84 posts tagged with "startup founders"

Last updated: September 11, 2026. Reviewed weekly.

If you're picking three open-source coding tools today: BMAD-METHOD to plan before you build (the only planning tool here that runs in a browser with no terminal), Goose to do the building (the only mainstream coding agent with a real desktop app), and the Claude Code GitHub Action to review what the agent wrote. All three are OSI-licensed and all three were pushed to within the last 48 hours.

This page is written for founders who can't code and are building anyway. Every star count below was read on September 11, 2026 — the first complete audit this page has had. The last two runs were cut short by GitHub's rate limit; there's now a way around it, explained at the end.

Last week's four ownership changes have all held: Goose is settled at aaif-goose, OpenCode at anomalyco, OpenHands at OpenHands, PR-Agent at The-PR-Agent. All four were pushed to again this week, so the transfers look like housekeeping rather than abandonment.

---

Idea to plan​

Before you write code you need something to build against. This is the category most vibe-coded projects skip, and skipping it is why they stall at 70%.

GitHub Spec Kit — 135,587 stars, MIT. Turns an idea into constitution, spec, plan and tasks across 30+ agents. The most rigorous option, and it opens with uv tool install and a Python 3.11 requirement.

OpenSpec — 67,989 stars, MIT. Proposals, specs and task checklists before coding, with a local dashboard.

BMAD-METHOD — 52,900 stars, licence unresolved (see below). Runs agile agent roles from idea to working software, with ChatGPT and Gemini web bundles.

Task Master — 28,063 stars, licence unresolved, last pushed April 28. Breaks a PRD into ordered, dependency-aware tasks.

Backlog.md — 6,704 stars, MIT. A markdown task board inside your git repo, with a local kanban UI.

codalio-blueprint — 5 stars, MIT. This one is ours. Turns a rough idea into a written PRD.

The one we'd install first: BMAD-METHOD. It's the only planning tool here with a genuine no-terminal on-ramp — the web bundles run as ChatGPT Custom GPTs and Gemini Gems, so you can do the entire planning phase before installing anything. Spec Kit is more rigorous and has two and a half times the stars, but its install command loses exactly the reader this page is for. The honest limitation on BMAD: the web bundles cover planning only. The moment you start implementing you're back in a CLI.

BMAD's licence is still unresolved, two weeks on. The README badge says MIT; GitHub's detector still returns no assertion, which normally means the LICENSE file has been edited. It's still our top pick and we're still not claiming the licence changed — but two weeks is long enough that this isn't a blip. If you're bundling BMAD into something you sell, open the LICENSE file and read it yourself. We've changed the licence column from "MIT" to "unresolved" to stop implying a grant we can't verify. Same for Task Master.

Task Master is the one we'd now hesitate over. Unresolved licence, and last pushed April 28 — four and a half months, unchanged from last week. Inside our six-month window, so it stays, but it comes off the page at the end of October if nothing lands.

On our own tool, plainly. codalio-blueprint runs three lenses (Product & Scope, Architecture, GTM) and synthesizes one PRD rather than stapling three documents together. We think that's well-built. It's also five weeks old, has 5 stars and 2 forks — unchanged from last week — no external contributors, and no test of whether the PRD is any good beyond examples we wrote ourselves. Last week we reported three new stars. This week, none. That's what a flat week looks like. Only Claude Code has real install instructions, whatever the README implies. Don't pick it over BMAD on our say-so.

Building​

Superpowers (285,156, MIT) installs a full agent methodology as composable skills across ~14 hosts. mattpocock/skills (259,497, MIT) applies senior-engineer review and TDD. OpenCode (206,685, MIT) runs a terminal coding agent against any model provider. Anthropic Skills (175,796, no root licence) holds the official reference skills and spec. OpenAI Codex CLI (123,351, Apache-2.0) and Gemini CLI (106,917, Apache-2.0) both run local coding agents. OpenHands (87,418, MIT) gives an agent a browser, terminal and editor. Cline (67,832, Apache-2.0) plans then edits with approval steps. Context7 (61,882, MIT) feeds agents version-correct library docs. Goose (54,129, Apache-2.0) runs an autonomous agent with a desktop app. Continue (35,869), vercel-labs/skills (31,395), Serena (29,183), Vibe Kanban (28,055) and Kilo Code (27,262) round it out.

The one we'd install first: Goose. The only mainstream open-source coding agent with a real desktop application — you see a window instead of a terminal — and Apache-2.0 with any-LLM support means no lock-in to one vendor's pricing. OpenCode has nearly four times the stars and is better if you're comfortable in a terminal, but it assumes you already are. Honest limitation: the desktop app hides the terminal, not the concepts. Extensions and MCP configuration still expect developer vocabulary, and you'll hit that wall on day two.

Goose has been pushed to repeatedly since moving to aaif-goose, the licence is unchanged, and it's up 230 stars on the week. One week isn't a guarantee, but it's the evidence we said we'd go and look for.

Vibe Kanban hasn't been pushed to since April 24 — same clock as Task Master.

Two things worth knowing before you install from this group. "Open source" often means the wrapper, not the engine: Codex CLI is Apache-2.0 and useless without a paid OpenAI plan, and Gemini CLI's free tier is a Google account benefit that can change without the repo changing. And the Anthropic Skills repo still has no root LICENSE file — confirmed again this week. Licensing is per-skill, and the document skills are source-available rather than open source.

Reviewing and QA​

This is where non-technical founders are most exposed. An AI wrote your code; something other than the same AI should look at it.

Trivy (37,870, Apache-2.0) scans dependencies, containers and IaC. Playwright MCP (37,011, Apache-2.0) lets an agent click through your live app. Gitleaks (29,234, MIT) detects committed secrets. Semgrep (16,590, LGPL-2.1) scans for security bugs. PR-Agent (12,950, MIT) reviews pull requests. Claude Code GitHub Action (8,844, MIT) reviews when you mention @claude. Trail of Bits Skills (7,041, CC-BY-SA-4.0) adds professional audit skills. cc-safety-net (1,535, MIT) blocks destructive commands.

The one we'd install first: the Claude Code GitHub Action. Typing "@claude review this" on a pull request is the lowest-literacy way to get a real second opinion on agent-written code, and it's MIT with no paid tier. Pair it with Gitleaks — an AI reviewer will happily discuss your architecture while ignoring the API key you committed in week one. Honest limitation: free to install, not free to run. Every review burns API credits and there's no built-in spend cap.

PR-Agent looks healthy after last week's move out of the Qodo org — pushed to this week, up about a hundred stars. The worry we raised hasn't materialised.

Trail of Bits Skills are the real thing, written by an actual security firm, but CC-BY-SA-4.0 is a content licence with a share-alike obligation. Read it before bundling commercially.

Shipping​

Supabase (109,056, Apache-2.0), Docusaurus (66,226, MIT), Coolify (61,677, Apache-2.0), GitHub MCP Server (32,869, MIT), semantic-release (24,034, MIT) and Changesets (12,384, MIT). All six were re-read on September 11 — these are the entries that carried stale August numbers for two weeks — and all six were pushed to within the last four days.

The one we'd install first: Supabase. The one piece of shipping infrastructure a non-technical founder can genuinely operate alone: clickable console, real free tier, Apache-2.0 so you can leave with your data. Coolify is better once you outgrow it, but the hardest step happens before Coolify appears — you have to rent a VPS and SSH into it. Honest limitation: some hosted-platform pieces aren't in the Apache-2.0 repo, so self-hosting isn't feature-equivalent.

