REA
Deploying REA for a team: MCP, CLI and provider boundaries
Decide where configuration, target files and local analysis engines live
What you will learn
- Place the agent connection
- Place analysis engines
- Treat targets as sensitive
Before you start
- A target you own or are authorized to examine
- Node.js and npm
- A selected local provider only if native analysis is needed
Use a harmless artifact to test setup, provenance, limitations and cleanup
Key takeaways
- MCP and CLI share documented workflows.
- Native engines are separate dependencies.
- Local execution still needs an access policy.
Place the agent connection
REA setup registers an MCP server for selected clients and installs workflow instructions unless opted out. Manual registration is also documented. An MCP registration is a local integration, not a hosted analysis service.
List the precise clients and configuration files to change. Use a dry run and review backups before rollout; the installation guide says malformed existing configuration blocks the transaction rather than being silently replaced.
Place analysis engines
A static JavaScript workflow can start without a native provider. Native binaries require a selected local engine and its own installation and licensing conditions. The CLI can list providers and diagnose a chosen engine.
Do not assume one provider supports every operation. Provider choice is bound to a binary session, and ambiguous automatic selection should be replaced with an explicit choice in a repeatable team workflow.
Treat targets as sensitive
The security guide says REA delegates parsing and analysis to a local provider under the current user account. Private binaries, Ghidra projects and session tokens should not be pasted into public reports.
Keep target samples, result snapshots and client configuration under an access policy. We have not validated a deployment, client registration or provider installation.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Plan client paths with a dry run.
- 2
Assign providers per target type.
- 3
Restrict sample, snapshot and configuration access.
Copy-ready example
rea setup --client codex --skill=false --dry-run
rea providers --json
rea doctor --provider ghidra --jsonFrequently asked questions
Is a cloud service required?
The README describes local analysis and local MCP or CLI integration.
Does MCP registration install Ghidra?
No. The installation guide says REA can use a verified existing Ghidra path but does not download or modify Ghidra.
Sources
- REA / README.mdSource checked 2026-10-14
- REA / docs/installation.mdSource checked 2026-10-14
- REA / docs/cli.mdSource checked 2026-10-14
- REA / SECURITY.mdSource checked 2026-10-14
- REA / docs/ghidra-provider.mdSource checked 2026-10-14