REA vs leanrea: Skill or MCP for Reverse Engineering Agents?

Searches for "reverse engineer anything" and "REA github" climbed again this week, and the reason is a second project: leanrea, an 8 KB skill file that claims to do what the REA (Reverse Engineer Anything) MCP server does without the server. The numbers in its README are striking. They are also the author's own, run on a narrow set of tasks, so this post reads them closely and says who should install which. If you want the basics of REA first, start with our REA guide.

Last updated: October 18, 2026

What leanrea says it is#

The leanrea README describes one SKILL.md that tells an agent which shell command is fastest for each kind of target, gives paste-and-run recon commands, and lists traps. The agent then calls real tools (asar, otool, nm, go version -m, jadx, apktool, Ghidra, tshark, binwalk, sqlite3) itself, with no MCP layer in between. Its latest commit is dated October 17, 2026, and it credits REA for most of its gotchas.

The README's overhead comparison, all author-reported:

The benchmark, read honestly#

The author ran Claude Code headless with Sonnet 5.5: 4 reverse-engineering tasks, 3 repetitions, 3 arms, graded against hand-made answer keys. Vendor-reported results (the "vendor" here being the leanrea author):

Three readings matter more than the headline "38% faster":

1. REA still scored higher. 75/75 against 74/75. The README says the miss named an older IPC channel instead of the v2 one, which is a small error but not "identical".
2. The win over no skill is modest. The README's own caveat puts it at about 19% faster and 32% fewer turns, with essentially the same cost ($2.17 vs $2.21). The plain model is already good at this class of task.
3. REA's heavy path was not exercised. The README says Ghidra, Hopper and jadx were not installed, so the native tasks ran on Xcode tools for both arms. That is the territory where REA's provider engines are meant to earn their keep. It also says only 3 reps per cell, one model and one machine.

The README is also upfront that REA was tested in its best case for context, because Claude Code can load MCP tools on demand. The 400k-token row only applies to agents that load every tool up front. That is the real lesson, and it is a general one: tool definitions cost context. We covered the pattern in skills over MCP with progressive disclosure and the trade-off in MCP servers vs agent skills.

The angle: when a skill beats a server#

What a builder does Monday, as a framework:

• Pick the skill when the targets are CLI-friendly: extracting an Electron app's app.asar and tracing IPC, reading Go build info, listing Mach-O exports and entitlements. The README's side-by-side shows the raw route finishing in seconds where the REA CLI took far longer, for example go version -m in 0.06 s against 0.56 s, and an asar extract plus rg -uu pass in 4.8 s against 47.9 s for REA's Electron analysis (author-measured, one app, one machine).
• Pick the MCP server when you need what a shell note cannot give you: Ghidra, IDA or Hopper-driven pseudocode, structured evidence you can cite, or a team setup where one shared server is easier to govern than a skill every developer copies.
• Pick neither blindly if the target is not yours. REA's disclaimer, summarised in our guide, limits intended use to authorized analysis, and a shorter prompt does not change the legal position of the software you point it at.

A concrete first step that is cheap to try, taken from the leanrea README (we did not re-run it here):

npx skills add aicodeking/leanrea

Then ask something narrow, as the README suggests: /leanrea How does the search feature in Foo.app work? Show the evidence. Compare the turn count with a plain run on your own app before deciding anything.

One tip from the README that applies beyond this project: search extracted trees with rg -uu, because bundlers hide code in dot-folders such as .webpack/ and default ripgrep skips them. Before you hand any tool to an agent, run through the agent security checklist, and see the best MCP servers shortlist for what else is worth the context.

What people are actually saying#

• The context complaint is the draw. On the launch video's comments, one viewer said REA's problem is that it adds around 200k tokens of context before doing anything, and another said plain REA used up a lot of their OpenAI credits. Several said they would try the skill.
• The methodology pushback is sharp. Another commenter argued the test is not rigorous: all four tasks are checklist-style (symbols, imports, build info), exactly leanrea's strength, and none needs deep decompilation, type reconstruction or data-flow analysis. Others called the claim marketing and asked for worked examples.
• A long reply sided with "partly". One commenter wrote an extended breakdown concluding that the claim holds for lower overhead but not for "does what REA does", noting that leanrea is a routing table with no evidence ledger or Ghidra and IDA orchestration, and that it is a distillation of REA's own knowledge. That is a commenter's opinion, not a verified analysis, but it matches the README's own caveats.
• Secondary coverage is thin. MindStudio published two explainers that restate the README's figures; they are not independent tests. We found no independent replication yet.

FAQ#

What is leanrea?#

An MIT-licensed, 8 KB agent skill from the aicodeking GitHub account that routes reverse-engineering tasks to standard command-line tools instead of an MCP server.

Is leanrea better than REA?#

On the author's four CLI-friendly tasks it was faster and cheaper at near-equal accuracy. REA scored 75/75 to leanrea's 74/75, and the Ghidra, Hopper and jadx paths were not tested, so "better" depends on your target.

Does leanrea need an MCP server?#

No. It adds no tools; the agent uses its normal shell.

Continue Reading#

• Reverse Engineer Anything (REA): What the MCP Server Does and Where the Line Is - the original guide to REA and its legal limits
• MCP Servers vs Agent Skills: Which to Build in 2026 - the five-question framework behind this choice
• Skills Over MCP: Progressive Disclosure - how to keep tool definitions out of context
• The Agent Security Checklist I Use Before Connecting Tools - decide before an agent gets access
• Best MCP Servers in 2026 - the shortlist

Sources#

• leanrea (GitHub README) - primary source for every leanrea figure; vendor-reported
• REA (GitHub README) - the project leanrea compares against
• REA DISCLAIMER.md - intended and unsupported uses
• AICodeKing launch video and comments - community reaction
• MindStudio: Lean REA explainer and install guide - secondary coverage