Sep 18, 2026 - Sep 24, 2026

The ten repositories that gained the most stars on GitHub in the week of Sep 18, 2026 - Sep 24, 2026, counted from GitHub's public event log. A star is a bookmark, not an endorsement: the commit counts and flags below show which ones people are actually building.

Where these numbers come from. GitHub's public event log missed most events this week, so weekly stars here are GitHub Trending's own figures (reported, not measured by us); repos created inside the week show their total.

#	Repository	New stars	Stars	Commits (30 days)	License
1	cloudflare/security-audit-skill	9,547	21,666	3	MIT
2	stablyai/orca	6,537	78,350	2,541	MIT
3	jev-chat/jev-chat-jarvis	6,516	6,516	98	MIT
4	mizorewww/laya-mlx	6,343	6,343	6	Apache-2.0
5	affaan-m/ECC	6,037	267,525	295	MIT
6	alibaba/open-code-review	5,030	41,351	171	Apache-2.0
7	vectorize-io/hindsight	4,869	29,846	578	MIT
8	dream-num/univer	3,928	18,456	109	Apache-2.0
9	Open-Dev-Society/OpenStock	3,794	19,248	32	AGPL-3.0
10	hydra-db/hydradb	3,563	7,072	0	AGPL-3.0

1. cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

9,547 new stars this week. 3 commits and 1 closed issues in the 30 days to Sep 24, 2026. JavaScript, MIT license, created Jun 18, 2026.

2. stablyai/orca

Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and remote runtime.

6,537 new stars this week. 2,541 commits and 788 closed issues in the 30 days to Sep 24, 2026. TypeScript, MIT license, created Mar 17, 2026.

3. jev-chat/jev-chat-jarvis

装在手机上的对话副驾：在 QQ / X / 飞书里读懂对方、给出候选回复、一键填入输入框，发不发由你。非侵入，只读屏幕，不 hook 不改包。

6,516 new stars this week. 98 commits and 19 closed issues in the 30 days to Sep 24, 2026. Kotlin, MIT license, created Sep 21, 2026. Worth noting: created Sep 21, 2026, new this fortnight.

4. mizorewww/laya-mlx

Native MLX runtime for Laya typed decision models - 7-14 ms short decisions on M3 Max. No text generation, PyTorch, or cloud API.

6,343 new stars this week. 6 commits and 1 closed issues in the 30 days to Sep 24, 2026. Python, Apache-2.0 license, created Sep 19, 2026. Worth noting: created Sep 19, 2026, new this fortnight.

5. affaan-m/ECC

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

6,037 new stars this week. 295 commits and 61 closed issues in the 30 days to Sep 24, 2026. JavaScript, MIT license, created Jan 18, 2026.

6. alibaba/open-code-review

Secure, fast, efficient, battle-tested at Alibaba's scale. Hybrid architecture code review tool: deterministic pipelines + LLM Agent, precise line-level comments, built-in multi-language ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible.

5,030 new stars this week. 171 commits and 121 closed issues in the 30 days to Sep 24, 2026. Go, Apache-2.0 license, created May 18, 2026.

7. vectorize-io/hindsight

Hindsight: Agent Memory That Learns

4,869 new stars this week. 578 commits and 252 closed issues in the 30 days to Sep 24, 2026. Python, MIT license, created Oct 30, 2025.

8. dream-num/univer

The Office Harness for AI Agents - Spreadsheets, Docs, Slides, Canvas, Relational Tables, and PDF in one runtime.

3,928 new stars this week. 109 commits and 39 closed issues in the 30 days to Sep 24, 2026. TypeScript, Apache-2.0 license, created Sep 29, 2022.

9. Open-Dev-Society/OpenStock

OpenStock is an open-source alternative to expensive market platforms. Track real-time prices, set personalized alerts, and explore detailed company insights - built openly, for everyone, forever free.

3,794 new stars this week. 32 commits and 2 closed issues in the 30 days to Sep 24, 2026. TypeScript, AGPL-3.0 license, created Sep 28, 2025.

10. hydra-db/hydradb

HydraDB - fast graph database on object storage

3,563 new stars this week. 0 commits and 0 closed issues in the 30 days to Sep 24, 2026. Rust, AGPL-3.0 license, created Jul 3, 2026. Worth noting: no commits in the 30 days to the week's end.

The week's story

The rising repos this week give agents your logged-in browser, your phone screen and a memory. That is the week in one sentence.

