooks versions, or how the replacement behaves in cases outside the sample company. It also does not establish that REA’s analysis will produce reliable findings for every program.
There are safety and privacy limits to account for. REA runs analysis locally, but the source says results are passed to the AI agent and may also reach the model provider under that provider’s data policy. The source does not set out the policies for every agent or provider. It warns that opening an untrusted program exposes it to analysis tools running with the user’s permissions, so local operation should not be mistaken for isolation.
As an affiliate, we earn on qualifying purchases.
Verify Before Building on Findings
Developers considering REA can begin by checking the project’s requirements, choosing a target they are authorized to inspect and confirming that their agent has loaded the REA tools. The source recommends starting with a harmless application the user owns, then asking a narrow question that can be checked against a complete example. If the agent answers without calling REA, its response may be based on model-generated guesses rather than an inspection.
For work based on the findings, the next step is to test the described rules against more inputs and edge cases before treating them as a specification. The source material gives no independent assessment of Ledger Reborn, no broader compatibility results and no announced follow-up milestone. Further validation of the app and REA’s findings remains open.
open-source software analysis toolkit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Reverse Engineer Anything?
REA is an open-source toolkit that connects AI coding agents to software-analysis tools through a local MCP server. It also includes a command-line tool and an agent skill for guiding investigations.
What did the QuickBooks project report?
The Ledger Reborn author said they investigated selected QuickBooks Desktop accounting rules and built a local app whose profit-and-loss, balance-sheet and trial-balance figures matched those for Intuit’s official sample company account by account, to the cent. The source does not describe independent verification.
Does REA prove an AI agent’s answer is correct?
No. REA provides analysis tools, but its findings still need checking. A matching result for one sample company does not establish that a new app handles every configuration, transaction or edge case.
Is REA safe to use with an unknown program?
The project warns that REA is not a sandbox: analysis tools run with the user’s permissions. The source advises treating unknown binaries like other untrusted files. It also says analysis results may be sent to the model provider under that provider’s data policy.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
