AM-Reaper

Security-hardened, de-clouded Asuswrt-Merlin for the ASUS RT-BE Series (WiFi 7 / Broadcom BCM4916), firmware line 3006.102.x — branded reaper. Current: v2.5.7 (newest published release — see §"Current version" below); the source tree sits at v2.7.1. Primary, hardware-validated model is the RT-BE96U; also built from per-model branches of the same tree for the RT-BE86U, RT-BE88U, GT-BE98, and GT-BE98 Pro (metal validation owed on the four siblings).

The goal: harden the open-source userspace so that only physical access can compromise the device — eliminating remotely/LAN-reachable command injection, buffer overflows, format-string and auth-bypass bugs — remove cloud-coupled/AI-branded attack surface, and produce a flashable image that can be shared with other security-conscious BE-series owners.

~70+ security issues fixed across four audit rounds (command-injection, memory-safety, and defense-in-depth) at v1.0, plus a later multi-agent audit-remediation arc (73 verified findings closed across v1.8.2–v1.8.6) — each compile/link-verified by a full firmware build. See docs/REAPER-FIXES.md. Version-by-version history: docs/CHANGELOG.md.

Beyond hardening, Reaper adds router features ASUS never shipped — two Hardware QoS engines that keep the flow accelerator on, a native Traffic Analyzer, an optional, read-only, LAN-only AI Advisor (with an opt-in, bounded network-diagnostics mode), on-router network diagnostics (ping/traceroute/DNS/netstat via the AI Advisor), one-click sanitized Reaper Diagnostics, Gatekeeper (opt-in, default-deny, on-router device access control), Reaper Warden (opt-in threat/geo firewall — ipset threat feeds + by-country blocking, IPv6 dual-stack, strict anti-lockout), a native firewall rules engine (opt-in; named objects for devices/networks/services/countries, inbound + forward + outbound rules on IPv4 and IPv6, per-device internet defaults, source- and schedule-restricted port forwards, and commit-confirm auto-rollback so a bad ruleset cannot lock you out), and a Device Identity Manager (a per-device "Devices" page unifying name, reservation, access state, and presence) — and removes cloud/telemetry surface (Alexa/Google, Trend Micro DPI, AiCloud/WebDAV, the AAE cloud tunnel). See docs/RELEASE-NOTES.md.

---

Disclaimer

This project is an independent, third-party firmware modification. Neither ASUS nor Eric Sauvageau (Asuswrt-Merlin) has participated in its development, reviewed it, approved it, or endorsed it.

References to ASUS and Asuswrt-Merlin are provided solely to identify the hardware manufacturer, acknowledge the upstream codebase, and credit the work on which this project is built.

Do not contact ASUS or the Asuswrt-Merlin developer for installation assistance, troubleshooting, debugging, compatibility questions, or issue reporting related to this firmware. Support requests and reports must be submitted through this repository or through the designated project email address, depending on the nature and sensitivity of the finding.

The GPL-covered portions of this firmware are, and remain, freely redistributable under GPL v2 — nothing here restricts that (see docs/SOURCE-AVAILABILITY.md). However, a compiled .pkgtbimage also bundles proprietary Broadcom/ASUS/Trend Micro/Tuxera components that are licensed for genuine ASUS hardware only and carry no redistribution grant (docs/README.proprietary, THIRD-PARTY-NOTICES.md). For that reason the project does not authorize rehosting of the compiled images, and asks that flashable images be obtained from the official project release channel so users receive an intended, current, and verifiable build. If you redistribute the GPL code or images, you must comply with GPL v2 — publish the corresponding source and preserve the notices (docs/SOURCE-AVAILABILITY.md).

Because this is an independently maintained project, updates may be intermittent or infrequent depending on available time, technical limitations, upstream changes, hardware access, and other project constraints.

Updates may be released when:

• ASUS publishes a new applicable GPL source release;
• Asuswrt-Merlin publishes changes relevant to this project;
• Newly discovered bugs or security vulnerabilities require remediation; or
• Upstream changes address issues involving proprietary or closed-source components that cannot be modified directly by this project.

