leanrea

leanrea is an open-source agent skill published by aicodeking under the MIT license. It is a single SKILL.md file that tells a coding agent which command-line tool is fastest for each kind of reverse-engineering target, with ready-to-paste recon commands and a list of common traps. The agent then runs the real tools itself through Bash, with no MCP server.

What It Is

leanrea is a lightweight alternative to REA (Reverse Engineer Anything), an MCP-based toolset. Instead of adding tool definitions to the agent, it supplies a short instruction file covering routing, rules and first-move commands. Tools it points the agent to include asar, otool, nm, go version -m, jadx, apktool, Ghidra, tshark, binwalk and sqlite3. It is not affiliated with REA.

What's in the skill

The rules tell the agent to work on a copy, route by file and magic bytes first, slice minified files instead of reading them, batch probes into one shell call, search extracted trees with rg -uu, and mark each claim as seen, inferred or unknown. A router maps target types to the fastest commands: Electron/asar, minified web bundles and source maps, Hermes/bytenode, Mach-O, ELF/PE, Go buildinfo, Rust, .NET, Android APKs, Flutter, WASM, SQLite, plists, pcap/HAR, firmware, websites and runtime tracing. It also includes one-shot first-move commands for native binaries and Electron apps.

Setup path

Install with the skills CLI via npx skills add aicodeking/leanrea, which can target Claude Code, Codex, Cursor, Gemini CLI, OpenCode and others. Manual install copies the skill folder into ~/.claude/skills, and agents without skills support can use the plain-text SKILL.md as rules or a system prompt. Invoke it with /leanrea followed by a question about a target app.

Benchmark claims

The README reports its own benchmark using Claude Code headless with Sonnet 5.5 on macOS arm64: 4 tasks, 3 reps, 3 arms. It states leanrea used 38% less wall time, 35% lower cost, 56% fewer turns and 60% fewer tokens than REA at similar accuracy (74/75 vs 75/75). The author notes caveats: few reps, one model and one machine, and the plain model without a skill is already strong. Benchmark scripts are included for reproduction.