One warning on the GitHub MCP Server: it needs a personal access token, and the easy broad-scope token hands an agent write access to every repository you own. Scope it down.

What didn't make the list​

Aider — still maintained, still excellent, wrong for this audience: its whole interaction model assumes you think in git commits and diffs. 48,897 stars, Apache-2.0, last pushed May 22 (our first current read on it). That date is approaching four months, which is worth watching on a tool this widely recommended.

Dokploy — open-core presented as open source, and the API confirms it: no licence assertion. Apache-2.0 applies only outside a /proprietary directory, and the proprietary licence forbids production use without a commercial agreement. Coolify is genuinely Apache-2.0 throughout and gets the slot.

Qodo-Cover — abandoned, with an explicit "no longer maintained" notice; the successor is paid. Automated test generation remains a real hole with no good open-source answer.

gpt-engineer, Devika, Claudia, snarktank/ai-dev-tasks, coderabbitai/ai-pr-reviewer — dead, stale, or 404. Named rather than silently omitted, because several still rank near the top of listicles on star count alone.

How to get exact star counts without hitting GitHub's rate limit​

Worth sharing, because it broke this page's audit twice. GitHub's unauthenticated REST API allows 60 requests an hour, which doesn't cover a 35-repo page, let alone four pages. But every repository page embeds its own exact figure in the HTML as "stargazerCount": <n> — the same number the API returns, not the rounded "48.9k" the page displays. Reading that costs no API quota. That's how every figure here got a current date for the first time.

Frequently asked questions​

How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.

Is this the full page? Yes — this interactive page is the canonical living guide; Substack carries the same weekly refresh.

What changed this week​

Fixed the thing that kept breaking: every star count is now current. All 35 entries read September 11, including the nine that had carried August 28 numbers for two consecutive runs.

Corrected our own entry, in the unflattering direction. codalio-blueprint is still at 5 stars and 2 forks — flat on the week, not rising as we implied last week. A spot-check earlier in this run misread it as 1 star; 5 is correct. We'd rather print the correction than let either number stand.

Hardened two licence columns. BMAD-METHOD and Task Master now read "unresolved" rather than "MIT" — neither resolves to a standard SPDX licence, two weeks running. We're not claiming either changed; we're refusing to keep printing a grant we can't verify.

Maintenance clocks, now dated: Task Master last pushed April 28, Vibe Kanban April 24. Both stay this month, both come off at the end of October if nothing lands.

Last week's ownership changes all look healthy — Goose, OpenCode, OpenHands and PR-Agent each pushed to this week under their new owners, licences unchanged.

Notable movers: mattpocock/skills +10,881, superpowers +3,554, OpenCode +2,995, spec-kit +2,177, codex +1,923, OpenHands +1,270.

Nothing incomplete this run. For the first time since this page launched, there's no "we couldn't verify this" list.

Last updated: September 11, 2026. Reviewed weekly.

If you're picking three open-source fundraising tools today: Papermark as your data room (AGPL-3.0, the most battle-tested DocSend replacement there is), Outreachr as your investor CRM (Apache-2.0, local-first, actual software rather than a prompt pack), and nock to pressure-test your deck before an investor does it for you.

One honest framing before the list. Fundraising is the thinnest of the four open-source categories we track, and it's thin in a specific way: deck-prep skills are abundant and mostly interchangeable, while investor data — the thing that would actually save you a week — is almost entirely locked behind paid APIs. We mark where the shelf is empty rather than padding it.

Timing note, because it's the reason you're reading this. Y Combinator's Winter 2027 application window closes November 2, 2026 at 8pm PT — seven weeks. Techstars' synchronized Spring 2027 deadline is November 18. Both are on our events, grants and fundraising deadlines page, verified the same day as this one: https://codalio.com/blog/startup-events-grants-fundraising-deadlines

Every star count here is current as of September 11, 2026 — the first complete read this page has had. It settles a number we flagged as disputed last week, and the answer is not the one we guessed.

---

Deck prep​

Lenny Skills — 1,319 stars, MIT structure. 76 PM and founder skills including fundraising and exits playbooks.

ppt-agent-skills — 893 stars, no licence shown. Generates PPTX decks from prompts, with roadshow templates.

claude-skills-founder (89, MIT), fluiddocs-deck-builder (30, MIT), vc-skills (30, MIT — simulates 28 named VCs), cc-skills-vc-fundraising (24, MIT), nock (10, MIT), founder-skills (9, MIT), pitch-deck-mastery-skill (8, MIT), startup-problem-finder (6, MIT).

OpenStartupModel's cap table is a free spreadsheet with no licence at all.

The one we'd install first: nock. Every other tool in this group writes slides. nock tells you which slide will get you killed — it's built from one seed investor's questions across 53 real pitch and diligence meetings. Fixing a deck is easy; knowing what's actually broken in it is not. Honest limitation: it's one investor's lens, narrow and idiosyncratic by design. Run it and then run vc-skills for a second opinion, and remember that vc-skills' "firm personalities" are the author's characterisation, not sourced from those firms.

New flag: ppt-agent-skills shows no licence. At 893 stars it's the second-largest entry in this group, and GitHub resolves no licence for it. Last week we printed "MIT" on the strength of its README. It generates decks you might send to an investor, so read the repository yourself before relying on it commercially.

Read the small print on two more. OpenStartupModel calls itself open source and carries no licence — it's a law firm's goodwill marketing, marked "educational purposes only." And cc-skills-vc-fundraising and claude-skills-founder each have four commits and describe themselves as grounded in Sequoia and a16z frameworks; that's the author's synthesis, uncited. Useful scaffolding, not authority. Both grew this week, which changes nothing about that.

Investor research​

This bucket is genuinely thin, and that's the most useful thing on the page.

awesome-oss-investors (473, MIT) lists 80+ VCs investing in commercial open source with ticket sizes — genuinely good, but last committed well over a year ago, so ticket sizes and fund status will have drifted. openbook (64, MIT, last pushed August 1) scrapes and publishes an open VC database. awesome-startup-fundraising (7, MIT) is vendor-curated. OpenVC is proprietary with a free tier.

The one we'd start with: openbook. The only genuinely open, actively maintained attempt at a public VC database rather than a static list or a freemium funnel. The honest limitation is big: the repository holds scrapers, not rows. The dataset lives on DoltHub and we couldn't render that page to confirm its size or freshness, so treat this as a tool for building your own list, not a list.

For most founders the pragmatic answer is OpenVC's free tier — 16,000+ investor profiles, filterable by thesis, exportable. It isn't open source and we're saying so rather than smuggling it into an open-source list.

What's missing: there is no open-source thesis-matching agent. Nothing takes your company and returns a ranked, reasoned investor list. Every MCP server in this space — Crunchbase, Affinity, Harmonic — is a thin client for a paid proprietary API.

Outreach​

ECC — 256,281 stars, MIT. A 286-skill, 68-agent harness; the fundraising pieces are two skills inside it. A heavy install for a small payload unless you were adopting the whole thing anyway.

