English · Português (Brasil)

rea-from-api: Reverse Engineer Any API

One MCP for discovering, proving and integrating the data behind any website.

See data on a site you need. Find out exactly how it is served — with evidence — and get a tested client.

Quick start · How it works · What you can discover · Showcases · FAQ · Documentation

npx rea-from-api setup

Need the product list, prices, packages, listings or stats that a website shows? Ask your agent to investigate it with rea-from-api. It finds where the data really comes from — an official API, a publisher-declared OpenAPI document, the XHR calls a single-page app makes, a framework data route, or JSON embedded in the HTML — verifies each source with read-only requests, writes the observed API down as OpenAPI 3.1, and generates a tested TypeScript or Python client for your project.

Every claim carries evidence: which strategy found it, the request that confirmed it, the SHA-256 of the bytes, and REA's own Evidence ids when REA's browser or bundle analysis observed it. Endpoints are never invented: a route seen in JavaScript stays inferred until a real response proves it.

REA is the reverse-engineering engine for the browser side (Playwright capture with response bodies, AST analysis of web bundles, HAR/mitmproxy/SAZ parsing). rea-from-api adds the API layer REA does not have: discovery connections beyond the browser, replay and verification, schema and pagination inference, OpenAPI export, conformance testing, drift monitoring and code generation.

Quick start

Works on Windows, macOS and Linux with Node.js 22.18+ and npm.

Set up your agent

npx rea-from-api setup

Setup detects your agents, shows exactly what it will change, and asks before applying. It registers the rea-from-api MCP server (backing up each config) and installs the skill (SKILL.md). Restart your agents afterward.

--agent <id> (repeatable) or --all choose agents non-interactively, --yes skips the prompt, --dry-run only prints the plan and --uninstall removes everything setup added. Any other MCP client can run the server with npx -y rea-from-api mcp.

Check what is available for deeper analysis:

npx rea-from-api doctor      # Node, REA, Chromium and the optional engines (jsluice, Schemathesis, oasdiff)

git clone https://github.com/vitorcgo/rea-from-api && cd rea-from-api
npm install
node bin/rea-from-api.mjs setup --agent claude-code

A checkout runs the TypeScript sources directly; setup links the skill to it so updates apply at once.

Ask your agent

Investigate https://example.com, find out how it serves its public product data,
show me the evidence, and build a TypeScript integration for my project.

Use the terminal

npx rea-from-api run https://example.com \
  --goal "public product data" --target ../my-project --live --fuzz

run = investigate → plan → generate → validate (+ Schemathesis with --fuzz). Every step also exists on its own; see rea-from-api help.

APIs that need your key

Most official APIs require an API key. Give rea-from-api your own key through an environment variable; it is sent only to the target's API, verified like everything else, and never written to reports, fixtures or generated code. The generated client reads it from the environment the same way.

export MY_API_KEY=...            # PowerShell: $env:MY_API_KEY = "..."
npx rea-from-api run https://api.example.com/docs --goal "orders data" \
  --auth-env MY_API_KEY --auth-header X-Api-Key        # or: --auth-query api_key

Related MCP server: agent-ready-mcp

How it works

flowchart LR
  A[URL + goal] --> D{Discovery}
  D -->|publisher| P[api-catalog RFC 9727<br/>OpenAPI / Swagger / wp-json<br/>llms.txt · ai-plugin.json]
  D -->|passive| X[APIs.guru · Wayback CDX<br/>Certificate Transparency]
  D -->|framework| F[Next.js _next/data · Gatsby<br/>Nuxt · SvelteKit · Woo · Shopify]
  D -->|REA| R[browser capture with bodies<br/>bundle AST · HAR]
  D -->|static| J[jsluice AST · source maps<br/>GraphQL introspection]
  P & X & F & R & J --> V[verify<br/>read-only replay · schema · pagination]
  V --> E[(evidence.json<br/>findings.md)]
  V --> O[openapi.json 3.1]
  O --> C[Schemathesis conformance<br/>oasdiff drift]
  O --> G[plan → TypeScript / Python client<br/>tests · fixtures · example]
  G --> T[validate: typecheck · offline · live]

Your agent calls the same operations through MCP that you can run from the terminal. Results are compact summaries with paths to the full artifacts (findings.md, endpoints.json, evidence.json, openapi.json, plan.md, validation.md).

