Data-backed guides and comparisons for choosing open-source AI agents, coding agents, frameworks, guardrails, memory systems, and agent infrastructure.
24 of the 30 most-starred AI agents ship with no build provenance. Here's the full list, the six that get it right, and why stars are the wrong way to choose an agent.
Read article →Q3 2026 across 1699 tracked agents: 1384 new listings, MCP-implemented servers 104 → 1061, build provenance 48 → 400, from 90 daily registry snapshots.
Read report →Q2 2026 across 319 tracked agents: 278 new listings, MCP-implemented servers 66 → 104, build provenance 15 → 48, from 39 daily registry snapshots.
Read report →Week 41: 103 trust-score gains, 45 declines, 37 new listings, 12 provenance and 6 MCP additions across 1742 tracked agents.
Read snapshot →Week 40: 96 trust-score gains, 55 declines, 32 new listings, 5 provenance and 4 MCP additions across 1705 tracked agents.
Read snapshot →Week 39: 136 trust-score gains, 37 declines, 0 new listings, 4 provenance and 1 MCP additions across 1673 tracked agents.
Read snapshot →Week 38: 90 trust-score gains, 40 declines, 0 new listings, 5 provenance and 3 MCP additions across 1679 tracked agents.
Read snapshot →Week 37: 223 trust-score gains, 49 declines, 30 new listings, 4 provenance and 2 MCP additions across 1679 tracked agents.
Read snapshot →Week 36: 645 trust-score gains, 45 declines, 4 new listings, 19 provenance and 12 MCP additions across 1649 tracked agents.
Read snapshot →Week 35: 613 trust-score gains, 10 declines, 178 new listings, 2 provenance and 1 MCP additions across 1645 tracked agents.
Read snapshot →Week 34: 29 trust-score gains, 53 declines, 0 new listings, 1 provenance and 1 MCP additions across 1467 tracked agents.
Read snapshot →Week 33: 29 trust-score gains, 11 declines, 263 new listings, 1 provenance and 2 MCP additions across 1467 tracked agents.
Read snapshot →Week 32: 56 trust-score gains, 5 declines, 763 new listings, 0 provenance and 5 MCP additions across 1204 tracked agents.
Read snapshot →Week 31: 12 trust-score gains, 2 declines, 23 new listings, 1 provenance and 0 MCP additions across 441 tracked agents.
Read snapshot →Week 30: 10 trust-score gains, 2 declines, 0 new listings, 0 provenance and 0 MCP additions across 418 tracked agents.
Read snapshot →Week 29: 27 trust-score gains, 7 declines, 70 new listings, 6 provenance and 20 MCP additions across 418 tracked agents.
Read snapshot →Week 28: 6 trust-score gains, 4 declines, 33 new listings, 0 provenance and 0 MCP additions across 348 tracked agents.
Read snapshot →Week 27: 20 trust-score gains, 91 declines, 2 new listings, 1 provenance and 1 MCP additions across 319 tracked agents.
Read snapshot →Week 26: 60 trust-score gains, 1 declines, 17 new listings, 0 provenance and 1 MCP additions across 317 tracked agents.
Read snapshot →Week 25: 24 trust-score gains, 18 declines, 78 new listings, 0 provenance and 1 MCP additions across 300 tracked agents.
Read snapshot →Week 24: 18 trust-score gains, 6 declines, 27 new listings, 1 provenance and 3 MCP additions across 223 tracked agents.
Read snapshot →Week 23: 40 trust-score gains, 4 declines, 29 new listings, 6 provenance and 98 MCP additions across 204 tracked agents.
Read snapshot →Week 22: 79 trust-score gains, 0 declines, 113 new listings, 1 provenance and 0 MCP additions across 192 tracked agents.
Read snapshot →30% of servers in the official MCP registry have no public source code: 22% are a bare URL, and 1 in 5 declared repositories doesn't exist. Only 0.9% have a public OpenSSF Scorecard. Data and method included.
Read article →Haystack is #1 of 1,328 tracked projects and Grade A on every day of the last 90. Where its 96.5 comes from, the gaps that remain, and why it publishes the badge.
Read article →We found and fixed a build-loop bug that let the bounded runtime adjustment compound across builds and inflate scores. Here's what happened, the v4.2 fix that de-inflated the board, and a new evidence-coverage grade that keeps thin evidence visible next to every number.
Read article →Verify checks one project deep. Scan runs the same trust engine over your whole requirements.txt, package.json, or MCP config — a verdict for every agent, framework, and server in one pass, plus your stack's average HVTrust.
