Top 10 AI Repos You Should Know

10 GitHub repositories, Eight of the 10 did not exist a month ago, and not one of them ships a model. No weights, no training run, nothing you could point at and call intelligence. Everyone is scaffolding, built around a model that already works to stop it burning your money, your context, or your name. The biggest one here has 74,000 stars for cutting your token bill. When JetBrains ran the controlled test, the bill went up. So, here is the list in the order the numbers put them. And at the end, the one question only two of these 10 can answer. Start with the money, because the two most starred repos on this list exist for the same reason. Your agent reads too much. Number one by stars, RTK, Rust Token Killer. 74,200 stars, Apache 2, climbing since January. The idea fits in a sentence. RTK sits between your coding agent and your shell and compresses what comes back before the model ever sees it. A directory listing gives you 4,500 lines, through RTK 12. A git push collapses from 15 lines to one. A failing cargo test drops from 200 plus lines to about 20. Same information, a fraction of the context, and under 10 milliseconds of overhead to do it. More than 100 commands are covered. Git, Docker, kubectl, the AWS CLI, Jest, Pytest, Cargo, and a hook rewrites your bash calls to the RTK version, so it happens whether you remember or not. 15 agents ship integrations. Claude Code, Co-pilot, Cursor, Codex, Gemini CLI, WinSurf, Klein, Open Code. The line on the front page says 60 to 90% fewer tokens. Scroll further down that same readme, and the maintainers say something more careful. RTK cuts up to 90% of the bash output your agent reads. That is what RTK measures, and it is not the same as cutting your bill by 90%. That distinction became the most interesting argument in developer tooling this summer. In July, JetBrains ran it properly. Skills bench, 86 tasks, four paired runs, 425 build trials on Claude Sonnet 5 in Docker sandboxes. With RTK switched on, the median task came out 7.6% more expensive. P = 0.004. 13.8% more turns. 14.3% more cash reads. Task quality was a coin flip. Five better, four worse, 71 ties. So, the tool did not break anything. It just cost more to run. The mechanism is boring and worth understanding. Most of a long session's input is cached re-reads, built at about a tenth of the price. And the agent's own read and grep tools bypass RTK entirely. The hook only ever sees roughly a fifth of the output. Compress a fifth of the context, add 14% more turns, and the arithmetic turns against you. A Hacker News post called it the token compression illusion and pulled 121 points. One developer had already dropped it. $4.96 saved on a $926 bill. None of which makes RTK useless. If your agent is drowning in kubectl output, it will help. It does mean the number on the box measures output, not invoices. And to their credit, the maintainers wrote that down before the critics did. And that fifth is the ceiling on the entire approach. If the tool only ever sees shell output, and shell output is the minority of what your agent reads, then squeezing it harder has a limit you can calculate in advance. Which is exactly why the second repo on this list does not squeeze anything at all. Number two, codebase memory-mcp from Dayus Data. 36,900 stars, written in C, MIT licensed. It attacks the same problem from the other end. RTK shrinks what the agent reads. This one deletes the reason to read. It indexes your whole repository into a persistent knowledge graph, functions, classes, call chains, HTTP routes, links between services. The agent queries the map instead of opening files. 158 languages parsed with tree-sitter plus a hybrid LSP layer doing real type-aware resolution in 11 of them. Python, TypeScript, Go, Rust, Java, C, C++, C#, Kotlin, PHP, and Perl. The speed is the part people screenshot. The Linux kernel, 28 million lines across 75,000 files. Indexed in 3 minutes into 4.8 million nodes and 7.7 million edges. Django takes about 6 seconds. After that, it is a database. A graph query answers in under a millisecond. Regex name search, under 10. Trace a call path five levels deep, under 10. Dead code across the entire repo, about 150 milliseconds. The example in the readme, five structural questions cost roughly 3,400 tokens through the graph against 412,000 grepping file by file. That is 99.2% less. It runs entirely on your machine and sends no telemetry. Now the part that makes this repo more trustworthy than most of the list. There is a preprint behind it. arXiv:2603.27277. Submitted the 28th of March by Vogel, Meyer, Eschenbach, Kular, Grunewald, and Balzar. They ran it against an agent that just reads files across 31 real repositories. The graph agent scored 0.83 on answer quality. The file reading agent scored 0.92. 