#1313th of 19 in Security
bla
Hardens release artifacts against AI reverse-engineering agents
Documentation ↗
(opens in a new tab)Website ↗
(opens in a new tab)Repository on GitHub ↗
(opens in a new tab)
- Stars
- 5.3k
- License
- MIT
- Last commit
- Nov 2026
- Last release
- Nov 2026
- Language
- TypeScript
110 on 20 Oct 20265,255 on 10 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
BLA (npm package bla-agents) is a TypeScript CLI and MCP server that rewrites release artifacts with decoys, honey SourceMaps and format-specific resource-limit triggers, so AI reverse-engineering agents such as morluto/rea hit budget or capacity errors. It covers 19+ formats including JS, Electron ASAR, WASM, SQLite, Safetensors, GGUF and PE, and ships Vite, Rollup, Webpack and esbuild plugins.
Who it is for: Software authors protecting their own releases from LLM reverse engineering
Strengths
- Format shields are pure TypeScript/Node, with no Ghidra, IDA or packer dependency
- One setup command registers MCP tools with Claude Code, Cursor, Codex, Gemini CLI and others
- Empirical table names the exact REA limit tripped per format, reproducible via npm run redteam:rea
- Bundler plugins for Vite, Rollup, Webpack and esbuild; opt-in ed25519 signed manifests
Weaknesses
- Token and USD amplification figures are internal estimates, not measured against live agents
- Ghidra, Frida, LLDB, JADX and firmware paths are not empirically tested
- Runtime equivalence is verified only on bundled fixtures; custom artifacts need your own tests
- Protection depends on specific REA analyzer limits; other tools may not be affected
What it needs
- no GPU
- Needs Node.js ^22.23.4 or >=24, Wabt (optional, red-team suite), tshark (optional, red-team suite)
- Models: Safetensors, GGUF
Quick answers
Is bla open source?
Yes. Its code is on GitHub under the MIT license.
Does bla need a GPU?
No, it runs without one.
Also in Security
See all 19| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source analysis | 91 out of 100 |
| 2 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 87 out of 100 |
| 3 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 84 out of 100 |
| #4 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 77 out of 100 |
| #5 | ai-infra-guardRed-teaming platform for AI infra CVEs, MCP servers, agent skills and jailbreaks | 75 out of 100 |