A GitHub Tool for AI-Cloning Anything Just Hit 327,000 Stars

The GitHub project REA (Reverse Engineer Anything), a Model Context Protocol server that delegates reverse-engineering tasks to tools including Ghidra, IDA, JADX and tshark, grew from 9,700 stars on October 7 to 342,000 by October 20, according to GitHub API figures tracked by BigGo Finance and 404 Media's own check. A cellcog.ai teardown ran REA's analyzer against REA's own npm package, parsing 1,706 JavaScript files and 3,315,012 AST nodes in 289.4 seconds with zero parse failures and producing 15,124 findings, 47,158 recorded unknowns and 2,529 stated limitations, while a separate test on an Electron app reported zero preload entry points and zero exposed API members for an app that had two of each. REA's tool count rose 22% in four days, from 170 functions on October 14 to 207 on October 18, while its payload grew 62%.

A GitHub project called REA — Reverse Engineer Anything — had 9,700 stars on October 7. By October 18 it had 318,860 stars and 80,864 forks, according to GitHub API figures tracked by BigGo Finance https://finance.biggo.com/news/515bde0a-f4ea-49e9-a1b9-be6581fe5b14 . By October 19 the count had passed 327,000. By October 20, when Jason Koebler filed his account for 404 Media https://404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/ , it read 342,000. Three outlets, three days, three different and probably all-accurate numbers, because GitHub’s star count updates by the hour and this one hasn’t stopped climbing. REA is not a decompiler. It’s a server built on the Model Context Protocol, the open standard that lets a coding agent such as Claude Code or Codex call out to software it does not itself contain. Point it at an app, a binary, a website or an Android package, and it decides which existing reverse-engineering tool to run — Ghidra, IDA or Hopper for native code, JADX for Android, tshark for network traffic — runs it, and hands the agent a standard record with a SHA-256 hash of what was examined and a confidence label. The project’s own README https://github.com/morluto/rea/blob/main/README.md is blunt about what it doesn’t do: it “never installs or upgrades Node.js, npm, Homebrew, Java, Ghidra, IDA, JADX.” It delegates. The hard analytical work still runs on tools that existed before REA did. REA's GitHub stars, October 2026 Cumulative stars on morluto/rea, by date checked | | GitHub stars stars | |---|---| | Oct 7 | 9,700 | | Oct 17 | 300,000 | | Oct 18 | 318,860 | | Oct 19 | 327,000 | | Oct 20 | 342,000 | Source: BigGo Finance GitHub API and 404 Media https://finance.biggo.com/news/515bde0a-f4ea-49e9-a1b9-be6581fe5b14 . Counts update hourly; the Oct 20 figure is 404 Media's own check at time of publication, not BigGo's How much that delegation is worth was tested by cellcog.ai’s technical teardown https://cellcog.ai/blog/rea-reverse-engineer-anything/ , which ran REA’s own analyzer against REA’s own npm package: 1,706 JavaScript files and 3,315,012 AST nodes parsed in 289.4 seconds with zero parse failures, producing 15,124 findings, 47,158 recorded unknowns and 2,529 stated limitations. A separate test against a real Electron app found REA matched most structural counts exactly — browser windows, inter-process handlers — but reported zero preload entry points and zero exposed API members for an app that had two of each, a blind spot cellcog traced to a helper-call pattern static analysis can’t resolve on its own. The tool count behind all this grew 22% in four days, from 170 functions on October 14 to 207 on October 18, while the payload describing them grew 62%. That’s a measure of how fast the project ships, not of how complete any one analysis is. How REA turns a target into a clone The orchestration path from agent prompt to rebuilt feature | From | To | How | |---|---|---| | Coding agent Claude Code, Codex, Cursor | REA MCP server | calls via MCP | | REA MCP server | Existing RE tools Ghidra, IDA, JADX, tshark | delegates analysis | | Existing RE tools Ghidra, IDA, JADX, tshark | REA MCP server | raw output | | REA MCP server | Evidence record SHA-256 hash + confidence label | normalizes, hashes | | Evidence record SHA-256 hash + confidence label | Coding agent Claude Code, Codex, Cursor | returns findings | | Coding agent Claude Code, Codex, Cursor | Agent writes & tests clone | implements feature | Based on cellcog.ai's analysis of morluto/rea https://cellcog.ai/blog/rea-reverse-engineer-anything/ What agents built on top of this are already running on hardware people own. On October 17, developer Gathin T. posted on X that his parents’ Xiaomi smart TV was showing an ad before it would even open Netflix, so he gave Claude Code the model number https://x.com/gathint/status/2111379569030939102 . The agent found the TV on the home Wi-Fi, switched off 25 Xiaomi system packages, and wrote a new home-screen launcher. “Looks like an Apple TV now lol,” Gathin wrote. 