Reverse Engineer Anything (Docker) MCP server

docker-reverse-engineer-anything

REA (Reverse Engineer Anything) in a Docker image, with everything it needs to tear apart Android APKs already inside, and a Streamable HTTP MCP endpoint in front of it.

REA is morluto's MCP server and CLI that lets an AI agent inspect software it has no source for: decompile APKs, trace references, read resources, poke at devices over adb, dig through Electron bundles, .NET assemblies, Go and Rust binaries. Upstream ships it as the rea-agents npm package that talks MCP over stdio and expects you to install a JDK, JADX and Apktool yourself. This image does that part for you.

This is an unofficial packaging. REA itself lives at

morluto/rea and is MIT-licensed. Bugs in

REA's tools go there; bugs in the image or the HTTP bridge go here.

Table of Contents

• What's in the image
• Quick start
• Ways to run it
• Opt-in tools
• Configuration
• Security
• Agent integrations
• Versions and updates
• Development
• License

What's in the image

APK analysis needs no extra setup: inspectandroidpackage, searchandroidclasses, inspectandroidclass, inspectandroidmethod, traceandroidreferences and decodeandroidresources work out of the box, and so do REA's static JavaScript/Electron, .NET, Go, Rust, WASM, SQLite and capture tools.

Native-binary decompilation (the .so libraries inside an APK, or any other ELF, PE or Mach-O) needs Ghidra. It is free but adds about 900 MB, so it is not baked in: set REA_INSTALL=ghidra and the container fetches it on first start. See Opt-in tools.

Images are built for linux/amd64 and linux/arm64. CI runs the APK tests on both architectures. Ghidra is amd64 only.

Quick start

export REA_BRIDGE_TOKEN="$(openssl rand -hex 32)"
mkdir -p targets && cp /path/to/app.apk targets/

docker run -d --name rea \
  -e REA_BRIDGE_TOKEN \
  -p 127.0.0.1:8080:8080 \
  --read-only \
  --tmpfs /tmp:rw,nosuid,size=4g \
  --tmpfs /home/rea:rw,nosuid,size=256m \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -v "$PWD/targets:/work:ro" \
  psyb0t/reverse-engineer-anything:latest

Shortened. The full README is on GitHub.