2026-10-16
Eleven: a visual REA workbench for agents
Eleven is an open-source, agent-first reverse-engineering visual IDE / workbench. It puts code views, AI chat, and change review in one desktop window. It is not a new decompiler engine: analysis still rides engines such as Ghidra, Rizin, and jadx (via the REA stack and Eleven’s own setup). Product site: eleven.chizi.app. Repo: Zfinix/eleven. REA toolbox: morluto/rea. Chinese twin: /zh/blog/eleven-rea-workbench/.
On rea.run the teaching pin for the MCP/CLI layer remains [email protected] (/blog/rea-agents-6-5-0/). If you are new to REA itself, start with /blog/rea-beginner-guide/ and the install demo /docs/install-demo/, then come back here for the GUI workbench path.

Snapshot (re-verified 2026-10-16)
| Item | Value | Source |
|---|---|---|
| Product | eleven.chizi.app | Live site |
| Repository | Zfinix/eleven | GitHub |
| License | Apache-2.0 | GitHub license.spdx_id |
| Version | 0.1.8 | Site install section + release tag v0.1.8 |
| Stars / forks (snapshot) | 503 / 78 | GitHub API 2026-10-16 |
| Platforms | macOS Apple silicon; Windows x64; Linux x64 (Ubuntu 24.04 / Fedora 40+) | Site FAQ |
| Android example | 61 MB debug build → 73,471 methods; reopen ~1 s | Site Android section |
| REA teaching pin (this site) | [email protected] | /blog/rea-agents-6-5-0/ |
Stars move. Re-fetch before you quote. Stars ≠ doctor-green on your box and ≠ permission to analyze arbitrary store binaries (/blog/evaluating-rea-claims/).
What Eleven is (and is not)
| Claim | Operator reading |
|---|---|
| Visual workbench: code + agent + review in one window | Yes |
| New standalone decompiler that replaces Ghidra/Rizin/jadx | No — engines still do the heavy lift |
| Drop-in replacement for REA CLI/MCP | No — complementary GUI; REA remains the tool/MCP layer for many agent hosts |
| Free / open source desktop app | Yes — Apache-2.0 upstream |
| License to reverse any commercial app | No — own / authorized / clean-room only (/compliance/) |
REA CLI/MCP vs Eleven GUI
Operators often ask: “Do I need Eleven if I already run REA?” Use both when the job needs eyes on decompiled text and a human-in-the-loop accept/skip loop; use CLI/MCP alone when you already have a strong agent host and Evidence-first scripts.
| Dimension | REA CLI / MCP (rea-agents) | Eleven GUI workbench |
|---|---|---|
| Primary UX | Terminal + MCP inside Claude Code / Codex / Cursor / … | Desktop window: views + chat + review |
| Role | Toolbox / Evidence layer for agents | Visual IDE around those tools |
| Teaching pin here | npx -y [email protected] | Product v0.1.8 (separate pin) |
| First proof | doctor --json + engine-free JS/Electron job | Open an authorized binary / APK; watch agent steps |
| Views | Agent requests Evidence / dumps | Pseudocode, assembly, CFG, hex in-app |
| Renames / notes | Via MCP tool results | Suggestions you accept or skip; undo |
| Patches | Follow REA / provider rules; never invent cracks | Byte patches → copy in Downloads, not the original |
| Share | Scripts, Evidence JSON/MD | .eleven project (binary + notes + chats) |
| Offline reading | Local analysis once engines are present | Reading / rename / patch / debug offline after first downloads; agent Q&A needs provider |
| Best for | CI, runbooks, headless labs, MCP-native hosts | Interactive teaching, side-by-side review, GUI-first operators |
Install / demo for REA on this site: /docs/install-demo/ · lab: /lab/ · beginner guide: /blog/rea-beginner-guide/.
Supported formats
From the product “What it opens” / FAQ pages (2026-10-16 fetch):
| Format family | Examples | Notes |
|---|---|---|
| Mach-O | Mac / iOS apps & frameworks | Universal binaries open on your Mac’s slice |
| ELF | Linux programs; native libs inside Android apps | |
| PE | Windows EXE / DLL | |
| Android | .apk / .dex | Decompiled to Java/Kotlin with jadx |
| GPU shaders | .metallib / .air / .spv | Linked to loaders; CUDA/HIP PTX path on site |
| ML | .gguf / .safetensors / .onnx / .pt | Read without running weights |
Four views of every native function (site copy): pseudocode, assembly, control-flow graph, hex — from Ghidra or Rizin.

Engines: Ghidra / Rizin / jadx
| Engine | Role in Eleven | Operator note |
|---|---|---|
| Built-in fast engine | First open is immediate | Site FAQ: no extra install for first file |
| Ghidra (+ Java) | Deepest pseudocode path | Downloads in background on first launch; Eleven can set it up |
| Rizin | Fast open without Java | “Under a second” path on site FAQ |
| jadx | Android dex → Java/Kotlin | Cited example: 61 MB debug APK → 73,471 methods |
| Hopper / IDA (optional) | If already on your Mac | Settings → Analysis; BYO licensed copies |
REA on the CLI still treats Hopper / Ghidra / IDA as bring-your-own for many workflows (/faq/setup-vs-providers/). Eleven’s product FAQ states it can download Java+Ghidra for its own first-run path — that is Eleven’s packaging, not a claim that rea-agents ships those engines.
