The Storytold Wave Is Gone, and Three September Regulars Came Back

Last issue we wrote that the storytold wave was thinning. This week it is gone: none of the clean-room rewrites of Photoshop, Word, Premiere and the rest reached either board. Three names from the September lists filled the space — Orca, Ponytail and DeepSeek Harness, each a regular from late August into October until the rewrites pushed them off. They did not come back because the bar fell; tenth place cost almost exactly what it cost last week, and all three cleared it by adding more stars than in either of the weeks they were missing. The other story is at the top. Rea is still first, but the acceleration we described last issue has broken, and on the breakout board a single skill file is making the case that rea's whole approach is heavier than it needs to be. DeepSeek, meanwhile, open-sourced the engine that serves its own models, and it reached the main board in less than a week.

#1 morluto/rea — an MCP-based toolkit that enables AI agents to perform deep reverse engineering on binaries and applications without source code

+62,579 stars this week → 384,548 · rea star curve

2026-W41: +1,553 · 2026-W42: +101,495 · 2026-W43: +218,506 · up and down across 4 issues · Earlier: 415 stars on 2026-09-27

Last issue we called rea's run an acceleration: each week had added more than the one before, and in the week to 19 October it outgained the other nine entries put together. Both halves of that broke this week. It is still comfortably first, but it added less than the rest of the top ten combined, and its daily additions fell through almost the whole week rather than dipping on a weekend — the shape of a launch wave running out, not of a project losing favour overnight. The coverage explains how large that wave was. Within days, write-ups in several languages were describing it as the MCP server that turns a coding agent into a reverse engineer, with backends for Ghidra, Hopper and IDA and static analysis reaching from native binaries and Electron apps to .NET assemblies, Android packages, EVM bytecode and firmware; one mirror site was already warning that lookalike copies with borrowed READMEs were circulating, which is what popularity at this speed attracts. What the curve now says is that most of the people who were going to find it through that coverage have. The more interesting pressure on it this week is not its pace but a rival argument, made on the breakout board by leanrea: that much of what rea does needs no server at all.

#2 Ebony-Vinyl/dsh-our-free-model — Free LLMs in DSH – no API keys, no caps

+18,186 stars this week → 42,913 · dsh-our-free-model star curve

2026-W42: +7,140 · 2026-W43: +15,852 · up and down across 3 issues · Earlier: 1,735 stars on 2026-10-06

Last issue we said this plugin's whole pitch was free and unlimited, and that nothing in our data told us who pays for the inference behind it. A week and a search later, that is still true. It puts a set of no-login frontier models into the DeepSeek Harness model picker behind a local OpenAI-compatible endpoint, so any tool written for a paid API can be pointed at it unchanged. The context that makes this attractive is DeepSeek's own pricing: in August the company raised its hosted API rates for the V4 models, by multiples at peak hours, while keeping the weights and the harness itself free. A plugin that routes around the meter is the obvious response to that. What we could not find is anyone explaining it — no write-up, no stated sponsor, no account of which upstream providers carry the load. The curve has also changed shape. The jump came last issue; this week added only a little more on top of it, and the daily additions eased as the week went on. A gateway with no visible business model can disappear as quickly as it arrived, so treat it as a convenience for experiments, not as something to build on.

#3 cloudflare/security-audit-skill — a structured security auditing framework that turns coding agents into adversarial vulnerability hunters

+15,691 stars this week → 46,844 · security-audit-skill star curve

Earlier: 22,014 stars on 2026-09-27

This is Cloudflare's own process for finding vulnerabilities with a coding agent, published as a skill, and the company describes it as the seed of the harness it now runs across its own code. It has six phases — reconnaissance, hunting, validation, reporting, structured output and independent verification — and the reason for the split is that the agent which reports a finding is never the one that confirms it: a separate set of agents is told to disprove each candidate before it reaches the report. That is the answer to the familiar failure of asking a model to “check this file for bugs” and getting back a confident list of things that are not there. Cloudflare is also candid about the limit. By its own internal measure a single run finds about half of what repeated runs find together, so the skill is meant to be run more than once, and it needs an agent that can spawn parallel sub-agents, plus a sandbox if it is going to build or execute the target. It reached our list once in September and dropped away. This week its daily additions climbed through the first half of the window and held near that level, which makes it the steadiest riser on the main board rather than another returning name.

#4 debpalash/VoiceStudio — a local-first desktop suite for voice cloning, dubbing, and transcription with support for 646 languages

+11,472 stars this week → 86,770 · VoiceStudio star curve

2026-W43: +16,589 · down from the last issue, after a week away · Earlier: 36,814 stars on 2026-09-27

#5 stablyai/orca — Orca – a desktop orchestrator for running many AI coding agents side‑by‑side

+9,188 stars this week → 105,795 · orca star curve

Earlier: 78,909 stars on 2026-09-27

Orca, Ponytail and DeepSeek Harness were fixtures of the September lists — Orca and the harness appeared in every issue from late August to mid-October — and all three vanished for the two issues the storytold rewrites dominated. Their daily series across that gap answer the obvious question. They did not drift back because the competition left; the price of tenth place is almost exactly what it was last week. Each of them added fewer stars than that in both missing weeks and more than that in this one. Orca made the sharpest turn of the three: its best week in our records came straight after the two it spent off the list. The product goes some way to explaining the staying power. Orca is a desktop workspace from Stably AI, a Y Combinator company, that sends one prompt to several command-line agents — Claude Code, Codex, OpenCode and others — each in its own git worktree, so the results can be compared and the best one merged, with GitHub and Linear boards and a browser design mode in the same window. It is free and brings no models of its own; you bring the agent subscriptions. That makes it a bet on the habit of running several agents at once, and this week says the habit is still spreading.

