<- all tokdocs
2026.10.14@chase_ai_

"Claude can now reverse engineer anything" describes a third-party MCP server started in April 2026 that needs Hopper, Ghidra or IDA for binaries

AI
Watch on TikTok

View on TikTok ->

The artifact is a 38.75-second vertical clip at 1080x1920 in an MP4 container, video encoded as HEVC Main profile in yuv420p at 60 fps across 2,325 frames and 402,129 bps, audio as HE-AACv2 at 44,100 Hz stereo and 48,201 bps, for an overall bitrate of 459,385 bps and a file size of 2,225,377 bytes. The post timestamp is 1791995936, which is 2026-10-14 16:38:56 UTC. The uploader handle is chase_ai_, the channel nickname is "Chase AI", and the audio is "original sound" by "Chase AI". The 55-character description repeats the title. At capture on 2026-10-19 01:57:15 UTC the metadata recorded 128,600 views, 7,700 likes, 93 comments, 1,211 reposts, and 5,917 saves. I read 10 of the 19 extracted frames (001, 003, 005, 007, 009, 011, 013, 015, 017, 019) and all 135 words of the transcript, 13 Whisper segments ending at 38.52 seconds against 38.79 seconds of audio, with no segment past the end. In every frame the upper half is a dark-theme browser recording of a GitHub README with the address bar truncated to "github.com/morluto/..." and a tab row that includes "README" and "MIT license"; the lower half is a bearded man with short brown hair in a brown t-shirt, beside a white door and a skyline poster. Frames 001, 003, 005, 017 and 019 show the header "REA: Reverse Engineer Anything", the subtitle "One MCP for reverse engineering across binaries, applications, and runtime behavior.", badges reading "npm v6.5.0", "Skills 5.1K", "license MIT", "Discord 3.9k online", and a boxed "GITHUB TRENDING #1 Repository Of The Day". Frames 007, 009 and 011 show a "Star History" chart, legend "morluto/rea", x-axis "August", "September", "October", with a line flat until October then nearly vertical past the 200K gridline. Frames 013 and 015 show the README's "What you can analyze" table, whose first row pairs "Native binaries" with "Hopper, Ghidra or IDA". Captions read "but this week" (009), "past 200,000" (011), and "it's completely free" (017). The transcript is one spoken pitch, quoted with timestamps below; Whisper spelled the name "RIA" at 3.40 seconds where every header frame reads REA.

"Claude can now" describes a third-party MCP server, and the chronology runs Anthropic in 2024, morluto in April 2026, the crowd in October

The transcript never says who built the tool or how Claude talks to it. The screen does. The README subtitle visible in frames 001 through 005 reads "One MCP for reverse engineering across binaries, applications, and runtime behavior." MCP is the Model Context Protocol, which Anthropic announced on 2024-11-25 as "an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools". Claude Code's live documentation, which I checked on 2026-10-19, describes the same mechanism: "Claude Code can connect to hundreds of external tools and data sources through the Model Context Protocol (MCP), an open source standard for AI-tool integrations", with local servers registered through claude mcp add [options] <name> -- <command> [args...]. The same page carries a warning that applies here: "Verify you trust each server before connecting it."

REA is one such server. The GitHub API lists github.com/morluto/rea under a personal user account named morluto (account created 2020-12-22, 8,688 followers, 257 public repos), with the description "Reverse engineer anything with agents, from app behavior down to native binaries." and an MIT license. Nothing in the repo, the rea-agents npm package, or the rea.tools site is published by Anthropic. The README's setup section says "Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents", and the dev.to write-up from October 12 lists fourteen clients including Claude Desktop and GitHub Copilot CLI. Claude is one client among many that can call it.

The order of events: Anthropic published the protocol in November 2024; morluto opened the repo on 2026-04-14, about sixteen and a half months later; the crowd arrived in the first two weeks of October 2026; the TikTok went up on 2026-10-14. "Claude can now" is accurate only in the sense that any MCP client could already do this once the server existed. Anthropic shipped nothing on October 14 that changed what Claude can do.