2.3 tool calls per question against 4.8. About 1,000 tokens per question against 10,000. So, what you are buying is a trade, not a win. You give up nine points of answer quality to spend a tenth of the tokens on a big repo that is an easy yes. And note the paper tested 66 languages while the repo now claims 158. The evidence is one version behind the marketing, which is normal and worth knowing. Number three, Grok build from xAI. 23,700 stars and the repository is 18 days old. Around 1,300 new stars a day, the fastest climb on this list. It is a Rust workspace shipping the same Grok CLI that runs xAI's agentic coding stack. Four crates, a terminal pager, the shell runtime, the tool implementations, and the workspace layer that actually touches your files. A full-screen mouse-driven TUI, a headless mode for scripting and CI, and editor embedding through the agent client protocol. It is a serious piece of engineering shipped under Apache 2 with the tools and the workspace layer in the tree. No weights ship with it. You point a config file at any provider you like, including one that is not theirs. As a release, this is the good version of open source. The reason it happened is the story. On the 13th of July, a researcher publishing as cereb lab put wire captures online. Grok build CLI version 0.2.93 was packaging developers' entire local Git repositories and posting them to a Google Cloud bucket named Grok code session traces. Not the file you were editing. Full commit histories, untracked files, and environment variables with the secrets still in them. One session moved 5.1 gibibytes where about 192 kilobytes would have done the job. That is roughly 26,000 times more data than the task required. And the CLI had a toggle for opting out of your data improving the model. Reporting found it had no effect on the uploads at all. Uploads happened even when users told the model not to read those files. xAI's own marketing had said nothing from your code base is transmitted to xAI servers during a session. On the 14th, xAI killed the upload server side and added a disable flag. Musk posted that everything already uploaded would be deleted. The OECD logged it as a formal AI incident that same week. The repository's creation timestamp is the 14th of July 2004 UTC. One day after the disclosure went public, the entire harness was on GitHub under Apache 2. And this is what reading the code gets you that a press release does not. The upload path is still in the tree. It is switched off by a server-side flag, not removed, so it can come back without shipping anyone an update. Opening the source did not fix that. It meant somebody could see it. Number four, and the newest thing here by a wide margin, QM from Y Combinator. The repo was created on the 29th of July. Three days later it has 3,300 stars. YC's own description is four words, multiplayer agent harness for work. What that means is the agent stops being your personal assistant and starts being a co-worker with a desk. Every person gets a sculpt workspace, so does every room. It's own memory, it's own file system, it's own view of the keychain, it's own permissions, cron jobs, and sandbox. Underneath, TypeScript on Fastify, Postgres for persistence. Every agent turn routed through one core. Slack and web from the same brain. You self-host it in your own cloud and swap the model layer, Pi, open code, Codex, Cloud Code, without rewriting anything above it. YC says they run it internally across accounting, legal, events, and engineering, including building QM itself. MIT licensed. For a deliberately tiny firm that behaves like a large one, that is about as unobstract as an endorsement gets. The idea worth stealing even if you never install it. Memory sculpt to a room, not a person. Most agent setups still assume work is something one human does alone and drop the thread the moment a second person joins. Work is a thing several people do to the same object. Number five, Open Worker from Andrew Ng. Repo created the 20th of July, announced on the 23rd, 11,400 stars by the 1st of August, roughly 950 a day. The pitch is one word, deliverables. Not a chat window describing a report, but a file on your disk that is the report. Document, spreadsheets, web pages, things you can open and send. It runs on your desktop, MIT licensed, and it takes your API key rather than selling you inference. 119 Python files, about 32,400 lines, 149 TypeScript files for the interface, and 78 back-end test modules. Tauri around React, fast API behind it. More than 25 integrations out of the box. GitHub, Slack, Jira, Notion, Linear, Gmail, Google Calendar, Outlook, HubSpot, monday.com, plus your terminal, your local files, and anything else that speaks MCP. The model matrix has 30 entries. OpenAI, Anthropic, Gemini, Inkling from Thinking Machines, GLM, DeepSeek, Kimmy, Quinn, MiniMax, Mistral, Grok, or Allama, if you want the whole thing to stay on the machine in front of you. The permission design is the part one would copy into my own tools. Every action is classified, read, write local, exec, or external. Then you choose a mode. Discuss and plan are read-only. Interactive asks before anything leaves the machine. Auto allows everything but stays