AIToolScan

1. Install: With Node.js 22.x+ and npm, run `npx rea-agents setup`.<br>2. Choose agents: Pick the agents you want — Claude Code, Codex, Cursor, Gemini CLI, Grok Build, and others — review the proposed changes, and approve them. Existing configurations are backed up.<br>3. Restart the agent: Restart your agent to pick up the new MCP registration and workflow instructions.<br>4. Ask your agent: For example: "Investigate how search works in the Notes app, show me the evidence, and build a similar feature for my project." Replace the app and feature with your target.<br>5. Use the CLI directly: Run `npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json` to inspect a JavaScript/Electron app directory or ASAR. Results include modules, imports, Electron boundaries, and their evidence. Replace the path with your target (e.g. `D:/apps/example` on Windows). Native analysis requires Hopper, Ghidra, or IDA to be installed first; see the CLI and Evidence guide.<br>6. Keep REA up to date: For a CLI installed with `npm install --global` or `bun add --global`, run `rea update`. To refresh agent registrations and the skill, run `npx rea-agents@latest setup`, review the changes, and restart the agent. For one-off CLI commands, use `npx rea-agents@latest <command>`.

Supported targets at a glance:<br>- Native binaries: pseudocode, assembly, strings, symbols, calls and references.<br>- Go / Rust binaries: embedded compiler version, modules, replacements, build settings, and dependency edges — no separate Go or Rust installation required.<br>- JavaScript / Electron: modules, imports, source maps, routes, IPC, and native add-on relationships.<br>- .NET assemblies: metadata, CIL instructions, declared native dependencies, and build comparisons (static only).<br>- Android APKs: manifest declarations, classes, decompiled methods, references, and decoded resources.<br>- Websites: page structure, scripts, network observations, and requested screenshots.<br>- Also: WASM, EVM bytecode, SQLite databases, recorded Linux crashes, firmware regions/extraction, packet summaries and decodes, logic-signal recordings, and more.

Notes:<br>- Static JavaScript and .NET inspection reads the supplied files without running the application; no separate runtime environment is needed.<br>- On Linux, Ghidra, JADX, firmware tool launches, and static JavaScript/Electron analysis require a procps-compatible `ps` on REA's PATH for process ownership checks.<br>- Results include evidence and limitations — treat agent answers as starting points and verify the evidence.<br>- Official distribution is only via morluto/rea, rea.tools, and the npm `rea-agents` package. Do not trust repositories or READMEs that merely resemble these.