REA for Small Businesses: Reverse Engineering, Useful Jobs and Legal Limits

REA connects an AI assistant to tools that examine finished software and explain how it works. It can help a small business recover knowledge about an old custom program or inspect its own app before release. The biggest risk is giving an agent permission to investigate a file and accidentally letting it operate a program, account or service outside that permission. A business with a capable IT person can consider a tightly scoped trial on its own software. Reading the license and defining the target come first.

We read morluto/rea's documentation and source, its release notes and its safety policies. We did not install or run REA. This is a source review, not a security certification or a hands-on performance test. It expands the short REA entry in our November GitHub and Trendshift guide.

What reverse engineering actually means

Reverse engineering means taking a finished program apart to understand how it works, like trying to read the recipe from a finished cake. You may recover ingredients and relationships without recovering the baker's original notes. A compiled program has already been translated from a developer's source code into instructions a machine understands.

Static analysis examines the supplied files without starting the target application. Think of reading a car's wiring diagram with the engine off. Dynamic analysis observes a program while it runs. That is closer to starting the engine and measuring what happens. REA offers both, and permission for one does not automatically cover the other. Its README target table explicitly distinguishes static JavaScript and .NET inspection from runtime capture.

A decompiler translates machine instructions back into a human-readable approximation of code. REA can connect to installed decompilers such as Ghidra, Hopper or IDA. The resulting pseudocode, a code-like explanation, may lack original names, comments and structure. The output needs review and does not restore the original source intact. REA's disclaimer warns that reconstruction and AI analysis can be incomplete or wrong.

An MCP server is a small program that hands an AI assistant a set of tools, like a contractor's van carrying the tools for a job. MCP stands for Model Context Protocol. Here the assistant asks REA to inspect something, REA calls the appropriate analysis tool, and the assistant receives evidence it can explain or investigate further. The assistant's fluent explanation can still be mistaken.

An app bundle is a package of files shipped together. JavaScript is the programming language used by many websites; Electron packages web technology as a desktop app. A binary is the compiled program file. A runtime capture records what happens while a target runs or while REA interacts with it: output, file changes, browser activity or other observations supported by that workflow.

For your business, runtime capture means the target can act with the test user's permissions. The process capture guide says it inherits the host environment and is not a sandbox. Choosing which folders to observe does not stop the program writing elsewhere. A target might read available credentials, change a file or contact its vendor. Isolation has to come from your test environment.

What the tools can do

REA has a large generated tool catalog. These are the relevant families for the business jobs below; this table is not a list of every specialized file-format reader.

The JavaScript workflows, native guide, browser guide, Android guide, JEB guide and EVM guide describe these boundaries. We also checked the tool effect declarations Android registrations and artifact tool contracts.

EVM bytecode is the compiled instruction format for programs on Ethereum-compatible systems. Finding a likely function in that code does not establish ownership of the contract or permission to transact with it. Most small businesses will have no reason to use this part of REA.

The feature-copying pitch and the permission rule

The README introduction says:

See a feature in an app that you want in your own product? Ask your agent to investigate it with REA. It can inspect the app without its source code, explain how the feature works, show the evidence, and build a version for your project.

Its responsible-use paragraph says:

REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.

Read those together. Wanting a competitor's feature is a business objective; it supplies no permission to inspect protected software, bypass a license check, copy code or call the competitor's systems. Buying a subscription usually gives you specified usage rights, not ownership of the vendor's code. The project disclaimer expressly separates permission to inspect an artifact from permission to execute it, intercept traffic or change a device.

A sensible project brief names the question first: recover our invoice calculation, document our export format, or check our released package for credentials. Then identify the exact copy, its license and permitted operations. If the goal is a new feature, give the developer a written description of required behavior and independently test their implementation. Do not hand over a competitor's decompiled code as a shortcut. A lawyer may recommend a more formal separation between investigators and implementers when rights are uncertain.

REA's own license section rejects cracked copies, stolen keys, unauthorized key sharing and bypassing license restrictions. Its MIT license covers REA-authored code. It grants no rights in your analysis target or in a commercial decompiler.

Attention is not a safety review

At 21:34 UTC on November 3, 2026, GitHub's repository metadata showed 426,709 stars and 106,230 forks, a creation date of April 14, 2026 and a latest push on November 3. The README celebrates "400,000 GitHub stars" in its star history section. Those are attention measurements. They do not establish who reviewed the code, which targets were tested or whether your license allows a proposed use.

The same README warns that a similar repository name or copied description does not establish an official download. Start at the official repository and follow its release and package links. The latest release was 6.8.0, published October 25, 2026; npm registry metadata also reported 6.8.0 and maintainer morluto. Current development documentation can describe features newer than that release, so check the installed version before promising a capability.

