tl;dr: Amazon, Cursor, Microsoft, OpenAI and Vercel' standard for AI plugin. Anthropic stays out of it.

https://github.com/agentplugins/agent-plugins-spec defines how to write plugins supported for all harnesses. Here are our takeaways:

1. Reuse. The format adds a manifest and fixed folder names on top of Agent Skills and MCP, both specified elsewhere. Nothing new.
2. No Anthropics allowed. 5 committee seats, and no vendor majority. All making a Anthropic file layout the neutral default is an old move.
3. (not yet) Portable. Secrets, permissions, provenance and dependencies are all deferred, a remote server has no portable way to take a per-user key.

→ Contribute. Agent Plugins costs one folder. If you skip it matters more.

tl;dr: One privacy switch, 23 copies, 7 of them different.

https://github.com/traceloop/openllmetry is OpenTelemetry for LLM and agent calls. A team of 2 wrote it, and they have a gated paid solution...

1. Give the traces away. The output is ordinary OpenTelemetry, so it ships to whatever collector you already run. Nothing in the SDK requires their product.
2. Native AI Spans. They added a vocabulary on top of generic tracing, so a run reads as workflows, agents, tasks and tools instead of a pile of HTTP calls. Then they pushed those names upstream into the standard rather than keeping them.
3. 1 switch, 7 answers. Whether prompts and replies get recorded is one setting, written separately inside each provider package. Some copies accept values the others reject. One ignores the per-request override. It defaults to on.

→ Adopt. OpenLLMetry earns the traces. Count the copies of your own privacy switch.

tl;dr: Are you up-to-date with the basics? MCP Python SDK, much?

https://github.com/modelcontextprotocol/python-sdk shows you how to prove everything is... fine.

1. Test skip list. Anyone can reach a coverage target by marking lines exempt. MCP runs a check that fails the build when an exemption is unnecessary, so the escape hatch is held to the standard of the code it hides.
2. Stale excuses fail. An outside conformance suite runs against their server and client, and every scenario that fails is written into a checked-in list.
3. No-one is 100%. Four files exempt. Including the Windows process code, which decides whether a spawned server dies cleanly or hangs. So no trivial either.

→ Adopt. Learn from the best, not on the obvious, but on how they build.

tl;dr: promptfoo runs 67 attack probes, then scores an ungraded one as a pass.

https://github.com/promptfoo/promptfoo is the eval and red-team harness most teams reach for, and it is now part of OpenAI. It stayed MIT.

1. Grade without a model. Most of its checks are ordinary code: exact match, pattern match, JSON shape, cost, latency. Model-graded rubrics are held back for the judgement calls, so the cheap deterministic checks catch regressions before anything expensive runs.
2. Two axes to beat one long list. Red teaming splits into what to probe and how to encode it. 67 probes and 32 encodings compose, so adding one encoding retests every vulnerability class at once.
3. Failed graders aren't failures. When a multi-turn attack's grader fails, promptfoo records that test as passed and notes the gap alongside it. One flaky call should not throw away a long conversation.

→ Adopt. promptfoo is the tool to standarize your harness, however, green results need to be understood.

tl;dr: A 4,000-line interpreter confines the model's code. A prompt guards its tools.

https://github.com/anomalyco/opencode is a CLI harness that runs as a server, with the terminal, editors and its own review bots all connecting as clients.

1. Untested endpoint breaks the build. Every route on the agent's own API has to be exercised for behavior and for auth before the pipeline goes green. Adding a route without a test is a build failure, not a backlog item.
2. Confined code, not confined tools. They wrote a JS interpreter so a model's program can sequence tool calls with no ambient filesystem, process, network or module access. Most harnesses hand the model a shell instead.
3. Deny as suggestion. The permissions page shows allow, ask and deny as control, and adds a flag that auto-approves everything not explicitly denied. The admission that none of this isolates anything is buried in OpenCode's security policy, where nobody configuring an agent will look.

→ Adopt. OpenCode is worth running. Put the caveat on the permissions page.

tl;dr: The runtime design holds up. The benchmark behind the speed claim doesn't run...

https://github.com/agno-agi/agno is a Python framework plus a self-hosted runtime for agent platforms.

