Trail of Bits turned its own audit playbook into a skill pack: static-analysis orchestration across CodeQL and Semgrep, smart-contract vulnerability scanning across six chains, constant-time analysis, and differential code review, built by a firm that gets paid to find what everyone else missed. /plugin marketplace add trailofbits/skills installs the set in Claude Code or Codex. Past 7,700 stars with a commit the same day as this digest, it's becoming the default when a security team wants its own review habits built into an agent instead of left to memory. Pricing: free, open source (CC-BY-SA-4.0).
Eleven skills make up this pack for Remotion's React video library: compositions, map animations through Mapbox or CesiumJS, caption generation, Studio interactivity, and package upgrades. npx skills add remotion-dev/skills installs them directly, or just say yes when bun create video offers to add them for you. At 5,500 stars with a commit landing today, the pack tracks the library it documents closely enough to trust. Pricing: free, open source.
HashiCorp writes its own style guide into code here: sixteen Terraform skills and four Packer skills that produce HCL the way HashiCorp's engineers would, generate .tftest.hcl test files, and scaffold new modules. claude plugin marketplace add hashicorp/agent-skills then claude plugin install terraform@hashicorp installs it. It's a vendor repo rather than a crowd favorite, which is exactly the point when you want the skill to match the maintainer's own conventions. Pricing: free, open source.
Twenty-nine Unity Editor skills shipped in about six weeks: a unity-cli for driving the Editor from a terminal, plus workflows for new-project setup, URP rendering, UI Toolkit, 2D and sprites, audio, multiplayer, IAP, ads, and localization. Unity made this live on September 9, 2026, and it's still labeled beta at v0.1.8. /plugin marketplace add Unity-Technologies/unity-agent-plugin then /plugin install unity@unity-agent-plugin gets it running. Pricing: free, official Unity-supported plugin.
Five slash commands, /speckit.constitution, /speckit.specify, /speckit.plan, /speckit.tasks, /speckit.implement, carry a feature from idea to shipped code, forcing an agent to draft a spec and a plan before it touches a single file. uvx --from git+https://github.com/github/spec-kit.git specify init my-project sets it up for whichever agent you name: Claude Code, Copilot, Cursor, or others. Past 142,000 stars with a commit today, it's the standard answer to "how do I stop an agent from guessing at requirements." Pricing: free, open source (MIT).
A short set of commands, /next-task, /audit-project, /gate-and-ship, /ship, /deslop, /perf, sits on top of twenty-five plugins, fifty-five agents, and forty-seven skills, written to work the same way across Claude Code, OpenCode, Codex CLI, Cursor, and Kiro. Version 6.1.1 shipped October 6, 2026. /plugin marketplace add agent-sh/agentsys installs it, or skip the marketplace with npm install -g agentsys && agentsys. Pricing: free, open source (MIT).
Eighty-three skills and fifteen slash commands turn Claude into a bug-bounty workflow covering OAuth and JWT exploitation, SSRF and RCE chains, and cloud misconfiguration, built around 681 patterns pulled from real disclosed reports. /plugin marketplace add elementalsouls/Claude-BugHunter then /plugin install claude-bughunter@elementalsouls installs it, or clone the repo and run scripts/install.sh. Over 5,200 stars and a commit today for a pack this specific says something about how many people now point agents at their own attack surface. Pricing: free, open source.
Sentry folded its MCP server into a broader toolkit this year alongside its CLI and shared packages, so error tracking, issue triage, and release data reach an agent through the same install as everything else Sentry ships. claude plugin install sentry-mcp@sentry-mcp wires it into Claude Code, or point mcp.json at npx @sentry/mcp-server@latest --access-token=<token> for stdio. Hand it an LLM key and its embedded-agent mode can investigate and summarize an error on its own. Pricing: open source server; requires a Sentry account (free tier available, paid tiers for scale).
One mcp.json entry pointed at https://mcp.supabase.com/mcp lets an agent query tables, run SQL, manage migrations, and read edge-function logs against whichever Supabase project you authorize over OAuth. It's the vendor-maintained server, past 2,900 stars with a commit today, and it's usually the first one named when someone asks how to connect an agent to a Postgres backend without hand-rolling a connector. Pricing: free to connect; usage billed through your existing Supabase plan.
xTiles registered a remote MCP server on October 21, 2026, authenticated over OAuth 2.1 with PKCE instead of an API key, that turns chat output into real xTiles projects, pages, notes, and assigned tasks, and can read your calendar or pull an existing project back into the conversation. claude mcp add --transport http xtiles https://mcp.xtiles.app/mcp is the entire setup; the OAuth handshake runs itself on first connect. Pricing: freemium — free workspace tier, paid plans for teams.