This week's rising repos have one thing in common. None of them makes a model smarter. They move the agent closer to you. Into your logged-in browser. Onto your phone screen. Into a memory that remembers what you did last time.

First, where the numbers come from. GitHub's public event log dropped most of its events this week, so we could not measure weekly stars ourselves. The weekly figures below are GitHub Trending's own, which means reported, not measured. For repos created inside the week, the total is the week.

The pattern

On Thursday the daily brief covered an agent that broke into a government site when it was told no. The fix we suggested was boring. Control what your agent can reach. This week's chart runs the other way. The most popular new tools hand agents more reach, not less.

That is not a scandal. It is what makes agents useful. An agent that can use your real browser can file the expense report. An agent with memory stops asking the same question every morning. But every one of these tools is a decision about access, and it should be made on purpose.

Now the picks.

Pick one. BrowserSkill, from Tencent.

It lets any coding agent that can run a shell command drive your real, logged-in browser through an extension, without taking over your screen. Trending reports about 2,100 stars this week. It has 26 contributors, 425 commits in thirty days and a release on Wednesday. MIT licensed. The access question is the whole story. Your logged-in browser holds your sessions, so the agent holds them too. Verdict: TRY, in a separate browser profile with nothing in it you would not hand to an intern.

Pick two. Hindsight, from Vectorize.

It is a memory layer for agents that learns from past runs. Trending reports close to 4,900 stars this week. With 263 contributors, 578 commits in thirty days and a release on Monday, it is well past a demo. Note that Vectorize sells retrieval infrastructure. Verdict: TRY, if your agents keep relearning the same facts.

Pick three. Paperclip.

It is an open-source app for managing agents at work, the dashboard for who runs what. Trending reports about 2,600 stars this week, 219 contributors and over 700 commits in thirty days. MIT licensed. Verdict: TRY, for anyone who has lost track of which agent is doing what.

Pick four. Laya MLX.

A native runtime for Apple silicon that runs Laya's typed decision models, small models that pick an option instead of writing text. The README claims decisions in 7 to 14 milliseconds on an M3 Max. It was created on Saturday, so all 6,343 of its stars are this week's. One contributor, six commits, Apache licensed. It connects to the daily's thread on decision models: not every task needs a model that writes. Verdict: WATCH. One person, one week old.

Pick five. Addy Osmani's agent skills.

Twenty-five instruction files for coding agents, written as engineering practice rather than tricks. Trending reports about 2,900 stars this week on top of 99,000. Eighty-three contributors, MIT licensed. Last week's radar was about skills, and they are still climbing. Verdict: TRY, as reading first.

Pick six. Jev Chat Jarvis.

An Android assistant that reads your chat screen in apps like QQ and Feishu, suggests replies and fills the input box, leaving the send to you. Created on Monday, 6,516 stars already, eleven contributors, a release on Wednesday. It works by reading the screen, which is exactly this week's pattern. Verdict: SKIP for this audience, but watch the method.

Now the hype check. HydraDB.

A graph database on object storage, created in July. Trending reports about 3,600 stars this week. The repo shows seven contributors, no commits in the last thirty days, 143 open issues and none closed, and no release. It also has 2,658 forks on 7,072 stars. That is a fork rate near thirty-eight percent, several times what a working library usually shows. We make no claim about why. The signals just don't match the attention.

Where are they now.

Last week's picks kept climbing on Trending's figures: Cloudflare's security audit skill with about 9,500 stars this week, Orca about 6,500, Open Code Review about 5,000, and WeKnora about 3,200. Those are reported numbers and last week's were measured, so compare direction, not size.

The bench.

Anthropic's financial services repo, which gained about 2,600 stars with no description yet. Univer, the spreadsheet engine. CC Switch, for moving between coding agents. JSON Render from Vercel, for generative interfaces. OpenStock, an open stock tracker. And Claude Code itself, still adding about 2,100 stars a week.

Through-line: the agents did not get smarter this week, they got closer, and closeness is an access decision.

One thing to try this weekend: list every place your agents can reach today, including browsers, inboxes and memory stores, and remove one you would not grant a new contractor.

---

*How this is made: stars, forks, commits, issues and releases are counted from GH Archive, the public record of GitHub events, for the Friday-to-Thursday window. Lists, courses and prompt collections are left out. Descriptions are each project's own. *