AI Agent GitHub Digest — 2026-09-04

🌏 中文版

Today's Highlights

Today's trending repos are all about giving agents more structure before letting them do more on their own. Spec Kit forces you to write down what you want built before an agent touches code. Orca lets a whole fleet of agents work in parallel, each in its own worktree. Shannon automates penetration testing end to end, exploit through report. And chrome-devtools-mcp opens browser control up to any agent through an official protocol instead of a bespoke integration. The pattern: instead of hand-rolling glue code, use protocols, specs, and isolated environments to draw the boundaries.

Trending Repos

github/spec-kit ⭐ 133,294 (+224)

GitHub · Python · MIT

• What it is: GitHub's own toolkit for "write the spec before the agent touches code" — it forces teams to nail down what they're building before any agent starts working.
• Why it's worth a look: it just turned one and re-numbered itself 1.0.0, and the maintainer's announcement is explicit that this isn't a stability freeze — because agents make changing a spec cheap, adaptability matters more than stability now. A good fit for teams already running multiple AI coding agents who are tired of specs scattered across prompts.
• Tech Stack: a Python CLI plus swappable spec-flow templates, compatible with any AI coding agent.
• Getting Started: Low — install the CLI and apply the default flow to an existing project, or bring your own template.

stablyai/orca ⭐ 60,787 (+812)

GitHub · TypeScript · MIT

• What it is: a command center for a whole fleet of coding agents — run Claude Code, Codex, OpenCode, and Pi side by side, each in its own git worktree, tracked from one interface.
• Why it's worth a look: it runs every agent on your own existing subscription, no extra token billing, and works the same from desktop, mobile, or a VPS. It gained more stars than anything else on today's list — 812 in a single day — which says something about "run several agents in parallel and watch them all" replacing "run one agent and wait."
• Tech Stack: TypeScript, git worktree isolation, and cross-platform clients for macOS, Windows, and Linux.
• Getting Started: Medium — the desktop app installs easily, but you still authenticate and configure each agent CLI separately.

KeygraphHQ/shannon ⭐ 47,684 (+117)

GitHub · TypeScript · AGPL-3.0

• What it is: an autonomous AI penetration-testing agent that reads your source code, maps out attack paths, and then actually runs the exploit to prove a vulnerability is real — no exploit, no report.
• Why it's worth a look: it just shipped 3.0 today, with deeper security code analysis, a rebuilt CLI, native CI/CD integration, and professional PDF and SARIF report output that drops straight into an existing security toolchain. The maintainers are explicit that it isn't meant to replace a human pentester — it's meant to make "run one automated pass first" solid enough for production.
• Tech Stack: TypeScript, an LLM agent loop, and SARIF/PDF report generation.
• Getting Started: Medium — npx @keygraph/shannon@latest gets you started, but CI/CD integration and the full feature set depend on which edition you're on.

ChromeDevTools/chrome-devtools-mcp ⭐ 50,823 (+148)

GitHub · TypeScript · Apache-2.0

• What it is: an MCP server from the Chrome DevTools team itself, exposing DevTools capabilities — screenshots, DOM inspection, network tracing, performance profiling — to any MCP-compatible coding agent.
• Why it's worth a look: unlike a pile of third-party browser-automation tools, this is the browser vendor's own protocol implementation, which buys more stability and a tighter guarantee of staying in sync with Chrome releases. It gained 148 stars today, and alongside Orca and Shannon it's more evidence that "expose a capability through a standard protocol" is winning out over "write your own integration."
• Tech Stack: the MCP SDK, the Chrome DevTools Protocol (CDP), and Puppeteer.
• Getting Started: Low — add one MCP server config entry and agents like Claude Code or Cursor can drive the browser directly.

Notable Releases

Pydantic AI v2.38.0

Release Notes

• Key changes: ModelProfile gains context_window and RunContext gains context_window_used; application code and capabilities can now emit typed CustomEvents and CapabilityEvents into the run event stream and subscribe with @on_event; adds support for Claude Fable 5.1 and Claude Mythos 5.1; adds a VLLMProvider for talking to a self-hosted vLLM server.
• Breaking Changes: a one-off capability (a tool or capability with no explicit id) now gets a default id and a default combine rule applied when it's registered more than once — if your code relied on the old behavior where same-named, id-less capabilities stayed independent instead of merging, that merge logic changes.
• What it means for you: if you register a lot of one-off capabilities, check whether you were depending on the old non-merging behavior before upgrading. If you want to track context-window usage, use Claude Fable/Mythos, or wire up a self-hosted vLLM server, this release is ready to use.

Claude Code v2.1.259

Release Notes

• Key changes: adds a managedMcpServers managed setting so organizations can push HTTP/SSE MCP servers to every user; adds --permission-prompts none for unattended headless hosts, auto-denying anything that would otherwise prompt; fixes concurrent sessions silently reverting each other's ~/.claude.json changes; managed settings that fail to parse now block startup and name the broken source instead of silently going unenforced.
• Breaking Changes: None.
• What it means for you: if you run multiple Claude Code sessions at once, or run it in CI or another unattended environment, this release fixes several real pain points — the concurrent-session config clobbering and the silent managed-settings failure are the two worth upgrading for first.

Today's Takeaway

I used to think running several agents in parallel worktrees was mostly a personal productivity trick. But Orca gaining 812 stars in a day, plus Spec Kit going out of its way to say 1.0.0 doesn't mean a feature freeze, points at a different default assumption taking hold: specs and context are expected to keep changing, and the job of the tooling is to make that change cheap — not to freeze a stable version — even when several agents are editing the same codebase at once.

References

• github/spec-kit
• Spec Kit Turns One — and Ships 1.0.0
• stablyai/orca
• KeygraphHQ/shannon
• Shannon 3.0 discussion
• ChromeDevTools/chrome-devtools-mcp
• Pydantic AI v2.38.0 Release Notes
• Claude Code v2.1.259 Release Notes
• GitHub Trending — Daily