REA Added 255,126 Stars in Eight Days: Re-Measuring GitHub's Fastest Star Curve, Where Forks Grew 43x Against Stars' 18x and 76% of the Git History Is 16 Days Old

Eight days ago this site published a measured audit of REA — the MCP server that lets a coding agent reverse-engineer anything from an Electron app down to a native binary. The audit put the repository at 15,095 stars, 44 watchers, 1,569 forks, and priced a real analysis run at 209,619 tokens for eight files.

On 2026-10-16, at 00:51 UTC, the same API endpoint returned 270,221 stars, 915 watchers, 67,778 forks.

That is +255,126 stars, +871 watchers and +66,209 forks in eight days. Nothing else on GitHub that I have measured moves like this, so this article does the only thing worth doing with a number like that: it measures the curve against a baseline, and separates the parts that are genuinely anomalous from the parts that are just what an agent-era repository looks like in 2026.

Two measurements, same repository, eight days apart

Both rows are API reads of morluto/rea, taken by this site, not quoted from a dashboard.

Per day, across that window: 31,891 stars, 8,276 forks, 109 watchers.

The numbers are corroborated independently. In the Hacker News thread on REA (806 points, 338 comments), a commenter tracked the repository live on 2026-10-10 and posted: “Oct 5 ~4.2k, Oct 7 ~10.3k, Oct 8 ~17–18k, Oct 10 54.6k live… Even stranger is forks: 438 → 10,376 forks. That is an unusually high fork acceleration.” Our own measurement of 15,095 stars falls between that comment’s Oct 7 and Oct 8 readings. Two observers, two methods, one curve.

How fast is 31,891 stars a day?

Here is the same metric — lifetime average stars per day — for the biggest repositories on GitHub, computed from the API on the same day.

Read the last two blocks together. React accumulated 251,069 stars in 13.4 years; REA accumulated 255,126 in eight days — about 623x React’s lifetime rate. Linux averages 45.7 stars a day over 15 years.

The more interesting comparison is not against the classics. It is against REA’s own peers. deepseek-ai/deepseek-harness, the fastest 2026 repository I measured, averages 4,039 stars/day over its 62 days — and REA’s eight-day window is still 7.9x faster than that, and 21.7x faster than REA’s own 184-day average of 1,468/day.

So the curve is not “a popular new project”. It is a discontinuity inside the project’s own history.

The watcher ratio is not the anomaly — the fork ratio is

The obvious reading of 270,221 stars against 915 watchers is “0.34% — that must be fake”. To check that, I pulled all 30 repositories with more than 40,000 stars and computed both ratios for each.

The collapse in watcher ratio is a cohort effect, not a REA effect. Every large agent-era repository in the top 30 sits between 0.37% and 0.58% — obra/superpowers 0.37%, NousResearch/hermes-agent 0.38%, anomalyco/opencode 0.38%, deepseek-ai/deepseek-harness 0.43%, mattpocock/skills 0.52%. REA’s 0.34% is the low end of that band, not a category error. If you want the real outlier signal, it is DigitalPlatDev/FreeDomain at 0.14% with 204,368 stars.

The fork ratio is different. REA is 25.1%, and inside the 30 biggest repositories only three are higher: tensorflow (39.6%), n8n (29.5%) and the Linux kernel (27.0%). Those three pair their high fork ratio with watcher ratios of 3.75%, 0.57% and 3.37%. REA is the only repository in the top 30 with a fork ratio above 25% and a watcher ratio below 0.5%. Forks are supposed to be intent — someone plans to work on the code. 67,778 forks against 915 watchers is a combination that the top of GitHub does not otherwise produce.

And the growth of forks was faster than the growth of stars: 43.2x versus 17.9x in the same eight days.

Where the traffic actually comes from

Stars and forks are vanity metrics in the sense that they are cheap to click. Downloads are harder to fake at scale, and they are what a user needs in order to run the tool at all. npm publishes them daily, so they show the shape of the adoption curve.

