Registry › Compare › Garak vs REA

Garak vs REA

REA leads on trust: 93.4/100 (Grade A) against 66.5/100 (Grade B), a 26.9-point gap. Garak rests on broader evidence; REA leads on supply-chain integrity and provenance. Note: REA's evidence coverage is thinner (coverage B vs A) — its score rests on fewer independent signal types.

B Garak 66.5

the LLM vulnerability scanner

NVIDIA/garak · #464 overall · #7 Security & Guardrails · coverage A (4/5)

Choose Garak if breadth of evidence matters most.

A vs BEvidence coverage: 4 of 5 independent signal types, against 3

A REA 93.4

Reverse engineer anything with agents, from app behavior down to native binaries.

morluto/rea · #7 overall · #1 Security & Guardrails · coverage B (3/5)

Choose REA if supply-chain integrity and provenance matter most.

+9.9Safety / Integrity: 77% of recent commits signed, against 76%
+7.2Identity / Provenance: package provenance attested, against none
+5.0Adoption: 132.5k weekly downloads against 10.9k
+1.6Transparency: OSSF Scorecard 6.7 against 4.8

Where they differ

9.8

Safety / IntegrityREA +9.9

19.7

10.8

Identity / ProvenanceREA +7.2

18.0

12.6

TransparencyREA +1.6

14.2

18.7

MaintenanceREA +1.3

20.0

14.9

AdoptionREA +5.0

19.9

-0.3

Runtime calibrationREA +1.9

+1.6

Full evidence table

An independent, evidence-based trust comparison of Garak and REA, two Security & Guardrails projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	GarakNVIDIA/garak	REAmorluto/rea
HVTrust score	66.5	93.4
Evidence grade	B	A
Coverage grade	A	B
Overall rank	#464	#7
Rank in Security & Guardrails	#7	#1
GitHub stars	9.6k	286.2k
Last updated	1d ago	today
Build provenance	No	Yes
OSSF Scorecard	4.8 / 10	6.7 / 10
License	Apache-2.0	MIT
Downloads	11k/wk	133k/wk
Trust dimensions (points earned)
Safety / integrity / 25	9.8	19.7
Identity & provenance / 18	10.8	18.0
Transparency / 17	12.6	14.2
Maintenance / 20	18.7	20.0
Adoption / 20	14.9	19.9
Runtime capability surface (full matrix)
MCP server	—	Implemented
External providers	8 — Amazon Bedrock, Anthropic, Cohere, …	—
Requires API keys	Yes	No
Plugin surface	plugins	extensions
Provenance drift	Match	Match

Open in the live compare tool → Garak profile REA profile More Security & Guardrails →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →