How to connect REA to Claude Code in a separate profile to analyze how apps work

REA (Reverse Engineer Anything) is an MCP server that lets your agent look inside apps without their source code. It analyzes native binaries, JavaScript and Electron apps, .NET assemblies and websites, and shows how a feature works along with the evidence. One setup command connects it to Claude Code.

1. Preview the changes first. --dry-run returns the plan without writing any files.

npx rea-agents setup --client claude_code --dry-run

1. If the plan looks right, run it again without --dry-run, approve it, and restart Claude Code.

npx rea-agents setup --client claude_code

This registers mcpServers.rea in ~/.claude.json and installs a skill under ~/.claude/skills, so every project can call REA. To use it only for analysis, give it its own profile with CLAUDE_CONFIG_DIR.

CLAUDE_CONFIG_DIR=~/.claude-rea npx rea-agents setup --client claude_code
CLAUDE_CONFIG_DIR=~/.claude-rea claude

A new profile may need you to sign in again. Use the same prefix when checking the registration.

CLAUDE_CONFIG_DIR=~/.claude-rea npx rea-agents doctor --client claude_code --skill --json

1. Ask Claude something like this.

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Static analysis of JavaScript and Electron apps needs no extra engine; native binaries need Hopper, Ghidra or IDA. Installing Hopper during setup requires its own approval.

A post on X with over 800 likes pitched this as rebuilding features clean-room without copying a line of code. REA's docs say a separate profile only controls which sessions discover REA; it is not clean-room separation. An agent under the same OS account can still run rea from the shell or read the analysis output, so use a separate account or container for real separation. Before analyzing someone else's app, check its license and terms of use.