Read article →Our public trust registry is now an MCP server. Point any MCP client at hvtracker.net/mcp and your agent can verify any server, package, or agent before it connects — three read-only tools, no auth, open verdict.
Read article →We graded 272 open-source AI agents on supply-chain trust. Only 13% earn an A; 43% land at D. 17% publish provenance, the median OSSF Scorecard is 5.3/10. The full state of the ecosystem.
Read article →45% of the agents we track now implement or declare an MCP server — and 76% of them ship no build provenance. As MCP tool-poisoning becomes the top 2026 attack, here's who you can verify.
Read article →The 2026 TrapDoor campaign weaponized three registries at once and planted hidden instructions in CLAUDE.md. Build provenance detects exactly this — and 83% of AI agents don't publish it.
Read article →HVTracker v3.2 adds public runtime-trust discovery and an experimental score lab. See how the current top 10 would move under the first calibration.
Read article →122 million weekly downloads, zero proof the package matches the source code. 83% of AI agents ship without build provenance. Here's what sits in the gap.
Read article →GitHub stars measure popularity, not trustworthiness. Here are the evidence-based signals that actually help evaluate whether an open-source AI agent is safe to adopt.
Read article →375k stars, 184k stars, 167k stars — and zero build provenance. We checked the 10 most-starred AI agents. Eight ship without any package attestation.
Read article →Claude Code has more stars. Codex ranks dramatically higher on HVTracker. The gap comes from provenance, signed commits, and public verifiability.
Read article →opencode (167k stars) ranks #127. GPT Pilot has 1% signed commits. Only one coding agent cracks the global top 10.
Read article →LangGraph #1, AutoGPT #39, LlamaIndex #126, smolagents #138. Stars don't tell this story — provenance, scorecards, and signed commits do.
Read article →Cline and ECC lead coding agents. Compare HVTrust 91.7 vs 90.4, evidence grades, safety signals, and maintenance.
Read comparison →Haystack and LangGraph lead agent frameworks. Compare HVTrust 96.6 vs 94.3, evidence grades, safety signals, and maintenance.
Read comparison →n8n and Botpress lead workflow platforms. Compare HVTrust 91.4 vs 87.1, evidence grades, safety signals, and maintenance.
Read comparison →agent-device and OpenClaw lead browser & computer use. Compare HVTrust 91.8 vs 90.3, evidence grades, safety signals, and maintenance.
Read comparison →OpenViking and ReMe lead memory & knowledge. Compare HVTrust 88.3 vs 87.8, evidence grades, safety signals, and maintenance.
Read comparison →Docling and Firecrawl lead research & data. Compare HVTrust 89.6 vs 88.4, evidence grades, safety signals, and maintenance.
Read comparison →Promptfoo and MLflow lead observability & evaluation. Compare HVTrust 92.1 vs 89.6, evidence grades, safety signals, and maintenance.
Read comparison →REA and HOL Guard lead security & guardrails. Compare HVTrust 92.0 vs 91.6, evidence grades, safety signals, and maintenance.
Read comparison →MCP TypeScript SDK and MCP Python SDK lead protocols & tool integration. Compare HVTrust 94.7 vs 94.0, evidence grades, safety signals, and maintenance.
Read comparison →Mobile MCP and Playwright MCP lead mcp servers. Compare HVTrust 92.2 vs 91.5, evidence grades, safety signals, and maintenance.
Read comparison →LiveKit Agents and Qwen Audio Agent lead voice & conversational. Compare HVTrust 92.6 vs 86.2, evidence grades, safety signals, and maintenance.
Read comparison →BoxLite and E2B lead sandboxes & runtimes. Compare HVTrust 85.1 vs 77.8, evidence grades, safety signals, and maintenance.
Read comparison →LeRobot and Habitat-Lab lead robotics & embodied. Compare HVTrust 90.0 vs 43.3, evidence grades, safety signals, and maintenance.
Read comparison →Bifrost and vLLM lead llm gateways & infra. Compare HVTrust 89.8 vs 81.0, evidence grades, safety signals, and maintenance.
Read comparison →AIPass and OpenMausBot lead multi-agent systems. Compare HVTrust 85.5 vs 83.2, evidence grades, safety signals, and maintenance.
Read comparison →Neo and OpenUI lead ui & app builders. Compare HVTrust 87.8 vs 87.6, evidence grades, safety signals, and maintenance.
Read comparison →Open Code Review and OmniRoute lead agent skills. Compare HVTrust 94.7 vs 92.7, evidence grades, safety signals, and maintenance.
Read comparison →Eve and Engram lead needs review. Compare HVTrust 66.5 vs 64.7, evidence grades, safety signals, and maintenance.
Read comparison →