Most MCP servers connect an agent to software. This one connects it to a person: place_call dials a real business phone number with a goal and a list of questions, a TaskBullet staffer makes the call, and the agent gets structured answers back plus a transcript through get_transcript. It surfaced on the awesome-mcp-servers list on October 21, 2026. npx -y @taskbullet/mcp-server with a TASKBULLET_API_KEY env var installs it, or hit the hosted endpoint directly. Pricing: paid, usage-based — $2.50 for the first minute, $1 a minute after, no free tier.
Chat, inline edit, autocomplete, and a full agent mode that reads the open project and runs multi-step tasks, all pointed at whichever model provider you already pay for: Continue has quietly become the default open-source agent sidebar for VS Code and JetBrains. Install it straight from the VS Code Marketplace. It's past 4.4 million installs on version 2.1.0, Apache 2.0 licensed, and still shipping even after the company behind it changed hands this year. Pricing: free, open source; bring your own model API key.
Exo Agent runs the Claude or Codex CLI inside an Obsidian sidebar, so your vault becomes the agent's workspace: it reads and edits notes, manages frontmatter, and keeps a memory system that writes extracted facts back in as ordinary notes. Version 0.45.1 landed October 19, 2026, after near-daily releases through the month that added git checkpoints and newer model support. Search "Exo Agent" in Obsidian's Community Plugins browser; it needs the Claude or Codex CLI set up separately first. Pricing: free, open source plugin; CLI usage follows that provider's own pricing.
Twenty-four commands put a local or remote Ollama model behind Raycast: multi-turn chat, one-shot writing and analysis tasks, vision support, and, as of Raycast's new provider API, the ability to supply its models to Raycast's own built-in AI Chat. Install from the Raycast Store by searching "Ollama AI." Past 42,700 installs with an update on September 28, 2026, it's the usual pick for anyone running models locally instead of through a hosted API. Pricing: free, open source; no cost beyond the models you already run.
A sidebar on every page you visit can chat with GPT, Claude, Gemini, Grok, or DeepSeek, summarize what's on screen, or run several of those models against the same question at once and compare the answers side by side, a group-chat feature most competitors skip. Install it from the Chrome Web Store. Five million users and a 4.9 rating make it one of the most-installed AI sidebars running, with version 5.35.3 shipping October 21, 2026. Pricing: freemium — limited free daily queries, paid plans for more.
OpenClaw doesn't run one model; it runs a control plane. A local Gateway manages sessions, tools, and events, and an Agent Client Protocol lets it spawn and coordinate Claude, Codex, or local models as interchangeable providers behind a persistent skills system reachable over Signal, Telegram, or Discord. It's grown fast enough to earn a Wikipedia page and regulatory attention in China, past 390,000 stars under the third name it's settled on. curl -fsSL https://openclaw.ai/install.sh | bash installs the Gateway; version 2.0 shipped August 30, 2026, with a paid Enterprise tier following a month later. Pricing: open source core (MIT); Enterprise tier is paid.
Pi's 1.0 release on October 1, 2026, added "virtual models": one model plans, a second does the typing, inside the same tool-calling loop, and MCP calls now route through a sandboxed JS layer the project says cuts prompt tokens by around 40%. Nine point releases landed in October alone, most recently v1.4.0 on October 21. curl -fsSL https://pi.dev/install.sh | sh installs the CLI. Pricing: free, open source (MIT); bring your own model API key.
A five-stage pipeline, team-plan, team-prd, team-exec, team-verify, team-fix, wraps Claude Code and loops the verify-and-fix cycle until a stage actually passes, instead of calling the job done after one run through, and routes the simpler stages to cheaper models to keep the bill down. It shipped v5.7.9 the same day as this digest, with nineteen specialized subagent variants and past 40,000 stars. npm i -g oh-my-claude-sisyphus@latest installs it, or add it as a Claude Code plugin. Pricing: free, open source; requires an underlying Claude Code subscription.
Every entity and relationship in this knowledge graph carries a validity window instead of a single snapshot, so an agent can ask what was true at a given point in time, not just what's true now, and retrieval blends semantic embeddings, keyword search, and graph traversal without an extra LLM call at query time. pip install graphiti-core gets the library; Neo4j or FalkorDB runs behind it. Past 32,000 stars with a commit this week, it's the usual answer when agent memory needs to actually track change over time. Pricing: free, open source (Apache 2.0); backing store and LLM costs are separate.