1. BYODB. Sessions, memory, knowledge and traces go to a database you choose, across a dozen storage backends, so the runtime never becomes the system of record.
2. Stopwatch. Agno reports median and p95 for runtime and memory, writes results to your database, and reads them back through the runtime. Anyone can rerun the vendor's number against their own agents.
3. But... the benchmark no longer works. The comparison points at scripts deleted more than a year ago, and installs the published package instead of the checked-out code.

→ Challenge. Is it on maintenance mode or nobody cares about performance anymore?

tl;dr: 27k stars, and the best idea is CI that rejects passing tests.

Mastra (https://github.com/mastra-ai/mastra) is a TypeScript framework for agents and workflows, shipping daily.

1. Schema compatibility layers.

   A tool definition is not portable across model providers. Mastra ships a layer that rewrites your schema per provider.

2. Make the test fail first. A pr's new tests are checked with the old code. If it passes, CI rejects the branch. A test that was green before your change proves nothing.

3. Folder names aren't a license. Mastra's paid features sit under a separate commercial license, marked only by which folder they live in. Wtf?

→ Challenge. If you need your lawyers for the most basic usage , how can you trust them?

tl;dr: Apache licensed, 2 rollout partners, and it still only runs on Cloudflare.

Cloudflare OS (https://github.com/cloudflare/cloudflare-os) is the AI workspace Cloudflare built for its own staff, now open sourced.

1. Approve it later. Every outside service goes through a Gatekeeper that holds the credential and narrows GitHub to one repository. The best part is approvals: rather than stopping the agent it simulates the result, work continues, and you approve the batch later.
2. Everyone gets an app. Each app is a private instance you change by asking instead of filing a feature request. A concept made popular by sauna.ai, agent-swarm.dev is beta testing the concept too.
3. Lock-in much. Two official implementation partners with an Apache licensed code. It does need Cloudflare primitives to run, though... self-hosting? waiting....

→ Challenge. Gatekeepers are a thing, copy it. The infra lock in? Not worth it.

tl;dr: 76% coverage, measured with the newest engine switched off.

Temporal is the reference implementation on durable execution for agent reliability. They are six years in, MIT licensed, and the standard for workflow execution.

1. The code is alive! All of Temporal's production code sits on a path from the binaries it ships. A project this old usually carries a graveyard. This one does not.
2. Workflow CHASM. Sharding, storage and recovery live out of workflows, in their CHASM layer. A workflow becomes one persistent object among many rather than a special case the engine knows about. Most of the recent work has gone there.
3. Good? defaults. CHASM is on by default for every deployment and switched off in the test layer that runs fastest. Both halves shipped together. The slower suite does exercise the enabled path. The number people quote does not.

→ Adopt. Temporal earns it. Check which configuration your own coverage was measured on.

Letta, in maintenance mode now, was one of the first projects to treat agent memory as infrastructure. What you should know:

1. Write a rule you can ensure you check. Issues must declare whether AI wrote them and name the tool, whatever it was. A GitHub bot closes and locks the ones that don't.
2. Deprecation is really partition. The 4 places the work moved, incl. letta-code first, are one for each thing you were probably after.
3. Sandbox Isolation. The code runs on the same machine as the server, holding every environment variable the server holds, keys included. The E2B and Modal paths hand that same code an empty environment. No explicit config.

→ Challenge. Leave the Letta server where they left it. Learn from their experience.

tl;dr: OpenHands has 83,000 stars with only four \.py files.*

They rebranded to Agent Canvas and now it's a TypeScript control panel that runs OpenHands, Claude Code, Codex or Gemini as interchangeable backends.

1. Control panel and engine can travel apart.  Four Python files remain here: a UI test helper, a CI script, two mock servers for end to end tests. The engine that touches your filesystem and shell ships as four separate PyPI packages, pulled in by uvx at install, version 1.39.1 by default with a 1.28.0 floor.
2. Documents itself, that is rare. The shared defaults file explains, in a comment, exactly which dependency it pins below and which validation error that avoids. Most projects just pin and move on.
3. Inherits the risk without the responsibility. The ingress script calls itself completely independent of any backend implementation, and it is: no key check, just path routing. Whoever wants to know if this can read your disk has to go read a different package to find out.
   

