GitHub Trending Top 10: Agent org charts, memory that learns, and a security audit skill (Sep. 20–27, 2026)

The board for September 20–27 opens with a repository that was already on this list in May: Anthropic's pack of finance agents, back at rank 1 four months after it first appeared. What the other nine add up to is a change in where the interesting work sits. The model is assumed now. What is being built is the layer above it — an org chart with budgets (Paperclip), memory that consolidates instead of accumulating (Hindsight), an audit whose output a reviewer can check (Cloudflare's security-audit skill), and a workspace for running a fleet rather than one agent (Orca). Two long-standing frameworks, Next.js and PyTorch, return with much smaller weekly gains and more immediately actionable news: a security patch, and a stable release that predates the window.

The ranking below is GitHub's own weekly Trending view, captured on September 27, 2026 at 8:00 p.m. ET. "Stars this week" is the gain GitHub attributes to the trailing seven days; "stars captured" is the running total at that same moment. Both measure attention, so production readiness stays a separate question. Each entry closes on the adoption boundary that decides the star: a license, a provider key, a backlog, or an unsandboxed execution path. 1

Current signal: Rank 1 with 2,606 stars this week and 37,862 captured, against 93 open issues and 131 open pull requests. Apache-2.0, no tagged releases, last commit on September 21. This repository last appeared on the list for May 8–15, when it ranked 4th at 22,939 stars. 12

Problem solved: Analyst work in investment banking, equity research, private equity and fund administration is repetitive and document-heavy — comps and DCF models, earnings updates, general-ledger reconciliation, KYC screening — and every output has to be checked by a professional before it counts. 2

Implementation: Markdown and JSON files with no build step. Ten named agents each ship as a self-contained plugin: Pitch Agent, Meeting Prep Agent, Market Researcher, Earnings Reviewer, Model Builder, Valuation Reviewer, GL Reconciler, Month-End Closer, Statement Auditor and KYC Screener. The same directory runs two ways — installed as a Claude Cowork plugin, or deployed as a Managed Agent through /v1/agents with an agent.yaml wrapper. A core financial-analysis vertical carries the modeling skills and the connectors; its table lists twelve MCP providers, among them Daloopa, Morningstar, S&P Global, FactSet, Moody's, LSEG, PitchBook, Chronograph, Egnyte and Box. Partner-built LSEG and S&P Global plugins and an advisors bundle sit alongside. 2

Differentiation: Anthropic ships this as a reference vertical rather than a framework. The guardrail is written into the README: every output is staged for human sign-off, and the agents draft models and memos without posting to a ledger or approving onboarding. The reusable piece is the packaging — one source, two deployment paths. 2

Verdict: Star it if you are assembling a vertical agent stack. Two boundaries: each connector needs its own subscription or key, and subagent delegation is still marked a research preview. Apache-2.0 makes forking the templates cheap. 3

Current signal: Rank 2 with 7,364 stars this week, the second-largest gain on the board, and 89,896 captured. 2,496 open issues and 3,364 open pull requests; MIT; commits through September 27. The newest versioned tag is v2026.916.1 from September 21, with canary and nightly builds arriving through September 27. 145

Problem solved: Twenty terminal tabs of coding agents have no owner, no budget and no audit trail. A reboot loses whatever was in them, and nobody can say which agent was working on what. 4

Implementation: A Node.js server with a React UI that provisions an embedded PostgreSQL, installed by a checksummed script or npx paperclipai onboard. Agents are adapters woken by heartbeats, so anything that can receive one joins: Claude Code, Codex, terminal CLIs, HTTP bots. Tasks carry their goal ancestry and are checked out atomically, so two agents cannot take the same one; budgets enforce hard stops; execution workspaces are git worktrees; approvals, decision tracking and an activity log sit above them; whole organizations export and import with secrets scrubbed. 4

Differentiation: The README draws the line itself: Paperclip is not an agent framework, a workflow builder or a prompt manager. It takes the agents you already run and gives them roles, reporting lines and budgets, on its own summary of the difference — if OpenClaw is an employee, Paperclip is the company. 4

Verdict: Star it if you have already lost track of several agents. The boundary is the backlog: 5,860 open issues and pull requests together is a support queue rather than a support desk, and versioned tags arrive about two weeks apart between daily canary builds. Telemetry is on by default and opts out with PAPERCLIP_TELEMETRY_DISABLED=1. 46

Current signal: Rank 3 with 11,089 stars this week, the largest gain on the board, and 37,316 captured. 96 open issues and 71 open pull requests; MIT; commits through September 26. Integration releases landed inside the window: integrations/paperclip/v0.4.0 and integrations/obsidian/v0.3.0 on September 25, and integrations/coding-agents/v0.7.0 on September 24. 178

