**CopilotKit/OpenBot** (⭐ 8,639) gives each AI coworker its own sandboxed computer — every browser, file, or MCP action has to clear a CEL policy gate and get logged to an audit trail before it runs, and any AG-UI agent (LangGraph, Mastra, CrewAI, and more) can plug straight in. **HKUDS/nanobot** (⭐ 49,682) packs a personal agent into a core small enough to actually read end to end, with built-in long-term memory and a dozen chat-channel integrations. **0xPlaygrounds/rig** (⭐ 9,027) bundles a Rust LLM library and a full coding-agent harness that plugs into editors like Zed into the same crate. On the release side, **Claude Code v2.1.314** adds `permissions.blockWritesOutsideWorkingDirectories`, enforcing write-path boundaries across every permission mode, plus idle conversation compaction and a batch of fixes.
**thedotmack/claude-mem** (⭐ 104,523, +459 today) broke 100k stars and added a memory timeline for Codex subagents; **HKUDS/DeepTutor** (⭐ 49,631, +1,926 today) turns personalized tutoring into a multi-agent system that maintains its own knowledge base; **Donchitos/Claude-Code-Game-Studios** (⭐ 28,954, +538 today) packages Claude Code into a 49-agent game studio template; **ruvnet/metaharness** (⭐ 729) mints a branded agent harness for any repo in one command, with built-in governance policy and approval gates. On the release side, Mastra 1.80.0 opens up per-end-user OAuth connections (with 4 breaking changes), and crewAI v1.15.33 adds skill search and flow input passing.
**morluto/rea** (356.6k★) lets AI agents drive Ghidra/IDA/Hopper over MCP to reverse-engineer anything — a niche tool six months old that rocketed to hundreds of thousands of stars. **microsoft/agent-governance-toolkit** (6.5k★) claims to cover all 10 OWASP Agentic Top 10 risks with a policy engine, zero-trust identity, and execution sandboxing. **cloudflare/security-audit-skill** (35.6k★) is Cloudflare's own coding-agent skill for multi-phase security audits with independently verifiable findings. **headroomlabs-ai/headroom** (77.1k★) compresses tool output, logs, and RAG chunks before they hit the LLM — 20% fewer tokens for plain text, 60-95% for JSON. Release: Pydantic AI v2.59.0 patches a high-severity DoS in `web_fetch_tool`; Mastra 1.79.0 ships experimental MCP Events so MCP servers can push updates via poll, stream, or webhook.
**MoonshotAI/kimi-code** (7.9k★) is Moonshot AI's own terminal coding agent — single-binary install, native video input, and built-in Agent Client Protocol support. **open-multi-agent/open-multi-agent** (7.0k★) is a self-hosted multi-agent runtime that puts governance first: no telemetry, no hosted control plane, and `runTeam()` runs that can be verified offline afterward. **vibheksoni/stealth-browser-mcp** (3.2k★) lets agents drive a real Chrome instance through the Chrome DevTools Protocol — not Playwright — to get past Cloudflare's JS challenge page, a fundamentally different approach from the usual browser MCPs. Release: pydantic-ai v2.58.0 fixes two security advisories — provider-native MCP configuration could leak server URLs and auth tokens into OpenTelemetry traces, and the Vercel AI/AG-UI adapters could let a client execute a tool with its own arguments without going through the model at all.
Uber runs one MCP Gateway for 800+ MCP servers and 5,000+ tools: a control plane crawls internal APIs into disabled-by-default tools, a data plane handles protocol translation, authorization and redaction, and Omni MCP, Response Projection and Code Mode keep context small at scale.
CopilotKit/OpenBot gives every AI coworker its own computer, gating every action through policy before it runs; Tencent/teamai-cli syncs skills, rules, and MCP config across a whole team's Claude Code / Codex / Cursor through push-review-pull; VaderChen/YourDesk adds an MCP interface so agents can connect to and drive a real remote desktop; agent-launcher wraps six coding agent CLIs behind one desktop app; AgentVerse-OS gives each project its own isolated Incus workspace that agents are confined to; no notable framework releases today
Omnigent moves governance off prompts into a Server-side Policy engine: Python functions returning allow/deny/ask, a three-layer stack with cost budgets and tool caps, plus Omnibox OS-native isolation via bwrap/seatbelt and egress credential brokering — compared with five peer governance stacks.