GitHub's Top Repos of 2026 Are Mostly AI Agent Add-Ons....

Trendshift keeps a running leaderboard of the GitHub repositories getting the most attention, ranked by day, week, month, and year (trendshift.io/yearly). If you scroll the 2026 yearly list, one thing jumps out before any individual project does: almost every repo near the top is an add-on for an AI coding agent. Not a database, not a web framework, not a language. A pack of prompts, a memory layer, a design brief, or a workflow that sits on top of a tool like Claude Code, Cursor, or Copilot and tries to make it behave better.

That matters for a small business, because it changes the question. The question is not "should I install the number-two repo on GitHub." It is "do I already run an AI coding agent, and if so, which of these bolt-ons is worth the tokens." If nobody at your company touches a terminal, most of this list is not for you yet, and I will say so plainly at each stop. If one person does, whether that is a founder, a lone in-house developer, or the technical person who keeps the internal scripts alive, then a handful of these are genuinely useful this week.

Two honest warnings up front, because they apply to everything below.

First, a star count measures attention, not fitness. The AI-tooling corner of GitHub has a documented fake-star problem. Researchers at Carnegie Mellon and collaborators traced roughly six million suspected fake stars across thousands of repositories, with a sharp rise in paid star campaigns through 2024, and found campaigns tied to more than sixteen percent of repositories at the mid-2024 peak (CMU, "Fake GitHub stars"; research paper). Several projects below grew from zero to six figures of stars in a few weeks or months, which is exactly the velocity that invites that scrutiny. Treat a big number as a reason to look, never as a verdict on quality. Judge by the code, the open issues, and your own test run.

Second, the repository is free. The engine it drives is not. Nearly everything here is built first for Claude Code, and Claude Code is not on the free plan. It comes with a Claude Pro subscription at about twenty dollars a month, a Max plan at roughly one hundred or two hundred dollars a month for heavier use, or pay-as-you-go through the Anthropic API billed per token (Claude pricing). When I say a tool "costs nothing," I mean the repo. Budget the agent underneath it separately, because an agentic loop that plans, verifies, and spawns subagents burns tokens faster than a single chat prompt does.

Here is the whole list at a glance. Star counts are live figures I pulled from the GitHub REST API on July 17, 2026, and they move every day.

Repo	Stars (Jul 17, 2026)	License	What it actually is	Trendshift yearly
obra/superpowers	~256,600	MIT	A skills pack that forces a plan-then-test workflow on your agent	#2
msitarzewski/agency-agents	~132,300	MIT	230+ ready-made role personas you install into your agent	#9
nextlevelbuilder/ui-ux-pro-max-skill	~107,000	MIT	A design-intelligence skill so agent-built UI looks less generic	#12
VoltAgent/awesome-design-md	~102,600	MIT	Drop-in brand design briefs so agents match a known look	#19
thedotmack/claude-mem	~87,600	Apache-2.0	A memory layer that carries context between sessions	#14
ruvnet/RuView	~81,000	MIT	WiFi-signal sensing (contested, see the caveat)	#15
666ghj/MiroFish	~68,700	AGPL-3.0	A multi-agent "what would people do" simulator	#18
usestrix/strix	~42,200	Apache-2.0	AI agents that pentest an app you own	riser
MadsLorentzen/ai-job-search	~23,500	MIT	Turns Claude Code into a job-application pipeline	riser
open-gsd/gsd-core	~6,800	MIT	A spec-driven ship-it loop with fresh-context subagents	new

The rest of this post walks each one: how it plugs in, the real install command from its own README, a small-business example, an individual-employee example, what it costs to run, and where the honest limit sits.

Group one: make your coding agent behave like a senior engineer

The first three are the reason the leaderboard looks the way it does. They do not write your app. They change how the agent that writes your app operates, forcing structure onto a tool that will happily sprint in the wrong direction if you let it.

Superpowers: the plan-then-test discipline, as a plugin

Superpowers is a skills framework and a software-development methodology, distributed as a bundle of markdown files (obra/superpowers). Its author, Jesse Vincent, describes it as a complete methodology for coding agents built on composable skills (author's write-up). Installed into Claude Code, it layers a seven-phase workflow onto the agent: brainstorm and ask questions before any code, spin up an isolated git worktree with a clean test baseline, write a detailed plan broken into two-to-five-minute tasks, dispatch fresh subagents per task with a two-stage review, enforce test-driven development, review the result against the plan, then finish the branch. The skills auto-trigger, so there is little to configure.

