Adobe and Microsoft Office just got cloned for free. The 325,000-star repo behind the trend is Kenya's turn next

Reverse engineering used to be a niche skill: a few specialists reading assembly to find malware or crack copy protection. AI agents have changed the economics. An agent can now open a binary, trace its functions, read the network traffic and explain the result in plain English in minutes, then write a working version of the feature it just studied.

That is good news for developers who build on top of systems they do not control. In Kenya that is most of us: telco gateways, bank integrations, government portals, imported hardware, and desktop software whose vendor disappeared years ago. Knowing how to take a system apart, carefully and legally, is how you stop waiting for documentation that is never coming.

REA is an MCP server: a bridge that lets an AI coding agent run reverse engineering tools on your own machine. The project describes itself as one MCP for reverse engineering across binaries, applications and runtime behaviour. Code written by its authors is MIT-licensed, and it works with Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other MCP clients.

When we checked on 19 October 2026 the repository showed about 325,000 stars, 82,400 forks, 1,200 watchers and 3,737 commits on its main branch. It is one of the fastest-rising projects GitHub has seen.

None of this is new capability. A skilled reverse engineer could always open a binary in Ghidra or an APK in JADX. What REA changes is the cost. It puts a dozen tools behind one interface and lets the agent do the slow parts: tracing calls, reading pseudocode, cross-referencing strings and writing up what it found.

1. You ask a question. How does this app validate a licence key? How does this smart plug talk to its cloud? Where does this POS store completed sales?

2. The agent calls REA, which runs the right local tool against the target: a decompiler for a binary, JADX for an APK, TShark for a packet capture.

3. REA returns evidence: code, references, and a list of what it could not resolve. It is designed to report what it does not know rather than guess, which is the right design for a tool whose output you may later have to defend.

4. The agent explains the behaviour, then writes and tests your own version of the feature.

Setup needs Node.js 22.19 or later and one command. It backs up your existing agent configuration before changing anything. Restart your agent afterwards and ask it to investigate something you own.

Do not download a "Reverse Engineer Anything" zip. Because the name went viral, copycat repositories with keyword-stuffed READMEs and zip downloads have appeared. The official project is morluto/rea and installs through npm. A zip from a random fork is exactly how malware reaches developers who are curious about security tools.

The README is also clear about the law. REA is meant for lawful research, education, interoperability, software preservation and software you own or are authorised to examine. Commercial tools such as IDA and JEB must be bought; cracked copies are explicitly not authorised. Analysis runs locally, but whatever the agent reads is sent to your model provider, so client data does not belong in it.

On 3 October 2026, ArtCraft founder Brandon Thomas released seven open-source Rust apps that imitate Adobe Creative Cloud, led by PhotoCraft, a Photoshop replacement. Days later he followed with WordCraft, GridCraft and DeckCraft, replacements for Word, Excel and PowerPoint, and named an AutoCAD clone, CADCraft, as next. He says he built them with Anthropic's Claude (Techstrong.ai, Futurism).

Most of the viral coverage overstates what happened, so it is worth being precise.

Thomas put his thesis bluntly: every closed workflow will fold. Whether or not that is true, one point is hard to argue with. A very small team with an AI model can now rebuild the surface of a billion-dollar product in weeks, so the moat is moving away from code and towards data, distribution, trust and support.

ArtCraft and REA demonstrate two halves of the same skill. ArtCraft shows the rebuild: give an AI a clear picture of what a product does and it will write a working version. REA supplies the understanding: it shows an AI how an existing system works, down to the bytes, so the rebuild is accurate. Combined, they give the workflow serious teams will use from now on:

The skill is neutral. What you point it at is not. We think of it as a ladder, from always fine at the bottom to plainly illegal at the top. Most of the money for Kenyan developers sits on rungs one to three; you do not need to clone Photoshop to make a good living from this.

The best targets are close to home: systems Kenyans use every day that have little documentation, no API or no vendor left. Each play names the target, what to ask your agent, what to ship and the guardrail.

KRA requires businesses to issue invoices through eTIMS, and thousands of shops run point-of-sale software whose vendor has closed or stopped updating it. The owner's sales history sits in a local database nobody can read, and the till cannot talk to KRA. Our guide to KRA eTIMS for online stores covers the KRA side.

Ask your agent to map where sales and line items are stored and how VAT is calculated, as a specification. Then ship a small bridge service that reads new sales and submits them through KRA's official eTIMS integration, so the shop keeps its old till.

Guardrail: the business that holds the software licence must agree in writing. You are only reverse engineering the old software to get the owner's own data out, which is the interoperability case the Copyright Act protects.

Many SACCOs, schools and clinics run Windows desktop systems written in VB6 or .NET a decade ago. The developer has moved on and there is no export button. REA's .NET analysis and SQLite readers can map how records are stored and how the business rules work.

Ask your agent to decompile the assembly and document how members, loans and repayments are stored and how interest is computed, as rules rather than code. Then build a modern web system with a tested migration script, and check the re-implemented interest rules against real member statements before anyone switches over.