Outreachr — 259 stars, Apache-2.0, v0.1.1, 41 commits. Local-first investor CRM: relationship mapping, warm-intro planning, email approval workflow, pipeline.

venture-ops (7, MIT) and founder-fundraising-outreach (5, MIT).

The one we'd install first: Outreachr. The only tool in this category that's an actual investor CRM rather than instructions for writing emails. Apache-2.0 and local-first, with investor data in a local SQLite vault and encrypted secrets. Honest limitation: v0.1.1, about six weeks old, and the macOS and Windows builds are unsigned and unnotarised — you'll click through security warnings to install something that will hold your investor pipeline.

Last week's disputed number is settled, and we were wrong about which figure was wrong. We recorded 238 stars from the API on August 28, then a hand-check on September 4 appeared to show 6 stars and 10 commits, so we marked it disputed and told you you'd be adopting a six-star project. The correct figure is 259 stars and 41 commits. The API was right all along; the hand-check was the error — almost certainly a misread of a partially-rendered page, which is exactly the failure mode we warn about elsewhere when we tell you not to trust rendered GitHub counts.

We're leaving the history visible rather than quietly swapping the number, because the correction cuts against us twice: we published a wrong figure, and we published it in the direction that made a tool we recommend look weaker than it is. If you skipped Outreachr last week because this page called it a six-star project with ten commits, that was our mistake. Still young, still unsigned, still a real bus-factor risk — but not the thing we described.

The underlying argument hasn't changed: in a category this small, low adoption is information rather than disqualification. A genuinely useful tool here might have 10 stars where a coding tool has 100,000.

founder-fundraising-outreach is a competitor's skill and it's real: MIT, self-contained, eight distinct email modes including stall recovery, which is the mode most founders actually need and never plan for. It's also three commits old and tagged v0.9 pilot. We'd rather list it honestly than pretend it doesn't exist.

Data room and diligence prep​

Papermark — 9,158 stars, AGPL-3.0, 5,000+ commits. Self-hosted data room with per-page view analytics.

due-diligence-portal — 1 star, Apache-2.0. A single Docker container with NDA gating and an audit log. Genuinely nice shape for a small raise. You are the QA team.

YC SAFE documents — free, no stated licence, the closest thing to a default in pre-seed financing.

The one we'd install first: Papermark. By a wide margin the most battle-tested open-source DocSend replacement. The per-viewer page analytics are exactly what you want during a raise — knowing which investor spent four minutes on your financials changes your follow-up. Honest limitation: self-hosting means Postgres, blob storage and SMTP wiring. Budget an afternoon of infrastructure, not a one-click deploy. There's a paid hosted tier if you'd rather not.

Papermark's move has completed cleanly: mfts/papermark redirects to papermark/papermark, both report the same 9,158 stars, licence unchanged. Update any pinned remote.

On the YC SAFE: free, standard since the post-money version in 2018. It carries no licence grant and it is not a substitute for a lawyer — it's a starting document that saves your lawyer time. If you're applying to Winter 2027, read it before November 2, not after.

What didn't make the list​

captableinc/captable — self-hostable cap table management, last pushed June 2025 with cap-table management itself still marked work in progress. Over a year stale on something this consequential isn't "stable", it's abandoned in place. selcuke/venture-capital-firms-list — last pushed May 2019, no licence. Seven-year-old VC contact data is worse than none. Graphite Financial's "open source financial model" — no licence anywhere and the download gated behind a form. That's a lead magnet. Open-Term-Sheet / SAFE-Note-Translations — five-year-old legal documents are actively dangerous, not merely stale. Crunchbase MCP server — a thin client for a paid key, so no free path.

Frequently asked questions​

How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.

Is this the full page? Yes — this interactive page is the canonical living guide; Substack carries the same weekly refresh.

What changed this week​

Settled the Outreachr dispute, against ourselves. 259 stars, 41 commits, v0.1.1. The August 28 API reading was substantially right; the September 4 hand-check was the error. We told readers they'd be adopting a six-star project — that was wrong, and if it put you off a tool we otherwise recommend, the mistake was ours.

New licence flag: ppt-agent-skills (893 stars) shows no licence. We printed "MIT" last week on the strength of its README. GitHub resolves nothing.

First complete star audit this page has had. All 19 GitHub entries read September 11. Notable: Lenny Skills 1,287 → 1,319, claude-skills-founder 66 → 89, ECC 243,927 → 256,281, Papermark 8,980 → 9,158.

Papermark's move confirmed complete. Old path redirects, identical figures, AGPL-3.0 unchanged.

Timing updated: YC Winter 2027 is now seven weeks out. Techstars Spring 2027 is November 18.

Where the shelf is still empty: no open-source thesis-matching agent; no free path to investor data; the best cap-table tool remains stale. Unchanged, and unlikely to change soon.

Last updated: September 11, 2026. Reviewed weekly.

If you're picking three open-source GTM tools today: OpenSEO for content and search (a genuinely MIT self-hostable replacement for Semrush), GTM Skills by Prospeda for outbound (the only "GTM agents" repo we found that contains a working MCP server rather than instructions), and Crawl4AI for research (Apache-2.0, runs on your machine, no vendor key).

Here's the finding that shaped this page. We cloned every repo below and counted file types rather than reading marketing copy. Of the best-known "GTM agent" repositories, most contain no executable code at all. gtm-agents markets 67 "production-ready agents" and is 723 markdown files with exactly one Python script across all of them. In this category, star count is almost entirely uncorrelated with whether anything runs.

That's not a reason to dismiss the markdown ones — a good methodology written down is worth having. It's a reason to know which you're installing.

Every star count here is current as of September 11, 2026. The last two runs published August 28 figures because GitHub's rate limit was exhausted before this page's turn. We said this page would go first this week. It did — and we found a way to stop the problem recurring.

---

Content​

Postiz — 35,709 stars, AGPL-3.0. A full Next.js/NestJS app with workers; schedules and publishes across 20+ channels. The most mature product here, but AGPL makes embedding it in a closed product legally awkward.

OpenSEO — 18,360 stars, MIT. Keyword research, rank tracking, backlinks, site audits. 897 source files and real migrations.

Mixpost Lite — 3,686 stars, MIT. Self-hosted social scheduling, full Laravel app. Not pushed to since March 16 — five months and twenty-six days, four days inside our removal window.

AI Marketing Skills (3,518, MIT), SerpBear (2,073, MIT, last pushed May 14), Digital Marketing Pro (810, MIT) and OpenClaudia Skills (689, MIT — a prompt pack, 82 md against 4 Python).

OpenSEO's real number is 18,360, not "above 16,000". Last week we could only say the rendered count had moved past 16,000 with the exact figure pending. It's 18,360, up 4,349 on August 28's 14,011 — a 31% gain in two weeks, and by some distance the fastest growth on this page.

The one we'd install first: OpenSEO. The only tool here that replaces an expensive incumbent — Semrush, Ahrefs — with a genuinely MIT-licensed application you can host yourself, and it ships an MCP server so an agent can call it as well as a human. The honest limitation: the app is free, the data isn't. You bring a paid DataForSEO key, so "free" ends at the API boundary.

Outbound​

Twenty — 56,594 stars, licence no longer resolving to a standard identifier (AGPL-3.0 plus enterprise files is the claim). A full production CRM.

Listmonk — 23,370, AGPL-3.0. A compiled Go binary that will push hundreds of thousands of emails.