Install it inside Claude Code with the command from the README:

/plugin install superpowers@claude-plugins-official

It targets Claude Code most deeply, and also runs on Cursor, GitHub Copilot CLI, OpenAI Codex, Factory Droid, Kimi Code, OpenCode, Antigravity, and Pi. Note that its README does not list Google's Gemini CLI, despite what some third-party guides imply, so do not count on that one.

For a small business, the natural fit is a four-person software or web shop that standardizes on this so every client project runs the same way: brainstorm, plan, isolated worktree, enforced tests, review gate. Junior contractors get guardrails, and deliverables come out tested and consistent without the owner reading every line. For an individual, picture the lone in-house developer at a thirty-person logistics company building an internal shipment dashboard. The framework forces a written plan and a passing test baseline, so when that developer is out, a colleague can read the plan and tests to understand what exists and change it safely.

The honest limit is cost and overkill. Superpowers is token-heavy by design, and users report it can turn a small fix into an hour-long verification loop; one write-up on its tradeoffs collects the "burned through my Max plan" complaints and the argument that modern models plan well enough on their own for quick or exploratory work (honest tradeoffs review). Reach for it on medium-to-large features where the ceremony pays off, not on a one-line change. Its acceptance into Anthropic's official plugin marketplace is a real legitimacy signal, but the star count is still a hype number, not proof it fits your work.

GSD-core: ship in phases, and keep the git history honest

GSD-core runs a five-step loop, Discuss then Plan then Execute then Verify then Ship, on top of an AI coding agent (open-gsd/gsd-core; docs). Its whole reason to exist is fighting "context rot," the quality decay you get as an agent's context window fills. It does the heavy research, planning, and execution in fresh subagents that each start with a clean two-hundred-thousand-token window, keeping your main session lean, and every milestone ends by opening a pull request and archiving the phase, so the git history reflects the real work.

Install it into a repo with the command from the README:

npx @opengsd/gsd-core@latest

Then start with /gsd-new-project on something new or /gsd-onboard on an existing codebase. A small agency can use it so every client feature ships through the same Plan, Execute, Verify, Ship loop, which produces a clean, auditable git trail to show the client. A solo developer modernizing an internal tool can break the work into atomic tasks that each execute in a clean context instead of one long, degrading session, then use the Verify step to catch gaps before merging.

Now the caveat, and it is a real one. GSD-core is a community fork. The original project, gsd-build/get-shit-done, was built by a developer known as TÂCHES, who went quiet for roughly seven weeks and deleted their social accounts, and an associated cryptocurrency token called $GSD was publicly linked to a rug-pull (fork rationale; token report). The clean-hands community fork at @opengsd/gsd-core is the version to use, which is exactly why it is worth treating as the current project rather than the original. That history is also why you should read the eye-popping star counts with suspicion: the original repo claimed somewhere between forty-eight and sixty-five thousand stars during the crypto hype, while this actual fork sits near sixty-eight hundred (star history). Before you run anything, confirm you are installing the current @opengsd/gsd-core package and not an abandoned older one left on the registry. The framework is MIT-licensed and the mechanics are sound; the lineage just deserves a careful eye.

Agency-agents: a shelf of role personas, ready to install

Agency-agents is not software. It is a library of more than two hundred and thirty "agent" personas, each a markdown file holding a system prompt, a workflow, and expected deliverables for a specific role, organized across nineteen divisions (msitarzewski/agency-agents). Frontend developer, SEO writer, bookkeeper, QA tester, accessibility tester, and so on. You install them into a coding tool you already pay for and then invoke one by name.

The installer copies the files into your tool's config directory. For Claude Code, the command from the README is:

./scripts/install.sh --tool claude-code

Claude Code reads these natively as markdown with YAML frontmatter, so no conversion is needed; the repo also supports Copilot, Cursor, Aider, Windsurf, Codex, and others (Claude Code integration notes). A small agency that already pays for Claude Code can install the engineering and marketing packs so a junior can invoke the "Accessibility Tester" or "SEO Content Writer" persona on client sites without the owner writing those prompts from scratch each time. The lone technical person at a twenty-employee brokerage can install a "Bookkeeping" and a "Technical Writer" persona to draft a reconciliation script and turn it into plain-English documentation, reusing the existing Claude Pro seat.

