REA-Prompts Gives Coding Agents a Reverse-Engineering Playbook

A prompt library takes off on a viral tool

Brazilian red-team lead Joas Antonio dos Santos has released REA-Prompts, a set of copy-and-paste prompts for running REA, the "Reverse Engineer Anything" toolkit that has spent October passing through AI coding agents. The Daily Commit's listing describes it as structured templates that walk large language models through taking a program apart, mapping its dependencies, pulling out its API design and drafting architecture blueprints for analyzing or replicating existing software.1 Santos announced the repository on X on October 19, and that post has passed 110,000 views.3 His GitHub profile calls him a red team lead and information security researcher. His other public repositories include an AI-driven penetration testing framework called NeuroSploit and a collection of EDR-evasion resources.2

The repository grew quickly. A Korean trend tracker counted 487 stars and 63 forks one day after launch.5 An automated GitHub radar logged 1,116 stars on October 21.9 It logged 1,504 on October 238 and 2,196 on October 25, an average of about 411 stars a day over the repository's first five days.10 Snapshots taken at different moments give different totals, so the exact number depends on when you look. Every tracker shows the same steady climb.

REA-Prompts contains no code. It is a guide to using someone else's tool, and the speed of its rise says something about where AI coding assistants are heading.

What REA is, and what the prompts add

REA itself is an MIT-licensed project written in TypeScript and distributed on npm as rea-agents. It works as a Model Context Protocol (MCP) server and CLI, giving coding agents access to real decompilers so they don't have to explain software from memory.21 It does no decompiling of its own. It passes an agent's requests to established tools such as Ghidra, IDA Pro and Hopper, and to Chrome DevTools for web and Electron apps. It then returns pseudocode along with the evidence and the open questions behind each finding.23 Its scope covers native binaries, JavaScript and Electron bundles, .NET assemblies, Android packages, firmware and websites.25

REA-Prompts sits on top of all that. The Korean tracker counts 16 sections. They include tracing a single feature, exploring native binaries, cloning features, game analysis and checking whether a game can be ported to WASM, firmware, Android, kernels, vulnerability research, Electron apps, anti-cheat and protection research, DMA research framed as defensive, cracking research, version diffing and crash analysis, and long-running investigations.5 The design rule is the same throughout. Each prompt asks the agent about one feature at a time, makes it separate confirmed facts from hypotheses, and requires evidence for every claim. The starter example follows an "Export notes" button all the way to the code that writes a CSV file.5 Security researcher Md Ismail Šojal summed up the appeal in a post: the prompts help agents reverse engineer software properly instead of guessing.4

The repository is a community project with no official link to REA, which keeps its own prompt gallery.5 In my view, that split matters. Usage guides from the official project and from the community are both becoming products in their own right, and the people writing them are increasingly security practitioners, not the tool's authors.

Where the coverage diverges

The reporting agrees on the mechanics and disagrees on the numbers. Estimates of REA's own popularity vary widely. One explainer gave 125,000-plus stars at the time it was written.21 A tutorial said more than 250,000.22 A tool directory showed 379,000.24 One startup outlet reported a jump from under 10,000 stars to 234,477 between October 6 and October 14.29 Some of the gap comes from timing. The range is still wide enough that readers should treat any single figure with care.

The framing differs more than the facts. Some coverage is openly enthusiastic. One explainer says REA turns AI reverse engineering from a parlor trick into an auditable engineering discipline.30 Others are cooler. A MindStudio analysis points out that REA is a connector to decompilers that are decades old, not a new reverse-engineering technique. It also predicts that much of what REA does will end up built into mainstream coding agents.23 A Medium write-up warns that decompiled pseudocode is not original source code and that an agent can still misread the evidence it gets.28 The Korean tracker adds that nobody has measured how much REA-Prompts actually improves an investigation.5

My reading sits between these views. REA's real contribution is the workflow, not the analysis engines, and REA-Prompts confirms that the hard part is now asking agents the right questions. A tool that needs a 16-section prompt guide is powerful, but it is not yet easy to use.

The coding-assistant angle

This matters for mainstream developer tools because REA plugs straight into them. Its one-command setup lists Claude Code, Cursor, Codex, Gemini CLI and Grok Build.25 Another guide adds Windsurf and the GitHub Copilot CLI to that list.27 A Russian-language post sharing the repository makes the commercial pitch directly: rebuild an MVP modeled on an existing product, or audit someone else's app, many times faster.6

That pitch is landing as the major assistants give agents more autonomy. The Daily Commit notes that auto mode is now the default in Claude Code, moving away from step-by-step approvals toward autonomous execution.1 Claude Code version 2.1.302, released October 17, added automatic model selection on the client side and controls for idle compaction. Version 2.1.296 on October 9 added a way to pin every subagent in a workflow to one model.19 Comparison guides keep giving the three leading tools distinct roles. Copilot is the cheapest at $10 a month for Pro. Cursor is the editor-first option at $20. Claude Code is the agent people hand long, multi-file jobs, also starting at $20.12 Reviewers say Claude Code handles large refactors and work spanning more than ten files well.12 That is the kind of long investigation REA-Prompts is built for.

Cost is a related concern. The Daily Commit points to Databricks' experience: without governance such as per-user budgets and usage dashboards, AI coding spend can grow unpredictably.1 Reverse-engineering sessions are long, iterative and heavy on tokens. They are the workloads most likely to break those budgets.

Review tools are the other half of the story

If agents can now rebuild a feature from a binary, someone has to check what they produce. October has been busy for AI code review. Anthropic made Claude Code Review generally available to Team and Enterprise customers on October 15. GitHub had changed the default for Copilot's built-in review from Lite to Balanced on September 28.13 Claude Code Review never approves or blocks a pull request. Copilot can submit approving reviews through an opt-in preview. Cursor's Bugbot is billed by usage and ranked first for catching high-severity bugs in one October comparison.13

Editors are making review more granular at the same time. Zed, Cursor, VS Code and Claude Code have all added or expanded ways to accept or reject AI-written changes one hunk at a time.19 The same report puts the developer trust gap at 46 percent.19 The pattern seems clear to me. AI tools generate faster than humans can check, and vendors are trying to close that gap with more automated review.

Legal and security edges

REA-Prompts opens with a responsible-use warning. It says users should analyze only software they own or have explicit permission to examine. It frames the anti-cheat, DRM, kernel and vulnerability prompts as tools for security research, interoperability, CTFs and bug bounties.5 The Korean tracker still flags the cloning and cracking sections as legally and ethically sensitive. It also notes that responsibility rests with the user.5 Cybersecurity News adds a practical warning: REA runs its analysis locally, but the agent still receives the results, so the model provider's data policy applies.25 One hands-on reviewer says the trust checks mattered more than the installation. He notes the project has attracted copycats and that its README tells users to install only from official sources.26

Those cautions are the part of the coverage most worth taking seriously. A prompt set written by a red-team lead makes skilled reverse engineering easier for everyone, defenders and attackers alike. One outlet put it this way: the outcome depends less on REA's code than on who adopts the workflow first.29 REA-Prompts is a small repository, but it carries that question into everyday coding assistants.