Every weekend the same thing happens on my feed. Someone posts “12 open-source AI projects you NEED right now,” the replies fill with rocket emojis, and I bookmark all twelve. Then I install none of them.
The projects aren’t the problem. The count is. Twelve is a list you scroll past, not one you act on. And these roundups rank by GitHub stars, which tells you what’s popular, not what earns a slot in your workflow.
So I did the filtering. I watched Matthew Berman’s latest “12 projects” video, pulled all of them, and cut it to the seven that genuinely change how my coding agent works. The rest were mostly video-generation toys, fun but not core, and one was Matt Pocock’s skills repo, which I already broke down in full.
Here are the seven I kept, and why.
Repo: github.com/bytedance/deer-flow DeerFlow is ByteDance’s open-source super-agent harness, around 66,000 stars, and it’s built for the thing most agents are terrible at: long-horizon work. The name stands for Deep Exploration and Efficient Research Flow. You give it a task and it runs for hours, sometimes days.
Most harnesses choke on anything past a few minutes. They lose the thread, forget the goal, run out of context. DeerFlow assumes the opposite, that the interesting jobs are the slow ones. It uses sub-agents to split big tasks, sandboxes to run pieces safely, and memory to stay coherent across a long session.
The repo points it at data pipelines, slide decks, dashboards, and content automation. If you’ve used OpenClaw or Hermes and wished for something built for the marathon instead of the sprint, this is it.
Repo: github.com/garrytan/gstack gstack is Garry Tan’s opinionated Claude Code setup, and it’s one of the most-starred agent repos around. Tan runs Y Combinator. He took how he thinks about building software and codified it into skills your agent runs in order.
That order is the point. Tan calls gstack a process, not a toolbox. You don’t cherry-pick. You go think, plan, build, review, test, ship, reflect, with each skill handing off to the next.
My favorite is /office-hours. It recreates the YC ritual where a partner grills you on your problem, your solution, and your team. Your agent plays the partner. If you're chewing on a startup idea and not just a feature, that hits different.
Install is the now-standard move: paste the repo URL, tell your agent to install it. Run gstack next to Matt Pocock’s skills and you’ve got two full philosophies of AI engineering to steal from.
Repo: github.com/DeusData/codebase-memory-mcp Here’s one that’s flying under the radar at around 12,000 stars. Codebase Memory MCP, from DeusData, indexes an average repo in milliseconds and answers structural queries in under a millisecond. Its benchmark flex: it indexed the entire Linux kernel, 28 million lines, in about three minutes.
Why care? Your agent doesn’t really understand your codebase. It greps, guesses, reads a few files, and hopes. On a large repo that burns tokens and still misses context.
This builds a persistent knowledge graph of your code, so the agent queries structure instead of re-reading files every time. The repo claims roughly 120 times fewer tokens for the same understanding, supports 158 languages, and works across 11 harnesses. There’s even a 3D view so you can fly through your codebase as a graph. One line to install. If your agent keeps getting lost in a big repo, this is the fix I’d reach for first.
Repo: github.com/mukul975/Anthropic-Cybersecurity-Skills I have to correct something here. “Anthropic Cybersecurity Skills” is a community repo by a developer named mukul975, not an official Anthropic release, even though “Anthropic” is right there in the name. It’s around 20,000 stars. The name is borrowing some credibility, so go in knowing that.
The skills are real and good. It’s a big pack mapped to six recognized frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and MITRE’s fraud framework, the last co-developed with JPMorgan, Citi, and Lloyds.
The workflow is dead simple. Install it, point your agent at your codebase, say “improve my cybersecurity defenses.” Now the agent reasons with actual security taxonomies instead of guesswork. It works with Claude Code, Copilot, Codex, Cursor, Gemini. Just remember whose repo it actually is.
Repo: github.com/NVIDIA/SkillSpector Notice what I just did. I had you install several repos by pasting URLs and telling your agent to run them. That’s an attack surface, and it deserves more respect than it gets. SkillSpector, from NVIDIA, around 10,000 stars, is the scanner built for exactly this.
It checks agent skills for 65 vulnerability patterns across 16 categories: prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, MCP tool poisoning, and more. It takes repos, URLs, zips, directories, or single files.
Think about what a bad skill can do. It runs inside your agent, with your agent’s tools and access. A skill that quietly leaks your environment variables looks exactly like a helpful one until it doesn’t. So the rule is obvious: scan any third-party skill, including a few from this list, before you install it. NVIDIA shipping it is about the best trust signal you get for a security tool. Honestly, this should be step zero.
Repo: github.com/NousResearch/hermes-agent Hermes, from Nous Research, is one of the most-starred repos on all of GitHub at nearly 200,000 stars. It’s pitched as an alternative to OpenClaw, and the hook is right in the name of the feature set: it’s self-healing and self-improving.
In practice, when a skill fails mid-run, Hermes doesn’t just error out. It tries to fix itself and improves for the next run. The failures you’d normally babysit start resolving on their own. It’s got everything you’d want from a top harness, persistent memory, messaging gateways, more than I could cover in one section.
OpenClaw is still great, to be clear. Hermes is a serious second option, and the self-healing angle is the reason I’d give it a weekend.
Repo: github.com/jamiepine/voicebox Voicebox, from Jamie Pine, around 33,000 stars, collapses two paid tools into one open-source app: ElevenLabs-style voice generation and WhisperFlow-style dictation, all running locally. Both sides of voice, input and output, in one place.
Output side: near-perfect voice cloning across several engines, a timeline editor for arranging audio, an effects pipeline. Input side: Whisper transcription and dictation into any app. Plug in local models and run it all offline.
The pitch I like is “talk to your agents in voices you own.” No per-character billing, no cloud dependency, no shipping your audio to someone else’s server. If you’re building voice into a product, owning the full stack locally is the gap between a demo and something you can ship. For a free project replacing two subscriptions, the local models sound shockingly good.
I dropped the three video tools (OpenMontage, Hyperframes, Palmier Pro), a new Baidu OCR model that’s too early to lean on, and Matt Pocock’s skills, which I already covered. The filter was simple: does it make my coding agent better at real work? If yes, it stayed. If it’s a fun demo, it got a wave goodbye.
Want all twelve, including the five I cut? Here’s Matthew Berman’s original video.
I Cut a “12 Open-Source AI Projects” List Down to The 7 I’d Actually Install was originally published in Towards AI on Medium, where people are continuing the conversation by highlighting and responding to this story.