Open-source reverse-engineering engine Craft Anything: it can take software apart and let AI rebuild it—but first know the boundaries

A project called Craft Anything has appeared on GitHub, from the ArtCraft team. The README describes it as a pure-Rust reverse-engineering engine: point it at websites, desktop apps, mobile apps, games, and files; use real inspection tools to study the original target; then have a coding agent build a new project according to your requirements, compare the result with the original target, and keep fixing. The project uses a dual MIT or Apache-2.0 license. The original tweet places it in the same narrative as REA and Grok Bot, and also claims the team has open-sourced Adobe and Microsoft stacks; the tweet also frames the release motivation as coming after Claude banned REA. The promotional language is aggressive. First, look at what it actually says.

How it works

The README's four steps are Study, Build, Check, and Ready. In Simple mode, you choose Website, App, or Game, enter the address, select Clean room or Deep, state your requirements, and press Start. The project page shows the four steps, what the agent is doing, question and approval cards, result similarity, and buttons to open the result or folder. Advanced mode gives you a full workbench: functions, strings, pseudo-C, disassembly, hex, call graph, evidence, unknowns, tasks, logs, and an agent console.

Each tool is both a CLI subcommand and an MCP tool. The README says there are 320 tools, 300 of which are in the engine, with the rest coming from the AI and setup layers. You can inspect without AI. This design is more practical for developers: you can let the agent drive, or you can type commands yourself to look at the evidence.

The boundary between Clean room and Deep

Clean room is the default mode. It does not read the original internal code, files, or page source; it uses only visible information: screenshots, visible text, measured layout, colors, fonts, spacing, opened menus, and, when allowed, an image of the app window. Tools that would peek inside are refused, with a hint on how to switch to Deep. Deep mode uses all tools, including the built-in engine and installed Ghidra, to read program code and files, website JS, and observe startup pages.

The README specifically states that Clean room is a product rule, not an OS sandbox; it does not isolate your computer. The coding agent still acts as you, and what it can read, write, and run depends on the agent's own permissions. This boundary matters more than the slogan.

Relationship to REA + Grok Bot

monokern's long post gives a different combination: morluto/rea serves as an MCP translation layer, connecting models to Ghidra, Hopper, IDA, Rizin, JS AST analyzers, and network inspection; put REA into Grok Bot's cloud container to get bash, a persistent filesystem, and a 24/7 runtime, avoiding multi-GB local analysis caches and a Java runtime; sort by xref count and tackle the high-frequency core functions first; divide work among multiple bots, with analysis bots writing specs and implementation bots seeing only the specs. The article also lists four clean-room rules: observe behavior without copying code, specs first, strict context isolation, and redo assets. A commenter reminds readers that clean-room separation is the part most easily skipped. That reminder is more useful than the promotional language.

Craft Anything's product direction is similar: gather tools, evidence, checks, and rules into one open-source engine. But do not conflate them—the main subject of monokern's article is REA + Grok Bot, while Craft Anything is another project. The main tweet strings them together, which can easily confuse readers.

What it can and cannot do now

Craft Anything is in early alpha. The desktop app, CLI, and MCP server are available; the Study-to-Refine workflow works when Claude Code is used as the builder; website inspection supports three screen widths; game rebuilding supports Unity, Unreal, and Godot; Deep mode connects to Ghidra; generating images and 3D models requires your own fal.ai key and is optional.

Some capabilities are built but have not been run live, such as API keys and other coding agents; behavior checks for apps and games and some engine tools have only been tested against stand-ins. Codex support exists but has not been verified on a real installation; GitHub Copilot goes through ACP and requires a separate login; other ACP agents can be switched in, but so far only Maki has been run live. It does not bypass DRM, logins, or anti-cheat. Rebuilding does not copy logos, photos, or text unless you confirm you own them or have the right to use them. Installing dependencies executes code; npm runs package install scripts by default, and the README warns to grant permissions only to projects whose dependencies you trust.

Is it worth trying?

If the target is a website layout, a small game, or a behavioral spec for an old tool, Craft Anything is worth trying. It can save you from the part where you open a hex editor, spend twenty minutes, and give up. If the target is Office-level software, the snake game and sample website in the demo do not prove anything. The real difficulties are specs, boundaries, legal isolation, and differential verification. The four clean-room rules in monokern's article are worth copying onto the project wall. Craft Anything's checklist and evidence ledger are more worth looking at than the headline 'rebuild any software.' The original tweet's 'closed source is doomed again' is emotion; from an engineering perspective, what matters is whether it can make the evidence chain work end to end.

Project URL: https://github.com/storytold/craft-anything

Original tweet: https://x.com/monokern/status/2118370857647018335

monokern long post: https://x.com/i/article/2117992396575145984