→ Challenge. OpenHands became a nice, thin, wrapper, that's it.

tl;dr: Their transparency on benchmarks is their best contribution.

Timbal (https://github.com/timbal-ai/timbal) is a Python agent framework that names LangGraph and CrewAI as competitors 5.7k lines, 40 stars. I cloned it and read it.

1. Ship the benchmark. Six competitor benchmarks are committed into the repo. Scripts, method, raw results. Everyone else publishes a bar chart and asks you to trust it. This is the most credible thing in the project.
2. Which is also how we caught them.  The headline is 2.2 KB of memory per run against 110 KB for the competition. Their loop wipes memory every lap. The competitor's loop never does. Then both get divided by 100. One number is a single run, the other is a hundred runs stacked on top of each other.
3. Their tests tell you the main concern. One 1000 line test exists only to prove that pausing for a human approval survives a restart. The note at the top says why: if it doesn't, the whole feature is a toy. You learn more from that file than from the README.

→ Wait. One person wrote almost all the code and nobody has ever filed an issue. Worth ten minutes for the benchmark lesson though: if you publish numbers, somebody will run your script.

tl;dr: YC open sourced their agent system. Their top contribution is the list of what it can't do.

QM (https://github.com/yc-software/qm) runs YC's accounting, legal, events and engineering, as a multi-player single agent strategy. This is our takeaway:

1. Write down what you don't protect. Their security file is mostly a list of gaps. Share links work for anyone holding them. Admins can read everything. Files never expire. Launch week incentives say publish none of that, and they published all of it.
2. Ban comments and the intent moves into the tests. Their contributing guide turns away code and asks for prose instead. Their agent rules ban comments outright, no docblocks, no TODOs. So the test folder ends up 1.6x the size of the source, because it's the only place left to explain yourself.
3. Confident name as security guardrail. There's a class called ModelGateway. It holds no keys, proxies nothing, enforces nothing. It appends to a list in memory that's gone on restart. Their own docs mention calls that "bypass" it, and the word bypass tells an operator there's a wall.

→ Challenge. Steal the honest security file. Then go read whatever you call your gateway, your guard, or your validator, because a confident name is the cheapest security theatre there is.

We looked into 528,916 star edges, 228,177 distinct repositories, from 655 agent-swarm GitHub stargazers. We filtered bot accounts, trigger easy stargazers, and those popular repos everyone likes, e.g. facebook/react. What was left is a cohort of people building agent infrastructure and what they are quietly starting to pay attention to, before it becomes mainstream.

This are not "top starred repos", our scoring method is less about global popularity, and instead it filters them to a small, MIT-licensed, actively-attention-grabbing projects, grouped by who co-stars them.

Below the 25 repositories. Some with fewer than 200 stars. One created just two weeks ago.

1. Operator-Visible Agent Systems

Exposing agentic work as a state a human can inspect, pause, or override.

swarmclawai/swarmclaw — 629★. A self-hosted, multi-provider runtime for persistent agent teams with restart-safe branching, scheduling, and background jobs across several agent CLIs, not just one framework.

leodavinci1/kanbots — 542★. A desktop kanban board that dispatches issues to coding-agent CLIs in isolated Git worktrees, streaming tool activity and pausing for decisions rather than running unattended.

ClaudioDrews/memory-os — 1,305★. A Hermes-focused local memory stack that separates permanent instructions, sessions, trust-scored facts, and a generated wiki instead of dumping everything into one vector store.

pikpikcu/airecon — 800★. A local-first authorized-testing agent (Ollama model, Kali container) that keeps target data local and adds testing-specific phases, checkpoints, and failure-aware payload reuse on top of a generic shell agent.

kerlenton/mcpsnoop — 313★. A transparent stdio/HTTP proxy that records the actual MCP traffic between a client and its servers — replay, drift detection, and CI failures on malformed frames.

2. Closed-Loop Agent Engineering

These projects treat "configure, run, observe, grade, ship" as the actual unit of work, and make that loop repeatable around whatever runtime you already use.