Tencent's Hunyuan team rebuilt its memory library around three separate cognitive modes, chat, working, and coding, each with its own storage shape: eight-layer memory for conversation, a two-layer store for working context, and a diff-chain that versions what an agent has learned about a codebase over time. Version 2.0 shipped October 16, 2026. pip install hy-memory==2.0.4 installs it against Chroma, Qdrant, or FAISS, with Neo4j or Kuzu available for graph mode. Pricing: free, open source (Apache 2.0).
Hooks into twelve coding agents, Claude Code, Copilot CLI, and Cursor among them, sort what gets captured into four tiers, working, episodic, semantic, procedural, store it in a SQLite file you can actually open, and retrieve it through a hybrid of BM25, vector search, and reciprocal rank fusion. npx -y @agentmemory/agentmemory@latest installs it, or run it as an MCP server with npx -y @agentmemory/mcp. Trending since May and still shipping, with a commit yesterday and nearly 30,000 stars. Pricing: free, open source; self-hosted, with roughly $10 a year in typical embedding costs.
Documents, code, and conversation history go in; a self-hosted knowledge graph comes out, built through entity extraction and relationship mapping with vector search layered on top, and tuned to run against small local models so nothing has to leave your machine. pip install cognee gets the library; a cognee-cli adds remember and recall commands directly. At 32,700 stars and version 1.6.1, it's one of the more complete local-first options in this category. Pricing: free, open source (Apache 2.0); fully local-capable.
Phoenix captures LLM and agent runtime spans over OpenTelemetry, scores them against a dataset through a built-in eval module, and surfaces the whole thing in a self-hosted trace viewer you can actually debug a multi-step run in, rather than just read a log about. pip install arize-phoenix gets it running locally, with Docker, Railway, or cloud templates for anything bigger. The project patched a compromised litellm dependency in its October 22, 2026 release, the kind of maintenance worth checking for in anything sitting in your eval pipeline. Pricing: open source core; paid managed cloud tier available.
A pytest-native test runner scores LLM and agent output with research-backed metrics, G-Eval, task completion, tool correctness, computed locally, so a regression in agent behavior shows up the same way a broken unit test would in CI. pip install -U deepeval is the whole install, and it reads straight off LangChain or OpenAI agent traces. Version 4.3.1 shipped October 16, 2026, and past 19,000 stars, it's become the default when a team wants evals living in the same test suite as everything else. Pricing: open source, free to run locally; paid cloud dashboard for hosted monitoring.
Beagle doesn't evaluate your agent; it evaluates your harness. A seed, baseline, propose, score, gate, land pipeline runs an "evolver" agent that proposes changes to how your agent is built, scores each proposal against benchmark suites like terminal-bench and swe-bench-verified using those benchmarks' own graders, and gates out anything that regresses before it lands. Salesforce AI Research's DarwinX algorithm, built on this pipeline, ranked first on the OSWorld 2.0 leaderboard in results published October 15, 2026. git clone plus bash scripts/install.sh sets it up; Python 3.12 and Docker are required. Pricing: free, open source (Apache 2.0).
Seven persona agents, Analyst, PM, Architect, UX Designer, Scrum Master, Dev, QA, chain together so the planning agents write the PRD and architecture docs, the Scrum Master turns those into fully-contexted story files, and Dev and QA implement and gate the work before anything ships. npx bmad-method install sets up the stable v6.12 line; a v7 preview already sits on main. At 54,000 stars, it remains the reference for an agent team that mirrors a real software process instead of one long prompt. Pricing: free, open source (MIT), donations welcome.
Eight role agents, planner, reviewer, scout, orchestrator, debugger, context-engineer, permission-analyst, cost-analyst, work alongside forty-one skills and thirty-three hook scripts spread across twenty-two lifecycle events, backed by a SQLite memory store that corrects itself over time and native git-worktree support for running sessions in parallel. Version 3.4.0 shipped September 28, 2026, adding an offline-trainable classifier layer. /plugin marketplace add rohitg00/pro-workflow then /plugin install pro-workflow@pro-workflow installs it in Claude Code. Pricing: free, open source.
386 slash commands sit on top of Claude Code, Cursor, and Codex here, forty-six hand-written and the rest generated on demand, alongside 229 skills and a "routed advisory board" of expert personas you can call into an architecture decision instead of making it alone. npx cocosuperintelligence runs the installer, or clone the repo and run install.sh. It shipped v1.9.0 the same day as this digest. Pricing: open-core — MIT core, with a paid "Super Intelligence" layer for advanced features.