No specific update schedule, support period, feature roadmap, or continued compatibility with future ASUS or Asuswrt-Merlin releases is guaranteed.

---

What's in this repo (and what isn't)

This repo is lean by design. It contains our work — not the multi-GB vendor tree.

In the repo:

• patches/ — the hardening, as patch files you apply onto an upstream Asuswrt-Merlin checkout.
• docs/ — all project documentation (see Documentation below).
• Root: LICENSE (GPL v2), LICENSE.reaper (the Reaper-specific notice), THIRD-PARTY-NOTICES.md, DEPENDENCIES.md, LICENSES/ (license texts), plus SECURITY.md and CONTRIBUTING.md.
• Compliance:docs/SOURCE-AVAILABILITY.md (GPL source + written offer).

Not in the repo (externally sourced — see docs/DEV-SETUP.md § "Get the inputs"):

• The upstream firmware source — clone RMerl/asuswrt-merlin.ng at tag 3006.102.8-beta2.
• The proprietary Broadcom/ASUS/Trend Micro/Tuxera components — licensed for ASUS hardware only; they come with the upstream source / ASUS GPL drop, never redistributed here.
• The toolchains — gcc-10.3 ARM/aarch64 from RMerl/am-toolchains.
• The flashable .pkgtb images are build artifacts. They are published here (GitHub Releases and in-tree under releases/), and the complete corresponding source travels with them in patches/ + provenance/ — see docs/SOURCE-AVAILABILITY.md.

Documentation — read in this order

0. docs/REAPER-GUIDE.md — the owner's guide: start here. What Reaper is, the requirements and rules for running it properly (the /jffs store, the two backups, USB, Apply and Keep, the sanitized report), every feature page, good practice, troubleshooting, glossary.
1. docs/PROJECT.md — what this fork is, scope, hard rules, threat model, flashing, legal. (The collapsed version of the upstream READMEs.)
2. docs/RELEASE-NOTES.md — what the current release contains, the two build variants, and how to flash it.
3. docs/CHANGELOG.md — big changes per version, v1.0 → the current release.
4. docs/DEV-SETUP.md — the hard-won contributor build/edit environment: WSL 20.04, gcc-10.3 toolchains, host deps, the build recipe and its traps, the editing/tooling gotchas, and how to verify a change. If you want to build or patch the firmware, this is the one.
5. docs/REAPER-FIXES.md — authoritative list of every security fix applied (all audit rounds), with commits.
6. docs/GPL-MERGE.md — maintainer guide for rebasing the hardening onto a new upstream/GPL drop.
7. patches/ — the hardening itself, as patches you apply onto an upstream checkout.
8. docs/CI-PUBLIC-BUILD.md — building the firmware in GitHub Actions from a fork, with no local setup: what each run proves, how to read the log, and current limits.

Retained upstream originals kept for reference: docs/README.proprietary (the blob-licensing notice, summarized in PROJECT.md § Legal) and docs/ASUS-Merlin_Changelog-3006.txt (upstream 3006.102 history; Reaper's own history is in docs/CHANGELOG.md). The other upstream READMEs (generic multi-model build notes, stale project blurbs, upstream support pointers) were out of date for this RT-BE-series fork; their still-relevant content was folded into PROJECT.md / DEV-SETUP.md.

Quick start

• Just want to flash it? Flashable builds are hosted right here on GitHub — grab the image for your model from the Releases page (also mirrored in-tree under releases/), each with a SHA256SUMS file to verify the download. Every image ships with its complete corresponding source in this repo (patches/ + provenance/); see docs/SOURCE-AVAILABILITY.md. There are two variants — a Standard image and an AI Advisor (…_MCP) image that adds the optional MCP server (off by default). First non-stock flash needs nvram set DOWNGRADE_CHECK_PASS=1 (see docs/PROJECT.md § Installation); flash via Administration → Firmware Upgrade.
• Want to build it yourself without setting anything up? Fork this repo and run the Build firmware from source workflow from the Actions tab in your fork. It builds an RT-BE96U image in a clean room on GitHub's runners — pinned upstream base, pinned toolchains, this repo's published patch series, this repo's own build engine and QA gate — and hands you the .pkgtb plus a full provenance record as artifacts. No Linux box, no toolchain, no Broadcom SDK required. docs/CI-PUBLIC-BUILD.md explains what a run proves, which log messages are normal noise, and what the limits are.
• Want to build it yourself locally / contribute? Read docs/DEV-SETUP.md — it walks you from fetching the upstream source + toolchains, applying patches/, through the build and verification (including every trap we hit). The AI Advisor is compiled in or out via the RTCONFIG_REAPER_MCP build flag.