Platforms and install (v0.1.8)
| Host OS | Package | Install hint | |
|---|---|---|---|
| macOS (Apple silicon) | Signed / notarized download | `curl -fsSL https://eleven.chizi.app/install.sh \ | bash` or site Download |
| Windows x64 | zip | Site Download · PowerShell: `irm https://eleven.chizi.app/install.ps1 \ | iex` |
| Linux x64 | AppImage | Ubuntu 24.04+ / Fedora 40+; site Download |
Release notes: v0.1.8. Prefer reading the release body before upgrading teaching labs.
Agent surface (ACP)
Site lists agents that speak the Agent Client Protocol, including Claude, Codex, Gemini, Cursor, OpenCode, Aster, plus “any ACP agent.” Eleven runs locally; whatever the agent reads still follows that model vendor’s data policy — same as using the agent elsewhere.
| Capability (site) | Operator habit |
|---|---|
@ picker for functions / strings / notes | Pass exact name + address with the question |
| Select lines + ask (⌘L on Mac) | Answer under selection; pin as note or continue in chat |
| Agent renames / notes as suggestions | Accept or skip; history + undo |
| Safe byte patches | Write to Downloads copy; never overwrite original |
| Compare builds | Diff added / removed / changed functions |
| Debugger | lldb: breakpoints, stack, locals |
.eleven project share | Binary + notes + patches + chats in one file |
Operator checklist: first authorized session
- [ ] Confirm the target is own / authorized / clean-room (/compliance/, /faq/legal-boundary/).
- [ ] Install Eleven v0.1.8 for your OS from eleven.chizi.app (or the curl/irm one-liners above).
- [ ] Sign in to an ACP agent you already pay for / host; Eleven does not replace that subscription.
- [ ] Wait for background Java/Ghidra setup if you need deep pseudocode; or use Rizin / jadx paths for speed.
- [ ] Open a disposable copy of the binary/APK — never your only production artifact.
- [ ] Ask the agent to explain one function; require Evidence-style specifics (address, name, callers) not vibes.
- [ ] If patching: verify output landed in Downloads as a new file; keep the original untouched.
- [ ] Optionally keep REA CLI pinned:
npx -y [email protected] doctor --jsonfor MCP hosts outside Eleven (/blog/rea-beginner-guide/). - [ ] For guided interactive practice on this site (separate from Eleven): /lab/ · showcase /showcase/dx-ball/.
# REA teaching pin on rea.run (CLI/MCP hosts — complementary to Eleven GUI)
npx -y [email protected] doctor --json
# Eleven Mac install one-liner (from product site)
curl -fsSL https://eleven.chizi.app/install.sh | bash
How this fits the rea.run teaching path
- Learn REA vocabulary + Evidence habit: /blog/rea-beginner-guide/.
- Pin and understand 6.5.0: /blog/rea-agents-6-5-0/.
- Walk install UI: /docs/install-demo/.
- Practice in /lab/ on fixtures you may analyze.
- Use Eleven when you want a desktop workbench that keeps the agent next to decompiled text — still on authorized targets only.
Compliance
- Authorized teaching / own software / written rights / clean-room fixtures only. No crack, keygen, or DRM-bypass how-tos (/compliance/, /faq/legal-boundary/).
- Byte patches in Eleven go to a copy (Downloads), not the original — keep that discipline in labs.
- Engines (Ghidra, Hopper, IDA, jadx, …) remain subject to their own licenses; BYO where required.
- rea.run is a community operator guide; footer disclaimer stays low-key. Not affiliated with Zfinix/Eleven authors or morluto beyond documenting public repos.
- Media under
/media/blog/eleven-rea-workbench/are product-demo stills and a short demo clip hosted for this article.
Sources
- Product: eleven.chizi.app (fetched 2026-10-16: v0.1.8, platforms, formats, engines, Android 61 MB / 73,471 methods)
- GitHub: Zfinix/eleven (API snapshot 2026-10-16: 503★, 78 forks, Apache-2.0)
- Release: v0.1.8
- REA: morluto/rea · pin /blog/rea-agents-6-5-0/
- On-site: /blog/rea-beginner-guide/ · /docs/install-demo/ · /lab/ · /showcase/dx-ball/ · /zh/blog/eleven-rea-workbench/
FAQ
| Question | Short answer |
|---|---|
| Is Eleven a new decompiler? | No — visual workbench; Ghidra/Rizin/jadx (and optional Hopper/IDA) analyze. |
Do I still need rea-agents? | For MCP/CLI hosts and this site’s teaching path, yes (pin 6.5.0). Eleven is the GUI companion. |
| Can patches overwrite my binary? | Product FAQ: patches write to a Downloads copy. |
| What Android number can I cite? | Site example: 61 MB debug build, 73,471 methods (2026-10-16). |
| Which OS builds exist? | macOS Apple silicon, Windows x64, Linux x64 (Ubuntu 24.04 / Fedora 40+). |
| Offline? | Read/rename/patch/debug after first downloads; agent chat needs provider. |