🔍 Read the full analysis: Unknown Codebase, Meet AI: A Guide To Getting Started on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A guide published by ThorstenMeyerAI.com on October 19, 2026, outlines how developers can use Reverse Engineer Anything (REA) with coding agents to inspect existing software. It presents five investigation approaches and stresses that agent conclusions need evidence and verification; its QuickBooks example is a case study reported by the author, not an independent evaluation.
Thorsten Meyer published a guide on October 19 to using the open-source Reverse Engineer Anything (REA) toolkit with AI coding agents to investigate unfamiliar software. The article describes five investigations and a reported QuickBooks Desktop case study, arguing that developers can use the tools to identify how a program handles specific behavior before building a compatible feature in another application.
REA combines a local Model Context Protocol (MCP) server, a command-line tool and an agent skill intended to guide investigations. The source says it supports analysis of several kinds of software, including native programs, Electron and JavaScript applications, .NET and Android apps, firmware, SQLite databases and WebAssembly. For websites, it can observe activity in a Chrome-family browser controlled by the user. Coding agents named in the guide include Claude Code, Codex, Cursor and Gemini CLI.
The guide recommends asking a narrow, decision-focused question, rather than asking an agent to explain an entire program. It suggests requiring the agent to distinguish observed evidence from inference and unknowns, and to explain one complete example using inputs and outputs. A report that describes only what a screen looks like, or cannot walk through an example, is not enough to establish the underlying behavior.
Meyer says a developer used REA to examine QuickBooks Desktop for Mac 2024 and build a local accounting application called Ledger Reborn. According to the article, the developer compared its profit-and-loss statement, balance sheet and trial balance with Intuit’s official sample company and obtained account-by-account matches to the cent. The source describes this as a project case study; it does not provide an independent audit or broader test results in the supplied material.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Buildable Rules
The guide’s practical point is that matching an interface does not establish matching behavior. A developer recreating a feature needs to understand what data is stored, how calculations work and which conditions change the result. Those details can affect accounting totals, payment balances and other outcomes that are not apparent from a screen alone.
For readers using AI coding agents, REA offers a way to ground a coding task in evidence gathered from an existing program. The reported accounting comparison illustrates the potential value when the goal is to reproduce defined outputs. But one author-described project cannot establish that REA will reliably explain every program or that an agent’s interpretation is correct. The guide instead emphasizes checking concrete examples and treating unsupported explanations as unverified.
There is also a privacy and safety trade-off. The source says analysis runs locally, but results are passed to the coding agent and its model provider under that provider’s data policies. It also warns that REA is not a sandbox: analysis tools operate with the user’s permissions. That makes the choice of target and the handling of sensitive findings part of the workflow, not an afterthought.
Popular right now
Hisense E6SR Series 55-Inch 4K UHD Hi-QLED Roku Smart TV
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
Apple AirPods Pro (1st Generation) with MagSafe Charging Case
As an affiliate, we earn on qualifying purchases.
How REA Connects to Coding Agents
The source identifies REA as an MIT-licensed GitHub project and reports that version 6.7.0 was released on October 18, the day before the guide appeared. It also reports about 325,000 stars and 82,000 forks on October 19, following a period on GitHub’s trending page in early October. These figures are dated observations reported by the source, not independent measures of adoption or product quality.
The guide says installation requires Node.js 22.19 or newer; native program analysis may also require a disassembler such as Ghidra, which requires Java, or licensed software such as Hopper or IDA. It advises users to restart their agent after setup, check prerequisites and then confirm the tools are available inside the agent itself. The source cautions that a setup diagnostic checks files and prerequisites, not whether the live agent connection works.
That distinction matters because an agent can respond to questions without having used REA, relying instead on its existing model knowledge or guesses. The guide recommends confirming an actual tool call before trusting an answer about the target program. It also advises beginning with software the user owns and can safely inspect.
“REA supplied evidence and imperf”
— Thorsten Meyer, describing the Ledger Reborn case study
Limits of the Reported Evidence
The supplied source does not include the full text of the Ledger Reborn case study: its final quoted sentence is cut off, and the article’s description does not provide a complete methodology, test data or independent verification. The reported account-by-account match is therefore attributed to the guide, not presented here as independently confirmed.
It is also unclear from the material how consistently REA works across the range of program types it lists, what limits apply to particular analysis engines, or how often an agent may mistake an inference for an observed fact. The source describes the maintainer as anonymous but offers no further information about project governance or support. Readers should treat those points as unresolved rather than infer performance or reliability from the project’s reported GitHub figures.
The source also notes that analysis is local while results reach the agent and model provider. It does not specify what information is sent in each workflow or the applicable retention terms; those depend on the tools and provider used. Users should check those policies before examining proprietary or sensitive software.
Verify Setup Before Investigating
The guide’s next step for users is to confirm REA is connected to the agent, not just that installation files are present. It recommends checking the agent’s available tools, then starting with a harmless application the user owns before moving to a focused investigation. A useful result should explain a complete behavior with concrete inputs and outputs and identify what is observed, inferred or still unknown.
For the project itself, the source identifies REA 6.7.0, released October 18, as the current version at the time of publication. It gives no further release schedule, maintainer announcement or independent evaluation. Whether the Ledger Reborn findings can be reproduced by other developers, and how well the workflow performs on other software, remain questions for subsequent testing and reporting.
Key Questions
What is REA?
Reverse Engineer Anything is an open-source toolkit that connects coding agents to software-analysis tools. The source describes it as a local MCP server, a command-line tool and an agent skill.
What did the guide report about QuickBooks?
Thorsten Meyer says a developer used REA to investigate QuickBooks Desktop for Mac 2024 and build Ledger Reborn. The guide reports that three financial statements matched Intuit’s official sample company account by account, to the cent; the supplied material does not include independent verification.
Does REA keep all information on the user’s computer?
The source says REA performs analysis locally, but the results are sent to the coding agent and its model provider. What is shared and retained depends on the tools and provider’s data policies.
How can a user tell whether the agent actually used REA?
The guide recommends confirming that the agent can call an REA tool after setup. A diagnostic that checks files and prerequisites does not, by itself, confirm a live connection.
Is REA a safe place to open unknown programs?
No. The source explicitly warns that REA is not a sandbox and that its analysis tools run with the user’s permissions. It advises treating unknown binaries like other untrusted files.
Source: ThorstenMeyerAI.com
