REA Has 242,083 GitHub Stars Six Months After Creation, and 231,579 Weekly npm Downloads to Match
Software / news
REA Has 242,083 GitHub Stars Six Months After Creation, and 231,579 Weekly npm Downloads to Match
The MIT-licensed reverse-engineering plugin for coding agents has no named team behind it, and three accounts wrote most of its commits.
The GitHub repository morluto/rea showed 242,083 stars and 60,275 forks on Oct. 15, according to the GitHub API, for a project whose repository record gives a creation date of April 14, 2026. That is an average of about 1,300 stars a day since creation.
REA, short for Reverse Engineer Anything, is a command-line tool and MCP server that lets coding agents such as Claude Code, Codex, Cursor and Gemini CLI inspect software. Its README lists native binaries, Electron and JavaScript apps, .NET assemblies, APKs, firmware and packet captures as targets. The MIT licence covers the code REA's authors wrote.
Stars are not adoption, but the downloads are large too
Stars are free to give and say little about use. The npm registry's download counter is a harder number: the rea-agents package recorded 231,579 downloads for the week of Oct. 6 to Oct. 12, according to npm's public API. The counter does not separate people from CI jobs, mirrors or scripts, so it is a ceiling on installs and not a headcount.
The repository also has 817 watchers, the people who subscribe to its activity. That is about 0.3 percent of the star count.
- morluto1624 contributions
- N0zoM1z0535 contributions
- kaoru0822-kitauji436 contributions
- rudycelekli90 contributions
- github-actions[bot]42 contributions
Source: GitHub contributors API for morluto/rea, accessed 2026-10-15
Who is behind it
The project site, rea.tools, names no founders, company or team. It links to the repository, a Discord server and an X account, @reatools. The npm package lists a single maintainer, the account morluto.
The contributors API credits morluto with 1,624 contributions, N0zoM1z0 with 535 and kaoru0822-kitauji with 436. Together that is 2,595. The repository page shows 3,210 commits in all. The five newest commits on the morning of Oct. 15, between 00:11 and 00:40 UTC, were all by kaoru0822-kitauji.
The release cadence is fast. GitHub Actions published version 6.3.0 on Oct. 9, 6.4.0 on Oct. 11 and 6.5.0 on Oct. 14.
| Version | Published (UTC) | Release notes say |
|---|---|---|
| 6.3.0 | Oct. 9, 23:56 | Not read |
| 6.4.0 | Oct. 11, 03:58 | Android inspection over ADB, a JEB project browser |
| 6.5.0 | Oct. 14, 12:32 | JavaScript bundle analysis, offline inspection tools |
The issue tracker reads like a roadmap. Issues #3731 through #3748 each propose a separate blockchain target, among them Starknet, Move VM, zkVM and Solana transaction reverse engineering. The tracker holds 466 open issues and 338 open pull requests.
What the README says it does to your machine
The install path is npx rea-agents setup, which proposes edits to the agent's configuration and asks for approval. The README says existing configuration is backed up. It also says runtime capture "runs or interacts with the selected target using your user permissions," and that results go to your agent, whose model provider "has its own data policy."
The README opens its trust notes with a warning: "A similar repository name or copied README does not establish that a download is official." It names morluto/rea, rea.tools and the rea-agents npm package as the only official sources. With a repository this popular, lookalike packages are the obvious risk.
REA does not bundle commercial disassemblers. IDA, Hopper and JEB need their own licences, and the README says REA "grants no tool license, key, or activation entitlement." Ghidra, the framework published under the National Security Agency's GitHub organisation, is the route without a licence fee.
What nobody has shown yet
The site claims "code, references and runtime observations" come back with each answer, and lists three case studies: Aegis on Android, Notion on Electron and DX-Ball as a native binary. We did not run REA, and no independent evaluation of its output quality turned up. The README's own claim that results carry "the evidence and limitations behind each conclusion" is the project's, not a tested result. Scoring agent output is its own problem, as the Parsimony benchmark found for code volume, and agents that run untrusted targets need somewhere to run them, which is what Agent37 sells.
The next release is the thing to watch. At the current pace of one every two to three days, version 6.6.0 would land by about Oct. 17.
Sources
More in Software
- 01VoiceStudio Has 75,300 Stars and an AGPL Licence, but Its OmniVoice Model Is CC-BY-NCThe README tells users that a paid app licence does not cover the model weights, and a CLA thread asks contributors for commercial relicensing rights.
- 02Free Pascal Gets Runtime-Loadable Dynamic Packages in a Fork, Two Years After a Core Developer Listed the Gapsysrpl's release closes the three gaps Sven Barth listed in 2024, but the page gives no version, no date and no merge into Free Pascal.
- 03Sphinx, a Git Hook, Quizzes Developers on Agent-Written Code Before a Push Goes ThroughThe MIT-licensed 0.1 release sets a global Git hooks path, can block a push for 25 minutes and sends the diff to a reviewer model of the user's choice.
- 04Microsoft and CMU Start PRAISE, a Certificate for Early-Career Engineers Working With AIJunior Microsoft engineers take four CMU courses over two semesters with senior mentors, but neither announcement gives a cohort size, a cost or an eligibility rule.