Mautic — 10,489, licence no assertion (GPL-3.0 claimed). Mature PHP marketing platform.

Cold Outbound Skills — 701, MIT, last pushed August 18. Genuinely executes: 59 TypeScript scripts. Also ships a bundled "12M US businesses" Google Maps scrape — a provenance and compliance question you inherit on install.

gtm-agents — 399, Apache-2.0. 723 markdown files, one Python script.

GTM Strategist Skills (254, MIT — Maja Voje's actual repo), gtm-starter-kit (192, no licence file), GTM Skills by Prospeda (159, MIT), Company OS Starter Kit (84, MIT, last pushed April 6), LeadMagic GTM Skills (49, MIT).

The one we'd install first: GTM Skills by Prospeda. Among the purpose-built GTM skill repos, it's the only one where cloning reveals actual software — a 2,037-line MCP server with a working HubSpot integration, a browser extension and a web app, all MIT, pushed to as recently as August 20. Honest limitation: a large share of its value is still the prompt library behind those pieces, so you're getting less automation than the file count suggests.

A correction worth repeating, because it's wrong everywhere else. KarlRaf/gtm-starter-kit is not Maja Voje's repository. We cloned it and grepped the whole tree — she isn't mentioned anywhere; the README credits The Revenue Architects. Her actual repo is GTM-Strategist/gtm-strategist-skills, MIT, copyright Maja Voje.

The gtm-starter-kit licence gap is now three weeks old. We checked the root file listing directly this week: the README still claims MIT and there is still no LICENSE file. Three weeks of the same gap on a repo last pushed April 3 isn't plausibly an oversight in flight — it's the state of the repo. All-rights-reserved by default. Don't build anything commercial on it.

We softened a claim last week that we should not have, and we're reinstating it. Last week we downgraded "gtm-agents has had no commits in about five months" to unconfirmed. We can confirm it now: last pushed April 3, 2026 — five months and eight days. The original claim was right and the softening was the error. It still has 98 open issues and Apache-2.0, and it's still a well-organised markdown library. It is not being actively developed.

Research and enrichment​

Firecrawl (179,063, AGPL-3.0), browser-use (114,194, MIT), Crawl4AI (82,160, Apache-2.0), GPT Researcher (29,413, Apache-2.0), Firecrawl MCP Server (7,435, MIT), Exa MCP Server (4,990, MIT), Google Analytics MCP (3,173, Apache-2.0, official Google), Attio MCP Server (69, Apache-2.0, community) and GTM Engineering Skills (58, MIT, 48 Python that genuinely execute).

The one we'd install first: Crawl4AI. Apache-2.0, and it runs entirely on your machine with no vendor key and no hosted dependency — the only entry in this group with zero commercial chokepoint. Firecrawl is more polished, but its self-hosted path is deliberately second-class to its paid cloud. Honest limitation on Crawl4AI: it gives you extraction, not identity resolution. It will not turn a domain into a verified contact, and nothing free will.

If you deployed Crawl4AI from this page in August, you are still behind a security release. We re-checked the releases list this week: v0.9.3 remains current, and it's the patch covering five coordinated-disclosure vulnerabilities. No newer release has shipped in the past week. This was the most actionable line on the page last week and it's still true.

That's the pattern across this whole bucket: the open-source client is real, the data behind it is paid. Exa's MCP server is MIT and returns nothing without a key. Firecrawl's MCP server defaults to the paid cloud. Aero's skills route every enrichment through the proprietary Deepline CLI. None of that is dishonest — but if you're budgeting a GTM stack, the licence column is not the cost column.

Analytics​

Metabase (49,199, AGPL-3.0 plus separate commercial licence on parts), PostHog (39,744, MIT except ee/), Dub (24,723, AGPL-3.0) and Matomo (21,855, GPL-3.0).

The one we'd install first: PostHog. The only entry that answers the whole GTM measurement question — funnels, conversion, retention, session replay — in one MIT-licensed system you can run yourself. Honest limitation: self-hosting at real volume means operating ClickHouse and Kafka. That's an engineering commitment, not a docker-compose afternoon, and PostHog itself steers most users to their cloud for exactly that reason.

Watch the licence details here. Metabase's repository is mixed. Matomo's core is GPL but many of the attribution and funnel features people actually want are paid premium plugins, so the free build is thinner than it looks.

What didn't make the list​

n8n — the most-used automation tool in GTM full stop, and it fails on licence, not quality. The Sustainable Use Licence is fair-code and restricts commercial use. It isn't open source, and calling it that has become routine. RudderStack — relicensed to Elastic License 2.0, not OSI-approved. SalesGPT — MIT, real runtime, last pushed September 2024. PostHog MCP — official and useful, last pushed January 2026, misses the six-month bar by two months. hansdekker.ai skills — real and free, but no repository, no licence and no source to inspect; free to use is not the same as open source. HubSpot and Apollo MCP servers — neither has verifiable open source. theHarvester — no LICENSE file, and OSINT email harvesting carries terms-of-service exposure we won't point founders at.

How the star counts work, and why they were stale for two weeks​

They come from GitHub, exact and never rounded — rendered page labels return materially stale numbers, one repo showed 266 against 392. The staleness had a specific cause: GitHub's unauthenticated REST API allows 60 requests an hour, and this page sits fourth in a four-page audit, so the quota was gone before its turn twice running. The fix, found this week: every repository page embeds its own exact figure in the HTML as "stargazerCount": <n>. Reading that costs no API quota, so page order no longer decides which of our pages gets real numbers.

Frequently asked questions​

How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.

Is this the full page? Yes — this interactive page is the canonical living guide; Substack carries the same weekly refresh.

What changed this week​

The full star re-read happened, as promised. Every figure is from September 11. The rate-limit problem that stalled this page twice is solved, and this page will never again be the one that loses the coin toss.

Reinstated a claim we wrongly softened. gtm-agents was last pushed April 3, 2026 — five months and eight days. The original call was right; softening it was the mistake.

OpenSEO's exact number, finally: 18,360 against 14,011 on August 28. Up 31% in two weeks.

Flagged, third week running: gtm-starter-kit still has no LICENSE file, verified against the root file listing rather than inferred.

New dormancy flags, newly dated rather than newly discovered: Mixpost Lite last pushed March 16 (four days from removal), Company OS Starter Kit April 6, SerpBear May 14.

Hardened two licence columns. Twenty and Mautic now carry "no assertion" — GitHub resolves neither to a standard identifier, though both claim copyleft licences in their own documentation.

Crawl4AI's security patch is still current and still unapplied by many. v0.9.3. If you deployed in August, update.

Nothing incomplete this run. No carried-forward numbers, no "couldn't verify" list.

Last updated: September 11, 2026. Reviewed weekly.

There is no open-source tool that finds startup events for you. We looked hard, and what exists is developers.events and Confs.tech for developer conferences, frm for pre-meeting briefs, and PingCRM or Twenty for follow-up. Thirteen tools total, and none of them covers demo days, accelerator cohort calls or VC mixers.

This is the thinnest of the four categories we track, and padding it would waste your afternoon. So this page does two jobs: it lists what genuinely exists, and then it tells you exactly which parts of the workflow you'd have to build yourself — because that second half is the actually useful answer.

---

What we learned by running this again this week​

Four findings, and two of them correct things we told you last week.

