Registry › Compare › Deepsec vs REA

Deepsec vs REA

REA leads on trust: 89.8/100 (Grade A) against 57.2/100 (Grade C), a 32.6-point gap. REA leads on supply-chain integrity and provenance, and rests on broader evidence.

C Deepsec 57.2

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents

vercel-labs/deepsec · #791 overall · #11 Security & Guardrails · coverage C (2/5)

Deepsec doesn't lead on any scored dimension in this pair.

A REA 89.8

Reverse engineer anything with agents, from app behavior down to native binaries.

morluto/rea · #31 overall · #2 Security & Guardrails · coverage B (3/5)

Choose REA if supply-chain integrity and provenance matter most.

+9.6Safety / Integrity: OSSF Scorecard 6.6 against 4.9
+7.2Identity / Provenance: package provenance attested, against none
+6.7Maintenance: last push 1d ago, against 5d ago
+4.2Adoption: 449.9k GitHub stars against 8.4k

Where they differ

11.1

Safety / IntegrityREA +9.6

20.7

10.8

Identity / ProvenanceREA +7.2

18.0

12.7

TransparencyREA +1.4

14.1

13.2

MaintenanceREA +6.7

19.9

9.4

AdoptionREA +4.2

13.6

+0.0

Runtime calibrationREA +3.5

+3.5

Full evidence table

An independent, evidence-based trust comparison of Deepsec and REA, two Security & Guardrails projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	Deepsecvercel-labs/deepsec	REAmorluto/rea
HVTrust score	57.2	89.8
Evidence grade	C	A
Coverage grade	C	B
Overall rank	#791	#31
Rank in Security & Guardrails	#11	#2
GitHub stars	8.4k	449.9k
Last updated	5d ago	1d ago
Build provenance	No	Yes
OSSF Scorecard	4.9 / 10	6.6 / 10
License	Apache-2.0	MIT
Downloads	—	—
Trust dimensions (points earned)
Safety / integrity / 25	11.1	20.7
Identity & provenance / 18	10.8	18.0
Transparency / 17	12.7	14.1
Maintenance / 20	13.2	19.9
Adoption / 20	9.4	13.6
Runtime capability surface (full matrix)
MCP server	—	Implemented
External providers	—	1 — Anthropic
Requires API keys	No	No
Plugin surface	—	plugins
Provenance drift	—	Match

Open in the live compare tool → Deepsec profile REA profile More Security & Guardrails →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →