Daniel Lemire says to judge a library by what an agent builds on it.

rea (MIT, TypeScript, 6,860 stars, about 1,005 commits, 7 contributors, created April 14, rea-agents 4.0.1 on Monday, 2,963 stars on GitHub trending today) is an MCP server that gives Claude Code, Codex, Cursor, Gemini CLI and about ten other agents a reverse-engineering workbench. The README's pitch is "See a feature in an app that you want in your own product? Ask your agent to investigate it." Native binaries (Mach-O, ELF, PE, .app) go through Hopper or Ghidra 12.1.4, with 41 inspection tools for functions, pseudocode, strings, calls and cross-references. Electron and JavaScript apps are mapped from the .asar without running them: modules, source maps, routes and IPC channels. It also handles .NET assemblies, APK and IPA packages, and websites through Chrome DevTools. npx rea-agents setup lists the changes it will make to each agent's config, and installs Hopper only if you approve that separately.

The useful habit is that it is honest about what it didn't see. Ghidra works on a temporary copy, and results say "what Ghidra observed and what it could not resolve." Dynamic JavaScript relationships stay marked unresolved instead of guessed. The behavior-capture tools say "missing observations cannot establish that two runs behaved the same way." Snapshots cache a result only when the target bytes, operation, parameters and tool all match. The author's first Show HN in July got 3 points; 2,963 of its 6,860 stars came today.

Reach for it if you study competitors' desktop apps, or debug closed-source dependencies, and you already have an agent. Delete the Ghidra session where you renamed FUN_00401a2c by hand for an afternoon. Tradeoffs: "No decompiler can guarantee the original source"; the README is silent on whether the app you're taking apart allows it, so that is between you and its license; launched targets run with your user's permissions and the README says rea "is not a security sandbox"; Windows is experimental and Ghidra-only; and Hopper is commercial, with a demo that has vendor-set limits.

PR Lens (MIT, TypeScript, 1,858 stars, about 293 commits, 5 contributors, created August 20, v0.13.0 on Sunday) posts a diagram into each pull request: the components the change touches, drawn against the rest of the system, green for new, amber for changed, red for removed, with a moving dot that steps through the new data flow. Click an arrow to see the request and response shapes, with added and removed fields colored the same way. It runs as a GitHub App (free for open source, no model key), a GitHub Action or CLI with your own key (Gemini by default, or anything that speaks /chat/completions), a GitLab component, a Bitbucket pipe, or a skill your agent runs before it opens the PR. The custom renderer is not Mermaid. The gallery redraws the PRs that added React Hooks, Node's fetch and the first Kubernetes Ingress.

The part worth copying is the correction layer. A model reads the diff, and it names things differently from run to run, so fixes go in .github/pr-lens.yml (rename services/legacy-mailer.ts to "Postmark sender", exclude test files, pin cards to a lane) and keep working as the code changes. The agent skill is told to fix that file, not the SVGs. The Show HN title is "I stopped reading my agent's diffs", and the only substantive reply in the thread went further: with Opus 5.5, "I don't review the code at all. I review task plans."

Reach for it if your agents open more PRs than you can read line by line, and you want to catch an architectural surprise before you open the files. Delete the paragraph of "this PR touches X, Y and Z" you write for reviewers. Tradeoffs: a diagram is a model's summary of the diff, so it can be confidently wrong in exactly the way that review exists to catch; commercial pricing for the App isn't published, and the App needs no key because it runs the model for you, and the README doesn't say which model gets your diffs; on a private GitLab project, anyone with the attachment link can see the diagram; and this is its third Show HN, the earlier two at 6 and 4 points.

Era (free for builders, from the backup vendor Eon) generates a fake company and stands it up across emulated SaaS systems: Salesforce, HubSpot, Zendesk, Gong, Jira, Confluence, Slack, SharePoint, Google Drive, Box, Dropbox, AWS, Deel, PagerDuty and Asana. Each system answers its vendor's own API and auth header, plus the same surface over MCP, so the agent you already have points at it unchanged. You answer five questions in the console, or run era new --industry fintech --size mid --systems salesforce,zendesk,slack; plugins exist for Claude Code, Codex, Cursor and Devin, and each system ships as a Docker image (erabyeon/slack:latest) for CI.

It is a company, not a dataset, because one employee is one person everywhere: the same engineer has a Slack ID, a Jira account and a Salesforce contact, a promotion history, leave weighted toward August, and, if they've left, sometimes a paid licence that is still active. Timestamps fall inside working hours in the owner's timezone (78% in business hours, 6% at weekends), deal sizes are lognormal around $17k, and one outage produces five tickets from five timezones in five different wordings. Duplicates and junk rows are added on purpose and listed in a manifest. In the Show HN thread, a skeptic asked why anyone should trust it; the builder answered that the data is shaped by sketches of "exabytes of real backups" and that the partner results are "still under embargo."