The limit is that this is prompt text, and its value is bounded entirely by the paid tool underneath. The agents cannot do anything your subscription cannot already do; they save you the writing. Quality varies agent to agent because the collection is community-contributed, and "production-ready" is the author's marketing phrase, not a measured result. The ranking deserves the usual skepticism: it went viral off a single social thread, reportedly gaining around ten thousand stars in seven days, and commentators note the Discussions tab is nearly empty relative to the star count, a pattern that reads as viral bookmarking rather than daily use (viral-launch writeup).

Group two: give the agent a memory and some taste

The next three fix two specific weaknesses of a bare coding agent: it forgets everything between sessions, and it tends to produce interfaces that all look the same.

Claude-mem: stop re-explaining your project every morning

Claude-mem is a memory layer for coding agents. It captures what your agent does during a session, the decisions, the fixes, the dead ends, compresses that with AI, and re-injects the relevant pieces into future sessions so the agent does not start from a blank slate every time (thedotmack/claude-mem). Under the hood it uses lifecycle hooks to capture observations automatically, stores them in a local SQLite database with Chroma vector search, and exposes memory back to the agent through the Model Context Protocol. It runs entirely on your machine with no account required to start.

Install it with the README command:

npx claude-mem install

It needs Node.js 20 or newer and an MCP-capable agent, most commonly Claude Code. A five-person agency where each developer's agent constantly re-learns the same project quirks can install this so that returning to a client's codebase after two weeks, the agent already recalls the auth workaround, the deploy gotcha, and the approaches that were already rejected. A solo technical person maintaining internal automation can pick a script back up months later and have the agent recall why a given library was chosen instead of reconstructing it from memory. An optional hosted sync called CMEM Cloud is free during its early-access beta (homepage).

There is a real security caveat here, and it is worth reading before you install. A security-audit issue on the repo notes that claude-mem captures a lot, which can include confidential business logic, API keys, and passwords, and that if the local worker is bound to 0.0.0.0, anyone on a shared network could read all of it and change its config (security issue #1251). Keep it bound to localhost and treat the memory store as sensitive. Users also report the agent does not always auto-use the search skill and that raw calls can trigger repeated permission prompts (usability issue #79). The Apache-2.0 license is permissive, so there is no copyleft trap. The value of memory as a concept is real, and I have made that case at length before; claude-mem is one implementation of it, not the only one.

UI-UX Pro Max: design intelligence, so the output stops looking like every other AI site

This one is a "skill," a bundled knowledge base plus a few standard-library Python scripts, that plugs into an agent and gives it a searchable local database of UI styles, color palettes, font pairings, and UX guidelines (nextlevelbuilder/ui-ux-pro-max-skill). When you ask the agent for UI work, the skill activates, matches your product type against its databases, and feeds coherent styles, contrast-checked colors, and anti-pattern checks back to the agent before it writes the code. The homepage catalogs dozens of styles, palettes, and font pairings across several stacks (uupm.cc).

Install and initialize it with the README commands:

npm install -g ui-ux-pro-max-cli
cd /path/to/your/project
uipro init --ai claude      # Claude Code
uipro init --ai cursor      # Cursor
uipro init --ai windsurf    # Windsurf

It needs Python 3 with only the standard library, plus Node for the installer. A three-person web-design agency building client marketing sites can install it so that a prompt like "landing page for a day spa" pulls a coherent palette and layout from the skill instead of defaulting to the same generic AI look on every client. A solo technical marketer at a small SaaS company can run uipro init and have a pricing-page redesign come out with consistent spacing, accessible touch targets, and checked contrast, shipping a cleaner page without hiring a designer.

