Best Open-Source Coding Skills, Plugins & AI Agents (Updated Weekly)
Last updated: September 11, 2026. Reviewed weekly. If you're picking three open-source coding tools today: BMAD-METHOD to plan before you build (the only planning tool here that runs in a browser with no terminal), Goose to do the building (the only mainstream coding agent with a real desktop app), and the Claude Code GitHub Action to review what the agent wrote. All three are OSI-licensed and all three were pushed to within the last 48 hours.
Idea to plan
6 listedBefore you write code you need something to build against. This is the category most vibe-coded projects skip, and skipping it is why they stall at 70%.
GitHub Spec Kit
135,587★ · MITTurns an idea into constitution, spec, plan and tasks across 30+ agents. The most rigorous option, and it opens with `uv tool install` and a Python 3.11 requirement.
Open on GitHub →OpenSpec
67,989★ · MITProposals, specs and task checklists before coding, with a local dashboard.
Open on GitHub →BMAD-METHOD
52,900★ · unresolvedIt's the only planning tool here with a genuine no-terminal on-ramp — the web bundles run as ChatGPT Custom GPTs and Gemini Gems, so you can do the entire planning phase before installing anything. Spec Kit is more rigorous and has two and a half times the stars, but its install command loses exactly the reader this page is for. The honest limitation on BMAD: the web bundles cover planning only. The moment you start implementing you're back in a CLI.
Open on GitHub →Task Master
28,063★ · unresolvedlicence , last pushed April 28. Breaks a PRD into ordered, dependency-aware tasks.
Open on GitHub →Backlog.md
6,704★ · MITA markdown task board inside your git repo, with a local kanban UI.
Open on GitHub →Building
15 listedGoose has been pushed to repeatedly since moving to `aaif-goose`, the licence is unchanged, and it's up 230 stars on the week. One week isn't a guarantee, but it's the evidence we said we'd go and look for.
Two things worth knowing before you install from this group. "Open source" often means the wrapper, not the engine: Codex CLI is Apache-2.0 and useless without a paid OpenAI plan, and Gemini CLI's free tier is a Google account benefit that can change without the repo changing. And the Anthropic Skills repo still has no root LICENSE file — confirmed again this week. Licensing is per-skill, and the document skills are source-available rather than open source.
Superpowers
285,156★ · MITinstalls a full agent methodology as composable skills across ~14 hosts.
Open on GitHub →mattpocock/skills
259,497★ · MITSenior-engineer review and TDD skills for coding agents — pushes agents toward disciplined, tested changes.
Open on GitHub →OpenCode
206,685★ · MITTerminal coding agent that can run against any model provider — best if you are already comfortable in a CLI.
Open on GitHub →Anthropic Skills
175,796★Official Anthropic reference skills and spec. No root LICENSE file — licensing is per-skill; some document skills are source-available only.
Open on GitHub →OpenAI Codex CLI
123,351★ · Apache-2.0Local coding agent CLI (Apache-2.0 wrapper). Still needs a paid OpenAI plan for the engine — open wrapper, not free inference.
Open on GitHub →Reviewing and QA
8 listedThis is where non-technical founders are most exposed. An AI wrote your code; something other than the same AI should look at it.
Trail of Bits Skills are the real thing, written by an actual security firm, but CC-BY-SA-4.0 is a content licence with a share-alike obligation. Read it before bundling commercially.
Trivy
37,870★ · Apache-2.0Scans dependencies, containers, and IaC for known vulnerabilities — essential after agent-written infra changes.
Open on GitHub →Playwright MCP
37,011★ · Apache-2.0Lets an agent click through your live app for smoke tests instead of trusting unit tests alone.
Open on GitHub →Gitleaks
29,234★ · MITDetects committed secrets in git history — pair with any AI reviewer that ignores leaked API keys.
Open on GitHub →Semgrep
16,590★ · LGPL-2.1Static analysis for security bugs and anti-patterns in the code agents just wrote.
Open on GitHub →PR-Agent
12,950★ · MITAutomated pull-request review agent — useful second opinion on agent-authored diffs.
Open on GitHub →Shipping
6 listedOne warning on the GitHub MCP Server: it needs a personal access token, and the easy broad-scope token hands an agent write access to every repository you own. Scope it down.
Supabase
109,056★ · Apache-2.0The one piece of shipping infrastructure a non-technical founder can genuinely operate alone: clickable console, real free tier, Apache-2.0 so you can leave with your data. Coolify is better once you outgrow it, but the hardest step happens before Coolify appears — you have to rent a VPS and SSH into it. Honest limitation: some hosted-platform pieces aren't in the Apache-2.0 repo, so self-hosting isn't feature-equivalent.
Open on GitHub →Docusaurus
66,226★ · MITDocs/blog static site stack — strong default when your GTM is content-led and you want owned SEO pages.
Open on GitHub →Coolify
61,677★ · Apache-2.0Coolify is better once you outgrow it, but the hardest step happens before Coolify appears — you have to rent a VPS and SSH into it. Honest limitation: some hosted-platform pieces aren't in the Apache-2.
Open on GitHub →GitHub MCP Server
32,869★ · MITMCP bridge to GitHub. Scope personal access tokens tightly — broad tokens hand agents write access to every repo you own.
Open on GitHub →semantic-release
24,034★ · MITAutomates versioning and changelog publishing from conventional commits.
Open on GitHub →What didn't make the list
Aider — still maintained, still excellent, wrong for this audience: its whole interaction model assumes you think in git commits and diffs. 48,897 stars, Apache-2.0, last pushed May 22 (our first current read on it). That date is approaching four months, which is worth watching on a tool this widely recommended.
Dokploy — open-core presented as open source, and the API confirms it: no licence assertion. Apache-2.0 applies only outside a `/proprietary` directory, and the proprietary licence forbids production use without a commercial agreement. Coolify is genuinely Apache-2.0 throughout and gets the slot.
Qodo-Cover — abandoned, with an explicit "no longer maintained" notice; the successor is paid. Automated test generation remains a real hole with no good open-source answer.
gpt-engineer, Devika, Claudia, snarktank/ai-dev-tasks, coderabbitai/ai-pr-reviewer — dead, stale, or 404. Named rather than silently omitted, because several still rank near the top of listicles on star count alone.
How to get exact star counts without hitting GitHub's rate limit
Worth sharing, because it broke this page's audit twice. GitHub's unauthenticated REST API allows 60 requests an hour, which doesn't cover a 35-repo page, let alone four pages. But every repository page embeds its own exact figure in the HTML as `"stargazerCount":