Base & status

• Base: Asuswrt-Merlin 3006.102.8 (patches apply on tag 3006.102.8-beta2; the sibling-model strip is optional — see patches/README.md).
• Current version: v2.5.7 (firmware line 3006.102.8_Reaper_v2.5.7) — current means the newest published release, i.e. the newest image you can actually download from Releases, for all five models. Source rungs are cut more often than releases are published (v2.3.3, v2.3.5 and v2.3.6 exist in the patch series but were never published), so the source tree is normally ahead of this number. Everything through v1.5.6 is validated on the physical RT-BE96U (security hardening rounds 1–4, the Hardware QoS engines, Traffic Analyzer, the de-cloud removals, the AI Advisor + its network-diagnostics tier, and the Reaper UI), as are the v2.4.1 and v2.4.2 rungs; intermediate rungs are built + shipped with on-metal validation owed. The v1.6–v1.7 lines added the full 24-language UI, QoS tuning, Channel-Quality Auto Scan, Reaper Diagnostics, Gatekeeper device access control, and the PSIRT openssl passwd class-fix. The v1.8 line added Reaper Warden (threat/geo firewall — IPv6 dual-stack + per-country block stats + the rwatch health watchdog), the Samba 4.15.13a SMB3 file server with a backported CVE fix, and a multi-agent audit-remediation arc (73 verified findings closed across v1.8.2–v1.8.6). The v1.9 line added the Device Identity Manager ("Devices" page + unified storage), first-boot credential enforcement, and the Traffic Analyzer per-network/Router accuracy fix. v2.0.0 is a security-hardening milestone: two full end-to-end audits (all Reaper-authored code, plus the inherited ASUS/Merlin open source Reaper ships) with every finding fixed and no critical or high-severity flaw left open — stored-XSS neutralization of device-supplied names across the admin UI, a USB volume-label root-injection fix, config-DB/VPN-page injection + overflow hardening, CSRF-token enforcement on the live diagnostics tools, and internal-TLS certificate verification. The v2.0.x → v2.1.0 line completed the de-cloud (ASUS AWS-IoT / account-binding removal), fixed and shipped the Samba 4 file server, set secure factory defaults (WPS + UPnP off), added the Hardware QoS Diagnostics and Connections flow-explorer pages, and closed with a pre-release code-review hardening pass (six-agent audit; no critical/high). The v2.1.x line added full localization of the last hardcoded strings and a defense-in-depth pass (v2.1.1), carried forward the final Asuswrt-Merlin 3006.102.8 upstream fixes incl. OpenVPN 2.7.5 (v2.1.2), added the Connections "Quick Look" view, RFC 4638 baby-jumbo PPPoE MTU, and closed an apostrophe-in-name stored-XSS hole in the stock client list (v2.1.3), and fixed a factory-reset credential lockout, a WireGuard peer-row UI clip, and the OpenVPN version-label (which had shown 2.7.4 for the 2.7.5 binary) (v2.1.4). The v2.1.5 → v2.2.x line carried three field fixes (PPPoE MTU on the WAN page that actually ships, a self-recovering first-boot credential page, and Traffic Analyzer history that survives a reboot), then added per-device connection-health metrics with analytics export (v2.2.2), a Gatekeeper internet-only DNS carve-out, Warden block-count persistence across reboots, and an async Speed Test poll that no longer freezes the browser tab. v2.3.0 reworked the login/logout header to a play-once APNG and redesigned the analytics page; v2.3.1 adds the native firmware page — check, download, verify and flash from the router GUI, with the update check never routed through ASUS. v2.3.2 → v2.3.7 finished the browser-facing de-cloud, explained and fixed the post-flash frozen browser, shipped a measured classful Hardware QoS profile, closed a stored XSS in the shared client picker, made Warden's block statistics survive reboots, moved the first-boot credential + Wi-Fi