Guardrail: the client must own the data and the right to use the software. Member and patient records fall under the Data Protection Act, so keep them on the client's machine and never paste them into an AI chat.

Dairy co-operatives weigh milk on digital scales that print a slip and keep nothing, and farmers dispute the numbers. Most of these scales send every reading out of a serial or Bluetooth port that nobody uses.

Capture the port with a cheap USB logic analyser and sigrok, then ask your agent to decode the baud rate and message format and explain each field. Ship an Android app that records each delivery against the farmer's number and sends an SMS receipt, priced per co-operative.

Guardrail: you are reading signals from hardware the co-operative owns. Do not touch calibration, which is a weights and measures matter.

Fleet owners buy low-cost imported GPS trackers that report to a foreign app with a monthly fee. Many of these devices speak well-known protocols such as GT06.

Give your agent a packet capture of the tracker talking to its server and ask it to identify the login, location and heartbeat packets, comparing them with the open-source Traccar decoders. Ship a locally hosted tracking dashboard with M-Pesa subscription billing and fuel and route reports for boda and matatu SACCOs. Our M-Pesa STK Push guide covers the billing side.

Guardrail: only re-point devices your customer owns, and start from open-source projects like Traccar before writing a decoder from scratch.

Digital lenders have a history of harvesting borrowers' contacts and using them to shame people into paying. In September 2023 the Office of the Data Protection Commissioner fined Mulla Pride, which runs the KeCredit and Faircash apps, KES 2.975 million for exactly this (NTV Kenya). Decompiling an APK shows which permissions an app uses, which tracking SDKs it ships and where the data goes.

Ask your agent to decompile the APK with JADX through REA and list every permission, third-party SDK and network endpoint, showing where contacts, SMS or location are read. Then publish the research, build a privacy scorecard for popular Kenyan apps, or send findings to the company and the ODPC.

Guardrail: work on the app as installed on your own phone, with your own data. Do not probe the company's servers, and do not publish anything exploitable before it has had a reasonable time to fix the problem.

Cheap DVRs, Wi-Fi cameras and smart plugs fill Kenyan shops and homes. Many ship with default passwords and report to servers abroad.

Ask your agent to unpack the firmware with Binwalk and Unblob and find default credentials, open services and cloud endpoints. Then sell a hardening service to SMEs: change the defaults, block the cloud calls and set up local recording.

Guardrail: your devices, or a client's with consent. Scanning other people's cameras on the internet is an offence under the Computer Misuse and Cybercrimes Act.

Your product wants the instant search of a big notes app or the offline sync of a global messaging app, tuned for patchy 3G and expensive bundles.

Ask your agent to observe how the app behaves offline and back online and describe the sync strategy as a specification, with no code. Then, in a fresh session that sees only the specification, ask it to implement that for your own app.

Guardrail: keep the specification and the implementation separate, and keep the specification. That paper trail is your clean-room defence if anyone ever asks.

Agents make reverse engineering faster, but they do not replace knowing what you are looking at. If you cannot read the pseudocode REA hands back, you cannot tell when the agent is wrong. Learn the fundamentals by hand, then let the agent take over the slow parts.

The whole toolkit is free: Ghidra for native binaries, JADX and Apktool for Android, Wireshark for network traffic, mitmproxy for an app's HTTPS calls on a test phone you own, Binwalk and Unblob for firmware, and sigrok with a cheap USB logic analyser for hardware. An old Android phone you can reset and a laptop with 8 GB of RAM complete the lab.

Practise with others. picoCTF and crackmes.one cover reversing, pwn.college goes deeper, and AfricaHackOn, OWASP Nairobi and BSides Nairobi bring the local community together. A public repository that clearly explains how you decoded one protocol is a stronger CV than a certificate.

Kenya's Copyright Act expressly allows decompiling a program to make it work with other programs. Section 26A(3), added by the Copyright (Amendment) Act 2019, means you do not need the rights holder's permission to decompile software for the information needed for interoperability (CIPIT, Strathmore University). Section 26A(2) also lets a lawful owner copy software to correct errors, test it or keep a backup.

Five rules keep you on the right side: own it or get permission in writing; analyse locally, never the company's servers; never publish someone else's code; keep personal data out of AI chats; and disclose vulnerabilities privately, giving the company time to fix them (90 days is a common norm) before involving the ODPC or the National KE-CIRT/CC.

This is not legal advice. If a project touches a large company's product or real customer data, an hour with an IP or technology lawyer is cheap insurance.

The ArtCraft story is not really about Adobe. It shows that a small team with AI can rebuild the surface of almost any software in weeks. REA's star count shows that developers everywhere want the other half: the ability to understand any system they are handed.

Kenya has a particular advantage. Our economy runs on systems that were never documented for us. The developer who can open those systems, explain them and build a clean bridge to them will not run out of work. Start this week: install Ghidra and JADX, open an app you built yourself, run REA against it, then pick one play from this guide and find one real business that has the problem. If you would rather have us build the bridge, see our custom software development service.