inside a path you named. And when it runs unattended overnight, it does not guess. It parks its questions in an inbox and waits for you. Every agent that has ever surprised you at 3:00 in the morning was missing exactly that one decision. It is an open beta and it says so on the tin. The Windows builds are not code-signed yet, so SmartScreen will shout at you. For a repository 12 days old shipping 78 test modules, I will take that trade. Which is five repos in and a pattern you may have noticed, every one of them assumes the model is fine. All the engineering is about what the model is allowed to see and touch. Number six, Turbo Field Fair. One line of description and it is the most audacious claim on the list. Gemma 4, 26 billion parameters running in about 2 GB of RAM on any M-series MacBook. The trick starts with the model. Gemma 4 26B is a mixture of experts. 26 billion parameters in total, but only about 3.88 billion of them fire for any given token. Most of that file is sitting idle at every single step. So, Andrey Mikhailov, an iOS and metal engineer, wrote a runtime that never loads the model. 1.35 GB of shared core stays resident alongside the key value cache. Every expert streams off the SSD the moment the router asks for it and goes away again. Weights are 4-bit affine at group size 64. The router stays at 8-bit on purpose because a router that rounds wrong sends the whole token to the wrong expert and the error compounds from there. 14.3 GB on disk, about two in memory, the rest is bandwidth. Measured decode, five to six tokens a second on an 8 GB MacBook Air M2. 31 to 35 on a 24 GB M5 Pro. The 8 GB number is the one that matters because that laptop was never supposed to run this model at all. It is Swift and handwritten metal all the way down. Not a wrapper over MLX. Not a wrapper over llama.cpp, which is also the catch. It is built for one model, text only, Apple silicon only, metal for or nothing. 3,200 stars for a single model runtime, and the reason is the ceiling it moves. If the resident cost of a big mixture of experts model is its shared core rather than its parameter count, the entry price for serious local AI just became whatever laptop you already own. Number seven, Native from Prince Canuma. 1,050 stars, the smallest number on this list, and the first thing I would install if you own a Mac. Canuma is not a newcomer to this. He maintains MLX VLM, MLX audio, and MLX embeddings, has published over a thousand models and libraries into the MLX ecosystem and worked with Google DeepMind on getting Gemma 4 running well on Apple silicon. Native is that entire stack wearing a native app, Swift, MIT, macOS 26 or newer. It bundles the MLX VLM server, finds the models already sitting in your hugging face cache, and gives you chat, vision, image generation, decode speed analytics, and a GPU monitor in one window. But the part that makes it infrastructure rather than a toy is a server. It exposes OpenAI compatible endpoints and Anthropic compatible ones, token counting included. So, Claude Code, CodeX, Zed, Cursor, Aider, Goose, and Continue all point at localhost and carry on as if nothing changed. That is the local first argument in its strongest form. Not a different way to chat. The same tools you already use every day with the inference moved onto hardware you own and a network tab that stays empty. Number eight, CodeX security from OpenAI. TypeScript, Apache 2, 7,800 stars, repository created the 13th of July. This one has history. It started life as Aardvark, went into research preview in March as a security agent for ChatGPT's business tiers, and what got opened up is the CLI and the TypeScript SDK around it. Before it looks for anything, it reads your repository and writes a threat model you can edit. Then it hunts against your model of your system instead of pattern matching a generic rule list, and it ranks what it finds by real world impact rather than severity theater. The March numbers are why people paid attention. Across 30 days, it scanned more than 1.2 million commits in external repositories. 792 critical findings, 10,561 high severity ones. In OpenSSH, GnuTLS, libssh, PHP, and Chromium, among others. The CLI does whole repo scans, path scope scans, pull request diffs, and scan history, so you can prove a fix actually landed. Output comes out as markdown, JSON, serif, or CSV, which means it drops into CI without anyone writing a parser first. The default model is GPT 5.6 Saul at extra high reasoning with a lighter option if you want one. And there is a max cost flag because what you pay for here is reasoning effort and worker count, not lines of code. The framing that came out of the coverage is the right one. Treat it like a senior reviewer who occasionally hallucinates. A finding from this thing is a lead, not a verdict. Powerful, not omniscient. One small detail that says a lot about July. OpenAI's own post about the release opened by admitting Hacker News found the repository before they got around to announcing it. One caveat the security people raised immediately. It reads code, so it finds what is visible in code. Configuration drift, a misrouted load balancer, an auth check that only fails against a live endpoint. Those still need something that pokes the running system. A very good first pass, not the whole program. Number nine, T3 MP3ST from the researcher who publishes as Elder Plinius. 