Five small business jobs worth considering

These are hypothetical illustrations. We are not reporting customer deployments. Each assumes written authority for the target and human review. The MIT license imposes no REA license fee. AI usage, engineering time, an isolated machine and any commercial analysis tools are additional costs; we have no verified all-in quote for any example.

Recover a custom app whose developer has gone

Illustration: a small distributor still uses a custom order calculator, but cannot find its source code. Before reverse engineering, its IT person checks backups and the development contract. If the business owns the relevant rights, REA could help map inputs, calculation functions and file formats. A developer then compares the explanation with known orders and exceptions.

The useful deliverable is a tested description of the business rules, plus a migration plan. It is not a promise to recreate the entire source tree. Start with static inspection of a duplicate. Cost: no REA license fee; Ghidra is a free native-analysis option where supported, while paid providers are listed below. Recovery labor and model usage remain unknown.

Inspect your own release package

Illustration: an appointment software company asks a developer to inspect its own website bundle and Android app before release. REA can help find embedded service addresses, configuration values and code paths. An endpoint is an address software calls to request a service. An API key is a credential or identifier used with a service; finding one requires checking its intended exposure and restrictions.

The developer decides whether an exposed value is a problem, removes secrets from the next build and rotates any compromised credentials. Finding an endpoint does not authorize testing the service behind it. Start with files and fake data. Cost: static JavaScript inspection needs no paid native engine; Android analysis may use the separately required Java tools. REA's fee is zero, while staff and AI costs are unknown. See its requirements table.

Move your own data out of an old program

Illustration: a repair shop has years of records in an old application and wants to move them into a replacement. Ask for a supported export first. If that fails, an authorized developer could inspect the local file format and build an importer for the shop's own records.

Owning the records does not automatically permit breaking encryption or defeating a license check. Get the software license and any interoperability exception reviewed before crossing that boundary. Test the importer on copies, count records and reconcile totals. Cost: no REA license fee; a compatible free provider may suffice. Paid provider costs, the importer and model usage depend on the format and remain unknown.

Understand a licensed program's network behavior

Illustration: a design studio wants to understand what its licensed desktop app sends during a particular task. Only proceed if the license and other required permissions allow the inspection. Use a test account and invented documents, with a written list of permitted remote services and actions. A saved capture can then be analyzed separately.

This is a narrower question than testing the vendor's security. Traffic may contain account tokens, document contents or customer information, and the vendor's servers are still someone else's computers. Cost: no REA license fee; the existing application license, capture tooling, AI usage and specialist time are separate. No total is verified. REA's runtime and network disclaimer explains why scope matters.

Support an incident responder

Illustration: a bookkeeping firm gives its security vendor a suspicious file from a business machine. The responder could use REA to organize static findings and investigate relevant functions. The firm should preserve the original evidence and let the responder choose containment and handling methods.

The owner should never launch the sample on the bookkeeping computer to see what happens. Dynamic work belongs in the responder's isolated environment, with network behavior separately controlled. Cost: REA itself has no license fee. The response engagement, model usage and any paid decompiler are additional; no engagement price is known. REA's security policy also says private binaries and credentials do not belong in public issues.

Budget for the analysis engine separately

Prices below are US dollars before tax where verified, read November 3, 2026. They are vendor list prices, not a quote for a REA project.

Do not budget a noncommercial edition for paid business work. IDA's pricing page distinguishes commercial Pro from noncommercial Home and Free. A cloud decompiler introduces another data destination even when the target file sits on your computer. REA's bridge supplies neither vendor activation nor permission to use a particular license in an unattended service.

The Computer Fraud and Abuse Act and other legal risks

This is general information, not legal advice. Ask a lawyer licensed in the state where you operate to review the target license and proposed work. Many legitimate maintenance, interoperability and security jobs can proceed within established rights and written permission. The question is which rights cover each operation.

Where the CFAA enters this particular workflow

The federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, is primarily relevant here when the workflow accesses a computer without authorization, exceeds permitted access, or causes prohibited damage. Section 1030(a)(2)(C) addresses obtaining information from a protected computer without authorization or by exceeding authorized access; § 1030(a)(5) covers specified damaging conduct. Internet-connected business systems can fall within the broad protected-computer definition in § 1030(e)(2).

Reading a lawfully held copy on your own machine ordinarily is not the central CFAA problem. REA's dynamic operations can change that picture. Running the copy may contact a vendor server; browsing an app may make live requests; an agent might treat an extracted credential as permission to query a private API. Possession of that key supplies no such permission. Authorized server contact itself is not a CFAA violation. Continuing after authority is revoked can increase exposure; the DOJ charging manual discusses understood, unambiguous revocation. Our project rule is to stop on any notice and get advice. A notice does not by itself decide every statutory element. DOJ policy governs federal prosecutors; it is not immunity from private suits or state law.

