GitHub Trending Top 10: REA leads at six months old with 229,268 stars in a week, ArtCraft gains 16,379 on one commit, and HyperFrames ships 24 releases (Oct. 11–Oct. 18, 2026)

The chart handed its top slot to a repository six months old. REA gained 229,268 stars in seven days — 71% of every star it has ever collected — and closed the week at 322,386.

Then the week stops behaving like a popularity contest. Three of the ten published a release. Seven published nothing and still took commits, between one and 167 apiece.

Cadence and attention almost never met. The second-ranked repository took a single commit. The third took 4,721. The eighth shipped 24 versions, roughly one every seven hours, and gained 5,883 stars: a fortieth of the leader's.

The ranking below is GitHub's own weekly Trending view, captured on October 18, 2026 at 8:00 p.m. ET. "Stars this week" is the gain GitHub attributes to the trailing seven days; "stars captured" is the running total at that moment. Both measure attention, so readiness stays a separate question, and each entry closes on the boundary that decides the star. 1

Current signal: Rank 1 with 229,268 stars this week and 322,386 captured. 1,300 commits inside the window, and three tagged releases: v6.5.0 on October 14, then v6.6.0 and v6.7.0 on October 18. MIT, and the repository dates from April 14, 2026. 123

Problem solved: Someone sees a feature in a shipped application and wants the same thing in their own. The source is not available, so "how does this work" has no cheap answer.

Implementation: REA is an MCP server — a process an agent calls as a set of tools — wrapped around analysis engines you already have. Native binaries go to Hopper, Ghidra or IDA.

JavaScript and Electron bundles, .NET assemblies, APKs, firmware images, packet captures and logic recordings each take their own path. Several need a tool you supply, such as JADX, binwalk, tshark or sigrok.

npx rea-agents setup writes the MCP entry and matching workflow instructions into Claude Code, Codex, Cursor or Gemini CLI. It backs up what it replaces and asks for a restart.

The two Sunday releases add a caller-installed Kuna provider, extend Ghidra analysis to Windows ARM PE targets, and make setup edit the last repeated member of a JSON or JSONC client config — the value clients actually read. 23

Differentiation: A decompiler gives a human a window and waits. REA keeps a human's question inside an agent and treats the decompiler as one provider among several, so the output is a written finding with evidence and stated limits, not a session someone had.

Verdict: Star it for the pattern: existing native tooling, wrapped in MCP, with evidence attached.

Boundaries: the deep providers are commercial or heavy, and REA neither installs nor updates them. Runtime capture runs the target under your own permissions, and that is where the legal exposure sits.

One upgrade trap: v6.6.0 was tagged and never published to npm, so installs moved straight from 6.5.0 to 6.7.0. The README also warns that a similar repository name or a copied README proves nothing about a download being official — the notice a 322,000-star project writes once clones appear. 4

Current signal: Rank 2 with 16,379 stars this week and 32,741 captured, against one commit inside the window. The newest release is ArtCraft v0.41.0 from September 26, three weeks before the window opened. Rust by GitHub's count, dual-licensed MIT or Apache-2.0, repository created in March 2022. 156

Problem solved: A prompt box gives an artist one lever. What a shot actually needs is decided before generation: who stands where, which camera, which prop, and which of six tools produced the last take.

Implementation: A desktop application for Windows and macOS, with Linux builds from source. It composites in 2D and stages in 3D, turns an image into a mesh, poses characters, and keeps one location across several shots.

Generation runs through a 62-model catalogue — 16 image, 25 video, 5 music and sound, 11 mesh, 5 world models — either through its own provider or through Grok, Midjourney, Sora and World Labs. 5

Differentiation: Most generative tools are a chat box with a gallery. ArtCraft is closer to a 3D editor that happens to generate: the composition exists before the model runs, which is the only way to get the same character into nine shots.