The limits: the repo was created at the end of November 2025, so it is only a couple of months old and still churning, and the exact database counts differ between its README, its homepage, and third-party listings, so do not lean on a specific number. A "Premium" tier for extended brand work is mentioned in the README with no published price. The star velocity, six figures in roughly six or seven weeks, is a classic inflation red flag, so treat the popularity as unverified social proof. And the output still depends entirely on the model and your prompt. The skill supplies context; it does not guarantee good design, and a human should still review what comes out.

awesome-design-md: hand the agent a real brand's design brief

This repo is the simplest idea on the list and one of the more useful. It is a curated collection of DESIGN.md files, machine-readable design briefs (colors, typography, spacing, component rules) modeled on design systems from well-known brands (VoltAgent/awesome-design-md). There is no code to run. You copy one file into your project and tell your agent to build UI using it. The format comes from Google Stitch, whose DESIGN.md draft specification Google Labs open-sourced in 2026 so it works across Claude Code, Cursor, and Copilot (Google Labs on DESIGN.md).

Because there is no installer, the workflow is three manual steps: pick a DESIGN.md, drop it at your project root, and prompt your agent to use it. A four-person agency can standardize client work this way, so when a client says "make it feel like a clean fintech dashboard," a developer drops in the matching brief and the whole site stays visually consistent. A solo marketer with no design training can use one as a style guide so internal docs pages come out coherent instead of default-framework gray. The getdesign.md site lets you browse the catalog free, with a paid "request a private DESIGN.md" option that has no published price (getdesign.md).

One caveat that is easy to miss: these briefs describe real companies' visual identities. Using one to learn or for internal pages is fine. Cloning a competitor's exact look in production invites trademark and brand-confusion problems, so keep that line in mind. On the popularity question, this repo is an interesting counter-example to the star skepticism, because its fork-to-star ratio runs noticeably higher than comparable "awesome" lists, which is evidence of genuine use rather than pure bot inflation (usage analysis). Even so, judge it by whether a specific file actually helps, not by the leaderboard.

Group three: point the agent at a job, and at your own security

The next two are the most directly useful to an individual employee and to a small shop that ships software, respectively.

ai-job-search: the employee angle, literally

This is the repo an actual employee can use for themselves. It is a job-application framework that turns the Claude Code CLI into a personal job-hunt assistant (MadsLorentzen/ai-job-search). You fork it, fill in your candidate profile, and run slash commands: /setup builds your profile from your documents, /scrape searches job boards and ranks results by fit, and /apply evaluates a posting, drafts a tailored CV and cover letter, runs a separate reviewer agent over the draft, compiles the result to PDF with LaTeX, and does a text-layer check for ATS compatibility. The author, a geophysicist named Mads Lorentzen, built it after his own role was cut in late 2025, and it reached number one on GitHub's trending list on July 7, 2026 (background and drafter-reviewer writeup).

Get it with the README's fork-and-own command:

gh repo fork MadsLorentzen/ai-job-search --clone
cd ai-job-search

A software engineer whose position was eliminated can fork it, load their resume, and run /scrape weekly plus /apply on each posting, cutting per-application time from an hour to a few minutes while getting a role-specific CV and interview prep for each. A small career-coaching or recruiting shop with a technical owner can adapt it into a per-client pipeline that produces first-draft, ATS-checked documents a human coach then edits.

The honest limits are heavy. It needs the Claude Code CLI, Python 3.10 or newer, the Bun runtime, and a working LaTeX install, so it is a developer tool, not a point-and-click app; a non-technical job seeker cannot run it without help. Its job-board scraping is hard-built for the Danish market and needs rewriting to work elsewhere. Automating applications and scraping sites like LinkedIn may break those sites' terms of service, so keep a human reviewing before anything gets sent. And it is not affiliated with Anthropic despite being built on Claude Code. If the broader "practice every skill a real AI job asks for" angle is what you are after, I wrote a separate piece on exactly that.

Strix: pentest your own app before someone else does

Strix is an open-source AI penetration-testing tool (usestrix/strix). You point it at your own web app, codebase, or repo, and a team of AI agents runs reconnaissance, spins up a browser to test for things like cross-site scripting, opens a shell, and writes and runs its own exploit code inside a Docker sandbox. Because it validates by actually exploiting, it reports only findings it could prove with a working proof-of-concept, which cuts the false positives you get from static scanners. It runs from the command line and can run headless in a CI pipeline to scan on each pull request, and it can propose fixes as pull requests too.