The repo dates to April 14, 2026, and "since August" is the left edge of a chart

At 14.94 seconds the creator says "It's been around since August". The GitHub API gives created_at as 2026-04-14T00:51:32Z, and the oldest commit on the default branch, timestamped two seconds earlier, carries the message "Initial commit: betterBinaryMCP - Enhanced MCP server for Hopper Disassembler". The project began as an MCP bridge to one commercial disassembler and broadened to the current name later. The tag list runs 39 deep, from rea-0.2.0 and rea-0.2.1 through rea-agents-6.7.0, the npm registry lists 31 published versions from 0.2.1 onward, and the GitHub release feed shows ten releases between 2026-10-06 (4.1.0) and 2026-10-18 (6.7.0). The "npm v6.5.0" badge in frame 001 matches the release rea-agents-6.5.0 published 2026-10-14T12:32:45Z, about four hours before the TikTok's 16:38:56 UTC post time, which dates the screen recording to the afternoon of October 14. The creator's YouTube channel carries the deep dive he mentions at 32.24 seconds: "This Viral Open Source Repo Lets Claude Clone ANYTHING", uploaded the same day, 9 minutes 10 seconds long, with a description that opens "Claude can now reverse engineer anything with REA."

The likely source of "August" is on screen. The Star History chart in frames 009 and 011 has x-axis labels "August", "September", "October" and no earlier months. Star-history.com draws its axis from star data, so a repo with few early stars shows a short axis regardless of its creation date. I tried to confirm when the first star landed using GitHub's stargazer endpoint with the star+json media type and received a 404 on two attempts, so the first-star date stays unverified. The creation date does not. The dev.to piece agrees: "The morluto/rea repository was created in April 2026 and remained mostly unnoticed until the first week of October."

The star run is real, and the baseline was thousands rather than zero

"It went from basically zero stars past 200,000" compresses a ten-day curve into one line. The dated figures I found, in order: Trendshift records REA first trending on October 4 and holding #1 from October 5 through October 16, with 52,186 stars added on October 12 alone, and its badge is the "#1 Repository Of The Day" box on screen. The dev.to piece dated October 12 says REA "first appeared on the trending list on October 4 with about 1,400 new stars in one day" and that "By October 12, it had passed 115,000 stars and 25,000 forks". AICoder's October 8 note gives "12,962 stars, 1,375 forks, MIT licence as of 2026-10-08". Max Quimby's dev.to post on October 15 says "REA went from under 10,000 stars on October 6 to over 100,000 by October 12" and "Today it has over 248,000". Star-history.com's weekly ranking for October 11 through 17 lists morluto/rea first at +232,742 stars. The GitHub API reported 333,801 stars and 84,372 forks when I queried it on 2026-10-19, and the README's star-history section now thanks readers for 300,000 stars.

On the day of the TikTok the count sat between the 115,000 reported on October 12 and the 248,000 reported on October 15, and the chart in frame 011 shows the line above the 200K gridline, so "past 200,000" on October 14 is consistent with the sources. "Basically zero" is the loose part. Eight days before the post the repo had roughly 10,000 to 13,000 stars, which is small against 200,000 but describes a working project with 39 tags and several releases a day during the run. The shape of the claim holds and the zero baseline does not.

"All the way down to the machine code" depends on a separate disassembler, and "completely free" covers REA alone

The table the creator scrolls at 24 to 26 seconds (frames 013 and 015) is the README's "What you can analyze" section, and its third column names the dependency for each depth. Native binaries return "Pseudocode, assembly, strings, symbols, calls and references" with the requirement "Hopper, Ghidra or IDA". The README's setup text repeats this: "Native analysis can use an existing Hopper, Ghidra, or IDA installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs no native analysis engine." The FAQ entry "Do I need Hopper, Ghidra or IDA?" answers that JavaScript and several static inspections work without a native engine, and that "Ghidra and IDA use your existing installations." The machine-code depth the video advertises comes from those decompilers. REA wraps them in MCP tool calls and returns the output with evidence.