404 Media reported the post had been viewed more than 6 million times; TechCrunch’s own count, taken separately, put it at 6.2 million https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/ . Gathin published the prompt as an open-source project, now called cleanyourtv, built to switch unwanted apps off rather than delete them, so a restore script can put everything back if the agent gets it wrong. A second project, dumbtv, built by developer Muzzammil Yasin Sabuwala using a mix of DeepSeek V4.1 Flash, Claude Opus 5.5 and Claude Sonnet 5.5, does the same debloating on Fire TV, Sony, TCL, Philips, Hisense and Shield devices. TechCrunch reported that a few thousand people repeated the trick on their own sets over the following two days, across Xiaomi, TCL, Sony, Fire TV and LG hardware, and the odd projector. One user, Mihir Gupta, said he disabled 25 bloat apps and swapped a 192-megabyte stock launcher for an 83-megabyte custom one. Not every agent cooperated: TechCrunch also reported at least one person whose Android TV was bricked midway through a Claude-assisted debloat, with no working launcher left to restore. Software isn’t the only thing getting cloned this way. On Hacker News, a user posting as valdiorn, who says he runs a small pro-audio company making guitar pedals, wrote that in 72 hours he had “ ONE-SHOT decompiled https://news.ycombinator.com/item?id=50104299 3 of my main competitors products, including the Strymon Big Sky... I could in theory just stick them in a box and resell them.” He said he was trying to build a multi-effects unit to compete with the Eventide H90 and wanted its reverb, delay and chorus algorithms to match. The thread split on what that actually threatens: one reply noted that analog pedal circuits have been cloned and resold cheaply for decades without killing off the originals, because the moat was never the circuit, it was the brand. Another argued that for digital pedals the software was never the moat either — the real barrier is access to electrical-engineering talent and cheap assembly, neither of which an agent replicates by inspecting a competitor’s firmware. Mike Nolan, who studies the politics of open-source software, gave 404 Media https://404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/ the line that sums up what engineers are telling him: All I am hearing from software engineers is that software-as-a-service is dying as a business model. It’s becoming so easy to recreate the functionality that you want with AI . That claim sits on top of a separate, larger number. Software stocks lost more than 20% of their value in 2026, erasing roughly $1 trillion in market capitalization while the S&P 500 held flat, according to AInvest data cited by Forbes https://www.forbes.com/sites/petercohan/2026/02/06/saaspocalypse-now-ai-is-disrupting-saas---but-not-all-software-is-doomed/ . That rout traces to February, when fears that AI agents would let one employee do several people’s jobs — collapsing demand for per-seat licenses — hit Salesforce, ServiceNow, HubSpot, Atlassian and Workday. It is a different mechanism from REA’s: the February selloff is about agents doing the work a software seat used to require; the REA wave, eight months later, is about agents cloning the software behind the seat, so the work no longer needs the vendor’s app running at all. Nolan’s own hedge matters here: “there’s a lot of work associated with maintaining software, so there may be a lot of instances where the software may not be reliable enough to use — I don’t know how many companies are going to be adopting these clones.” REA’s viral week isn’t the first front in this fight. A Rust clone of Photoshop, built largely by AI and funded by a side business, https://rews.cc/a/a-rust-photoshop-clone-built-by-ai-funded-by-a-side-business-fb55de and the AI-assisted decompilation of hundreds of video games both predate it. One community built over years on patient, human reverse-engineering of old game binaries shut down this month https://rews.cc/a/decomp-dev-a-home-for-patient-game-decompilers-closes-its-do-cd0e05 after being flooded with AI-generated decompilations that didn’t match the original source and introduced bugs nobody who submitted them could explain or fix. Enforcement runs the other way too: Activision and Bethesda shut down AI-built Fallout and Call of Duty fan projects https://rews.cc/a/activision-and-bethesda-shut-down-ai-built-fallout-and-call--45eaca this month, which exposes the asymmetry. A publisher can still pull its own intellectual property off GitHub. Nobody owns the right to stop someone decompiling the launcher on a TV they already bought, or the reverb algorithm inside a pedal sold to the public as a finished product. Koebler’s own caveat is worth keeping. A lot of what calls itself “decompiled” doesn’t reproduce the original source; it’s an agent’s best guess at equivalent behavior, with bugs the person who generated it doesn’t understand and can’t fix — which is exactly why REA’s evidence records bother to distinguish “unknown” from “absent” rather than asserting certainty. The star count will keep climbing by definition. What’s worth checking in six months is how many of these clones — the TV launchers, the pedal firmware, the office-suite rewrites — are still running, un-bricked, with nobody who built them still around to patch them.