5,300 stars in 30 days, AGPL3, and it is the most uncomfortable entry here. It is a meta harness. It does not want an API key or a cloud account. It drives a coding agent you are already running and organizes it into an offensive security team for testing systems you own or have written permission to test. Eight operators mapped onto MITRE ATT and CK tactics. Recon, scanner, exploiter, infiltrator, exfiltrator, ghost, coordinator, analyst. 36 tools by default, 109 with the full arsenal. The reported results, 90.1% pass at one on XBOBAYOU's own 104 challenge XBN suite, where XBOBAYOU self-reports around 85. 23 of 40 hint-free solves on Cybench. And on 10 CVEs disclosed this year across seven languages eight pin to the exact file line and CWC EE. The repository is more careful than the headlines about it were. Only the recon engine and the single agent loop are marked stable and benchmarked. Everything else is labeled experimental. The license restricts it to authorized testing and it states plainly that the operator carries a legal weight. It also ships something no other repo on this list does. Run npm run verify claims and every benchmark number recomputes from committed data on your machine. On a list where the going rate for evidence is a percentage in a read me, that one command counts for more than an entire front page. And the reason it belongs in a top 10 rather than a warning post is simple. Tooling at this level is now cheap for both sides of the fence. The useful response is to run a scanner over your own code before somebody else's agent does. Number 10, no AI slop from Peter Yang. 3,700 stars, MIT licensed and there is barely any code in it. It is a skill, a set of editing rules you install into Claude code or Codex and it names more than 20 patterns that mark writing as machine made then strips them while leaving your actual voice intact. The named list is uncomfortably accurate. Binary contrast, throat clearing openers, faux insight setups, colon reveals, importance puffery, weasel attribution, experts agree, studies show, fake strong verbs, synonym cycling, negative listing, dramatic fragmentation. There is also a detect mode that rewrites nothing. It hands your draft back with every pattern quoted at you, which is a considerably worse experience and a much more useful one. I will be straight with you, this script goes through a gate built on the same idea before it gets voiced. Yang's own workflow is the part worth copying. First quarter of a draft with no model at all, middle half with the model and the skill, last quarter line by line by hand. Substack shipped slop detection this summer and used his writing as the example of doing it properly. 10 repositories, 170,871 stars, two written in Rust, three in TypeScript, two in Swift, two in Python, one in C. Zero model weights, not one of these 10 contains the thing everybody spent four years arguing about. That is the shape of this year. The intelligence stopped being the hard part and the hard part became everything around it. What the model may read, what it may touch, where it runs and who checks what it produced. Eight of the 10 were created in July. Grok build is pulling 1,300 stars a day, QM 1,100, Open Worker 950. Those numbers measure attention and attention arrives long before evidence does because only two of the 10 have had their central claim checked by somebody with nothing to gain. Codebase memory NEFCP has a preprint reporting it loses nine points of answer quality. RTK has a JetBrains study saying it costs more than it saves and there is a cheaper tell than star counts. Five of these 10 put a headline number on their front page. Exactly one of them ships a command that recomputes it. If you are choosing between two tools this week, that ratio will tell you more than any leaderboard does and both of those repos should go up in your estimation, not down. A number that survived contact with a controlled test is worth more than a number that has never met one. Even when the test went badly, especially then. So, pick by what you actually pay for. If it is context, take the graph over the compressor. If it is data leaving the building, Open Worker or Native and watch the network tab yourself rather than trusting a toggle. If it is a team re-explaining itself every morning, QM. If it is a laptop somebody wrote off as too small for a real model, Turbo Field Fair. And if you are shipping code you did not write a single line of, run CodeX security tonight. Then, when the next repo lands with 60 to 90% across the front page, ask the question this entire list mostly cannot answer. Who measured it and what did they find?