Verdict: Star it for the shape, not for this week. Boundaries: the half that generates runs through hosted providers, so the open-source part is the client rather than the compute. Releases stopped three weeks ago. And one commit in seven days means the chart measured a reputation, not work. 7

Current signal: Rank 3 with 14,224 stars this week and 43,222 captured. This chart placed it first for October 4–11, at 25,151 that week and 30,158 then. Inside this window it took 4,721 commits, the most on the board, and published v0.1.2 on October 14 and v0.1.3 on October 18 — the first releases since v0.1.1 on September 28. GPL-2.0. 189

Problem solved: A PlayStation 5 title is built for that console's hardware and system libraries, and on its own it runs nowhere else.

Implementation: The core is still a relinker: it rewrites the executable into the host's native format and links it against reimplementations of the console's libraries, recompiling shaders to SPIR-V and mapping input through SDL. What changed is the release process. Neither new version carries notes. The title of v0.1.3 is the commit that produced it: "Merge pull request #6138 from fdfawef324/claude/mc-netctl-check-callback". 810

Differentiation: An emulator reproduces the console and runs its code underneath. AnyPS5 rewrites the binary, so the game becomes an ordinary host process — which is why a 2D title can hold 60 fps on a mid-range card, and why an unsupported state ends the process instead of degrading.

Verdict: The reason to star it has not changed; the reason to wait has. Two releases in five days, both silent, means the changelog is a diff between tags. Add GPL-2.0, a compatibility list that fits on one page, and binaries you supply and answer for yourself. 11

Current signal: Rank 4 with 4,774 stars this week and 42,696 captured. 167 commits inside the window and no release ever, because the repository is a catalogue and versions nothing. Apache-2.0 at the root, each listed plugin under its own terms. It last appeared here for August 23–30, at rank 8 with 1,940 that week and 35,613 then. 112

Problem solved: A Claude Code user who wants a plugin has to find one, judge it, and keep it current. An author has to be found. Both need a place where the middle step is not homework.

Implementation: Two directories: /plugins for Anthropic's own, /external_plugins for partners and the community. Installation is /plugin install name@claude-plugins-official.

Two mechanisms are worth reading even if you install nothing. A plugin's name is an immutable slug, and renames run through a top-level renames map the loader reads on the next sync, so installs migrate instead of breaking. An entry marked strict: false can also point at SKILL.md directories inside someone else's repository, exposing a curated subset without a manifest. 1213

Differentiation: Community directories collect. This one gates: submissions arrive through a form and a quality and security bar, and the README states plainly that Anthropic cannot verify what an included MCP server or file will do.

Verdict: Star it if you install plugins you did not write. Boundaries: that disclaimer hands verification back to you. The 167 commits are curation — a directory being edited, not code you run. And nothing here is versioned, so "current" means whatever main says today.

Current signal: Rank 5 with 4,138 stars this week and 30,759 captured, 11 commits inside the window, and no release since v1.0.169 on June 29 — sixteen weeks. Elastic License 2.0, which GitHub records only as "Other". This is its third appearance: rank 8 for September 13–20 with 1,242 that week and 23,773 then, and an appearance the week before that. 114

Problem solved: Every tool call an agent makes dumps raw output into the context window. A browser snapshot costs 56 KB, twenty GitHub issues 59 KB. Then compaction wipes what the agent was in the middle of.

Implementation: An MCP server plus hooks. Sandbox tools keep raw output out of context and return a summary; the README's example turns 315 KB into 5.4 KB.

Session events land in SQLite. After a compaction, an FTS5 index with BM25 ranking retrieves only the relevant rows instead of replaying history.

Its last release, v1.0.169 on June 29, corrected the savings bar itself: the old one could render "1 B / 100% kept out", and the ratio is now reported to one decimal. 15

A third rule, "think in code", has the agent write a script that counts files and prints one line, rather than reading fifty files into the window. 14

Differentiation: Memory layers store what happened and inject it back later. This one's first job is refusing to let the data in, and its second is ranking what may re-enter.

