Trending GitHub Repos: OpenCode, Firecrawl & 5 More

> **TL;DR:** This week's trending GitHub repositories are led by OpenCode (189,539 stars), an MIT-licensed open-source coding agent that works with any model, and Firecrawl (155,761 stars), an API that turns the web into LLM-ready data. Rounding out the list: Immich for self-hosted photos, Browser Use for giving agents a real browser, Remotion for React-based video, Tailscale for WireGuard networking, and NVIDIA's SkillSpector, a security scanner for AI agent skills.

Key Takeaways

- OpenCode tops the week at 189,539 stars: an MIT-licensed coding agent that works with any model and now ships a beta desktop app for macOS, Windows, and Linux. - Firecrawl (155,761 stars) claims 96% web coverage with LLM-ready output, and now offers scheduled page monitoring with email and webhook alerts. - Immich and Tailscale pair naturally: a self-hosted Google Photos alternative plus zero-fuss private networking to reach it securely. - NVIDIA's SkillSpector addresses a real gap — research it cites finds 26.1% of AI agent skills contain vulnerabilities and 5.2% show likely malicious intent. - Check Remotion's license before shipping: it is free only for companies of up to three people.

Seven repositories define this week's [GitHub Weekly Wins](https://speka.info/github-weekly-wins/), and together they read like a blueprint for the 2026 developer stack: an open-source coding agent closing in on 190,000 stars, a web-data API purpose-built for LLM pipelines, the leading self-hosted alternative to Google Photos, a framework that hands AI agents a real browser, programmatic video rendering in React, WireGuard networking without the configuration pain, and an NVIDIA security scanner for the booming agent-skill ecosystem. Six of the seven are free to self-host under open licenses; one — Remotion — carries a licensing caveat worth reading before you build on it. Here they are, ordered by star count, strongest first.

OpenCode: The Open-Source Coding Agent (189,539 ★)

**What it is:** OpenCode describes itself in five words — “the open source coding agent” — and the numbers back up the confidence: 189,539 stars make it the most-starred project in this week's roundup. Written in TypeScript and released under the MIT license, it is designed to work with any model rather than binding you to a single provider. The project has also moved beyond the terminal: a beta desktop app is now available for macOS (both Apple Silicon and Intel), Windows, and Linux via .deb, .rpm, and AppImage packages, and the README ships in more than twenty languages — a signal of how global its user base has become.

**Why it matters:** The coding-agent market moves fast — [Claude Opus 5 alone reset expectations for what agents can do](https://speka.info/blog/claude-opus-5-anthropics-step-change-for-ai-agents) — and a model-agnostic, MIT-licensed agent lets you switch to whichever frontier model is best this quarter without rebuilding your workflow. Open source also means the agent's behavior is fully inspectable, which is increasingly a hard requirement for teams adopting AI tooling.

**Who it's for:** Developers who want a serious AI pair programmer they control end to end, and teams hedging against single-vendor lock-in.

**GitHub:** [anomalyco/opencode](https://github.com/anomalyco/opencode) (TypeScript, MIT)


Firecrawl: Turn the Web into LLM-Ready Data (155,761 ★)

**What it is:** Firecrawl is an API for searching, scraping, and interacting with the web at scale, returning clean Markdown, structured JSON, or screenshots that drop straight into an LLM pipeline. The project claims coverage of 96% of the web — JavaScript-heavy pages included — with a P95 latency of 3.4 seconds across millions of pages. A notable recent addition is scheduled monitoring: point it at pages you care about and receive email or webhook alerts when they change. The code is open source under AGPL-3.0, and the hosted service includes roughly 1,000 free credits per month before paid plans kick in.

**Why it matters:** Web context is the quiet bottleneck of nearly every agent and retrieval pipeline. Rotating proxies, headless browsers, brittle HTML parsing — Firecrawl collapses all of it into a single API call, which goes a long way toward explaining its 155,761 stars.

**Who it's for:** Teams building AI agents, RAG systems, research automation, or monitoring dashboards — anyone who needs fresh, structured web data without maintaining a scraper farm.

**GitHub:** [firecrawl/firecrawl](https://github.com/firecrawl/firecrawl) (TypeScript, AGPL-3.0)

Immich: The Self-Hosted Google Photos Alternative (108,701 ★)

**What it is:** Immich is a high-performance, self-hosted photo and video management solution: upload your library to your own server and browse it through a polished web interface or Flutter-based mobile apps. It is written primarily in TypeScript and licensed under AGPL-3.0. The maintainers are refreshingly blunt about responsibility, too — the README leads with a warning to always follow a 3-2-1 backup strategy for irreplaceable photos and videos.

**Why it matters:** Your photo library is among the most personal data you own, and Immich's 108,701 stars show how many people want it off other people's servers. Self-hosting means no subscription tied to storage limits and no third party setting policy over your memories, while Immich keeps the convenience that made cloud photo services popular in the first place.

**Who it's for:** Homelabbers, privacy-conscious families, and anyone with a spare server or NAS who wants Google Photos convenience without Google.

**GitHub:** [immich-app/immich](https://github.com/immich-app/immich) (TypeScript, AGPL-3.0)


Browser Use: Hand Your AI Agent a Real Browser (106,697 ★)

**What it is:** Browser Use is an MIT-licensed Python framework that lets an AI agent operate a web browser the way a person does: it opens pages, clicks buttons, types text, and fills in forms from a plain-English task description. The project's own examples range from “fill in this job application with my resume” to extracting follower data into a CSV and QA-testing a local website for bugs, usability issues, and visual inconsistencies. A CLI and a cloud offering sit alongside the open-source core.

