See how an app is put together.
Give REA for Web an app and it maps how it’s built: an Electron app’s processes, preload bridges and IPC channels; a Windows or Linux program’s functions and calls into external code; an Android app’s components, permissions and code. Each part comes with REA’s evidence. Uploaded apps are read, never run.
Map your own appAnalyze it on your own machine with the free CLI, then open the result here. Nothing is uploaded.
- Reads
- Electron apps (
.asaror a folder), Windows programs (.exe,.dll: .NET or native), Linux programs (.elf,.so), Android apps (.apk) and, on your own machine, websites by URL - Shows
- A graph of the app, with the evidence behind every part
- Ask
- Questions in plain English: a free tier where available (an open model, limited per day), your own Claude key for better answers, or from Claude by adding
/api/mcpas an MCP connector (how) - Engine
- REA 6.4.0, static analysis
Loading Tiny Electron sample…
This is the explorer itself, running on REA’s output for Tiny Electron sample. Click a part to see its evidence; double-click to see what it connects to.
How to read the map
Static analysis finds a lot and misses some. The drawing always shows how REA knows what it shows.
| Links | |
|---|---|
| Observed. REA saw this relationship directly in the code. | |
| Inferred. REA reasoned it from indirect evidence. | |
| IPC. A message that crosses from one process to another. | |
| Studio heuristic. REA for Web’s own guess on top of REA’s findings. Always labeled as such. | |
| Parts | |
|---|---|
| Runtime. Processes, windows and workers. | |
| Boundaries. Preload bridges and IPC: where web content reaches into the app. | |
| System access. Native add-ons, local storage, network endpoint candidates. | |
| Code. Shipped files, modules and source files recovered from source maps. | |
| Analysis gap. A file REA couldn’t fully read. “Not found” never means “doesn’t exist.” | |
Demos
Real REA output from open-source apps, and a small sample app with a known answer key.
| App | Parts | Links | Analysis | |
|---|---|---|---|---|
| Tiny Electron sample A 7-file hand-written app with a known answer key. | 28 | 58 | Complete | |
| GitHub Desktop A real, webpack-bundled Electron app (open source, MIT). | 910 | 1,623 | Partial | |
| VS Code (core) VS Code 1.141’s main process and preload scripts: windows, contextBridge APIs, named IPC channels. | 137 | 292 | Partial | |
| This website REA for Web’s own landing page, captured in a headless browser: its scripts, the frameworks they use and endpoint candidates. | 89 | 96 | Complete | |
| Tiny .NET sample A hand-written C# program: types, methods, its call graph and three calls into native code. | 43 | 53 | Partial | |
| Tiny Windows .exe A hand-written C program read with Ghidra: its functions, the Windows APIs each one calls, a URL, a file and a registry key. | 96 | 136 | Complete | |
| Tiny Linux program The same idea as a Linux ELF, read with Ghidra: its functions, the C library calls each one makes, a URL and two files. | 33 | 39 | Complete | |
| Tiny Android app A hand-written APK read with JADX: its activity, service, receiver and provider, permissions, and the WebView’s JavaScript bridge. | 32 | 40 | Partial | |
| Caprine (Electron) An open-source Messenger desktop app: its main, preload and renderer processes, the window and the IPC channels between them. | 771 | 987 | Partial | |
| jq (Windows .exe) The popular JSON command-line tool, read with Ghidra: about 900 functions and the Windows APIs they call. Release builds are stripped, so most functions have Ghidra’s generic names. | 1,121 | 4,999 | Complete | |
| Binary Eye (Android) An open-source barcode scanner from F-Droid, read with JADX: its 18 components, 11 permissions and readable classes. Most classes appear under defpackage and are left out of this map. | 215 | 232 | Partial | |
| Your own appAnalyze it on your computer with one command, then open the result here. Nothing is uploaded. | ||||