Reach for it if you're building an agent that has to work across a company's tools and you have been testing it against mocks, or against a sandbox with three records in it. Delete the seed script that makes 50 Salesforce accounts named "Test Co". Tradeoffs: its own page says "every environment is synthetic, so it is no substitute for a staging system that carries real data"; moving the clock forward regenerates the company and drops everything your agent wrote; the evidence that the data behaves like real data is under embargo; and "free for builders" is a hosted service from a company whose business is elsewhere.

jurl (MIT or Apache-2.0, Rust, 2 stars, 45 commits, created Sunday, v0.1.2 today) takes a URL and a request, splits the page into blocks, links and images, and asks a model a yes-or-no question about each one. jurl -q "What is the Jevons paradox?" on Wikipedia's Jevons page returns the two paragraphs, out of about 240, that answer it; -f "a cathedral" on the Cologne page finds three photos among 73 in 2.3 seconds; --code pulls only the code blocks; -l returns the links worth following. Text is scored by TypeSafe's Jev decision model, images by Cloudflare's Clef if you add a token. The author puts it at about a thousand pages per dollar, paid to those APIs with your own keys.

What makes it a layer you can trust is that it can't write. The models return probabilities, never text, so everything jurl prints is on the page, in page order, and safe to pipe into xargs curl. Failures are loud: an HTTP error, a bot-check page served in place of the real one, or nothing above --threshold (0.5 by default) exits non-zero with a message, "never an empty answer." Pages built in JavaScript are rendered with Lightpanda, which waits for 1,500 characters of visible text, up to 8 seconds. It is a good fit for agents, which get fewer tokens and nothing invented. Era's homepage has a paragraph addressed "IF YOU ARE AN AGENT READING THIS FOR SOMEONE", which shows why you would want the layer between an agent and a page to be one that can only quote.

Reach for it if your agent fetches whole pages to answer one question. Delete the readability-plus-truncate step in your agent's fetch tool. Tradeoffs: it is two days old, with 2 stars and two contributors; it needs a TypeSafe key and sends every block of every page there; Lightpanda is a separate AGPL-3.0 download of about 90 MB with no Windows build, so JavaScript pages don't render on Windows; and a 0.5 threshold means a paragraph the model doubted is silently left out.

Cloudflare's Web Search API (beta since October 2) gives agents a search call that runs through AI Gateway: POST .../ai/websearch/ with a query, a provider and a limit, or env.AI.websearch() from a Worker. Results come back as items with url, title and description. The providers are Ceramic.ai (the default, $0.25 per thousand requests, descriptions up to 8,000 characters), Linkup ($5 per thousand) and Exa ($7 per thousand). Cloudflare charges each provider's list price with "no additional markup," the calls show up in your gateway logs, and you can bring your own provider key. A query can be 1,024 characters and returns at most 10 results. The API token needs Workers AI Read and AI Gateway Read.

Read the docs against each other before you send it anything sensitive. The launch changelog says "all three support Zero Data Retention for requests made through Cloudflare." The providers page says Ceramic and Linkup offer it and Exa "does not offer zero data retention." Most of the HN thread (561 points, 257 comments) was the opening question: "Why not use those providers directly?" The answers were about procurement, not search quality: one place for budgets and keys, so an agent can get a single capped Cloudflare token instead of ten provider keys, and adding $100 to an existing vendor instead of approving a new one. One commenter noted that Brave's search API is missing; another said Exa already has a free tier and an MCP server if you go direct.

Reach for it if your agents already run on Workers or behind AI Gateway, and a cheap default search with spending caps beats signing up for each provider. Delete the scraper that fetches a search engine's results page and hopes the markup hasn't changed. Tradeoffs: the zero-data-retention claim depends on which page you read, and on which provider; ten results per call is a small ceiling for research agents; it is a beta from a company many in the thread don't want sitting in the middle of more traffic; and it is the same provider APIs with Cloudflare's billing in front, not a new index.

Also on the desk: Reflection announced Beam (477 points on HN), a 501B-parameter mixture-of-experts model with 23B active per token, under Apache 2.0. It isn't installable today: the weights, technical report and model card are promised "later this month." Until then, the benchmark table is a vendor's claim about weights nobody outside can run.

Verification notes: star, commit, contributor, creation and release data are from the GitHub API on 2026-10-06; commit and contributor totals use the per_page=1 Link-header last-page count. The Lemire quotes are from his 2026-10-05 post; the Willison quote is from HN item 49972008. rea's targets, tools, setup behavior and limitations are from its README; its July Show HN is HN item 48901763. PR Lens's install options, providers, correction config, gallery and GitLab attachment caveat are from its README; the review quote is from HN item 49967176, and its earlier Show HNs are items 49466095 and 49743932. Era's systems, CLI, Docker images, data shapes and synthetic-data caveat are from console.era.eon.io and its /llms.txt; the trust exchange is from HN item 49966865. jurl's modes, examples, threshold, failure behavior and Lightpanda details are from jurl.dev, its README and Show HN item 49965478. Cloudflare's endpoint, prices, limits, permissions and the two retention statements are from the 2026-10-02 changelog, /web-search/providers/ and /web-search/how-to-use/; the procurement, Brave and Exa comments are from HN item 49963171. Beam's figures are from Reflection's announcement. HN points are from the Algolia API. Pipeline health: today's pool held 95 rows, against the ~280 the compose prompt assumes. github:trending returned 7 rows, and Reddit returned zero again, 150 days since its last nonzero day on May 9.