Verdict: Star it for the sandbox. Boundaries: sixteen weeks without a release while commits continue means a pinned install is a frozen install. Elastic License 2.0 is not an open-source licence. The 98% figure is the project's own measurement, and the row of company logos at the top of the README is a claim the repository never documents. 16

Current signal: Rank 6 with 7,901 stars this week and 57,698 captured, 74 commits inside the window, and no GitHub releases at all — the version lives in .claude-plugin/plugin.json next to a changelog. MIT. It was rank 1 here for August 9–16, with 15,600 that week and 19,529 then, so it has roughly tripled its total in two months. 117

Problem solved: Ask a model for a diagram and you get the same rounded boxes with drop shadows, drawn in a style that belongs to no one and matches nothing you own.

Implementation: An Agent Skill, installed with npx skills add cathrynlavery/diagram-design. It covers 45 diagram types, each in minimal-light, minimal-dark and full-editorial variants.

Output is one self-contained HTML file with inline SVG: no build step, no JavaScript, no external images. The agent places nodes on a 4 px grid, and CI checks for overlap and clipping.

An onboarding command reads a site's palette and fonts so later diagrams match it, and existing Mermaid, draw.io or Excalidraw files can be redrawn. 17

Differentiation: Mermaid is text you diff. draw.io is a canvas you drag. This is a description you ask for again. The README states the trade itself: there is no source format to review in a pull request, and Mermaid remains the better answer for docs that change every sprint.

Verdict: Star it if you publish diagrams rather than version them. Boundaries: nothing to pin, output quality tracks whichever model runs the skill, and the same prompt can lay out differently twice. 18

Current signal: Rank 7 with 7,602 stars this week and 90,912 captured, the second-largest total on the board behind the leader. 79 commits inside the window, and no release in it: the newest is Ghidra 12.1.4 from September 21. Apache-2.0, Java, repository created March 2019. 11920

Problem solved: Compiled code does not explain itself. An analyst needs disassembly, decompilation, cross-references and graphs over binaries from many architectures and formats, inside a session that can be scripted.

Implementation: A desktop reverse-engineering framework with a decompiler, processor modules, a headless mode for automation, and an extension API in Java or Python. The current release asks for JDK 25 and ships a PyGhidra launcher. Its own README opens with a warning that certain versions carry known security vulnerabilities. 19

Differentiation: IDA Pro and Binary Ninja are commercial and polished. Ghidra is free, government-funded, and extensible enough that other tools treat it as a back end — which is the pattern worth noticing this week: the rank-1 repository on this chart lists Ghidra as one of the engines it drives.

Verdict: Star it, with the README's own caution attached. Read the advisories before trusting an install, budget for a JDK upgrade, and note that main runs 79 commits ahead of the download. If you are choosing an engine today, the question is less Ghidra-or-IDA than which one your agent can call. 21

Current signal: Rank 8 with 5,883 stars this week and 66,744 captured. 210 commits and 24 releases inside the window, from v0.8.150 on October 12 to v0.8.173 on October 18 — about one every seven hours. Apache-2.0, Node 22 or newer. Fourth appearance: October 4–11 at rank 6 with 4,223 and 60,977, September 27–October 4 at 56,774, and September 6–13 at 49,597. 12223

Problem solved: An agent can write HTML and CSS. Turning that page into a video that renders identically twice is a different problem, and most pipelines answer it by shelling out to ffmpeg and hoping.

Implementation: A composition is an HTML file with data attributes. Animation becomes seekable through adapters — GSAP, CSS animations, Lottie, Three.js, Anime.js, WAAPI — so frame 412 is a lookup rather than a wait.

Headless Chrome renders and FFmpeg encodes. The CLI is non-interactive by default, and there is no build step: index.html plays in a browser as it stands. The README now also announces a native macOS and Linux app.

What the 24 versions actually did was last-mile repair. v0.8.171 stopped check hanging inside an agent's macOS sandbox; v0.8.172 kept its report when another app had the project open; v0.8.173 made the desktop-app button stop dead-ending and fixed a 29.97 fps clip exporting at 30. 2223

Differentiation: Remotion, which the README credits by name, bets on React components and a bundler. HyperFrames bets on plain HTML any agent can write, under Apache-2.0 with no per-render fee, against Remotion's source-available licence.

Verdict: Star it if agents make video. The four releases above are the honest kind: narrow, specific, and named.