The README's install command is a piped shell script:

curl -sSL https://strix.ai/install | bash

Piping a remote script straight into your shell is worth pausing on. Fetch and read the script first, then run it. Beyond that you need Docker running and an LLM API key from a supported provider (OpenAI, Anthropic, Google, Vertex, Bedrock, Azure, or a local model via Ollama or LMStudio), set through environment variables. A six-person web shop can run Strix against a client staging site it controls before launch, treating the proof-of-concept findings as a pre-launch security checklist. A solo developer at a small SaaS can wire it into GitHub Actions in headless mode so it scans on release-branch pull requests, then triage the validated findings before merging.

Two caveats matter more than usual here. First, this is an offensive tool that actively exploits its target, and running it against any system you do not own or have written permission to test can be illegal; the project itself tells you to only test what you own. Second, the cost is real and variable. Independent testers report roughly five to twenty dollars per scan in normal mode and fifty dollars or more for deep scans on large apps, with one quick scan consuming close to six million input tokens for about seventeen dollars (hands-on cost review). Cap spend by scanning release branches, not every commit. There is also a hosted cloud version and an enterprise tier with no public pricing (strix.ai). If you are thinking about the wider question of running agents like this without a surprise bill, I laid out the cost-control approach separately.

Group four: fascinating, high on the charts, and not ready for your business

The last two are on the leaderboard, and they are the clearest illustration of why a star count is not a recommendation. Both are interesting. Neither belongs in a small business's production stack today.

RuView: WiFi as a sensor, with a serious credibility problem

RuView claims to turn ordinary WiFi radio signals, captured by roughly nine-dollar ESP32 sensor boards, into presence detection, breathing and heart-rate vital signs, and body-pose estimation, all with no camera (ruvnet/RuView). It is a renamed continuation of the author's earlier wifi-densepose project. There is a Docker demo you can run with no hardware:

docker pull ruvnet/wifi-densepose:latest
docker run -p 3000:3000 ruvnet/wifi-densepose:latest

Here is why it is in the "watch only" group. An independent technical audit, mirrored as a fork bluntly retitled to flag it, alleges the project is largely an AI-generated facade: that the core signal processing returns random or hardcoded data, that the neural networks ship with no trained weights, and that headline accuracy numbers were fabricated (audit fork; predecessor issue thread). The current README actively disputes this and now advertises published pretrained weights with a stated held-out accuracy and a verification script, and it retracts the old "one hundred percent" claim. So the fair way to hold it is: auditors allege the pipeline does not work, and the author disputes that with newer material. That is not the footing you want a business dependency on. The same author has separately been accused of star inflation on a predecessor repo, so the eighty-one-thousand-star, yearly-rank-fifteen figure should not be read as organic validation.

On cost, the README's own hardware table lists a minimal ESP32-S3 setup around nine to twenty-four dollars and a multi-node mesh around fifty-four dollars. The higher figure you may see quoted, around one hundred forty dollars, is a "recommended" bundle that includes a proprietary add-on called a "Cognitum Seed" from the author's own company, so that number is partly an upsell, not just parts. Realistically this is a project for an embedded or RF developer who wants to study or debunk a WiFi-sensing codebase as a learning exercise, and only after independently checking whether any of it functions. And any real deployment that senses people carries privacy and consent obligations. It is not a product a small business should deploy, and it is not a dependency worth putting your name on.

MiroFish: a crowd simulator that is fun, viral, and unvalidated

MiroFish spins up a simulated world of thousands of LLM-driven agents, each with a persona and memory, and lets them react to a scenario you seed, so you can watch how an event might plausibly unfold and read a generated forecast (666ghj/MiroFish). You feed it a news item or a draft announcement, and it builds a knowledge graph, generates agent personas, runs a social-media-style simulation where they post and argue, then writes a prediction report you can interrogate. It was built by a Chinese undergraduate and went viral in March 2026 alongside a widely repeated story about a large investment (overview).

It is a self-hosted codebase. The README quickstart is:

cp .env.example .env
npm run setup:all
npm run dev

You need Node 18 or newer, Python 3.11 or 3.12, the uv package manager, your own LLM API key (the README recommends Alibaba's Qwen-plus), and a Zep Cloud key for agent memory. A technically capable marketing agency could self-host it to stress-test how a client's planned announcement might play out before launch, seeding the draft messaging and watching where simulated agents pile on, strictly as a "what could go wrong" rehearsal.

