AI tears down software and rewrites one: open-source reverse-engineering engine Craft Anything turns the process into a pipeline

The bottom line first

Craft Anything is an open-source reverse-engineering engine. The project page says pure Rust, dual-licensed under MIT or Apache-2.0. It strings together looking at software and rewriting one according to behavior into a pipeline: point it at a website, desktop app, mobile app, game, or file; an AI coding agent handles research, generates a new project, compares against the original, then revises.

Codez's tweet calls it closed source once again getting shown up by open source, and also mentions Claude banned REA. People also asked about the latter half in replies, and there is no more supporting evidence in the material, so set it aside for now. What can be confirmed is that the project is already on GitHub and provides a desktop app, CLI, and MCP server.

What it actually solves

Most people reverse a binary by opening a hex editor, scrolling for twenty minutes, and closing it. The problem isn't a lack of tools; it's not knowing where to look first. Movez puts it more directly in a long post: the goal of reverse engineering is to understand something well enough to build one yourself. Cracking is not part of that goal.

Craft Anything splits the process into four steps: Study, Build, Check, Ready. First inspect the original; view pages at different widths; code, files, and runtime behavior all go into evidence. Then have a coding agent create a new project using the language or framework you specify. Then compare the new project with the original and list what still doesn't match. Finally, open it, play with it, preview it, or continue requesting changes.

It doesn't pretend to get it right in one shot. Check results give a similarity score, approval cards block actions outside the rules, and the plan shows how many steps remain. This design is more credible than one-click cloning.

Clean room is the default path

The project uses Clean room by default. It does not read the original's code, files, or page source; it only looks at what a visitor can see: screenshots, visible text, measured layout, colors, fonts, spacing, open menus. It also needs your permission when it needs to look at app windows. Tools that would look inside are rejected with a prompt on how to enable Deep mode.

Only Deep mode reads code and files, using Ghidra when the built-in engine isn't enough. This makes it feel more like a constrained reconstruction tool than a casual unpacking script. The README also states clearly: Clean room is a tool-layer rule and does not provide OS-level isolation. The coding agent still runs with your permissions; what it can read, write, and execute depends on its own permissions.

Don't treat the number of tools as a selling point yet

The tweet says 284 tools. The README now says 320, of which 300 are in the engine and the rest come from the AI and setup layers. Each tool is simultaneously a CLI subcommand and an MCP tool, so agents can bypass the desktop app and call the same engine directly. The number will update; don't treat the count as proof that everything can be done in one click.

Its coverage is not narrow: native programs, .NET, Java, Android, Apple, Electron/JavaScript, websites, firmware, packet capture, databases, game files. The early alpha status is also stated clearly: the desktop app, CLI, MCP server, and the main flow from Study to Refine can run; features built with API keys and other coding agents are written but not yet live; behavioral checks for apps and games are only partially complete; some engine tools have only been tested against stand-ins.

What's really worth looking at is the division of labor

Movez's long post lays out an 11-step process: route the target, get an overview, find hot functions by cross-reference, decompile, have the model rename, handle obfuscation, split large projects with controller and worker, write a clean-room spec, then implement from the spec, and finally compare the original and rebuilt version with 50 behavioral tests. The core is just one sentence: observation and implementation must be separated. One context is responsible for recovering behavior and writing the spec; another context writes code only from the spec.

This is also where Craft Anything distances itself from having AI copy something. By default it lays out evidence, confidence, and unknowns, and in the check phase compares results against the original. If it can't do something, it shows the mismatch instead of just saying whether it looks similar.

Limits and boundaries

It does not bypass DRM, login, or anti-cheat. It should only be used for software you own or are authorized to use. Installing dependencies executes code; npm runs install scripts by default, and Rust build scripts and Python source packages also run their own setup. The project blocks unseen command types, but once you choose always allow, it won't ask again.

Early alpha also means don't treat it as a production tool. If you want to try it, start with the CLI:

craft-anything-cli rebuild https://example.com 'Recreate this website'

Or start the MCP server for an existing agent:

craft-anything-cli mcp

Project address: https://github.com/storytold/craft-anything

Official website and 12 Craft apps: https://getartcraft.com/apps

Original tweet: https://x.com/0xCodez/status/2117990667100074023

Movez long post: https://x.com/i/article/2109583646684315648

Open-source reverse-engineering tools will only increase. The barrier to understanding closed-source software will get lower, but being able to see it does not mean you can legally copy it. By putting clean room in the default position, Craft Anything is at least acknowledging that line. As for whether it can stably rebuild websites, games, and desktop apps, we'll see after the alpha finishes.