Step 1 โ Run setup (no global install needed)
npx rea-agents@latest setup
REA ships as a single CLI (rea / rea-agents). setup configures integrations for detected AI agents. Useful flags:
--dry-runโ print the resolved plan without applying anything. Run this first if you're cautious about what gets written.--client <agent>โ target a specific agent (repeatable);--all-detectedconfigures everything found.--yesโ approve user-owned actions without prompting (add--install-hopperif you also want the Hopper analysis engine).
What setup actually does: it registers an MCP server and a bundled skill with your agents, and records provider configuration. It does not download analysis engines โ Ghidra, IDA, jadx and Hopper integrations require you to supply your own installations (see Step 4).
Step 2 โ Verify with doctor
npx rea-agents@latest doctor
doctor audits your environment: runtime version, detected clients, and each analysis provider (ghidra / ida / jadx / hopper / kuna). A fresh install shows healthy: false โ that's normal. The web/JavaScript commands work with zero optional providers; you only need engines for native binary decompilation.
Step 3 โ The Node version gotcha
At the time of writing, rea-agents declares engines: ^22.23.4 || ^24.22.1 || >=26.12.1. If your Node is older (e.g. 22.22.2), npm only warns (EBADENGINE) and the CLI still runs โ but doctor flags the runtime as missing_dependency. If you want a clean bill of health, upgrade Node past the declared floor.
Step 4 โ Optional: native analysis engines
Only needed for binary/mobile decompilation. Skip this for web and JavaScript work.
- Ghidra โ set
GHIDRA_INSTALL_DIRto an extracted Ghidra 12.1.x directory. - IDA โ set
REA_IDA_MCP_CONFIGto your IDA MCP registration JSON (see REA'sdocs/ida-provider.md). - jadx โ set
REA_JADX_MCP_JARto an absolute path ofjadx-headless-mcp0.7.1 JAR. REA does not download it for you. - Hopper โ install via
rea setup --install-hopper --yes, or setHOPPER_LAUNCHER_PATH.
Step 5 โ Your first command
npx rea-agents@latest --help # 100+ commands, grouped by target
npx rea-agents@latest capabilities # what providers and side effects exist
Good first real workflows (no engines needed): analyze-web-bundle (static analysis of a page's JS via CDP), analyze-javascript-application (local JS/Electron app), capture-browser-scenario (bounded Playwright scenario). We walk through the first one in full, with real evidence, in the web bundle workflow.
FAQ
Does setup modify my agent configs?
Yes, that's its purpose โ it writes MCP registration entries and a skill file for detected agents. Use --dry-run to preview exactly which files it plans to touch before approving.
Can I use REA without any AI agent?
Yes. Everything is available as plain CLI commands. The agent integration is a convenience layer, not a requirement.
Windows / Linux?
REA is a Node CLI, so it runs anywhere Node runs. Our testing is on macOS ARM; native-engine setup steps differ per OS.