# REA in Claude Code: an isolated static-analysis A/B trial > A Japanese field report connects REA 6.4.0 to Claude Code in a separate project directory, denies 43 of its 170 tools and common shell launch forms, and compares REA-enabled and REA-disabled runs on two real tasks: an Electron terminal’s packaged files and a saved HAR capture. Both arms answered correctly, while the REA arm took up to 2.00× the time and 1.67× the API-equivalent cost. It is an analysis-evaluation and safety-configuration case, not a reconstruction. - Type: Case study - Targets: App · Website - Category: Community REA investigations - Relationship: Author-reported mixed workflow - Sources reviewed: 2026-10-18 - Added to the catalog: 2026-10-18 - Original resource: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/rea-claude-code-isolated-ab-case/index.md) ## Requirements & limits - **Scope:** The article by keigoly was published on Zenn on 2026-10-14 (JST). It pins REA 6.4.0 from the rea-agents package and runs it with a checksum-verified official Node.js 24.21.0 placed inside the project, because the host’s Homebrew Node 25.8.1 is outside REA’s supported range. All trials used non-interactive claude -p with Claude Opus 5.5 and permission prompts bypassed; the Claude Code version is not stated. - **Limits:** Isolation is configuration, not a sandbox: REA is enabled only through a project-local .mcp.json, a generated deny list blocks 43 tools selected from effect metadata, and Bash prefix rules block common package-runner launches. The author states that deny rules are a fence rather than isolation, that other invocation forms bypass the prefix rules, and that prompt injection through analysis output was not tested. - **Scope:** The tasks were MIT-licensed Orca terminal v1.4.224 (128 MB of distributed Electron files) and a 2.5 MB HAR from an unnamed venue website; answers were checked against Orca’s public source and the HAR data. The author excluded DRM or license circumvention, online multiplayer games, business or customer data and malware from scope. - **Limits:** Each condition ran once (n=1), the REA arm was told to prefer REA tools, parallel processes make timings approximate, and only static JavaScript/web work with one model was tested; an interrupted run was excluded and repeated. One REA analysis result exceeded the 10 MB MCP response limit. Scripts and JSONL logs are excerpted rather than published. - **Attribution:** The author reports that REA helped with extraction, such as asar unpacking and HAR element extraction, while grep and small scripts carried code reading in both arms. Nothing was reconstructed: the HAR task identified an existing request path. Native binaries and APKs are deferred to a planned second step; Orca, the venue site, REA and the model service keep their own terms. ## Primary sources 1. ## More in Websites - [Dinosaur runner: an REA-inspected speed rule rebuilt with Codex](https://awesomerea.org/resources/rea-dino-runner-community-case/index.md) · Case study - [Terminal: a Rust terminal informed by TradingView chart research](https://awesomerea.org/resources/terminal-tradingview-rea-chart-case/index.md) · Case study - [BaoCut Design: porting reconstructed canvas and design-system editors](https://awesomerea.org/resources/baocut-design-canvas-case/index.md) · Case study - [whatsapp-web-reveng: documenting the legacy WhatsApp Web protocol](https://awesomerea.org/resources/whatsapp-web-reveng-legacy-protocol-case/index.md) · Case study - [Ruffle: a Rust reimplementation of Adobe Flash Player](https://awesomerea.org/resources/ruffle-flash-player-case/index.md) · Case study - [Littlebird.ai static home-page rebuild](https://awesomerea.org/resources/littlebird-static-rebuild-case/index.md) · Case study ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.