Method: we compared stars-today figures from bot issues that archive GitHub Trending daily (happydog-intj/ai-xiaohongshu-daily #542 “2026-10-08” for today, #539 “2026-10-07” for the prior day). Excluded: repos with 40k+ total stars (mattpocock/skills, diagram-design, agent-skills, claude-mem, i-have-adhd), long-running leaders with a past GitHub Trending #1 badge, and small movers under +300 a day (trycua/cua +229, manaflow-ai/cmux +96). The latest Rain1er/trending issues (#397, #398) appear in search but could not be opened, so no second-source cross-check was possible today.
morluto/rea — +4,666 ⭐ today (2 days in a row)
https://github.com/morluto/rea
Total stars: 13,772 · Daily gain: +4,666 (up 57% from +2,963 the day before) · Language: TypeScript · License: MIT
REA (Reverse Engineer Anything) lets AI coding agents investigate software from app behavior all the way down to native binaries. A CLI and an MCP server share the same workflows and evidence contracts, so agents like Claude Code can use either, while a target-bound session router deterministically picks a deep-analysis provider such as Hopper or Ghidra and never silently falls back to another one on failure. Every finding is stored as an “Evidence v2” record naming the provider, confidence, limitations and locations, and an investigation workspace keeps evidence and captures across sessions so version comparisons and open questions can be resumed. Its stated goal is not to recover original source or clone apps, but to explain how a feature works with evidence and help you build something comparable in your own stack. As MCP tooling spreads, it stands out as one of the first integrated ways to hand an agent a decompiler, which is why it is pulling in thousands of stars a day for a second straight day.
- Decompilation, pseudocode, assembly, strings, cross-references, call graphs and function dossiers
- Swift/Objective-C metadata analysis; targets include Mach-O, ELF, PE, .app, APK, IPA, ASAR and source maps
- Persistent, resumable comparisons between two artifact versions, with differences labeled as candidates
- Passive observation of a user-owned Chrome browser over loopback CDP, plus controlled Playwright scenarios
- Node/Electron V8 Inspector observation and static reconstruction of JavaScript and Electron apps
- Non-executing .NET (PE/CLI) triage and controlled PTY process capture
- Export, import and diff of evidence bundles
Practical use: hand an agent the job of documenting the auth, storage, update or networking flow of legacy or third-party apps without source, or tracking behavior changes between releases (it is not a sandbox, so run targets in an isolated environment).
#ReverseEngineering #Ghidra #BinaryAnalysis #MCP #AgentTooling #Decompilation
Leave a comment