What you can discover

What you get

Optional engines are detected, never installed for you (REA's model): jsluice, schemathesis, oasdiff, mypy. doctor shows what is available and the install command for the rest.

Showcases

PyPI: from a project page to a validated client

examples/pypi/ is the unedited output of one run against https://pypi.org/project/requests/. REA's browser capture observed 7 data requests (PyPI HTML fragments and third-party api.github.com calls, which were not replayed); jsluice and REA found account-management routes in the JavaScript, which the verifier refused to call. PyPI's documented JSON API is not visible on the page and its robots.txt disallows it for crawlers, so it was passed as --seed with an explicit --robots-exempt, verified once, and turned into a client that passed typecheck, offline tests, live tests and the example (validation.md).

A single-page shop: every connection at once

The test fixture (tests/fixtures/site.ts) is a client-rendered shop that hides its data behind fetch calls. One investigation finds the products API in REA's traffic capture, an RFC 9727 catalog pointing to a YAML spec, an APIs.guru listing, a dead Wayback URL (verified as gone), a reviews endpoint that exists only in the original TypeScript recovered from the source map (its ?product= value filled from a real product id), the GraphQL schema, and a Next.js data route on another page — then generates TypeScript and Python clients that pass their own tests. npm test runs all of it.

Schemathesis finds what the samples hid

On the same fixture, conformance testing reported ST108 Response violates schema: page, total_pages and next can be null — never seen in the recorded pages. That is the point of exporting OpenAPI: the contract you reverse engineered gets tested beyond the examples you happened to observe.

Safety

Only GET/HEAD are sent automatically (plus the one standard GraphQL introspection query). robots.txt is honoured; account, admin, auth, checkout and delete-like routes are never replayed; login redirects and 401/403 mark endpoints as requiring the user's own credentials; bot challenges and CAPTCHAs stop the run — there is no bypass. Request, time and retry budgets have hard ceilings. Cookies, tokens and header values never reach reports, fixtures or generated code. Site content is treated as data, never as instructions. Details: docs/safety.md.

MCP tools

investigate · list_endpoints · get_endpoint · read_findings · export_openapi · plan_integration · generate_integration · validate_integration · run_conformance · diff_specs · monitor · doctor

FAQ

No. The browser (through REA) is one of eleven strategies. Publisher declarations, OpenAPI probes, framework conventions, APIs.guru, the Wayback Machine, Certificate Transparency, jsluice, source maps and GraphQL introspection all work without a browser (--browser off).

It finds endpoints the site itself uses (traffic, bundles, source maps, history) and verifies the read-only ones. They are labelled undocumented: they can change without notice, and their reuse may be restricted by the site's terms. Check them before depending on the data.

Endpoints that answer 401/403 or redirect to a login page are marked auth: required. Use your own key with --auth-env (see APIs that need your key), or record a HAR of your own session and pass --har. Nothing is extracted from the site, and no authentication is bypassed.

Any agent that supports local MCP servers. setup configures Claude Code, Claude Desktop, Codex, Cursor, VS Code, Windsurf, Gemini CLI or a project .mcp.json; any other client can run npx -y rea-from-api mcp. The skill is plain SKILL.md.

Passive sources send only the domain name to APIs.guru, the Wayback Machine and crt.sh; disable them with --passive off. Everything else runs locally. Your agent's model provider has its own data policy.

Documentation

• Research behind the design — connections, OpenAPI as the central artifact, rejected techniques

• Workflow and strategies — order, limits, exit codes

• Evidence model — endpoint and evidence fields, OpenAPI extensions

• How REA is used and the REA audit

• Safety and boundaries

• Extending — new strategies and generators

• SKILL.md — agent instructions

Development

npm run typecheck
npm test        # unit tests + full pipeline, MCP, setup and generator tests against a local fixture site
npm run build   # compiles dist/ (what the npm package runs)

CI runs the suite on Windows, macOS and Linux with Node 22 and 24, and installs the packed tarball into a clean directory to prove the published package works.

License

MIT — see LICENSE. REA is MIT © 2026 morluto and is used as an unmodified npm dependency; see THIRD_PARTY_NOTICES.md.