REA
REA performance and cost: measure the investigation, not a slogan
Account for provider startup, cache validity and analyst review time
What you will learn
- Separate workload classes
- Understand snapshots
- Measure human work
Before you start
- A target you own or are authorized to examine
- Node.js and npm
- A selected local provider only if native analysis is needed
Use a harmless artifact to test setup, provenance, limitations and cleanup
Key takeaways
- Different surfaces need separate baselines.
- Snapshot reuse requires exact identity.
- No performance claim was measured here.
Separate workload classes
Static JavaScript inspection, Ghidra decompilation and browser observation do different work. Record their target sizes, engines, operations and result quality separately instead of quoting one generic REA speed number.
A native provider can take time to start and analyze. The CLI guide notes that a client timeout may expire while the provider continues; record activity and completion after the first response.
Understand snapshots
A snapshot can reuse an exact result when target bytes, operation, parameters, provider and version match. Metadata writes invalidate the active session cache because the provider may already have applied the change.
A snapshot is cached observation, not a serialized live provider. Some later queries still need provider startup. On Windows, Ghidra may start even for an apparent cache route because it owns source admission.
Measure human work
Compare time to first supported finding, time spent reviewing evidence, false leads and rework after target changes. Include local engine license and compute costs when applicable.
We did not run benchmarks or inspect billing. A short response that omits uncertainty can cost more analyst time than a slower, well-qualified result.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Define one target and operation per trial.
- 2
Record provider startup and snapshot status.
- 3
Count evidence review and correction time.
Copy-ready example
target,provider,operation,snapshot_hit,startup_seconds,review_minutes,validated_finding
not-run,,,,,,Frequently asked questions
Will a snapshot skip provider startup?
Not always; the CLI guide names cases where the provider still starts.
Does a timeout prove failure?
No. Check analysis activity because the provider may still be working.
Sources
- REA / docs/cli.mdSource checked 2026-10-14
- REA / docs/mcp-contracts.mdSource checked 2026-10-14
- REA / docs/ghidra-provider.mdSource checked 2026-10-14
- REA / docs/javascript-application-workflows.mdSource checked 2026-10-14
- REA / docs/browser-observation.mdSource checked 2026-10-14