gate into httpd so no page can bypass it, added a workaround for the closed-source Broadcom libnvram defect that can permanently freeze saving settings, and reworked the Wi-Fi pages (Auto Scan now applies the channel it ranked; Professional asks once instead of 116 times). The v2.3.8 → v2.4.1 line — source only, not yet published — adds Reaper's own native firewall (rules engine, per-device egress defaults, hardened forwards, commit-confirm auto-rollback, and a posture-summary Status view replacing the raw chain dump) and the UPnP correctness fixes (IGD:1 advertised by default, after an IGD:2 description stopped a PS5 connecting to Call of Duty, plus a revert of a carried upstream patch that had been DNAT-ing all traffic through the UPnP table). v2.4.2 made Warden's outbound direction actually block (the whitelist was tested before the destination rules, so any entry covering a LAN host — including the one the lockout guidance tells you to keep — skipped them entirely), added an opt-in filter on traffic the router itself originates, populated website-name objects from dnsmasq, and gave every firewall tab an explainer and a help link; v2.4.3 is that rung after a security audit of it, with six defects found and fixed before any of it published. The v2.4.4 → v2.4.9 line brought per-device IPv6 traffic accounting in the Traffic Analyzer, a batch of field fixes (the Call-of-Duty/UPnP and IPv6-pinhole corrections, a mesh node that flashed to a blank page, a selectable scheduled-firmware-check hour), self-explaining Reaper settings behind a ? help link, and the PPPoE 1500-byte MTU work (RFC 4638 baby-jumbo needs both MTU and MRU raised, plus the tagged-WAN VLAN-parent and dual-WAN MTU fixes). v2.5.0 added Warden bring-your-own blocklists, honest per-country block counts, a donate link that outlives the image, and a three-phase security review. v2.5.3 — folding the v2.5.1 pre-public hardening and the v2.5.2 metal-validated fixes — is the milestone that brought IPSec back from the dead: IPSec Server, IPSec client and Instant Guard were missing their strongSwan runtime on every prior image and are now built and confirmed working on metal for the first time in the lineage, alongside the Gatekeeper first-seen fix, the QoS shaper restore, and a run of firewall/Warden reliability fixes. The v2.5.4 → v2.5.7 line — source only, not yet published — lands the hardware-QoS strict-priority fix and an honest QoS page, plus the speed-test / channel-scan / Warden-blocklist / SDN-key fixes and the Firewall + About + Warden translations (v2.5.4); ipset Policy Routing — a companion to VPN Director that matches by firewall object or device — plus a post-boot PPPoE re-dial for lines that go quiet after a reboot (v2.5.5) and its editor page (v2.5.6); and an audit-remainder security-hardening batch (v2.5.7). Model scope: the full five-model fleet (RT-BE96U / RT-BE86U / RT-BE88U / GT-BE98 / GT-BE98 Pro) is published at v2.5.3, both variants each and all passing the verify gate. RT-BE96U is the primary, hardware-validated build; on-metal validation is owed on the four siblings. Per-version history: docs/CHANGELOG.md.

Legal

• GPL: the GPL portions are under GPL v2 (LICENSE); the Reaper modifications are likewise GPL v2, with a Reaper-specific notice in LICENSE.reaper. Publish your changes if you redistribute the GPL code.
• Proprietary components (ASUS / Broadcom / Trend Micro / Tuxera) are licensed for genuine ASUS hardware only (docs/README.proprietary) and are intentionally not included here. This fork targets the ASUS RT-BE Series (RT-BE96U / RT-BE86U / RT-BE88U / GT-BE98 / GT-BE98 Pro), all BCM4916.
• No warranty: provided as-is; keep a recovery path ready when flashing. See the Disclaimer above for redistribution and support terms.

Security reports: see SECURITY.md. Contributions: see CONTRIBUTING.md.