The cost picture follows from that. REA-authored code is MIT and the npm package installs free. Hopper, the engine REA's setup offers to install, sells a Personal License at $99.00 and a Computer License at $129.00 on its FastSpring store, with a free trial. Ghidra is Apache-2.0 and "created and maintained by the National Security Agency Research Directorate", per its GitHub repo. IDA Free is "Lightweight IDA at no cost", limited to x86 and x86-64 with no commercial-use rights. A user who wants the full binary depth on a Mac through the Hopper path is paying $99 or working inside a trial. The README's license section is direct about this: "You must legally obtain and be authorized to use commercial tools, including IDA Pro / Hex-Rays decompilers, Hopper, and JEB" and "REA grants no tool license, key, or activation entitlement."

"Clone it" is the one use the project's own disclaimer rules out

At 10.20 seconds the pitch is that Claude can break down an application "so you can either clone it or create a custom version". The README's example prompt is narrower: "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project." The project ships a DISCLAIMER.md that lists what it "does not support, and will not help with", and two items on that list are "copying proprietary software or reproducing its protected code and assets" and "circumventing DRM, license checks, anti-cheat systems or other technical protection measures". It adds that "Reverse engineering may be restricted in your jurisdiction or by the license of the software you analyze", and that requests for the listed uses "will be closed without response".

The README's disclaimer section states the intended scope: "REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine." Quimby's October 15 post draws the legal edge in the same place: "The DMCA Section 1201 exemptions for interoperability and security research provide some cover, but the lines between 'understanding for interoperability' and 'cloning a competitor's product' are blurry." "Create a custom version" of a feature you have studied matches the README. "Clone it" matches the exclusion list.

One more README line matters for anyone who follows the video to GitHub: "A similar repository name or copied README does not establish that a download is official." Quimby reports that "Within days of trending, at least one copycat appeared." The official sources named in the README are github.com/morluto/rea, rea.tools, and the rea-agents package on npm.

Key Takeaways

  • Verified: The artifact facts are confirmed by ffprobe and the post metadata. 38.75 seconds, 1080x1920, HEVC Main at 60 fps, HE-AACv2 audio, 2,225,377 bytes, posted 2026-10-14 16:38:56 UTC, 128,600 views and 7,700 likes at capture on 2026-10-19.
  • Verified: REA exists at github.com/morluto/rea under MIT, with 333,801 stars and 84,372 forks on 2026-10-19, an npm package rea-agents at 6.7.0, and a 6.5.0 release published 2026-10-14 12:32 UTC that matches the badge on screen.
  • Verified: The deep dive the creator mentions is "This Viral Open Source Repo Lets Claude Clone ANYTHING" on the Chase AI YouTube channel, uploaded 2026-10-14, 9 minutes 10 seconds, 38,895 views when I checked on 2026-10-19.
  • Correction: The video says the repo has "been around since August". GitHub's API dates creation to 2026-04-14, with an initial commit titled "betterBinaryMCP - Enhanced MCP server for Hopper Disassembler". The August label is where the on-screen star chart's axis begins.
  • Correction: "Claude can now" presents a third-party MCP server as a Claude capability. REA is published by the GitHub user morluto, works with Claude Code, Codex, Cursor, Gemini CLI, Grok Build and others, and Anthropic's part is the MCP standard it published on 2024-11-25.
  • Partial correction: "From basically zero stars past 200,000" this week. Dated sources put the repo at under 10,000 on October 6, 12,962 on October 8, past 115,000 on October 12 and over 248,000 on October 15. The 200,000 figure on October 14 is consistent; the zero baseline is not.
  • Partial correction: "All the way down to the machine code" and "completely free". Pseudocode and assembly depth requires Hopper ($99.00 personal, $129.00 computer, free trial), Ghidra (Apache-2.0) or IDA (IDA Free is x86-only and non-commercial). REA itself is MIT.
  • Clarification: "Clone it" conflicts with the project's DISCLAIMER.md, which lists "copying proprietary software or reproducing its protected code and assets" among uses it will not help with. The README's own example is "build a similar feature for my project".
  • Unverified: The date of the repo's first GitHub star. The stargazer endpoint with starred_at timestamps returned 404 twice, so I cannot say whether the chart's August start reflects the first star. Per-version npm publish timestamps did not surface either; release dates here come from GitHub.

Resources

Published October 14, 2026. Writeup generated from a favorited TikTok.