Problem solved: An agent that recalls conversation history still repeats its mistakes, because retrieval returns what was said in the shape it was said and never forms a belief that outlives the turn. 7

Implementation: A Python server run through Docker, pip or Helm, with Python, Node, Go and CLI clients over PostgreSQL and pgvector. Three operations: retain extracts facts, entities and relationships; recall runs semantic, keyword, graph and temporal retrieval in parallel and fuses the results by reciprocal rank with a cross-encoder rerank; reflect reasons over what is stored. Memories are typed as world facts, experiences, observations and mental models, and isolated per bank. Observations consolidate related facts into consolidated beliefs that are refined as evidence arrives; a mental model is a standing answer to a question, rewritten in the background, that an agent reads as a database read. 7

Differentiation: The bet is consolidation rather than retrieval. The README reports state-of-the-art results on LongMemEval, says researchers at Virginia Tech's Sanghani Center and The Washington Post reproduced them, and publishes per-model results on the project's own benchmark site. A per-bank memory defense policy scans every retain against 45 patterns for secrets and personal data. 910

Verdict: Star it when the failure you are debugging is forgetting rather than reasoning. Two boundaries: the headline benchmark lives on the vendor's own site, and every retain costs an LLM call on a provider you configure, so memory carries a running bill. MIT, and self-hostable. 8

Current signal: Rank 4 with 4,805 stars this week and 22,338 captured, against 19 open issues and 31 open pull requests. MIT, no tagged releases, and the last commit landed on September 14 — so this week's gain came from attention to the skill while the code itself stood still. 11112

Problem solved: Ask a coding agent to find vulnerabilities and it produces findings you cannot check. It holds one hypothesis at a time, exhausts its context window on a fraction of the repository, and loses what it learned when the context is compacted. 13

Implementation: A skill installed with npx skills add, made of phase documents, a JSON schema and two zero-dependency Node validators. Six phases: reconnaissance writes architecture.md and coverage-ledger.json; hunting assigns one isolated hunter per ledger unit and runs coverage critics over the gaps; every candidate goes to a fresh verifier that tries to disprove it; survivors are written to findings.json against report-schema.json; independent agents re-verify each final source claim; reports are derived from the verified records. Verdicts are confirmed, needs_validation and rejected, and later runs reuse earlier ledgers to target the gaps. 11

Differentiation: Validation is adversarial by construction: the agent that checks a finding is never the agent that found it. This skill is the single-repository seed of Cloudflare's fleet-wide vulnerability harness, and the write-up records the design decisions behind the scaled-up version — different models for discovery and validation, runs that are additive across repositories, and the finding that one run surfaced roughly half of what repeated runs found. 13

Verdict: Star it for two artifacts: the coverage ledger that says what was examined, and the findings schema that makes an agent's output reviewable. Boundaries: the method assumes an OS-enforced sandbox and leaves leads as needs_validation without one, a needs_validation record carries no severity by design, and the repository has not moved in two weeks. 11

Current signal: Rank 5 with 2,705 stars this week and 30,613 captured. v0.8.2 shipped on September 24, inside the window, and commits ran through September 27, against 317 open issues and 246 open pull requests. This repository was covered here last week at v0.8.0 and 28,000 stars. 11415

Problem solved: A company's documents sit in Feishu, Confluence, GitLab, Notion and DingTalk alongside Office files, and making them answerable by an agent usually means either a hosted service that holds the data or a retrieval stack assembled from four vendors. 14

Implementation: A Go platform with swappable models (27 vendors), vector stores (pgvector, Elasticsearch, OpenSearch, Milvus, Weaviate, Qdrant, Apache Doris, Tencent VectorDB) and object storage, deployed with Docker Compose, Helm, a single binary or a desktop app. Version 0.8.2 adds browser control through Tencent's BrowserSkill extension, so the agent drives the reader's own Chrome or Edge and hands back for logins and CAPTCHAs; a built-in MCP server that publishes per-workspace /mcp/ endpoints, each with its own token, knowledge-base scope, rate limit and tool groups; conversation control that appends to a running turn, forks from an earlier question, and rewinds with sandbox checkpoints; and an interactive terminal and graphical desktop beside the chat. 16

Differentiation: The governance furniture is what separates it from the retrieval field: four-tier workspace roles, per-workspace audit logs, scoped API keys, OIDC, AES-256-GCM credential encryption and a whitelist-only outbound mode, with the whole stack deployable on a private network. Version 0.8.2 states its breaking changes plainly in the same document. DingTalk channels are Stream-only, and sandboxed commands now run as root. 16