#6 DietrichGebert/ponytail — Ponytail – a prompt that makes AI coding agents write tiny, safe code and self‑review their changes

+9,140 stars this week → 176,175 · ponytail star curve

Earlier: 146,490 stars on 2026-09-27

#7 deepseek-ai/deepseek-harness — an open-source agent harness with an everything-is-a-plugin architecture

+8,287 stars this week → 261,351 · deepseek-harness star curve

Earlier: 236,840 stars on 2026-09-27

#8 deepseek-ai/DeepInfer — DeepInfer – Scalable, low‑latency inference for DeepSeek LLMs

+8,170 stars over 4.8 days → 22,386 · DeepInfer star curve

DeepInfer is the engine DeepSeek says serves its own production traffic for V4.1-Flash, open-sourced on 20 October under Apache 2.0 — which is why its window is shorter than everyone else's, and why reaching the main board anyway says something. It ships kernels, speculative decoding, asynchronous scheduling, deterministic sampling and structured output, and it targets both Nvidia's newest data-centre GPUs and Huawei's Ascend accelerators. The second target is what most of the coverage led with: a production-grade path onto Huawei hardware, published by a lab that serves real traffic on it. Read the release notes before planning around it, though. It is not a complete serving stack — there is no KV-cache system, no prefill/decode disaggregation and no load balancing across replicas — and the build wants a recent Linux toolchain with CUDA or Huawei's CANN. DeepSeek published a companion recipe repository for request conversion alongside it, which suggests the missing pieces are the ones it still treats as its own business. Its daily additions peaked on launch day and fell every day after, the ordinary decay of a release announcement. Whether it stays on the list depends on whether anyone outside DeepSeek builds a server around it.

#9 xerj-org/xerj — a local AI search engine that automatically indexes folders to reduce agent token burn via precise retrieval

+7,186 stars this week → 15,562 · xerj star curve

Earlier: 2,520 stars on 2026-09-28

#10 mattpocock/skills — Skills – Plug‑in Library for AI Coding Agents

+7,041 stars this week → 303,228 · skills star curve

2026-W41: +5,478 · 2026-W42: +10,019 · 2026-W43: +10,006 · up and down across 4 issues, after a week away · Earlier: 270,262 stars on 2026-09-27

Breaking out

Ranked by growth relative to their own size, not by stars added. These are small enough that a week can multiply them — and small enough to have escaped you.

AhmadHassan-BTed/NaSuno · +818.0% over 7.7 days → 4,186 stars · NaSuno star curve

Earlier: 456 stars on 2026-10-18

NaSuno is a signal-processing toolkit that strips forensic watermarks, ultrasonic carriers and provenance metadata from AI-generated audio, so a generated stem can be reused without being traced back to the platform that made it. Whether that is privacy or laundering depends on whose audio it is.

kuafuai/andee · +711.1% over 7.7 days → 2,912 stars · andee star curve

Earlier: 359 stars on 2026-10-18

andee is an Android agent that runs on the phone itself, seeing and driving any app through the accessibility service, keeping its own local memory and talking to whatever OpenAI-compatible endpoint you point it at.

aicodeking/leanrea · +303.8% this week → 2,580 stars · leanrea star curve

Earlier: 495 stars on 2026-10-18

leanrea is the counter-argument to the top of the main board, made as a single small skill file. Where rea registers a server full of tools, leanrea teaches the agent to do reconnaissance with the command-line utilities a Mac or Linux machine already has — otool, nm, asar, jadx, sqlite3 — choosing the fastest native route for an Electron bundle, a Mach-O binary or an Android package before reaching for anything heavier. Its case is about the context window. Every tool an MCP server registers is text the model carries on every turn, and for the reconnaissance that makes up most of a reverse-engineering session, a few paragraphs of method may be worth more than a catalogue of tools. The author has published a benchmark claiming faster, cheaper runs at similar accuracy, and at least one independent write-up has already set the two side by side; the benchmark is the author's own and covers a narrow set of tasks, so it is a claim worth testing, not a result. Provenance is also muddled — one install guide points at a different repository name — so install it from the one linked here. Read with rea, it is this week's list in miniature: the same job, one answered with infrastructure and one with discipline.

Leonxlnx/earshot · +249.1% this week → 2,786 stars · earshot star curve

Earlier: 422 stars on 2026-10-17

earshot gives an agent ears: a CPU-only Python toolkit that describes a sound, finds events in a recording, judges real against synthetic, and can turn a recording into a reusable synthesis recipe, exposed as a CLI, a Python API and an MCP server.

Ephemeral-AI-Lab/layerfs · +198.6% this week → 2,072 stars · layerfs star curve

Earlier: 337 stars on 2026-10-04

LayerFS is a Rust, SQLite-backed store that gives an agent cheap snapshots of its workspace — content-addressed and forkable without copying files — so parallel runs can share history. Its growth landed in a single day, a step rather than a ramp, and from outside we cannot tell a front-page day from a bought one.

Last issue ended on interfaces: the projects that moved were the ones turning software built for hands and eyes into commands an agent can call. This week's list is about the agent's own working conditions instead — how it audits, how several of it are run at once, what it costs to call and what it takes to serve. Two of last issue's claims did not survive the week: rea's acceleration and the storytold wave are both over. Next issue we will check three of this one's: whether the returning regulars stay above the line, whether leanrea keeps gaining on rea, and whether anyone says who pays for dsh-our-free-model's free models.