Popular AI Repos on GitHub

The question arrives in board meetings in almost identical wording every time: is this the market standard yet. The answer everyone in the room reaches for usually reduces to a single number, the GitHub star count. It is public, easy to compare and looks objective, so it ends up in slide decks and then in architecture decisions. It is worth understanding what that number actually measures.

The landscape in August 2026

The figures below are star counts rounded to the nearest thousand.

MCP in the charts below stands for Model Context Protocol, the open standard for connecting AI agents to company tools.

Agent frameworks and platforms

1. OpenClaw386k
2. AutoGPT186k
3. LangChain144k
4. browser-use108k
5. MCP servers89k
6. OpenHands83k
7. Cline66k
8. CrewAI57k
9. LlamaIndex51k
10. LangGraph39k

The Model Context Protocol servers repository, visible in the first chart, has become the de facto exchange point for integrations between tools.

Running models on your own infrastructure

1. Ollama178k
2. Transformers163k
3. llama.cpp123k
4. vLLM88k
5. LlamaFactory74k
6. Unsloth70k
7. LocalAI48k
8. SGLang32k

RAG and semantic search

RAG (retrieval-augmented generation) is the pattern where a system first retrieves passages from company documents and only then attaches them to the prompt.

1. RAGFlow87k
2. Milvus46k
3. FAISS41k
4. GraphRAG35k
5. Qdrant34k
6. Chroma29k
7. Haystack26k
8. Weaviate17k

Workflow orchestration and interfaces

1. n8n200k
2. Langflow153k
3. Dify152k
4. Open WebUI148k
5. AnythingLLM64k
6. LiteLLM56k
7. Flowise55k
8. LibreChat42k

One figure on that list distorts the scale of everything else. OpenClaw carries more stars than React, which sits at 247,000¹, and it got there in under eight months. It is still well short of the top of GitHub overall, where learning-resource collections pass half a million stars, and no AI project has grown that fast before.

What popularity genuinely tells you

A high ranking does carry several pieces of information with commercial value.

The first is talent supply. With a project in the six-figure star range it is easier to find an implementation partner, easier to hire and easier to replace someone who leaves the team. The second is integration surface. Widely adopted libraries ship connectors to the systems an organisation already runs, which shortens integration work. The third is the quality of supporting material. A large community means documented failure modes, deployment examples, and language models that know the project’s API (application programming interface) well enough to make AI-assisted coding meaningfully more productive. The fourth is security attention. Vulnerabilities in heavily used components tend to be found sooner.

What popularity does not tell you

This is the part that gets skipped in a quick review.

A star is a bookmark that never expires. The counter only goes up, so a project being wound down can hold a high position for years. Microsoft AutoGen carries more than 60,000 stars¹, and its most recent code change dates from 15 April 2026. The repository README states plainly that it is in maintenance mode and directs new users to Microsoft Agent Framework, which has collected around 13,000 stars¹. An organisation picking components by ranking would have chosen the project being retired and passed over its official successor.

Popularity says nothing about the licence. n8n, at 200,000 stars¹, is distributed under the Sustainable Use License, and the project itself declines to call this open source because the licence restricts commercial use in ways the Open Source Initiative definition does not allow. Dify uses a modified Apache 2.0 licence that prohibits operating multi-tenant environments without separate written permission, and prohibits removing the logo from the interface. For a company planning to resell a service to end customers, that is a decisive distinction and it is entirely invisible in the star count.

Popularity says nothing about risk profile. OpenClaw earned its position as an assistant that runs on the user’s own machine, executing shell commands and file operations, driven from messaging apps. That characteristic is the source of both the enthusiasm and the serious reservations in environments handling personal data or trade secrets. Star velocity reflects market curiosity and carries no judgment about enterprise readiness.

Six signals we check instead of the ranking

Before a component reaches our recommendation it passes six checks. None of them needs tooling or access beyond the public repository, and together they take a quarter of an hour. The order matters: the first three signals say whether the project is still alive, the other three whether it is safe to build on.

• Date of the last code change, and not the last release but the last commit. A release can be cut from material prepared long ago; a commit shows whether anyone is still working on the project.
• Release cadence: regular releases every few weeks mean something different from three releases in one week followed by six months of silence. Irregularity often signals a project resting on one person.
• Contributor concentration: if most changes come from a single account, the risk becomes personal: that person changing jobs is enough.
• Rate at which issues get closed. Not the number open, but whether reports get an answer at all. A hundred open issues with fast replies says something different from twenty open and six months of silence.
• Licence changes in the project’s history. A project that has tightened its terms once can do it again, and then the choice is staying on an old version without fixes or rewriting the integration.
• Licence read, not assumed. The “open source” label in a repository description is sometimes inaccurate, and terms restricting resale or multi-tenant environments only show up in the licence text itself.

On a longer assessment, the presence of a security policy comes in, and for projects with a commercial owner the question of who funds development. A commercial entity usually means a predictable release cadence, and at the same time a risk of licence changes at the moment investors start expecting revenue.

This set does not replace testing. It does filter out projects where testing would be wasted time, and it does so before anyone starts building an integration on top. Signals sometimes conflict, and then the layer the component is meant for decides, as described below.

Popularity says nothing about fit. A ranking knows nothing about document volumes, latency requirements, the language of the data or the fact that the documents in question are scanned PDFs in Polish. The statistically strongest project is sometimes oversized for the task, or missing the one capability that decides the case at hand.

Layers differ in the cost of being wrong

That sets the order of decisions. The model serving layer is comparatively cheap to swap, because the interfaces have converged on a near-standard and migrating between engines takes days. The agent and workflow orchestration layer is the most expensive to swap, because it permeates business logic and team habits. Where the cost of change is high, a conservative and well-tested choice pays back faster than a fashionable one. Where the cost of change is low, experimenting with younger projects is entirely reasonable. The same weakness means different things depending on how expensive it would be to reverse the decision.

Open source components inside an AI system fall under the same documentation regime as the rest of the solution, including obligations arising from the EU AI Act.

Footnotes

1. Public star counters on the repositories: OpenClaw, React, n8n, Dify, Microsoft AutoGen, Microsoft Agent Framework. ↩ ↩² ↩³ ↩⁴