That is a 218x increase in daily download rate, and 97.6% of the entire month’s downloads happened in the last week. The daily series is even clearer:

npm counts tarball fetches, and fetches come from CI, mirrors and container builds as well as from people, so 103,109 is not 103,109 users. But the shape — flat at double digits for a month, then five consecutive doublings — is a launch event, and it starts two days after the star burst began. Note also that the number kept climbing for two days after the Hacker News thread peaked.

The contributor list contains a pull-request farm

The repository has 230 contributors and 3,391 commits. The top four accounts account for 2,848 of those commits (84.0%) — down from 95.6% at the time of the Oct 8 audit, which is itself a data point: the commit base really did broaden.

Then there is the fourth name on that list. rudycelekli has 91 commits in REA — and 4,498 pull requests on GitHub, of which 2,278 were merged and 814 were closed unmerged. 142 of them are pull requests to morluto/rea. On 2026-10-16 alone that account created 39 pull requests. The same-day sample includes mvschwarz/openrig (#1337, #1338, #1339), openclaw/Peekaboo (#1085), proffesor-for-testing/agentic-qe, Yeachan-Heo/oh-my-claudecode (#4403) and HKUDS/Vibe-Trading (#1870) — unrelated projects, opened in the same hours.

That pattern matches what a commenter described in the same Hacker News thread: “when a repo gets on the trending list on github it gets swarmed by some form of contributors and most of those contributor profiles started contributing to random repos around March/April. It’s a pattern but dunno what to take from that.” A separate commenter was blunter about the whole project: “Reeks of botting, some comments here also look artificial.”

I checked the forks the same way. The 100 most recent forks were all created on 2026-10-16. Sampling 28 of their owners: 16 have zero followers, 4 have two or fewer public repositories, and 7 accounts were created in 2025 or later — including 258036-KK, an account created on 2026-10-16 whose single repository is the fork it just made of REA. Every sampled fork’s head commit is byte-identical to upstream 808339f0, i.e. nobody has pushed anything to them.

That is consistent with fork-farming, and equally consistent with a viral launch: real users do fork-and-never-touch. What the data does not support is the simpler story that 270,221 stars reflect 270,221 people who intend to use a reverse-engineering tool. The watcher count, which is the one signal that requires a deliberate second click, says 915.

76% of the git history is 16 days old

The last unusual number is not about GitHub at all; it is about the repository’s own timeline.

75.9% of every commit in the project’s history landed in a 16-day window. The repository is also a rename: the first commit is a Hopper-disassembler MCP called betterBinaryMCP, dormant for two and a half months, then rewritten into a general reverse-engineering MCP from July onward. The current release cadence matches the burst — 36 releases and 36 tags, with rea-agents going from 6.0.0 to 6.5.0 in six days.

Two readings are both defensible. An agent-driven development loop can produce 161 commits a day, and the tooling around it is real: 719,095 lines of TypeScript, of which 387,222 lines (53.9%) live in test files — 1,396 test files out of 2,985 .ts files. The other reading is that a repository rewriting 76% of its history in two weeks while adding a quarter of a million stars is being built and marketed at a pace that leaves little room for anyone to check the result.

What is verifiable and good here

Strip the growth numbers out and REA remains one of the more careful agent tools I have measured.

• No install-time execution. The published rea-agents@6.5.0 tarball carries 39 runtime dependencies and no install or postinstall script — only prepack/prepare, which do not run for consumers. Running npx does not execute repository code at install time.
• No telemetry in the source. Grepping the full 71 MB checkout for analytics SDKs (posthog, sentry, mixpanel, amplitude) returns nothing, and the only non-fixture network hosts referenced in src/ are github.com and www.hopperapp.com. Every other URL is an *.example.test fixture.
• The install surface is honest about what it changes. Setup writes an MCP registration plus instructions into your agent’s own config: .claude/skills/reverse-engineer-anything/SKILL.md, .codex/config.toml, .cursor/mcp.json, .agents/skills/…, with backups of existing configuration. You are installing instructions your agent will follow, not just a binary — which is worth understanding before approving the plan.
• The requirements are stated, and they are strict. Node.js ^22.19.0 || ^24.11.0 || >=26.0.0 (the repo pins .nvmrc to 24.18.0), SQLite inspection needs 24.15+, and deep native analysis needs your own Hopper, Ghidra or IDA. The project is explicit that it grants “no tool license, key, or activation entitlement”, so the marketing phrase “free and open source” comes with a paid disassembler attached for the main use case.
• The weak spot is named by users, not by me. The Android path still routes through headless JADX, and a security researcher in the HN thread reported that “jadx takes tens of minutes to preprocess an APK”, which he says makes large-scale APK triage impractical — he wrote a faster alternative instead.

