Home/Agent setup/Claude Code

SetupChecked 18 Oct 2026

Set up REA with Claude Code without losing an afternoon

One command does most of the work. Everything below exists because the other twenty minutes — the versions, the restart, the engine that has to be already installed — is where people quit. Commands checked against the project README on 18 Oct 2026; REA moves fast, so read the original before trusting mine.

Independent guide. This site documents REA; it does not host, mirror or distribute it. Install only from github.com/morluto/rea, rea.tools, or the rea-agents npm package. The authors explicitly warn that a similar repo name or a copied README does not make a download official.

The short version

node -v                 # 22.x (>=22.19), 24.x (>=24.11) or 26+
npx rea-agents setup    # choose Claude Code, review, approve
# restart Claude Code, then ask:
#   "Inspect the Notes app I own. Understand how search works,
#    show me the evidence, and build a similar feature."

Prerequisites, honestly

REA is a TypeScript, MIT-licensed MCP server and CLI. It routes to real analysis tools, so what you need depends on the target — not on which agent you use.

Linux users, read this one twice. Launching Ghidra or JADX, firmware work, and even static JavaScript or Electron analysis need a procps-compatible ps on REA's PATH for process-ownership checks. A minimal container or a stripped distro will fail here in a way that looks like REA being broken. It isn't.

Android analysis needs a full JDK plus headless JADX. That gets you the generator. It does not get you the verifier: why an expired login code still works is the half that lives on the server.

Step by step

1. 01

   Check Node before anything else.

   node -v must land on 22.x (≥22.19), 24.x (≥24.11), or 26 or newer, with npm available. Most failed first runs are a Node 20 or a stray 18 still shadowing your PATH.

2. 02

   Run npx rea-agents setup.

   You choose which agents to configure, review the proposed changes, and approve them. It adds REA's MCP server and matching workflow instructions, and backs up existing configuration first — know where those backups are before you say yes.

3. 03

   Restart Claude Code.

   Not optional: an MCP server registered mid-session isn't picked up by a running agent, and “it says it has no REA tools” after a successful setup is almost always this.

4. 04

   Start with a target that fits in an afternoon.

   An Electron app you own, or a folder of JS bundles. Static JavaScript analysis needs no engine, so your first run has nothing else to go wrong.

5. 05

   Ask for evidence, not a summary.

   The interesting part of REA's design is that findings come back with their evidence and stated limits. Compare “explain how the clipboard feature works” with “show the IPC call and the file and line behind each step, and say what you could not confirm.”

If you prefer a terminal to an agent

# one-off static analysis of an unpacked Electron app or ASAR
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

# or install the CLI permanently
npm install --global rea-agents
rea --help

The JSON result carries modules, imports, Electron boundaries and their evidence. On Windows, pass a real path like "D:/apps/example". Bun users: bunx rea-agents@latest replaces npx rea-agents@latest.

Keeping it working

rea update                      # global CLI install
npx rea-agents@latest setup     # npx-based agent registration, then restart

Releases ship frequent bug fixes, so “update first” is the real support workflow. Bun global updates need Bun 1.2.17 or later; on older Bun, upgrade Bun before rea update.

Failure modes worth pre-loading

Two lines this guide will not cross

REA's licence position is unambiguous: it is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorised to examine. Commercial engines — IDA Pro / Hex-Rays, Hopper, JEB — must be legally obtained under their own terms; REA grants no licence, key or activation entitlement, and cracked copies, stolen keys, key sharing and bypassing licence restrictions are not authorised. Nothing here is legal advice; if a rebuild touches a shipping product, get advice first. The longer version is on the disclaimer.

Where to go next

Commands verified against the project README on 2026-10-18.