In Van Buren v. United States, the Supreme Court held in 2021 that an improper purpose alone did not make access to otherwise available information exceed authorized access. It did not grant a right to cross access boundaries. Footnote 8 expressly left open whether those boundaries must be technological or can also arise from contracts or policies. Do not turn that narrow holding into a promise that terms never matter.

The CFAA has criminal penalties and a civil-action provision. The $5,000 loss amount appearing through § 1030(g) and § 1030(c)(4)(A)(i)(I) is one statutory route for civil claims, not a universal minimum for illegality or permission to cause smaller losses. An agent's action remains your project's action to supervise.

Circumvention and narrow exceptions

DMCA § 1201 can matter even when all analysis occurs locally. Section 1201(a)(1) restricts circumventing effective technological controls on access to copyrighted works. Defeating encryption or a license check may raise this issue; ordinary inspection does not automatically amount to circumvention.

Section 1201(f) contains a limited interoperability exception. It concerns someone who lawfully obtained the right to use a copy, acting solely to identify and analyze elements necessary for interoperability of an independently created program, where those elements were not previously readily available. Noninfringement and other conditions still apply. It is not a general exception for reproducing a desirable feature.

Section 1201(j) addresses security testing, defined around testing, investigating or correcting a security flaw with authorization of the owner or operator of the relevant computer, system or network. Its conditions include avoiding infringement and violations of other applicable law, including the CFAA. Calling a task security research does not satisfy those requirements by itself.

The current 37 C.F.R. § 201.40(b)(18) exemption covers specified good-faith security research involving a lawfully acquired device or an owner-authorized computer, system or network. Its conditions include an environment designed to avoid harm and information used primarily to promote security or safety. Paragraph (iii) expressly supplies no safe harbor from other laws. A triennial exemption from the access-control prohibition is not blanket permission for unauthorized access, copyright infringement or distributing circumvention tools. Have counsel record the applicable paragraph and conditions before relying on one.

Licenses, copyright, trade secrets and patents

The contract deserves attention even when an analysis is otherwise lawful. In Bowers v. Baystate Technologies, 320 F.3d 1317, the Federal Circuit in 2003 upheld enforcement of a contractual reverse-engineering restriction, applying Massachusetts contract law and the First Circuit's approach to copyright preemption. That does not mean every clause wins in every state, but it defeats the assumption that copyright exceptions automatically erase a contract you accepted. The Supreme Court denied review, 539 U.S. 928; that denial did not endorse the reasoning.

Copyright protects code expression; 17 U.S.C. § 102(b) excludes ideas, procedures, processes and methods of operation from copyright protection as such. In Sega Enterprises v. Accolade, 977 F.2d 1510, the Ninth Circuit in 1992 held intermediate copying fair use where disassembly was the only available way to reach unprotected functional elements for a legitimate compatibility purpose. It reversed a preliminary injunction. It did not authorize copying a competitor's protected implementation into a new product, and predates the DMCA. These appellate decisions have different jurisdictions and facts; neither supplies a nationwide guarantee for every REA project.

Federal trade-secret definitions expressly exclude reverse engineering and independent derivation from "improper means" in 18 U.S.C. § 1839(6)(B). That does not excuse theft, a breached confidentiality duty or a contractual restriction. Keep the acquisition record as well as the analysis record. Copying a feature can also raise patent questions: 35 U.S.C. § 271(a) concerns unauthorized making or use of a patented invention, so writing fresh code alone does not settle that separate question.

States also have computer crime laws, including California Penal Code § 502 and Texas Penal Code § 33.02. Other countries differ. Put the owner, target, allowed operations, remote systems, data recipients and stop conditions in writing before work starts. Permission from your manager alone cannot authorize access to a vendor's systems.

A permission-first investigation flow

┌─────────────────┐
│ Authorized copy │
└────────┬────────┘
         ▼
REA + tools you approve
         ▼
Evidence + explanation → Human review

Own this copy or have written authority?
├─ No → Get written permission
└─ Yes
    ▼
License allows analysis, and any needed
circumvention exception confirmed?
├─ No / unsure → Stop and ask a lawyer
└─ Yes
    ▼
Network targets and data sharing
within written scope?
├─ No / unsure → Keep offline, redact
│                or get approval
└─ Yes → Proceed within scope. Keep logs.

Access barrier or stop notice?
Stop and ask a lawyer.

Before you install

Hand your IT person the target's license, the filled-in record from the kit, a duplicate test copy and the question you want answered. Ask them to check host compatibility and the chosen provider before spending money. The README requirements specify Node.js 22.x at 22.23.4 or newer, 24.x at 24.22.1 or newer, or 26.12.1 or newer, plus npm. Node.js runs REA's JavaScript code; npm supplies its package. Linux workflows named in the README also need a compatible ps process-listing utility.