Boundaries: a project that cuts 24 releases a week can only be adopted pinned. The skills picker installs all 21 published skills unless you go through the router, and a plugin that auto-updates is a moving dependency inside a render pipeline. 24

Current signal: Rank 9 with 1,717 stars this week and 12,747 captured, 96 commits inside the window and 103 plugin directories in the README table. No releases. And still no licence file at the root: LICENSE, LICENSE.md, LICENSE.txt and COPYING all return 404, while the README's last section says "MIT". Third appearance, after August 16–23 and October 4–11 at rank 7 with 1,140 and 10,900. 125

Problem solved: Every agent now has a plugin format, and a format is only useful with worked examples of things developers already do: review a branch, audit a repository, drive a CLI.

Implementation: One directory per plugin at the repository root, each with .cursor-plugin/plugin.json as its manifest. The catalogue runs from a team kit and a branch reviewer to a pull-request review canvas, a documentation canvas, the Cursor SDK, an orchestration pack, and a third_party folder for vendors shipping their own.

Differentiation: Anthropic's directory, one row above, accepts outside plugins and vets them. Cursor's is a first-party and partner kit whose real artefact is the manifest — 103 worked examples of how a plugin should be shaped.

Verdict: Star it to read 103 manifests as a pattern library, not to depend on it. Boundaries: MIT is claimed in prose and absent as a file, so the grant is ambiguous. There are no versions to pin, and a catalogue edited 96 times a week is a moving target for anyone wrapping it. 25

Current signal: Rank 10 with 5,742 stars this week and 53,204 captured, 52 commits inside the window, and no release in it: v1.7.2 from September 29 is the newest. MIT, repository created March 18, 2026. It appeared here for August 23–30 at rank 7, with 5,348 that week and 38,531 then. 12627

Problem solved: A job search is a pipeline nobody builds. Find postings, judge fit, rewrite the CV per posting, write the letter, prepare, and remember what went where. Done by hand it caps out at a few a week.

Implementation: A workflow for Claude Code. You fork the repository, fill in a profile, and run /scrape, /apply and /interview. The prerequisites are explicit and steep: a paid Claude Code plan or API credits, Python 3.10, Bun, and a TeX distribution with lualatex and xelatex.

What lifts it above a prompt pack is the checking. /apply compiles the CV, inspects the rendered page and fixes the layout. It then extracts the PDF's text layer to see what an applicant-tracking system will actually read. 26

Differentiation: A resume builder produces documents. This produces a pipeline with a checker at each end, and a second agent with a fresh context reviews the drafts before anything is sent.

Verdict: Star it for the PDF and text-layer verification, which transfers to any document you generate. Boundaries: Claude Code has no free tier, the TeX toolchain is not optional, and the author's own funnel — 69 applications, 20 first interviews, one signed contract — is one person's result, labelled as such. 28

The chart measured attention. The week measured something else. Seven of the ten shipped no release at all, and among them the busiest took 167 commits while the quietest took one — the repository that landed at rank 2.

Where releases happened, they happened in bulk or not at all. HyperFrames published 24 versions in seven days, a cadence nobody can read. AnyPS5 published two with no notes and titled one after the merge commit that produced it.

Three entries are layers over something older, and that is the reusable pattern this week. REA is a layer over Ghidra, IDA and Hopper, and Ghidra itself sits at rank 7 as one of the engines it drives. HyperFrames is a layer over headless Chrome and FFmpeg. diagram-design is a layer over a problem Mermaid already solved, answering it with taste instead of syntax.

Four boundaries recur. Provider dependency decides what you own: REA's deep analysis and ArtCraft's models both run on someone else's software.

Absent releases decide what you can pin. Three of the ten publish no versions at all, and a fourth has published nothing since June. One of those three calls itself MIT without a licence file.

Price decides who can start: the job-search workflow assumes a paid Claude Code plan before the first useful run, and AnyPS5 assumes you already own the game. A README's own warning decides whether you trust the install, and Ghidra's opens with one.

For a first experiment, take the entry whose blocker you can already satisfy: a licence you can live with, a tool you already own, a version you can pin. A star records that a project moved. Whether it should stay in your toolchain is a question about the boundary, and no star count measures that.