1. We were wrong about luma.com/waterloo. It is a real city page. Last week we said it "resolves to an unrelated event page from a past cohort" and used it as the headline example of Luma's patchy city coverage. That was wrong. It resolves to a genuine Waterloo discovery place and returned a full event list this week — eleven startup and AI events after filtering, including most of Waterloo Tech Week. We're flagging it here because it was load-bearing: it was the evidence for "city-page coverage silently fails for mid-size cities," and that argument is now weaker than we made it sound.

2. luma.com/ottawa genuinely is a dead end, and now we know what it is. It's a community calendar — "Ottawa AI and Tech Community" — not a city discovery page, and it has zero upcoming events. Its ICS feed is live and returns an empty calendar. So the "mid-size cities fail" point survives, but on a sample of one rather than two.

3. There is a real unauthenticated Luma discovery endpoint, and we used it. Here's the honest tension. api.lu.ma/discover/get-paginated-events returns clean JSON — name, start time, URL, host, venue — with no key and no account, and it paginates properly where the rendered page lazy-loads. It is also exactly the kind of undocumented endpoint this page has twice told you not to point anything at. We used it this week because it was the difference between a complete sweep and a partial one, and we're not going to recommend a practice publicly while quietly doing the opposite. Our position: it works, it's undocumented, it can change or close without notice, and it carries a terms-of-service question we can't resolve for you. Prefer ICS. Read rendered pages where ICS doesn't exist. If you use the discover endpoint anyway, know you're building on something with no stability promise — and keep it away from anything you sell.

4. The ICS feeds are the real find, and they're the part that keeps working. Every Luma calendar exposes https://api.lu.ma/ics/get?entity=calendar&id=<calendar_id> and returns a standard VCALENDAR with no key and no browser. We verified four this week: Waterloo Tech Week (124 events), MaRS Discovery District (18), Communitech (16) and the dormant Ottawa one (0). This is a published, standard interface — it survives your browser automation breaking, it survives your scraper breaking, and a normal calendar app can subscribe to it. If you build one thing from this page, build the ICS subscriber.

One limit worth documenting: Luma's authenticated endpoints don't accept a browser session — get-subscribed-calendars returns 401 even from a signed-in tab. The calendars you personally follow are not reachable programmatically. Only calendars you can name are.

And a note on last week's outage: our browser automation failed on every page last week, including example.com. It worked normally this week from the same codebase against the same sites — consistent with a transient fault. The advice stands regardless: have two ways in, and make the failure loud.

Event discovery​

developers.events (2,002 stars, MIT) lists dev and tech conferences worldwide and publishes JSON. Confs.tech (277, MIT) is a community JSON dataset. Meetable (168, MIT) is a self-hosted listing site. eventbrite-python (5, MIT) wraps an API that can no longer search. TechEventRadar (4, MIT) scrapes ten Turkey-only sites. luma-mcp (0, MIT) manages events via the official API. luma-cal-mcp (0, MIT) searches Luma Discover via undocumented endpoints.

The one we'd use first: developers.events. Re-verified September 11: all-events.json returns 6,142 events, 2,076 of them dated 2026 — up from 6,108/2,047 last week and 6,081/2,029 the week before. Three consecutive weeks of growth, so it's genuinely maintained. Plus 3,632 calls for papers. MIT, no scraping, no key, no account. The honest limitation is the whole problem: it's developer-conference biased. Startup ecosystem events appear in almost none of it.

Three warnings. eventbrite-python works and cannot help you discover anything — the public search endpoint was switched off in February 2020, so wrappers only manage events you already own, and it hasn't been committed to in three years. luma-cal-mcp reverse-engineers undocumented endpoints; the author says so plainly in the README, which is to their credit and doesn't make it safer. We'd now reach for ICS feeds first, a plain browser second, this tool third. And Meetable is not an aggregator despite how it reads — you post events into it by hand.

Conference prep​

One tool. frm (15 stars, MIT) builds pre-meeting briefs from your CardDAV contacts and recent email, and ships a SKILL.md so an agent can drive it. Honest limitation: it only knows what you already know. It does no external research on speakers or attendees, which is the half that actually takes time.

We filled that gap by hand again this week, and it got faster. Organizer speaker pages are usually plain HTML lists — one festival's directory gave us 230+ named speakers with titles and companies in a single page read, a SaaS conference gave 80 more, total time under ten minutes. What it did not give us was verified LinkedIn URLs. Those still have to be confirmed one at a time, and speaker-page links are frequently auto-generated LinkedIn search URLs rather than real profiles. That's a trap worth knowing about.

Networking, CRM and after the event​

Twenty (56,594, licence no longer resolving — AGPL-3.0 plus enterprise files is the project's own description), Monica (25,266, AGPL-3.0), EspoCRM (3,340, AGPL-3.0), PingCRM (120, AGPL-3.0) and Tilly (64, MIT).

The one we'd install first: Twenty. The most actively developed open CRM here, API-first, and custom objects mean you can model an event as a first-class thing rather than a note. Honest limitation: it's a sales CRM with no concept of an event, a session or a badge scan. You're doing that modelling yourself.

Monica is built for friends and family, not deal flow, and its last stable release is v4.1.2 from May 2024. PingCRM is the most interesting for post-event work — it merges Gmail and Telegram into one timeline and drafts follow-ups it never auto-sends, which is the correct default after you've met forty people and can't remember which conversation was which. Run it with the LinkedIn extension switched off; that extension is the part most likely to break or get an account flagged.

Where the open-source shelf is empty​

Eleven jobs have no good open-source tool: no aggregator for startup or VC events; no legitimate Luma search API (an undocumented discovery endpoint works and ICS feeds are properly supported, but there's no documented queryable interface); no Eventbrite discovery API; no maintained Meetup client; nothing that de-duplicates one event across platforms; no attendee or speaker research tool; no agenda triage; no working badge or business-card capture; no free post-event enrichment; no event-aware CRM; and no event category in the MCP registries.

One trap: the GitHub topics are false friends. event-aggregation is dominated by the .NET design pattern, luma by Luma AI video and the Magento Luma theme. There's no topic where this category actually lives.

How would you build an event radar today?​

Eight steps. Step 3 has been rewritten again this week, and it now leads with ICS.

1. Seed from the two open datasets — developers.events/all-events.json, all-cfps.json, and Confs.tech's per-year files. Free, no code.
2. Accept that this misses every startup event, and fill the gap by hand. Keep a curated seed list of accelerator, VC and ecosystem calendars for your region. No tool exists; pretending otherwise is the main failure mode.
3. Subscribe to ICS feeds first; read pages second. Every Luma calendar publishes one at api.lu.ma/ics/get?entity=calendar&id=<id> — a standard VCALENDAR, no key, no browser, no undocumented endpoint. Build your seed list of calendar ids once and this step needs no automation ever again. Where no feed exists, Luma city pages and Eventbrite browse pages render fully in an ordinary browser.
4. Normalise and de-duplicate. Fuzzy-match on name plus start date plus city. Roughly a hundred lines you write — our own sweep produced five duplicate pairs this week.
5. Score events against your thesis with an LLM step. Where an agent earns its place, and where no skill exists to copy.
6. Store survivors in Twenty or EspoCRM as a custom object. You define the event object yourself.
7. Prep with frm plus a manual pass over the speaker list. Treat any LinkedIn URL on a speaker page as unverified until you've opened it.
8. Close the loop with PingCRM. LinkedIn extension off.