**Why it matters:** Most of the web has no API. For agents, browser control is the universal fallback interface — if a human can do it in a browser, an agent can too. At 106,697 stars, Browser Use has become the default Python answer to that problem.

**Who it's for:** Automation engineers, QA teams, and agent builders whose targets are websites rather than well-behaved endpoints.

**GitHub:** [browser-use/browser-use](https://github.com/browser-use/browser-use) (Python, MIT)

Remotion: Videos as React Code (54,233 ★)

**What it is:** Remotion turns video production into a React programming problem: compositions are components, code is the source of truth, and you can batch-render millions of videos on your own infrastructure. The project now positions itself as offering “video tools for the agent era” — you can build videos agentically with a coding agent, interactively with drag-and-drop editing, or programmatically from data, and switch between those workflows at any point.

**Why it matters:** Data-driven video — personalized onboarding clips, automated reports, batch social assets — is painful in timeline editors and natural in code. One caveat before you build a business on it: Remotion is not under a standard open-source license. It is free only for companies of up to three people; larger organizations need a paid license. Factor that into your planning early rather than after launch.

**Who it's for:** React developers and product teams generating video at scale — solo builders and micro-teams ride free, while bigger companies should budget for licensing.

**GitHub:** [remotion-dev/remotion](https://github.com/remotion-dev/remotion) (TypeScript, custom license)


Tailscale: Private Networks Without the Pain (34,308 ★)

**What it is:** This repository holds the majority of Tailscale's open-source code — the tailscaled daemon and tailscale CLI that build private mesh networks on WireGuard, with 2FA and SSO support built in. The daemon runs on Linux, Windows, and macOS, with varying degrees of support for FreeBSD and OpenBSD, and the iOS and Android apps are built on this same codebase. It is written in Go under the BSD-3-Clause license.

**Why it matters:** Tailscale is the connective tissue for half of this roundup. Want to reach your Immich library from your phone without exposing it to the public internet? Want agents running on separate machines to talk to each other securely? A mesh VPN that takes minutes to set up — no port forwarding, no certificate wrangling — is the kind of boring infrastructure that makes everything else possible.

**Who it's for:** Homelab owners, remote teams, and anyone connecting more than one machine who never wants to write another firewall rule.

**GitHub:** [tailscale/tailscale](https://github.com/tailscale/tailscale) (Go, BSD-3-Clause)

SkillSpector: NVIDIA's Security Scanner for Agent Skills (13,688 ★)

**What it is:** SkillSpector is an Apache-2.0-licensed Python tool from NVIDIA that scans AI agent skills — the installable extensions used by Claude Code, Codex CLI, Gemini CLI, and similar tools — for vulnerabilities, malicious patterns, and other security risks before you install them. It runs a skill through a pipeline of security analyzers and answers one question: is this skill safe to install? It can even run from inside agent sessions via a Pi extension.

**Why it matters:** Agent skills execute with implicit trust and minimal vetting, and the research SkillSpector cites is sobering: 26.1% of skills contain vulnerabilities, and 5.2% show likely malicious intent. As official resources like [Anthropic's Claude Cookbook](https://speka.info/blog/claude-cookbook-anthropics-official-recipe-hub-goes-viral) draw huge audiences, unofficial skills and extensions are multiplying even faster — with far less review. SkillSpector's 13,688 stars suggest plenty of developers share that concern.

**Who it's for:** Anyone who installs third-party skills into a coding agent, and security teams setting policy for how agents get extended inside an organization.

**GitHub:** [NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector) (Python, Apache-2.0)

The Pattern: Agents Are the New Platform

Look at the list again. An agent that writes code. An API that feeds agents clean web data. A framework that gives agents a browser. Video tooling explicitly rebranded for “the agent era.” A scanner that vets what agents are allowed to run. Five of this week's seven wins are agent infrastructure, and the remaining two — Immich and Tailscale — form the self-hosted backbone that much of it can run on. The same dynamic is playing out well beyond developer tools, as [OpenAI's push into health](https://speka.info/blog/health-in-chatgpt-openais-big-health-ai-launch) shows: as AI reaches more sensitive data and higher-stakes decisions, the projects that win pair raw capability with ownership, transparency, and security. That is exactly what this week's repositories deliver.

Frequently Asked Questions

What is the most-starred trending GitHub repo this week?

OpenCode, at 189,539 stars — an MIT-licensed, open-source AI coding agent written in TypeScript that works with any model and now offers a beta desktop app for macOS, Windows, and Linux.

Is Firecrawl free to use?

The code is open source under AGPL-3.0, so you can self-host it. The hosted service includes roughly 1,000 free credits per month, with paid plans beyond that.

Is Remotion free for commercial use?

Only partly. Remotion uses a custom license that is free only for companies of up to three people; larger organizations need a paid company license.

What does NVIDIA's SkillSpector actually scan?

It scans AI agent skills — extensions used by tools like Claude Code, Codex CLI, and Gemini CLI — for vulnerabilities and malicious patterns before installation. Research it cites found 26.1% of skills contain vulnerabilities and 5.2% show likely malicious intent.

Do Immich and Tailscale work together?

They are independent projects, but they pair well: Immich hosts your photo library on your own server, and Tailscale's WireGuard-based mesh VPN lets you reach it remotely without exposing the server to the public internet.

Sources

- https://github.com/anomalyco/opencode - https://github.com/firecrawl/firecrawl - https://github.com/immich-app/immich - https://github.com/browser-use/browser-use - https://github.com/remotion-dev/remotion - https://github.com/tailscale/tailscale - https://github.com/NVIDIA/SkillSpector