Verdict: Star it if company documents have to stay on your own infrastructure. Boundaries: 246 open pull requests and sandbox semantics that shift between minor versions; the README tells production operators to keep the service on an internal network, and the local host-process sandbox backend was removed back in 0.8.0. 14

Current signal: Rank 6 with 1,154 stars this week and 31,992 captured, against 94 open issues and 203 open pull requests. MIT. The newest release is v1.29.6 from September 16, four days before this window opened, while commits continued through September 27. 11718

Problem solved: A Claude Code setup is assembled by hand, project by project — agents, slash commands, hooks, MCP servers, settings and skills — and once assembled there is no view of what is installed or what a running session is doing. 17

Implementation: An npm CLI, npx claude-code-templates@latest, that installs named components from a catalog with one flag each: --agent, --command, --setting, --hook, --mcp, --skill. Alongside the catalog it ships local tools — --analytics for live session state, --chats for a mobile conversation monitor that can be exposed through a Cloudflare Tunnel, --health-check for installation diagnostics, and --plugins for marketplaces, installed plugins and permissions. Release 1.29.6 added Claude Mods, which install Anthropic-layout plugins with --mod; 1.29.5 added installable TypeScript function hooks. 1718

Differentiation: The value is curation and one install path rather than new capability. The catalog bundles other people's work — Anthropic's own skills, Jesse Vincent's Superpowers, wshobson's agents, K-Dense's scientific skills — and the README keeps per-source attribution and license with each bundle. 17

Verdict: Star it to bootstrap a configuration and to see what a maintained catalog for an agent CLI looks like. Boundaries: what it installs runs inside your agent with your credentials, and each bundled component keeps its own license rather than the repository's MIT. 19

Current signal: Rank 7 with 6,227 stars this week and 79,609 captured. The project ships daily, and its newest tag v1.4.215 was published on September 26, inside the window. 3,333 open issues and 3,588 open pull requests; MIT. It last appeared on this list for the week of July 5–12, at 16,991 stars — 79,609 today. 12021

Problem solved: Running five agents against one repository turns into guessing which worktree holds which branch, which agent is waiting on an answer, and which of them finished while you were away. 20

Implementation: An Electron and React desktop application for macOS, Windows and Linux, with iOS and Android companions that notify and accept follow-ups. It runs any CLI agent, each in its own git worktree, so one prompt can fan out across five agents and the results can be compared before merging. Terminals render through WebGL with scrollback that survives restarts; Design Mode clicks an element in a real Chromium window and puts its HTML, CSS and a cropped screenshot into the prompt; GitHub and Linear are browsable in-app; SSH worktrees run an agent on a remote machine; and an orca CLI lets an agent create worktrees, snapshot, click and fill. 20

Differentiation: Orca stays neutral about which agent you run — the README lists more than thirty supported CLI agents and accepts any program that runs in a terminal — so the product is the surfaces around a fleet: mobile steering, usage and rate-limit tracking with account switching, diff annotation, and computer use. 20

Verdict: Star it if several agents already run at once and you want them somewhere other than nine terminals open on one desktop. Boundaries: 6,921 issues and pull requests open together on a project that publishes several builds a day, and what you adopt is an application plus a workflow rather than a library. 22

Current signal: Rank 8 with 496 stars this week, the second-smallest gain on the board, and 142,803 captured. A security release landed inside the window: v16.3.6 on September 22, with the same fix backported to v15.5.26 the same day. 1,033 open issues and 2,490 open pull requests; MIT; canary is at v16.4.0-canary.51. 12324

Problem solved: This week's problem is narrower than the framework's: a remote code execution flaw in next/og ImageResponse, the path applications use to render Open Graph images at request time. The release links the fix to advisory GHSA-vcvr-r3jv-pc5j. 2425

Implementation: A pnpm monorepo whose framework package extends React features and compiles with Rust-based JavaScript tooling. The stable line is 16.3.x, and 15.5.x still receives security fixes. The repository's root README is a one-line pointer to packages/next/README.md, where the framework's own documentation now lives. 23

Differentiation: Next.js is the substrate this week's other chart entries are built against rather than a competitor to them, so the relevant distinction is release discipline: one fix reached the current major and the previous one on the same day, which means a team on either line has a version to move to. 2426

Verdict: Star it if you build React applications and want release notes arriving in the feed. The immediate action is a version bump: if anything in your application renders images through next/og, move to 16.3.6 or 15.5.26 and read the advisory, which carries the actionable part of this entry. 2527

