Use REA to Trace an Electron Search Request with Source Evidence
Analyze the included Desk Notes artifact, connect renderer and main-process evidence, and read the original JSON before configuring an MCP connection.
Fastest way
Ask your AI to do it
Paste this into the AI agent you already use:
Use the pinned REA 6.4.0 workflow to statically analyze the included Desk Notes fixture. Build a new evidence notebook, verify its input and delivery hashes, and trace notes:search through source locations and original nodes. Separate observed source facts, inferred IPC pairing and unexamined runtime behavior. Do not execute the target, change MCP configuration, install a commercial engine or call a paid API. Explain optional setup only after the first result.
What does the REA skill do, and what is included?
REA — Reverse Engineer Anything by morluto is an MIT-licensed workflow for investigating packaged software with source-located evidence. This Skillrove snapshot preserves the official rea-agents 6.4.0 skill and six reference guides. It adds a fictional Desk Notes practice artifact and a helper that produces a browsable evidence notebook. Platform version 1.0.0 names the distribution snapshot; the runtime is separately installed.
For a first result, use the included static JavaScript/Electron example. It needs no model key or commercial decompiler and never launches the target app. Installing the skill ZIP does not register MCP tools. Try the command-line example first; configure your agent only when you need the tool connection.
Build a real evidence notebook from the supplied fixture
Download through a verified free Skillrove account and read SKILL.md plus SKILLROVE-SETUP.md. Use Node.js 22.19+ in the 22.x line, 24.11+ in 24.x, or 26+, with npm. Run the helper from the complete installed directory. It downloads the pinned official npm runtime when needed, statically reads examples/desk-notes and creates a new delivery directory. Python only serves the result on loopback.
- Open http://127.0.0.1:8080/. Select IPC & bridge, search preload.cjs and expand an original evidence node.
- Keep analysis.json, input-manifest.json, index.html and delivery-manifest.json together. Check that input hashes match the fixture and delivery hashes match the three listed result files.
- Use a new output directory on every run. Stop the local preview with Ctrl+C. No agent configuration change is needed for this first result.
Inspect the published Desk Notes evidence notebook
node scripts/analyze-example.mjs --output ./sample-rea
python3 -m http.server 8080 --bind 127.0.0.1 --directory sample-reaTrace notes:search through four source locations
Use the notebook’s source path, range and original node to support each statement. The bundled practice reports six relevant files, four parsed JavaScript files, zero parse failures, one literal IPC channel and one main handler. Those counts describe this fixture. They do not establish that the same path is reachable in a running production app.
Treat renderer-to-handler pairing as a static inference based on recorded channel evidence. Separate it from a runtime observation. The notebook is not an Electron execution, a security verdict or proof of complete application coverage.
| Location | Source behavior |
|---|---|
| renderer.js | Calls the exposed window.deskNotes.search API with the search input |
| preload.cjs | Exposes deskNotes through contextBridge and invokes notes:search |
| main.cjs | Registers the notes:search handler and delegates to searchNotes |
| notes.cjs | Validates a text query and performs case-insensitive matching over fixture notes |
Preview MCP setup before changing agent configuration
The optional dry-run below reports proposed Codex configuration paths, replacements and backups. It is separate from the sample builder. Review the proposal before applying interactive setup, then restart the agent and confirm that REA tools are visible. Claude Code uses claude_code and Cursor uses cursor as the client identifier. Setup may replace the curated skill folder; preserve your practice project separately.
npx rea-agents@6.4.0 setup --client codex --dry-run --jsonMove from the fixture to one authorized investigation
Provide an absolute path to software you own or are authorized to inspect, one concrete question and whether runtime observation is allowed. Start with a bounded static question such as which source locations implement a particular IPC request. Preserve source hashes and the tool version so a later result can be compared with the same inputs.
Record observed facts, inferred relationships, unexamined code and required next checks separately. Native decompilation needs the corresponding external engine and was not exercised by this JavaScript example. Review which evidence may be sent to your model provider; the free package does not include model usage or commercial tooling.
Compare a skill with its separate MCP tool connection
Turn an observed defect into a reproducible before/after check