REA, a Reverse-Engineering Tool for AI Agents, Gained 52,186 GitHub Stars in a Day. It Has 653 Watchers.

The GitHub repository morluto/rea gained 52,186 stars on October 12, 2026 and 43,698 more on October 13, according to Trendshift, and the GitHub API now reports 199,120 stars against 653 watchers. REA, short for Reverse Engineer Anything, is an MCP server that lets a coding agent drive disassemblers such as Ghidra and Hopper. The numbers say it is popular on GitHub; they do not say how many people run it.

What REA does

The README's pitch is "See a feature you like. Understand how it works, down to the binary level." It suggests asking an agent to investigate a feature in an app without its source, then build a similar version for your own project. REA covers native binaries, Go and .NET programs, WASM, Electron and JavaScript, Android APKs, firmware and packet captures. It lists Claude Code, Codex, Cursor, Gemini CLI and Grok Build as supported agents.

Install is npx rea-agents setup, which proposes edits to the agent's configuration and asks for approval first. Native analysis needs Hopper, Ghidra or IDA installed, and setup can optionally install Hopper. The README's worked example is DX-Ball, and it says the reconstruction "passes 3,205 original-x86 cases and reproduces all 63 compiled function bytes." That is the author's claim, and nothing in the repository's metadata verifies it. The README also says analysis runs locally, though the agent's model provider keeps its own data policy, so whatever the agent reads from a binary may still leave the machine.

Three trackers, three star counts

The repository was created on April 14, 2026, per the GitHub API. Trendshift credits it with 198,491 stars in the 61 days to October 13, which would put nearly all of the total inside the last two months. Other trackers disagree with each other on the total.

Source	Stars	Forks
GitHub API, October 13	199,120	48,708
Trendshift header	197.9k	41k
OSSInsight page	46,097	7,355

The README's own star-history section says 180,000, while the repository sidebar says 199.1k. OSSInsight's figure looks like a stale snapshot, but the page does not say when it was taken.

1. Oct 919K stars
2. Oct 1027K stars
3. Oct 1131K stars
4. Oct 1252K stars
5. Oct 1344K stars

Source: Trendshift, repository page, accessed 2026-10-13

Trendshift shows the repository ranked first on its overall list on October 5, 9 and 10, then not trending from October 11 to 13 even as the daily star counts peaked. Trendshift's page does not explain the gap, and neither the page nor this reporting can say why.

What stars cannot tell you

Watchers number 653, about 0.3% of the star count. Forks stand at 48,708, about 24% of stars, a ratio that a fork alone cannot interpret: a fork can be a build, a bookmark or a copy made to read. The author, account morluto, has existed since December 22, 2020, has 252 public repositories, 4,500 followers and a bio reading "member of technically staff". The account page names no company.

Activity inside the repository is real and busy. Trendshift counts 977 merged pull requests in 61 days. The 15 newest issues and pull requests, all opened on October 13 between 17:27 and 17:48 UTC, are bug fixes, many in draft, and one says in its body that it was generated with Claude Code. Three drafts arrived from one account within about six minutes. That is a volume pattern like the commit counts in two studies of coding agents, though the issue list alone cannot show who or what wrote each change.

Two of those pull requests concern the installer, which is the part that edits an agent's configuration. #2947 stops a setup-plan check from accepting sibling directories that share a path prefix. #2946 requires client config backups to match the pre-setup bytes exactly. Both are drafts, so the fixes were not merged when the list was read.

The legal footing

The README says REA "is for lawful research, education, interoperability, software preservation," and that it "grants no tool license, key, or activation entitlement" for IDA, Hopper or JEB. It does not address malware handling. Its own suggestion, to rebuild a feature from an app you do not have source for, sits next to a licence question the README leaves to a separate disclaimer file.

The licence is MIT for REA's own code, and third-party material keeps its own. Agent-written code is also reaching the Linux kernel, where Linus Torvalds published eight page-cache patches written with Claude Code, but REA points an agent at other people's binaries rather than at its own repository.

What to check next

REA's setup command rewrites configuration for up to five agents. Anyone installing it should read the diff the installer proposes before approving it, and watch whether #2946 merges. The next data point is Trendshift's October 14 row: if daily stars fall back toward the October 9 level of 19,375, the spike was a news cycle; if forks keep adding about 13,000 a day, as on October 12, the attention has not cooled.