How to read a repository like this

Five checks, all of which cost one API call each:

1. Watchers, not stars. Divide subscribers_count by stargazers_count and compare it to the era cohort, not to 2015. Above 0.5% is normal for a 2026 agent repo; below 0.35% deserves a second look.
2. Forks divided by stars, paired with watchers. Either ratio alone is noise. A fork ratio above 25% with a watcher ratio below 0.5% is the combination that the top 30 repositories do not otherwise produce.
3. Download shape over download totals. A flat line that doubles five days in a row is a launch. A curve that grows for a year is adoption.
4. Commit concentration by month. If most of a repository’s history is weeks old, you are reading a rewrite, not a track record.
5. Who is in the contributor list. One account with thousands of pull requests across unrelated repositories tells you how the contribution graph is being inflated, whatever the repository’s own quality is.

None of these checks measures whether the software works. That still requires installing it and running it, which is what the Oct 8 audit did — and its conclusion has not changed: the evidence model is good, and the output is priced for a machine rather than for a model.

FAQ

Did REA really gain 255,126 stars in eight days? Yes, as measured by two API reads of the same repository by this site: 15,095 stars on 2026-10-08 and 270,221 on 2026-10-16 at 00:51 UTC. The trajectory was independently observed in the Hacker News thread on 2026-10-10.

Does the low watcher ratio prove that the stars were bought? No. The 0.34% ratio is close to the median for every large repository created since 2025 (0.40–0.43%), so it proves that GitHub’s newest cohort attracts very few watchers. The anomaly is the fork ratio, 25.1%, which is the only figure in the top 30 that combines a high fork ratio with a sub-0.5% watcher ratio.

What do the npm numbers say? That something real happened around 2026-10-08. Downloads went from 0–56 per day for a month to 103,109 on 2026-10-12 — a 218x jump in daily rate, with 97.6% of the month’s downloads in the final week.

Is the project actually maintained? Yes, and heavily. 230 contributors, 3,391 commits, 36 releases, and the top four accounts’ share of commits fell from 95.6% to 84.0% in eight days. The caveat is that 75.9% of the commit history is 16 days old.

Should I install it with npx rea-agents setup? It is safe in the specific sense that the package has no install-time scripts and no telemetry. It is not free of consequence: setup writes an MCP registration and a SKILL.md instruction file into your agent’s configuration, and the underlying analysis engines (Hopper, IDA) are separately licensed commercial products.

Is the fastest-growing repository on GitHub the best one to use? Not necessarily, and in this case the two questions are unrelated. The tool’s value is its evidence model and its bridge coverage; its star count tells you how quickly a launch spreads, and nothing about whether eight files should cost 209,619 tokens.

The part worth remembering

The interesting number in this story is not 270,221. It is 915 — the number of people who asked to be told what the project does next, out of a quarter of a million who clicked a star. Measured against its own era, REA is not an outlier in that ratio; it is an outlier in how many of the people who arrived also forked the repository (67,778) and in how fast a single project’s entire history can be rewritten (76% of 3,391 commits in 16 days).

The tool itself is worth evaluating on its own terms, and this site has already done that once. What the eight days in between demonstrate is a different lesson: on GitHub in 2026, a good repository and a fast-growing one are two separate facts, and the second one no longer tells you anything about the first.