Registry › Compare › Garak vs REA

Garak vs REA

REA leads on trust: 79.4/100 (Grade B) against 65.4/100 (Grade B), a 14.0-point gap. Garak leads on adoption and rests on broader evidence; REA leads on provenance and supply-chain integrity. Note: REA's evidence coverage is thinner (coverage B vs A) — its score rests on fewer independent signal types.

B Garak 65.4

the LLM vulnerability scanner

NVIDIA/garak · #462 overall · #6 Security & Guardrails · coverage A (4/5)

Choose Garak if adoption matters most.

+5.5Adoption: 10.6k weekly downloads against 155
A vs BEvidence coverage: 4 of 5 independent signal types, against 3

B REA 79.4

Reverse engineer anything with agents, from app behavior down to native binaries.

morluto/rea · #157 overall · #3 Security & Guardrails · coverage B (3/5)

Choose REA if provenance and supply-chain integrity matter most.

+7.2Identity / Provenance: package provenance attested, against none
+4.4Safety / Integrity: OSSF Scorecard 4.8 against 4.7
+1.8Maintenance: last push today, against 1d ago

Where they differ

9.3

Safety / IntegrityREA +4.4

13.7

10.8

Identity / ProvenanceREA +7.2

18.0

12.5

TransparencyREA +0.1

12.6

18.2

MaintenanceREA +1.8

20.0

14.9

AdoptionGarak +5.5

9.4

-0.3

Runtime calibrationREA +6.0

+5.7

Full evidence table

An independent, evidence-based trust comparison of Garak and REA, two Security & Guardrails projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	GarakNVIDIA/garak	REAmorluto/rea
HVTrust score	65.4	79.4
Evidence grade	B	B
Coverage grade	A	B
Overall rank	#462	#157
Rank in Security & Guardrails	#6	#3
GitHub stars	9.4k	477
Last updated	1d ago	today
Build provenance	No	Yes
OSSF Scorecard	4.7 / 10	4.8 / 10
License	Apache-2.0	MIT
Downloads	11k/wk	155/wk
Trust dimensions (points earned)
Safety / integrity / 25	9.3	13.7
Identity & provenance / 18	10.8	18.0
Transparency / 17	12.5	12.6
Maintenance / 20	18.2	20.0
Adoption / 20	14.9	9.4
Runtime capability surface (full matrix)
MCP server	—	Implemented
External providers	8 — Amazon Bedrock, Anthropic, Cohere, …	—
Requires API keys	Yes	No
Plugin surface	plugins	—
Provenance drift	Match	Match

Open in the live compare tool → Garak profile REA profile More Security & Guardrails →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →