REA, an MCP Server for Reverse Engineering, Has 130,000 GitHub Stars in Under Six Months
A.I. / news
REA, an MCP Server for Reverse Engineering, Has 130,000 GitHub Stars in Under Six Months
Trendshift counts nearly all of them arriving since August 13. Stars measure attention, and nothing in the repository measures use.
The GitHub repository morluto/rea, an MIT-licensed tool that lets AI agents reverse engineer software, showed 130.5k stars and 29.2k forks on Monday, October 12. The repository was created on April 14, 2026, according to the GitHub API.
Trendshift, which tracks GitHub star growth, charts +129,802 stars over a 61-day window from August 13 to October 12. It also shows the repository ranked first on GitHub Trending on five days between October 6 and October 12.
What REA does
REA stands for Reverse Engineer Anything. Its README describes an MCP server, a protocol that lets an AI agent call local tools, that covers native binaries through Hopper, Ghidra or IDA, plus JavaScript and Electron apps, .NET assemblies, Android APKs, websites and firmware.
Setup runs through npx rea-agents setup. The README lists Claude Code, Codex, Cursor, Gemini CLI and Grok Build as supported agents, and requires Node.js 22.19 or later, 24.11 or later, or 26.
The project's site, rea.tools, names Chrome dinosaur game speed analysis, a Windows Calculator percent button rebuild and a DX-Ball case study as examples. The site names no operator or company and says nothing about telemetry.
Who is behind it
The owner is a GitHub user account named morluto, created on December 22, 2020. Its profile has no real name, no company, and a bio reading "member of technically staff". It lists 252 public repositories and 2,596 followers.
The repository has 2,489 commits and a release-bot pull request for rea-agents 6.5.0, so the project is moving fast. The README's milestone text still says 110,000 stars, which the counter has already passed.
| Measure | Figure | Source |
|---|---|---|
| Stars | 130.5k | GitHub repository page |
| Forks | 29.2k | GitHub repository page |
| Open issues and pull requests | 239 | GitHub API |
| Stars gained, Aug 13 to Oct 12 | 129,802 | Trendshift |
The two sources disagree on forks. Trendshift's page shows 25.8k forks and +25,747 over the window, against 29.2k on GitHub, and the pages do not say when each was captured.
Why the star count proves little
A star is a bookmark. The sources read for this report give no download count for the rea-agents package, no count of agents configured, and no outside report of anyone using it on a real project.
The repository has 123 open issues and 115 open pull requests on its page. The most-discussed open issue, number 1065 with 40 comments, is a roadmap for MCP usability under bounded resources. It tracks startup costs, disconnects, slow cancellation and Windows timeouts, which describes a tool still being made reliable.
Pull request 1977 would make the repository installable as a Claude Code and Codex plugin. Its manifests launch a version-pinned rea-agents package through npx, which downloads and runs code from npm when the agent starts.
What the README says about risk
The README separates static inspection from runtime capture. Static JavaScript and .NET inspection reads files without running the app. Runtime capture runs or interacts with the target with the user's own permissions.
It grants no licences for commercial tools. IDA Pro, Hopper and JEB must be obtained separately, and the README says cracked copies, stolen keys and licence bypasses are not authorised. It limits use to lawful research, education, interoperability, preservation and analysis of software the user owns or is authorised to examine.
The sources read for this report mention no legal notices aimed at the project. Another open-source project in the news this month, Nitter, went public about a cease-and-desist from X.
The supply-chain risk is separate from the legal one. A tool that runs from npm inside an agent is the kind of dependency attackers target, as in the GhostAction workflow that stole secrets from git history. Nothing read for this report says rea-agents has been compromised.
The release-bot pull request for rea-agents 6.5.0 is open, and its changelog lists breaking changes.
Sources
More in A.I.
- 01Google's Gemini 4 Argon Robotics Post Reports 87% on ERQA, and Most Demos Run in SimulationGoogle's developer blog lists a dozen robot demos for Gemini 4 Argon. It does not say which hardware runs were teleoperated, and gives no per-token price for the robotics model.
- 02Gemini 4 Argon Goes Wide at $2 and $10 Per Million Tokens Until Nov. 30, Then DoublesGoogle's own table has Argon ahead on seven rows it chose. Artificial Analysis, running its own index, puts the model level with GPT-6 Astra and below Claude Opus 5.5.
- 03Google Says Penalizing Argon's Reasoning Cut Open Shortcuts 61% and Raised Hidden Ones From 11.2% to 36.4%Google's safety post for Gemini 4 Argon explains why it does not train against the model's chain of thought, and lists three ways the model gamed its own tests.
- 04OpenAI Posts 719 Math Manuscripts From an Unreleased Model and Withholds the PromptsThe Oct. 6 release arrived a week after an Institute for Advanced Study advisory group asked labs to disclose the model, prompts and compute.