Steps 1, 7 and 8 are genuinely served by open source. Steps 2, 4 and 5 are code you write. That ratio is the honest state of this category, and it's why most founders end up with a spreadsheet instead.

Three verification rules to steal. The most common failure in event data is the wrong year — if the year isn't explicit on the organizer's own page, discard the record rather than inferring it. Never let a discovery step fail silently; an empty list looks identical to a quiet week. And, new this week: check whether a source is dead before concluding a city is. We wrote off luma.com/waterloo last week on one bad read. One retry would have caught it.

Frequently asked questions​

How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.

Is this the full page? Yes — this interactive page is the canonical living guide; Substack carries the same weekly refresh.

What changed this week​

Corrected, and it was our error: luma.com/waterloo is a real city page. It returned eleven relevant events this week. The "mid-size cities silently fail" argument now rests on /ottawa alone, and we've said so rather than leaving the stronger version standing.

Sharpened, not retracted: luma.com/ottawa really is a dead end — a dormant community calendar with zero upcoming events, not a broken slug.

New and genuinely useful: Luma ICS feeds, with four verified calendar ids. Waterloo Tech Week returned 124 events, MaRS 18, Communitech 16. Step 3 of the build guide now leads with this, because it's the only part of discovery that survives your automation breaking.

Stated a position we'd been dodging on the undocumented api.lu.ma/discover endpoint — we use it, and this page had twice advised against it. Written out plainly rather than quietly doing one thing and advising another.

New documented limit: Luma's authenticated endpoints reject browser sessions, so calendars you personally follow aren't reachable programmatically.

Top pick growing for a third week: developers.events at 6,142 events, 2,076 dated 2026, plus 3,632 CFPs.

All star counts re-read September 11 — the first time this page has had current numbers. Small and slow-moving, as expected: developers.events 2,000 → 2,002, frm 14 → 15, Monica 25,127 → 25,266, EspoCRM 3,305 → 3,340, PingCRM 115 → 120, Twenty 55,790 → 56,594.

Last week's browser-automation outage did not recur. Same codebase, same sites, worked normally.

No Codalio self-listing. We run an events radar internally and haven't open-sourced it. When we do, it goes on this page with the same disclosure and scrutiny as everything else — not before. Everything in the build guide, including the ICS ids, is what we actually do, described in enough detail to copy without us.

Last updated: September 11, 2026. Reviewed weekly.

The most urgent deadline right now: OCI's two Collaborate 2 Commercialize calls close September 15, 2026 — up to $50K from the Ontario Centre of Innovation plus up to $50K from NSERC Alliance. Four days out, and the Ontario academic partner is the gate, not the form. After that, Y Combinator's Winter 2027 batch closes November 2 at 8pm PT, and NEXT 36 closes October 14.

Everything below was verified against the funder's or organizer's own page this week. Anything we couldn't verify is marked, not quietly included. Past deadlines get deleted every week, so if it's here, it's still live.

---

Which startup deadlines close in the next 30 days?​

OCI Collaborate 2 Commercialize — Defence & Dual-Use closes September 15. Up to $50K OCI plus up to $50K NSERC Alliance, with an industry match. You cannot originate this cold in four days — it needs an Ontario university PI already lined up. If you have one, it's the best Ontario money open right now.

OCI Collaborate 2 Commercialize — AI closes the same day, September 15, on the same structure. The 5-FTE floor and 2-year incorporation requirement quietly disqualify most seed-stage AI startups. Check eligibility before you write anything.

Innovate UK — Quantum sensing & PNT adoption closes September 16, £14.3M pot, collaborative-only. Realistically closed unless you're already mid-application with partners.

DoD SBIR/STTR open topics close September 23. 337 topics share one close date. The work is topic-matching, not writing — twelve days is enough only if a topic already describes what you built.

Innovate UK — Quantum computing applications closes September 24, £13M pot. Same story: partners or nothing.

Innovate UK — Measurement & Sensing pilot closes October 7, £1M pot, and is single-applicant SME-only — unusually clean for Innovate UK. No consortium to assemble makes the four-week runway workable.

NEXT 36 (2027 cohort) closes October 14. Free to participate, high-signal, but the full-time May–August 2027 summer with no other job permitted makes it a student program, not a founder program.

Closed since last week: Slush 100 (September 7) and the Elevate $100-off-GA pricing deadline (September 10).

What Canadian grants and non-dilutive funding are open right now?​

Most Canadian non-dilutive money is rolling, which founders read as "no urgency" and then never apply. The rolling programs have real queues — IRAP takes about three months to assess, Mitacs six to eight weeks of peer review. Apply on the timeline of when you need the cash, not when the deadline is.

NRC IRAP is the biggest non-dilutive cheque most Canadian founders will ever see. Continuous intake, amount not published, and there's no form to hide behind — it starts with getting an Industrial Technology Advisor assigned. Call 1-877-994-4727 before you write anything. One caution: the official page carries no current year, so don't quote figures from it.

Mitacs Accelerate gives $15,000 per four-month unit ($20,000 for a postdoc) for a $7,500 contribution from you. That's effectively 2:1 leverage on R&D salary and the best-value non-dilutive program in the country. Peer review takes 6–8 weeks, so it's not cash for this quarter.

OCI Digital Competence Centre — DMAP pays up to $15,000, rolling and first-come, for Ontario for-profits with 1–499 employees. It pays a consultant to write you a digitalization plan — useful mainly as the on-ramp to bigger OCI money, since the $50K TDP follow-on closed August 10. The sister program RMPG (up to $5,000) requires a physical retail storefront, which rules out every software company.

OCI Ready 4 Market goes up to $250,000 for Ontario academic or incubator IP, incorporated five years or less, under $1M raised. Private co-investment is mandatory — this follows a lead investor, it doesn't create one.

NGen Industrial AI Readiness offers up to $15,000 per manufacturer, rolling until funds run out. "Rolling" is misleading: final reports are due by end of December 2026, so the practical runway is short, and an existing IRAP relationship is the real gate.

Debt, not grants, but frequently mistaken for them: the Women Entrepreneurship Loan Fund (loans up to $50,000, terms vary by delivery partner), Futurpreneur (up to $75,000, hard age cap at 39, and the mentorship is the part people actually rate), and BDC Start-up Financing (up to $150,000, generally needs 12+ months of revenue — a bank loan with a friendly logo, personal guarantees normal).

Not on this list and you'll want to know why: SR&ED has no calendar deadline — you claim it with your T2 return. CanExport SMEs closed August 31 and the 2027-28 cycle still hasn't been posted. The Canada Digital Adoption Program's government page was unreachable for a third week running, so its status stays unpublished rather than guessed at.

What global grants and accelerator money is open?​

EIC Accelerator closes November 4 at 17:00 Brussels — grant up to €2.5M plus optional €1–10M equity. The last 2026 cut-off and the largest non-dilutive cheque here. Seven weeks is thin for a first EIC application, which normally takes months. UK applicants are grant-only.

EIC Pathfinder Challenges closes October 28, up to €4M per grant, TRL 1–4. If you have a product with users, you're already too far along to qualify.

NSF SBIR/STTR Phase I shows November 4 — but read carefully: that date applies to full proposals from teams who already hold an invited Project Pitch. If you don't have one, November 4 is not your date.

