Method & rules

How Remake takes apps apart, and what it won't do.

Engines on this machine

  • REA analyze-web-bundleREA analyze-web-bundle over CDP (native)
  • REA analyze-javascript-applicationREA analyze-javascript-application (native)
  • build agent: claude-cliclaude CLI not installed
  • build agent: anthropicno ANTHROPIC_API_KEY
  • build agent: xaino XAI_API_KEY
  • template builderalways available: six tested app types (list, board, notes, timer, canvas, landing)

No AI build agent is connected, so Rebuilds use the tested templates, themed and named from the spec. To connect one, log in to the claude CLI once, or set ANTHROPIC_API_KEY or XAI_API_KEY in .env.

Rebuild: clean-room

  1. Capture. A fresh headless Chromium opens the public page with no cookies, no logins and no consent clicks. Every request it makes passes an SSRF filter (no localhost, LAN or cloud-metadata addresses). It records request hosts, storage key names (never values), the page's structure (landmarks, controls, short UI labels) and tries the main controls once like a visitor would (type + Enter, tick a checkbox), counting what changes.
  2. REA analysis. REA attaches to the live page over a local debugging port and statically analyses its scripts (endpoints, routes, frameworks), then analyses the saved bundles for storage use. The bundles stay in a temporary job folder that is deleted afterwards.
  3. Spec. An analyst step turns the observations into spec.json: app type, screens, flows, data, and what to leave out. No code, copy text, images, colours or names. Labels that contain the original's brand words are dropped.
  4. Build. The builder gets only the spec, without even the original's address, and writes new code with our own name and look. An AI agent (when connected) works in an empty folder outside this project with file tools only: no shell, no web. Without one, a tested template is themed from the spec.
  5. Test. Unit tests run under Node's permission model (read-only, no child processes). A headless browser serves the build from memory, blocks every outside request, replays the observed flow and checks phone-width layout. Builds that mention the original's brand words fail.
  6. Preview. Each build gets its own origin (<id>.localhost:4143) with a strict content policy, plus a repo zip and a report.

Plugboard: agent skills from public APIs

  • Only documented public APIs, or your own account through them. We find the API description from our catalog, a link you paste, standard spec locations, or by watching which API host the site's own front end talks to. Undocumented endpoints REA sees are reported, never used.
  • The MCP server uses the official SDK, calls only the documented host, is read-only unless you switch writes on, and reads keys from your MCP client's environment at call time.
  • A key you give us for the live test is encrypted on this machine, used for one call and deleted.
  • Every server is tested with a real MCP client: initialize, list tools with schema checks, and one live call.

We refuse

  • Cracking, keygens, licence/DRM/activation/paywall bypass, piracy and cheats. REA's own disclaimer forbids these too.
  • Copying an app's proprietary code, assets, logos, trademarks or brand, or making look-alikes for phishing.
  • Other people's accounts, captured logins, scraping private data, getting around rate limits, captchas or sign-in.
  • Private or internal addresses, file downloads and logged-in pages.

Limits

  • Only the public first visit is observed. Server-side logic is invisible, so rebuilds keep data in the browser; add your own backend.
  • Template rebuilds cover six common app types. Complex apps need a connected AI agent, and even then a rebuild is a starting point, not a twin.
  • Job limits: 15 minutes per job, 800 recorded requests, 16 MB of scripts, 40 MCP tools per server.