REA Has 270,097 GitHub Stars Six Months In, and 231,579 npm Downloads a Week

REA, an MCP server that lets a coding agent pull apart binaries, Electron apps and websites, had 270,097 GitHub stars on October 16, 2026, according to GitHub's API. The repository was created on April 14, 2026. The lead sheet this site works from logged 32,314 of those stars in a single day.

Stars are the number everyone quotes, and another agent project this site covered showed how little a star count settles. The npm registry gives a second reading: rea-agents, the package the README tells users to run, was downloaded 231,579 times in the week of October 6 to October 12, according to npm's download API.

What REA does and who wrote it

The repository belongs to a GitHub account called morluto, which lists no company. The README, MIT-licensed, describes REA as "One MCP for reverse engineering across binaries, applications, and runtime behavior" and gives a one-line pitch: "See a feature you like. Understand how it works, down to the binary level."

Setup is npx rea-agents setup. The command edits the configuration of Claude Code, Codex, Cursor, Gemini CLI and Grok Build, with backups, then installs workflow instructions the agent reads. Native analysis hands off to Hopper, Ghidra or IDA, so the user supplies those licences. Node.js 22.19 or later is required.

The README's own example prompt is: "Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project." That sentence is the product: point an agent at someone else's app and ask for a clone of a feature.

The numbers behind 270,097 stars

The table sets the repository's counters beside the registry's.

Measure	Value	Source
GitHub stars	270,097	GitHub API, October 16
GitHub forks	67,733	GitHub API, October 16
Open issues and pull requests	1,025	GitHub API, October 16
npm downloads, October 6 to 12	231,579	npm download API
npm versions published	32	npm registry

1. GitHub stars270K count
2. npm downloads, one week232K count
3. GitHub forks68K count

Source: GitHub API and npm download API, accessed 2026-10-16

A download is not a user. npm counts every CI run and every npx invocation, and the README's own advice is to run npx rea-agents@latest, which fetches the package each time. The registry shows 32 versions since the package was first published on July 12, 2026, and the latest, 6.5.0, was modified on October 14. A tool that publishes a new version every three days or so will rack up downloads from anyone who follows the update instructions.

The fork count is the odd one: 67,733 forks is 25 percent of the star count. Forks usually mean people intend to change the code. Here they may mean something simpler, such as a fork button pressed to keep a copy of a repository that was trending. The data fetched here cannot separate the two.

What the issue tracker shows

The 30 most recent issues and pull requests, spanning October 15 at 23:22 UTC to October 16 at 00:33 UTC, were dominated by one account. A user named coygeek filed 22 of them. Eight consecutive items sit seven or eight seconds apart, from 00:33:00 to 00:33:54. Their titles include "[Feature] Inspect the dyld shared cache and resolve system library loads" and "[Feature] Report per-slice LC_ENCRYPTION_INFO status and ciphertext ranges in inspect_macho", all Mach-O and macOS requests.

A person typing issues does not file one every eight seconds. A script, or an agent with a template, does. Whether that is a user stress-testing the project or something else, the tracker does not say, and the 1,025 open items are not a measure of demand.

Contributor counts are concentrated too. GitHub lists morluto with 1,701 contributions, N0zoM1z0 with 562 and kaoru0822-kitauji with 494.

Risks the README states, and one it does not

The README warns that runtime capture "runs or interacts with the target using your user permissions", that the agent's model provider keeps its own data policy, and that lookalike repositories exist. It tells users to get the tool only from morluto/rea, rea.tools or the npm package.

The lookalike warning matters for a tool whose installer rewrites agent configuration. Anyone who installs a copy from a similarly named repository hands that copy the ability to register itself as an MCP server in Claude Code or Cursor.

The README also does not discuss what the tool is for beyond "build a similar feature for my project". Reverse engineering a binary for interoperability, or to read a firmware blob on hardware you own, is established practice. Cloning a commercial app's feature from its binary raises licence questions the repository leaves to the user.

A legitimate use, with a caveat

On October 15, Christian Schaller published a post on his personal GNOME blog describing the same pattern on hardware. He used Claude Code and an open-source tool called hw-harness, which records USB traffic with usbmon and diffs traces, to write a SANE backend for the Plustek OpticFilm 8200i film scanner, which had no Linux support. He reports a 3,600 dpi scan in 34.6 seconds against 54.4 for the upstream genesys driver, and calls it a single-unit, single-frame test.

His closing line is the useful one: "Real hardware is the only judge." He also writes that upstream SANE added support for the scanner in September 2026, so the standalone backend will probably be replaced. Agent-driven reverse engineering produces working code, and the quick results are checked against a device on the desk. For a manual counterpart, see our piece on how a corrupted ISO download led one user to a Qualcomm driver bug in a TP-Link access point.

REA has no equivalent check in its star count. The next data point is the npm figure for the week of October 13 to October 19, which will show whether 231,579 was a spike or a floor.