Anti-REA: Harden apps against AI reverse engineering

Assess software exposure to AI reverse engineering, apply compatible defenses, and measure the results. Anti-REA helps teams compare release artifacts before and after changes using REA (reverse-engineering agent) analysis and behavior checks.

Use it with an AI assistant through the portable Skill or MCP server, or run the same workflows from the terminal. Anti-REA shows applicable options and trade-offs before execution, keeps the original project intact, and reports evidence from the candidate.

Try it with an AI assistant

With the Anti-REA Skill or MCP server available to your assistant, try:

Inspect this app with Anti-REA. Show me what the release exposes, the compatible hardening options, and their trade-offs. Ask me to choose before making changes. Then verify the selected candidate against the same baseline and report the results.

Anti-REA presents evidence-backed options before execution and waits for the user's plan-bound choice. Available actions depend on the target and the adapters that can verify it.

See example results

These examples show specific workflow results. They do not prove that an app is protected from all reverse engineering.

How Anti-REA works

1. Inspect the target and capture a BEFORE release baseline.
2. Present compatible defenses, expected benefits, trade-offs, and verification requirements.
3. Wait for the user to choose actions in a plan bound to its exact hash.
4. Apply the selected actions to an isolated candidate.
5. Compare the candidate with the unchanged baseline. Accept only if required checks pass; otherwise reject and retain rollback evidence.

Reports show artifact identities, check results, and candidate outcomes. A successful build alone is not evidence of protection.

What Anti-REA does

The repository currently includes selected adapters for JavaScript, Flutter Android, WebAssembly, browser behavior, and Python dependency workflows. This is today's implementation set, not the limit of the product's intended platform coverage. See the adapter guide and acceptance audit for exact status and open blockers.

Set up

Install the portable Skill in an application project with the standard community installer:

npx skills add tamkimd/anti-rea --skill anti-rea

Choose your agent and installation scope when prompted. See harness setup for Codex, MCP, and other host options. To use Anti-REA directly from the terminal, install Python 3.11 or newer and the published PyPI package:

python3 -m venv .venv
. .venv/bin/activate
python -m pip install anti-rea
anti-rea doctor

Then inspect a project without executing it:

anti-rea inspect /path/to/project

Start the MCP server with anti-rea mcp serve. Set ANTI_REA_STATE_DIR to keep local workflow records outside the target project. See CLI usage for commands and options.

Security and limitations

• Anti-REA keeps source and candidate files separate, but a private copy is not automatically a security sandbox.
• Supported Node and pinned REA/BLA lanes use the configured Docker profile by default. The Docker daemon is trusted, and staged output has no live disk quota.
• Host-run commands and project-provided browser tests may execute with the user's privileges. Run workflows only for projects and dependencies you trust.
• Keep state, raw reports, release artifacts, debug symbols, screenshots, caches, and secrets outside the source checkout.
• Blind LLM Agents (BLA) defenses and obfuscation can increase analysis effort; neither encrypts client code or prevents determined reverse engineering.

See execution boundaries, the release workflow, and the acceptance audit.

Development

python -m unittest discover -s tests -p 'test_*.py'
python -m pip install -e '.[dev]'
ruff format --check .
ruff check .

More

• Optimization workflow
• Flutter obfuscation workflow
• Upstream tools and dependency limits
• Harness setup · compatibility matrix
• Examples: Foodie · Simple To-Do List · Loopweek · Flutter Todo · TodoMVC React