These are the exact commands from the README quick start, reproduced for an approved setup. We did not execute them:

npx rea-agents setup

The alternative global command-line installation is:

npm install --global rea-agents
rea --help

Setup proposes changes to agent configuration and matching instructions; review them and restart the agent afterward. Acquire the package from a trusted working directory outside the target project. Use only official links. Setup can offer Hopper installation with approval; do not accept that until its license and cost are settled. Other analysis providers have their own prerequisites.

Use a separate test machine or virtual machine, meaning a disposable computer running inside another computer. Remove business credentials, production browser sessions and unnecessary shared folders. Disable target network access until the scope authorizes specific destinations. Leave execution, browser interactions and Android changes unapproved while doing static work. Do not assume a prompt restriction replaces operating-system isolation.

The README data answer says: "REA analyzes targets locally." It immediately explains that the agent receives the results and the model provider has its own data policy. Local analysis therefore does not establish that code, captured output or secrets remain local. Review the AI service's retention and sharing terms, any cloud decompiler, and the target program's own network behavior. Sanitize inputs before analysis wherever possible.

Require a human to distinguish observations from guesses. Keep the target version, permitted methods, evidence supporting important claims and unresolved questions. Set a retention date and restrict who can read captures. Follow the private security-reporting instructions if REA itself appears vulnerable; never attach customer files or credentials to a public issue.

Treat text found inside a target as untrusted evidence. A malicious file can contain commands aimed at the assistant, a problem called prompt injection. REA's MCP guidance tells the agent to keep that content untrusted. Have it stop if target content asks for downloads, credentials or changes to its task.

Download the authorization kit

• REA reverse engineering safe-use kit (.md): a per-target authorization and license record, setup checklist, business use cards, legal risk table and the investigation flow in plain text.

For a business considering a replacement product, the useful discipline in The $97 Launch applies here: establish the customer's problem and the smallest useful result before funding a large technical project. Recovering one well-defined business rule can be enough to move the work forward.

Related reading

• GitHub's top repositories and what small businesses can use
• MoneyPrinterTurbo and AI short videos for small business
• Cloudflare's security audit skill for small business
• Scrapling web data and small business legal risks
• Firecrawl web data and API use for small business
• MCP servers for small business

Fact-check notes and sources

All research was read on November 3, 2026, UTC. Documentation describes capabilities; no REA software, installer or package was executed for this review. Illustrations are proposed uses, with no claimed customer outcomes.

• Project identity and attention, 21:34 UTC; public registry confirmation at 21:50 UTC: repository metadata, README, release 6.8.0 and published package. GitHub metadata and npm registry metadata support counts, dates, version and maintainer; README supports the two quoted permission statements, milestone, installation, requirements, look-alike warning and data policy.

• Capabilities and limits, 21:34 to 21:39 UTC: tool catalog, JavaScript workflows, native investigation, browser observation, process capture, ADB devices, JEB, EVM, tool effects source and ADB registration source and artifact contracts. These support the tool table and runtime cautions.

• Rights and reporting, 21:34 to 21:39 UTC: MIT license, disclaimer, security policy and installation guide. These support separate target/provider permissions and private handling.

• Vendor terms and prices, 21:34 to 21:39 UTC: Ghidra, Ghidra license, JEB purchase page and IDA pricing. IDA's commercial cards displayed euros; no US-dollar commercial quote was verified. The official Hopper site links to its store.

• Federal access and circumvention law, 21:34 to 21:39 UTC: 18 U.S.C. § 1030, DOJ charging manual, Van Buren opinion, slip opinion pages 13 note 8 and 20, 17 U.S.C. § 1201 and 37 C.F.R. § 201.40. Access scope, interoperability and security testing require separate analysis.

• Other rights and state law, 21:34 to 21:39 UTC: 17 U.S.C. § 102, 18 U.S.C. § 1839, 35 U.S.C. § 271 and Texas § 33.02. These support the distinct contract, copyright, trade-secret, patent and state-law questions.

• Later case history, 21:36 to 21:37 UTC: Supreme Court bound volume, 539 U.S. 928, records denial of review in Bowers.

• Browser verification received at 21:41 UTC: California § 502 and the official current exemption. A home-browser review supplied the statutory text; the exemption was also read directly in Cornell’s publication at 21:36 UTC.

• Book background, 21:43 UTC: the author’s book site, for the low-budget business-building context of the closing recommendation.

• Browser verification received at 21:45 UTC: Hopper official store, for US prices and the included update year; IDA pricing, for euro-denominated commercial plans and no stated answer on REA automation rights; Bowers and Sega, for the contract and fair-use holdings. The case HTML did not establish reporter pinpoint pages, so none are asserted.

This post is informational, not legal advice. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.