aicodeking / leanrea

# leanrea
**One 8 KB skill file that does what REA does: no MCP server, no 207 tools, no setup.**
REA (Reverse Engineer Anything) puts an MCP layer between your agent and tools it can already use: asar, otool, nm, `go version -m`, jadx, apktool, Ghidra, tshark, binwalk, sqlite3. leanrea drops that layer. It tells the agent which command is fastest for each kind of target, gives it ready-to-paste recon commands, and lists the traps that REA's code handles for you. The agent then runs the real tools itself.
| | REA 6.5.0 | leanrea |
|---|---|---|
| What gets installed | 25 MB npm package + MCP server | one `SKILL.md` |
| Instructions | 23.5 KB skill + 48.8 KB references | 8 KB |
| Tools added to the agent | 207 (3.35 MB of definitions) | 0 (uses Bash) |
| Context for "Reply OK", all tools loaded | 400.7k tokens, $1.60 | 34.5k tokens, $0.09 |
## Benchmark
Claude Code headless (`claude -p`), Sonnet 5.5, macOS arm64. 4 reverse-engineering tasks × 3 reps × 3 arms, with the arms run side by side. Answers are graded against hand-made keys.
| arm | total wall time | cost | turns | tokens | score |
|---|---|---|---|---|---|
| **leanrea** | **388 s** | **$2.17** | **55** | **2.40 M** | 74/75 |
| no skill | 479 s | $2.21 | 81 | 3.11 M | 67/75 (one refusal) |
| REA (MCP + its skill) | 627 s | $3.36 | 124 | 5.93 M | 75/75 |
Against REA, leanrea had **38% less wall time, 35% lower cost, 56% fewer turns and 60% fewer tokens, at the same accuracy**. Its one partial miss named an older IPC channel instead of the v2 one (both channels exist).
The tasks:
- **electron**: trace a feature through a real Electron app's app.asar (native function → main-process class → IPC channels).
- **native**: inventory the exports, a TCC permission check and the single-instance lock of that app's native addon (`.node`).
- **go**: toolchain and dependency versions of a stripped `gh` binary.
- **deep**: from disassembly alone, the exact socket path format, wire protocol and peer authentication of that lock.
The same operation run through REA's CLI vs the raw command:
| operation | REA | raw |
|---|---|---|
| Go build info | 0.56 s | `go version -m`: 0.06 s |
| Mach-O overview | 3.32 s | otool + dyld_info + nm: 0.04 s |
| Electron app analysis (real desktop app) | fails on asar integrity until you pass a flag, then **47.9 s and 140 MB of JSON** | asar extract + `rg -uu`: 4.8 s, 24 KB |
Full tables, the context-overhead runs and caveats: bench/BENCHMARK.md. Raw per-run metrics: bench/results/final.jsonl.
**Caveats:**
- Only 3 reps per cell, one model, one machine.
- REA was tested in its best case: Claude Code's deferred tool search loads MCP tools on demand. Agents that load every tool pay the 400k-token row.
- Ghidra, Hopper and jadx weren't installed, so the native tasks ran on Xcode tools for both arms.
- The plain model is already good at this. leanrea's gain over no skill (about 19% faster, 32% fewer turns) is smaller than its gain over REA.
## Install
 [code] 
This uses the skills