Current signal: Rank 9 with 1,105 stars this week and 50,752 captured, against 56 open issues and 56 open pull requests. Apache-2.0. The newest tagged release is v0.4.0 from June 25, and the last commits landed on September 21, so this window brought no release. It last appeared on this list for May 18–25, at 40,061 stars. 12829

Problem solved: Professional software exposes a graphical interface to people and very little to agents. Screenshot-and-click automation breaks on every redraw, and hand-written API wrappers cover a fraction of what the application can do. 28

Implementation: A plugin for Claude Code, Cursor, Pi and similar harnesses, plus skills, that runs a seven-phase pipeline over a target codebase: analyze the architecture, design the command surface, implement it, plan tests, write them, generate documentation and packaging, and publish. The output is a Python CLI under the cli_anything.* namespace with JSON output, session state with undo and redo, and a SKILL.md generated in phase 6.5 so an agent can discover the commands. Generated harnesses install with pip, and CLI-Hub, a registry package installed with pip install cli-anything-hub, handles browsing, installing and updating them. 2830

Differentiation: The artifact is the generator and the pair of files it leaves behind — the CLI and its SKILL.md — rather than a fixed list of integrations. The README claims real backends rather than simulations: LibreOffice writes the PDF, Blender renders the scene, Audacity processes audio through sox. It reports more than 2,280 tests across 18 applications. 28

Verdict: Star it for the generated CLI plus SKILL.md pair, both of which you can read before installing anything. Boundaries: the pipeline writes code that then drives the target application on your machine, so review the harness it produces the way you would review any generated code, and the release feed has been quiet since June while community pull requests keep arriving. 2931

Current signal: Rank 10 with 320 stars this week, the smallest gain on the board, and 103,422 captured; 5,000 open issues and 3,499 open pull requests, with nightly and trunk tags landing through September 27. The newest stable release is v2.14.0, published on September 2 — before this window opened. 13233

Problem solved: Training and serving models in Python with GPU acceleration, and keeping the compiler, the distributed collectives and the hardware backends moving together. 32

Implementation: The 2.14.0 release notes concentrate on kernels and collectives. NVGEMM brings CuTeDSL-generated CUTLASS kernels into Inductor with epilogue fusion and NVFP4 GEMM. torch.switch generalizes torch.cond to multi-way branching, and torch.while_loop can be captured in a CUDA graph. @dynamic_spec declares dynamic shapes once for torch.compile, torch.export and make_fx. Complex-valued tensors get experimental compile support, and a rewritten NCCL backend ported from torchcomms previews as a drop-in replacement. Fault tolerance becomes a c10d concept with in-place process-group reconfiguration and a Flight Recorder. Apple Silicon gains SVD, eigh, QR and Cholesky; ROCm 7.14 wheels come from the TheRock SDK; Inductor targets Rubin (sm_107). 33

Differentiation: PyTorch is the substrate most of this list trains or builds on, so its release notes compete with its own previous version. The direction shows in where the highlights point: kernel generation, collectives and hardware breadth rather than API surface. 33

Verdict: Star it if you ship training code. The reason to read the release notes this week is the upgrade checklist, where two changes are silent: acc_policy="balanced" was removed from LinearCrossEntropyOptions, and gradients at clamp, min and max boundaries now split at ties instead of following the old rule. The release predates this window by more than three weeks, so treat the chart placement as a signal of attention rather than of a new version. 3334

Management moved up a level. Paperclip models roles, budgets and approvals above the agents; Orca models the workspace around them; Anthropic's finance pack models a department; WeKnora models a knowledge base with permissions and an audit log. The individual agent has become a component with a job description, and the interesting design questions have moved to checkout, budgets and sign-off.

Memory acquired a schema. Hindsight separates what was said from what the agent now believes and rewrites beliefs as evidence arrives; WeKnora keeps a profile, preference and fact store across sessions with user confirmation; Paperclip's roadmap still lists memory and knowledge as unshipped. Three years of "put it in a context file" produced the problem the first two are now selling a fix for.

Verification stayed the differentiator. Cloudflare's skill makes an agent try to disprove each finding before writing it down, and Next.js shipped one security fix to two supported major lines on the same day. Both make the check a separate step with its own record — a schema, a ledger, or a backport.

Attention and release activity ran on different clocks in three of the ten. Cloudflare's skill has no tagged releases at all and has not been pushed since September 14; CLI-Anything's newest release is from June 25; PyTorch's stable release came on September 2. The weekly chart measures what developers are looking at, and for those three the looking is ahead of the shipping.