Two limits make this watch-only for a business. First, there is no validation. There are no published benchmarks or backtests showing its simulations match real outcomes; "scarily accurate" is a social-media impression, not a measured result (hype-versus-reality writeup). The README itself warns of high consumption and tells you to try runs of fewer than forty rounds first, because a multi-thousand-agent simulation makes a lot of metered LLM calls and Qwen pricing varies by region and model version. Second, and this is the one to flag to whoever signs off on tools, MiroFish is licensed under AGPL-3.0. That is a copyleft license. If you modify it and expose the modified version over a network, including an internal or client-facing web tool, the license obligates you to offer your changed source to those users. For an agency that wants to keep customizations proprietary, that is a genuine problem, and it is worth a quick legal read before any networked deployment. Every other tool on this list is under the permissive MIT or Apache-2.0; MiroFish is the exception, and it is the kind of exception that surprises people.

So which of these should a small business actually touch

Sorted honestly:

Usable this week, with the caveats above: Superpowers and GSD-core if you want discipline forced onto your agent, claude-mem if you are tired of re-explaining your codebase every morning, awesome-design-md and UI-UX Pro Max if your agent's output looks generic, Strix if you ship software and can supply an API key, and ai-job-search if you or someone on your team is actually job hunting.

Watch, do not deploy: RuView and MiroFish. Interesting, high on the charts, and either credibility-challenged or unvalidated.

The common thread is that none of these is the starting point. The starting point is a working AI coding agent, which for most people means Claude Code on a Pro or Max plan, and a little comfort in a terminal. If you are not there yet, get that running first; I wrote a plain walkthrough of what to do the day after you install it, and a broader look at the under-fifty-dollars-a-month AI stack a small business can actually run. Once the agent works, pick exactly one tool from the usable list, try it on a throwaway branch, and watch your token bill for a day before you commit to it. That is the whole method: one tool, one branch, one honest look at the cost.

If you want the wider map of doing your own marketing and web work on a small AI budget instead of paying an agency retainer, that is the argument I make in The $20 Dollar Agency, one of the $9.99 Digital Empire books. But you do not need the book to start. You need a terminal, a plan, and the willingness to pilot one thing at a time.

Fact-check notes and sources

Star counts: All ten figures are live values from the GitHub REST API (api.github.com/repos/<owner>/<name>) captured on July 17, 2026, and they change daily. Each repo links to its GitHub page in the table above.
Trendshift yearly rankings: From the yearly leaderboard at trendshift.io/yearly. Trendshift's own daily, weekly, and monthly ranks differ from the yearly list and from a repo's self-reported global rank, so ranks here are cited as the yearly leaderboard shows them, not as a single fixed number.
Fake-star research: The estimate of roughly six million suspected fake stars and campaigns tied to more than sixteen percent of repositories at the mid-2024 peak is from Carnegie Mellon and collaborators (CMU news; paper).
Claude pricing: Pro at about $20/month, Max at roughly $100 or $200/month, and metered API billing are from Anthropic's pricing page. These are the paid dependency for most tools here; verify current numbers before quoting them.
Install commands: Each command is quoted from that repo's own README: superpowers, gsd-core, agency-agents, claude-mem, ui-ux-pro-max-skill, ai-job-search, strix, and RuView. awesome-design-md documents no install command; you copy a file.
claude-mem security note: The data-capture and 0.0.0.0 binding risk is from a security-audit issue on the repo.
GSD lineage and the $GSD token: The community-fork rationale is on the gsd-core discussion; the rug-pull report is here.
RuView allegations and rebuttal: Non-functionality allegations are in an independent audit fork and a predecessor issue thread. The current README disputes them with pretrained weights and a verification script. Both sides are presented; neither is settled here.
MiroFish license and cost: The AGPL-3.0 license and the "fewer than forty rounds first" consumption warning are stated in the repo. The lack of published benchmarks is discussed here.
Strix cost figures: The per-scan cost estimates are from an independent hands-on review, not from the project, and vary with the app and the model you point it at.

GitHub's Top Repos of 2026 Are Mostly AI Agent Add-Ons. Here's What a Small Business Can Actually Do With Each One.