On Friday, “REA — Reverse Engineer Anything” sat on the front page of Hacker News at 580 points and 253 comments, and the thread was the usual split: half arguing decompilation is fair use, half arguing it’s theft, none of it asking the question that matters. REA is an open-source, MIT-licensed MCP server and CLI toolkit — github.com/morluto/rea, runs locally — that wires reverse-engineering tools into Claude, Codex, Cursor, and Gemini CLI. Decompile native binaries. Trace execution. Recreate a feature for your own stack. A walkthrough posted Friday was titled, without irony, “Reverse Engineering is Officially Automated.”

The copyright fight is a decade old and will not be settled this weekend. What changed is narrower, more useful, and not a legal question at all.

Anti-Circumvention Was Enforced by Inconvenience

Nobody who has shipped software for a living believes the “you may not reverse engineer” clause in a EULA is doing the work. It never was. 17 U.S.C. §1201 makes circumventing technical protection measures a separate offense, the Librarian of Congress convenes a triennial rulemaking to carve out exemptions, and litigation under it is rare, expensive, and awkward to aim at a person who merely reads a file. Your competitor didn’t clone your feature because of the clause. Your competitor didn’t clone it because cloning it cost three weeks of a scarce specialist’s calendar and a very bad time with a disassembler.

That input just got repriced. Not to zero — what’s on offer this weekend is demo videos and a leaderboard published by the people promoting the idea, which is not the same as a number from someone with no stake. But the direction is unmistakable: from a month of a specialist to an afternoon of agent time, plus whatever review you insist on. That is the entire difference between a moat and an annoyance.

The Firms Screaming Loudest Argued the Opposite for a Decade

Here is where the property-rights caucus should wince. The loudest objections to REA will come from large vendors who spent years insisting that training models on public code is transformative, that scraped repositories are fair game, and that anyone demanding permission is a Luddite. They will now discover that a principle consistently applied is expensive. That’s fine by me. But it means the industry’s organizing principle was never intellectual property. It was moat preservation, dressed up as principle when convenient and discarded when not. If you actually believe in property, you enforce it like property — with contracts, trade-secret discipline, shipping cadence — not with a sentence in a license that nobody reads and no one has ever litigated at scale.

The Casualty Is Not Oracle. It’s the Forty-Person Shop.

Oracle and Adobe now have the same tool you do. They have more binaries, more lawyers, and more to gain. The losers are the companies whose entire differentiator is one undocumented integration into a legacy controller, sold on an annual maintenance contract. On the loading dock of a machine shop outside Dayton, the owner of a small controls-software firm put it plainly: “Our moat was that nobody wanted to spend a year reading that controller’s firmware. That’s a prompt now.”

He’s right, and his company has perhaps two years to become something other than the custodian of a binary nobody else could parse. The same applies across the long tail of industrial, medical, and laboratory software, where the source code is a rumor and the binary is the product. That is a real transfer of wealth, and it requires no one to break a law.

The Property You Can Actually Defend

Two institutions should be nervous for the same reason. Coordinated vulnerability disclosure runs on the premise that reading binaries is slow and that first-finder credit is worth something; when triage is automated at scale, “first” becomes an auction between pipelines, and the 90-day disclosure norm gets harder to maintain. License compliance runs the other way — auditing a shipped binary for a GPL violation gets dramatically cheaper, which is excellent news for the Software Freedom Conservancy and unpleasant for anyone who assumed nobody would ever check. Both are prior updates nobody scheduled.

The correct response to REA is not another round of §1201 lobbying. It’s a confession. For twenty years, software companies told themselves they held property when what they held was a head start — and for twenty years, their own engineers told them the head start was the asset. The engineers were right. Friday’s thread is just the head start getting a clock on it.

Sources

REA is an open-source toolkit that plugs reverse engineering into your AI agent through MCP and the CLI.

Ships with: • Decompile apps and native binaries • Trace execution and keep the evidence • Recreate a feature for your own stack • Works with Claude, Codex, Cursor, and Gemini CLI • MIT licensed. Runs locally

No source required. The agent reads the binary.

👉 https://github.com/morluto/rea | Marco Kazandjieff](https://www.facebook.com/100090263898034/videos/-reverse-engineer-any-app-then-hand-it-to-your-agentrea-is-an-open-source-toolki/974968245649544)