Evidence first.
Words second.
Blueprint runs REA (Reverse Engineer Anything, an open-source reverse-engineering tool) for you, in a sandbox, and turns what it finds into plain sentences you can check.
Open it safely
A fresh headless Chromium loads the public page once: no login, no consent clicks, downloads off, every request checked against private and internal addresses.
Record everything
Every request and the domain it went to, cookie names, storage key names (never values), the page's links and a screenshot.
REA maps the code
REA attaches to the live page over the browser's debugging port and statically analyses its scripts: endpoints, routes and frameworks, with file, line and column.
Plain words, checked
An AI writer (or a fixed template) writes from those facts only. Each sentence must cite evidence ids; unsupported sentences are deleted.
What we look for
- Where your data goes: every outside domain, grouped as analytics and tracking, advertising, payments, AI providers, crypto and wallets, sign-in, monitoring, consent, support, embeds, backend services, fonts and CDNs.
- What it's built from: frameworks, notable libraries and the browser abilities its code uses (storage, location, camera, live connections).
- Crypto specifics: wallet libraries, what it can ask your wallet to sign or approve, contract functions it calls by name, chains and addresses written into its code.
- Key features: sign-in, search, payments, live updates, AI, wallet flows, traced to the requests and code locations that show them.
- Smart contracts: paste an address on Robinhood Chain, Base, BNB Chain or Ethereum to see what its owner can do (mint, pause, block wallets, change fees, replace the code), read from the public bytecode.
What we never do
- No logins, no paywalled or members-only pages, no private or internal addresses.
- No file or app uploads yet. Analysing binaries is planned for a later version, behind terms of use.
- No cracking, piracy, licence or DRM bypass. We refuse those requests, and REA's own disclaimer forbids them.
- We never publish a site's source code: only behaviour, domain names and short identifiers such as endpoint or function names.
- We describe what code does, not what people intend. We never call anyone a scam, and nothing here is financial advice.
Engines on this server
| Part | Status |
|---|---|
| REA analyze-web-bundle (live page, over CDP) | ready |
| REA analyze-javascript-application (saved bundles) | ready |
| REA inspect-evm-interface (contracts) | ready |
| REA version | rea-agents@6.4.0 |
Limits
Server-side logic is invisible from outside: we see what a browser sees. Most site code is minified, so names are partly lost and very large bundles are only partly analysed. Some trackers load only after you accept cookies or log in. Contract powers are read from function selectors; powers hidden behind unnamed functions can be counted but not explained.