Asuswrt-Merlin, taken further
A security-hardened, de-clouded, open-source Asuswrt-Merlin fork for six ASUS Wi-Fi 7 routers: RT-BE86U, RT-BE88U, RT-BE96U, GT-BE98, GT-BE98 Pro, and the experimental RT-BE92U. Reaper keeps the familiar Merlin foundation while adding deeper security controls, hardware-accelerated QoS, network visibility, diagnostics, privacy-focused defaults, and a purpose-built administration experience.
The newest image you can install without opting into a beta, and what the router's own update check reads. Warden lists that survive the move to flash, a rebuilt LAN shield, atomic feed updates, steadier Gatekeeper, and the Traffic Analyzer's live view unfrozen.
The 3.0 window is on every model as a beta. Read the release notes and keep a recovery path before you flash it.
.rbk that carries settings and the whole /jffs partition.Why Reaper exists
Reaper is built around a simple idea: infrastructure you own should remain understandable, controllable, and defensible. It is not a replacement for the Asuswrt-Merlin foundation - it is a focused fork that adds security hardening, visibility, and operational tooling for people who want more control over the edge of their network.
Targeted fixes and defence-in-depth changes across the open-source userspace, with findings documented and changes compile-verified through the firmware build.
Cloud-coupled features and unnecessary remote surface are reduced where practical, while management and diagnostics stay centred on the router and your LAN.
Hardware-accelerated QoS, connection inspection, traffic analytics, and practical diagnostics help tune the network without turning the router into a black box.
The project publishes its patch series, build instructions, public build workflow, release documentation, source-availability details, and build provenance.
Reaper additions
The interface is intentionally different, but the deeper changes are functional: dedicated security controls, traffic management, device policy, diagnostics, and operational tools integrated directly into the firmware.
An opt-in threat and geographic firewall that consumes reputation feeds and your own lists, applies country policy on IPv4 and IPv6, keeps honest per-country block counts, and preserves an explicit anti-lockout rule.
Platform scope
Five BCM4916 models are standard firmware targets - the RT-BE96U is simply the project's primary development and physical-validation hardware. The RT-BE92U, built on the sibling BCM6765 SoC, joined in the v2.7 line and ships as an experimental prerelease.
Reaper provides model-specific firmware images for every supported router. Flash only the image built for your exact model - cross-flashing can brick the unit.
Broadcom BCM4916 · Standard releases
Broadcom BCM6765 · Experimental prereleases
The RT-BE92U rides the same patch series and the same clean-room CI matrix as the BCM4916 fleet, but because it publishes as a prerelease it never lands as a standard release alongside the other five. Treat it as field-test firmware and keep a recovery path.
Choose the firmware image that matches how you want to run the router.
Includes the optional Reaper AI Advisor/MCP capability. The service remains off until explicitly configured.
All AI Advisor/MCP components are compiled out for users who want the smallest feature surface.
Owner's guide
The Reaper owner's guide is the single reference for installing, configuring, and running the firmware. It is written for someone who will operate the router - technically literate, not a developer - and it covers every Reaper page and switch: what it does, how to set it up, what to expect, and the limits and gotchas the project has documented.
Interface explorer
The rail and tabs below are laid out the way the Reaper shell lays them out, and every screen behind them is a real capture of the page it names, taken on the project's own hardware with addresses and identifiers blurred. Nothing here is interactive beyond navigation: pick a section, pick a tab, read the screen, open it full size.
Open source, built in the open
Reaper is a public patch series applied to the public Asuswrt-Merlin source, and every published image is compiled in a GitHub Actions clean room from pinned, public inputs. There is nothing in the pipeline you cannot read, and nothing in the firmware that answers to anyone but you.
The build needs no private keys, tokens, SDK drops, or hidden inputs. Fork the repository, run the workflow, and you get the same image the project publishes - from the same source, on GitHub's own runners.
The ASUS cloud connector, account binding, AAE/AiHome tunnel, AiCloud, and every browser-side callback to vendor servers are removed. The build fails if a vendor CDN reference reaches the shipped web root.
The router reports to no one. The only outbound check the firmware makes on its own is the opt-in update check against the Reaper GitHub release channel - and nothing is ever downloaded or installed automatically.
Nothing about a Reaper release depends on the maintainer's machine. The public workflow rebuilds the firmware from scratch on a fresh GitHub-hosted runner, and the provenance it prints is what lets anyone check a published image against source.
Review the documented hardening work, the release history, and the provenance material that connects every published image back to source.
Everything Reaper adds is GPL v2, like the Merlin base it patches. The Broadcom radio drivers and a small set of vendor objects are proprietary, licensed for genuine ASUS hardware only, and shipped unmodified - the project lists them rather than pretending they are not there.
Every supported model has to be bought, flashed, bricked, and recovered on real hardware before a release ships. If Reaper saved you time, you can help cover the bench.
Ready to dig deeper?
Reaper is independently maintained third-party firmware. Before flashing, read the owner's guide, review the current release notes, confirm your exact model, verify the hashes, and know the rollback procedure.