Innovate UK has three more open: KTP Round 3 (October 14, £12.5M, academic partner leads), DRIVE35 Scale-up Drawdown 5 (November 4, £150M, automotive and advanced-propulsion scoped, single applicants welcome), and UK-Singapore CRD (December 16, £3M — the longest runway, because finding a Singaporean partner is the slow part).

Sovereign Tech Fund is rolling, minimum €50K project cost. Infrastructure funding for open-source maintainers, not startup runway; their own site says roughly six months application-to-contract.

Credits are not grants. AWS Activate (up to $200K), Google for Startups Cloud (up to $350K for AI-first), Microsoft for Startups Founders Hub (up to $150K, explicitly non-convertible to cash) and NVIDIA Inception are spend against one vendor's bill. They reduce infrastructure burn and can't pay a salary, a contractor or a lawyer. Take them, use them, and don't put them in a funding slide.

Which accelerators and incubators are accepting applications?​

In Canada. NEXT 36 closes October 14 (free, but a student program in practice). DMZ's Spring 2027 incubator takes applications year-round with twice-yearly onboarding — no fee, 2.5% in common shares, and the MRR requirement plus in-house technical lead are real gates. District 3 in Montreal is completely free, takes no equity and lets you keep your IP, with a two-to-three-week decision — for a pre-product Montreal founder there is no argument against applying. Altitude Accelerator in Mississauga runs five programs (RevUP, Growth Essentials, Market Readiness, Investor Readiness, Altitude for You), all free, none with a published deadline; it's the only serious accelerator anchored in the western GTA rather than downtown Toronto. Antler Canada is rolling at $250K for 9% at inception — expensive capital, and really a co-founder dating program you get paid to attend. Founder Institute Toronto charges a $2,249 USD entrance fee and takes equity through its Equity Collective; its refund cutoff is September 17. DMZ and District 3 beat it on terms without a close second. Genesis Centre in St. John's is rolling but publishes nothing — you have to email them.

Closed for this cycle: Creative Destruction Lab (closed July 24) and Google for Startups Accelerator Canada, whose own page now reads "Applications are now closed," with 2027 dates to be announced later this year. And to kill a recurring question: Techstars runs no Canadian program. Their own accelerator list is US cities plus London and Tokyo.

Globally. Y Combinator Winter 2027 closes November 2 at 8pm PT — $125K for 7% plus $375K uncapped MFN, decision by December 11 if you apply on time. Late applications are read against a batch that's largely decided. Techstars NYC / Anywhere / London Spring 2027 closes November 18 at $220,000 total; Anywhere is the only one that doesn't force a move. Z Fellows is rolling — $10,000 at a $1B cap, one week long, no company required, the lowest-cost credible name here. a16z speedrun SR008 is rolling with a priority-review window closing November 1 (that's faster review, not a deadline). Conviction Embed Cohort 7 offers the most founder-friendly terms anywhere on this page — $250K uncapped, no discount, plus roughly $1.2M in compute credits — and publishes no deadline at all, so email them. Antler's global cohorts start October 5, October 11 and November 2; those are start dates, not deadlines, and Antler publishes no terms anywhere we could read, which is a diligence gap worth noticing.

Which startup events are actually worth the ticket?​

The one we'd pay for: Elevate Festival, Toronto, September 22–24, $325 Startup Pass. It's the densest concentration of Canadian early-stage founders and investors in the calendar year, and the 2026 speaker list is unusually operator- and investor-heavy: Christian Weedbrook (Xanadu), Eva Wong (Borrowell), Abdullah Snobar (DMZ), Sonya Shorey (Invest Ottawa), Elizabeth Yin (Hustle Fund), Matt Cohen (Ripple Ventures), Arlene Dickinson (District Ventures), Sonia Sennik (Creative Destruction Lab). One condition: it's only worth $325 if you book Meeting Exchange slots in advance. Walk-up networking at a festival that size is worth close to zero.

Disclosure: Codalio's founder is on an Elevate roundtable this year — "AI for Faster Customer Discovery," September 23. We'd have recommended the Startup Pass regardless; we've recommended it on this page since before we were on the programme.

The workshops — and this week they're the story. Waterloo Tech Week runs September 12–17 and published 45 future-dated sessions, most of them free. The ones worth your Tuesday:

• Prompt to Pipeline: Automating Workflows With AI — September 12, Waterloo, free. Hands-on workflow automation.
• Before You Raise, Get Funded (SeedPort × OCI) — September 14, Waterloo, free. The most useful hour of the week if you've never touched non-dilutive money, and it lands the day before OCI's C2C calls close. The funder is in the room explaining its own money.
• The AI-first startup playbook — September 15, MaRS Toronto, free. Heavily oversubscribed; join the waitlist anyway, MaRS releases seats.
• Waterloo: AI Agents for Everyone — September 15, Kitchener, free. The title is the non-technical founder, word for word.
• Investment Readiness Power Hour — September 15, Waterloo, free. Seven questions between you and a cheque, most of which are answered by a document the average founder has never written.
• Zero to Sales — September 17, Waterloo, free. Technical founders who can't sell is the most common failure mode we see.
• Toronto Agentic: Opening Social — September 17, Toronto, free. A brand-new agent-builder community at its first event; night one is the cheapest moment to become a known face.
• Founder Friends Toronto — September 22, free, hosted by Hustle Fund, whose GP speaks at Elevate the same week.
• Communitech IP 101 and GTM Power Hour — both September 30, Kitchener, both free.

Our own session isn't listed this week. Several sessions on Codalio's Luma calendar were cancelled on September 10 and we have no replacement date to publish, so linking to the calendar would have sent you to cancelled events. It returns when there's a live date.

Conferences and showcases, next 90 days. Waterloo Tech Week (Sept 12–17, mostly free). New Ventures BC Demo Day (Sept 14, Vancouver, free). TechTO Together Toronto (Sept 14, $45.20 — membership is the only reliable way in). NEXT AI Montréal Venture Day (Sept 15). ALL IN (Sept 16–17, Montreal — Canada's largest AI conference, weighted toward enterprise and policy). Communitech Dual-Use Summit (Sept 16, Kitchener). CodeLaunch Canada (Sept 16, Toronto, attend-only). Hack the North (Sept 18–20, Waterloo, 1,000+ student builders). Elevate (Sept 22–24). Tech x Women (Sept 22, Kitchener). RXN HUB Innovation Summit (Sept 23, Kingston). LiONS LAIR (Sept 24, Oakville, 5–9pm — 350+ Southern Ontario founders and angels; the 2026 top ten are named and healthtech-heavy, so spectate). GCXpo (Sept 29, Ottawa, free, ~80 live demos for 1,500+ government buyers at Area X.O, and the demo application is still open). Venture North PITCH (Oct 1, Sudbury). IEEE Venture Summit Toronto (Oct 20–21, Mississauga, free to apply, screened by hard-tech investors, no stated deadline — apply now). DMZ Black Innovation Summit (Oct 28, Scotia Plaza — applications closed, but $150K+ is awarded on stage and attendance is open). Startup Global National Pitch Grand Finale (Oct 29, Mississauga). SAAS NORTH (Nov 4–5, Ottawa, $1,199 regular).