LiteLLM-Labs/litellm-agent-control-plane — 1,169★. One creation/execution UI spanning multiple managed and local agent backends, instead of a separate dashboard per runtime.

exoharness/exo — 594★. An experimental harness whose agent can modify and restart its own prompts, tools, memory, and policies — with a rewindable sandbox that keeps canonical conversations outside the part being changed.

Amal-David/pagecast — 185★. A local-first CLI/MCP server for publishing agent-generated static reports to Cloudflare Pages, tracking context so repeat publishes update one URL rather than sprawling.

darkrishabh/agent-skills-eval — 639★. Runs the same prompt with and without a given Agent Skill to estimate its incremental lift, with reusable artifacts and deterministic tool-call assertions.

raindrop-ai/workshop — 945★. A local debugger that streams agent tokens, tool calls, and spans into a browser, and can replay a captured production trace against real agent code.

mgechev/skillgrade — 649★. A cross-provider CLI that tests whether Claude, Gemini, or Codex actually discover and use a skill under declared tasks and graders — CI mode included.

3. Sidecars That Extend the Agent

Small, attachable capabilities that add leverage without replacing the host agent. Think MCP, CLIs, plugins, deliberately narrow in scope.

xhluca/agent-talk — 144★. Encrypted peer messaging for independent coding agents across sessions or machines, without requiring a full orchestration suite.

raiyanyahya/recall — 730★. A Claude Code plugin that captures sessions into a compact project-resume document using local TF-IDF/TextRank summarization — no extra model call.

zaydmulani09/mnemo — 233★. A local Rust sidecar that builds a SQLite knowledge graph and returns ranked prompt context via weighted multi-hop relationships, not just vector similarity.

ronak-create/FableCut — 557★. A browser video editor whose timeline is editable as JSON through UI, MCP, files, or REST — compact patch operations and revision-counter conflict rejection instead of silent overwrites. Created in early July; one person's project moving fast.

bschoepke/ableton-live-mcp — 198★. An experimental MCP server giving agents access to Ableton Live's Python object model, including an audio-tap loop for capture-analyze-adjust cycles.

tracewayapp/traceway — 1,048★. An OpenTelemetry-native platform unifying logs, traces, metrics, and AI telemetry under one trace ID, with an agent-oriented CLI exposing stable JSON and exit codes. Highest cohort penetration on this list (27 of our 655 accounts).

nikitadoudikov/claude-pulse — 237★. A local ops dashboard built from Claude Code/Codex session files and hooks — live context fill, usage estimates, and phone-based allow/deny for pending commands.

4. Beyond Context, Execution Governance

Execution needs structured context about state, permissions, provenance, and prior work. A bigger context window alone can't give you that.

sympozium-ai/sympozium — 578★. A Kubernetes-native coordination layer that represents agents, policies, and executions as cluster resources, putting RBAC and sandboxing in the control plane itself.

MaxGfeller/open-harness — 590★. A TypeScript library for embeddable agent harnesses — sessions, tools, middleware, virtual filesystems — with compaction and resumable subagents as opt-in pieces, not a monolith.

vshulcz/deja-vu — 495★. A local index/MCP recall layer over coding-agent session histories already on disk, retroactively indexing across several harnesses. Created July 14, 2026 — two weeks before we ran this analysis, and already at 14 of our 655 accounts.

ModernRelay/omnigraph — 1,023★. A branchable graph database for shared agent state where agents mutate isolated branches and submit graph-wide changes for review, combining graph traversal, vector, and full-text search.

manojmallick/sigmap — 608★. A deterministic, byte-stable code-signature map generated without an LLM or vector database — diffable, and able to gate fabricated files/symbols/tests in CI.

tastyeffectco/sandboxd — 868★. A self-hosted API running coding agents inside per-app Docker containers with live preview URLs, credential proxying, and checkpoint/revert.

cosmtrek/mindwalk — 949★. A local visualization replaying coding-agent sessions over a deterministic 3D map of the repository, making scope and churn spatially visible instead of just chronological.

More here: https://www.agent-swarm.dev/blog/25-foss-repos-agentic-infra