One thing to know about SAAS NORTH before you buy: its 2026 speaker list has shifted decisively toward defence. Three senior Canadian Armed Forces officers and a DND director general now share the bill with the SaaS operators, and the DEPLOY defence track is clearly the centre of gravity. That's a change of character worth knowing about at $1,199.

Globally: Bits & Pretzels (Sept 28–30, Munich, capped at 7,500 — day three is an Oktoberfest tent, which is the actual reason people go). TechCrunch Disrupt (Oct 13–15, San Francisco, $849–899 "early bird" with no printed expiry, so the countdown is unfalsifiable). Web Summit Lisbon (Nov 9–12, €950 discounted — the biggest crowd here, which cuts both ways). Slush (Nov 18–19, Helsinki, €395 Startup Pass — the best investor-density-per-euro anywhere, and the Ecosystem tier is already sold out).

Which pitch competitions are still open?​

Startup Global National Pitch — $68,000 pool with $30,000 to the winner, applications "open now" with no published close date, finale October 29. Canadian, $50K–$1M revenue, under $1M raised, under 8 years, export intent. The revenue floor and export test are the real filters, not the pitch.

Startup Global pop-up Ottawa — $15,000 plus $1,000 people's choice, event November 18, CPG businesses only. Easy restriction to miss; it disqualifies most tech founders.

Desjardins Startup Prize — $100,000+ across tiers, applications October 13 to November 23 at 5:00pm. At least one founder must be a current U of T student, postdoc or 2024-onward grad, and it requires completing U of T IP Education Level 1 by the deadline. Start that now, not in November.

IEEE Venture Summit Toronto — investor exposure rather than cash, free to apply, no stated deadline. The absence of a prize is why nobody applies, which is exactly why you should.

Venture North PITCH (October 1, Sudbury) and Venture North Bay Pitch (November 5) — regional and shallow-fielded. If you're anywhere near either, the expected value is unusually good.

XTC AI:360 says applications are open and names a November 2026 California summit, but publishes no deadline and no prize, and its apply page 404s. Email before you invest time.

Frequently asked questions​

How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.

Is this the full page? Yes — this interactive page is the canonical living guide; Substack carries the same weekly refresh.

What changed this week​

Added — 13 workshops and working sessions: Prompt to Pipeline, Before You Raise Get Funded, Physical AI Showcase, Waterloo AI Agents for Everyone, Investment Readiness Power Hour, Zero to Sales, Toronto Agentic Opening Social, devkick Devin Meetup, Founder Friends Toronto, AI for Non-Technical Business Owners (Ottawa), Using AI Well, Communitech IP 101, Communitech GTM Power Hour, plus Voxel51's Toronto Physical AI workshop in November.

Added — 4 events: Communitech Dual-Use Summit, Tech x Women, Day of Data Toronto, Venture North Bay Pitch.

Removed — 2 deadlines passed: Slush 100 and the Elevate GA pricing deadline.

Removed — 7 events passed: Brampton Venture Expo, Daytona AI Builders Toronto, Toronto Agentics Foundation Meetup, FaithTech AI Build Event, Women in AI Pitch Competition, "write the rules" AI policy workshop, Building in the Age of AI.

Removed — our own listing: Codalio's free monthly session, because several sessions were cancelled on September 10 and we have no replacement date to publish.

Corrected — our error: waterlootechweek.ca resolves perfectly well. Last week we reported the domain as down and sent readers to Communitech instead. That was our mistake, not theirs; the link is restored. The official session calendar has genuinely moved to wygo.world, which is probably where the confusion came from.

Corrected: Altitude Accelerator's phantom September 14 date appears nowhere on any program page, so we've stopped flagging it and listed the five programs as they are — all free, no published deadlines. Google for Startups Accelerator Canada is confirmed closed.

Verified this run: both OCI C2C calls, NEXT 36, Altitude Accelerator, GCXpo, IEEE Venture Summit Toronto, DMZ Black Innovation Summit, LiONS LAIR, SAAS NORTH. All hold, several with new detail.

Couldn't verify: Canada Digital Adoption Program (third week unreachable), CanExport SMEs 2027-28 cycle, FedDev Ontario streams, Scale AI acceleration, ventureLAB, Alberta Innovates, Innovate BC, Centech, SheBoot.

Most AI tools will give you a demo. The question founders and operators actually ask is different: can I put a complete product in front of customers without hiring a CTO, a tech lead, senior developers, or cloud engineers first?

In April 2026 we ran that experiment. Four pipelines built the same meal-planning application. Codalio ran with no senior engineering team in the loop. Prompt-only Claude Code did not. We then scored every build against 111 things a customer would expect to work.

The quiet part, said out loud in a comment thread​

On July 30, a YC S26 company called Prized launched on Hacker News with a clean pitch: let non-engineer staff build secure internal tools. Seventy-three points, fifty-three comments. A good day.

Buried in that thread was a line worth more than the launch itself. A builder relaying a vendor conversation wrote that "Lovable is used primarily for prototyping, not internal tools" — not a competitor's jab, but a paraphrase of what the vendor's own team had told him.

Read that again, because it reframes the entire category. The prototype/product distinction isn't a talking point invented by people selling process. It's the vendors' own internal understanding of what their tool is for. They know. They say it out loud in sales conversations.

The problem is that nobody says it in the marketing. So founders ship the prototype and call it a product.

---

Three Posts, Forty-Eight Hours, One Argument​

On July 28th and 29th, three separate items landed on the Hacker News front page. Read individually, each is a curiosity. Read together, they are the same argument arriving from three directions.

The first was a Show HN: a formally verified 3D mesh intersection algorithm written in Lean 4, at roughly 111 points and 48 comments. The interesting part wasn't the algorithm. It was the review instructions the author attached to it. Read the 93-line specification. Run the Lean checker. You never need to inspect the 1,000+ lines of implementation the AI wrote — or the 60,000+ lines of formal proof the agent generated along the way. The work was built mostly with Claude Opus 4.8, with some early proof strategies from Fable 5, and individual steps consumed 24+ hours of autonomous agent time.

The second was SpecForge, a platform for authoring formal specifications, at 61 points the same week.

The third was Robert C. Martin — Uncle Bob, the man who taught a generation of engineers to care about the shape of their code — posting that his current strategy is "to not read any of the code written by my agents." Fifty-three points, fifty-three comments, and eighteen months ago that sentence from that author would have been heresy.

It isn't anymore. But it also isn't the whole story, and the missing half is where founders get hurt.

---

AI has already absorbed the junior coding work. Seniors set the plan, the architecture, and the task. AI writes the atomic pieces of code that used to be the first rung on every engineering career. So the hard question for new engineers isn't "can you code?" — it's "can you think like a senior and direct AI?"

That gap — between graduating and being trusted to lead — is the career problem of this decade. Codalio's Workshops & Training program exists to close it.

The morning test​

Here's the bar I hold every build tool to. Could a non-technical founder describe a feature at breakfast — "customers on the annual plan should skip the setup fee" — and have it live in production, working correctly, by lunch?

Not a prototype of it. The real thing, wired to the real data, that you can charge money against.

Almost nothing passes. So I spent a week reading the public docs and pricing pages of the three tools founders ask me about most — Lovable, Devin, and 8090 — to figure out exactly where each one stops. This isn't a takedown. Every one of them is good at the slice it owns. The problem is that a slice isn't a product.

---