AI Agent GitHub Digest — 2026-09-18

Today's Highlights

Today's trending list splits into two ends. On one side, Nous Research open-sources hermes-agent, a general-purpose agent built around a closed learning loop that grows and improves its own skills. On the other, a cluster of tools shows up to patch the specific ways agents go wrong — context windows blown out by tool output, quality drift in vibe coding, and MCP itself becoming a new attack surface. Notable Releases echoes that same security thread: Pydantic AI shipped a release that fixes four security issues in one go, all reachable through web_fetch_tool or telemetry instrumentation.

Trending Repos

NousResearch/hermes-agent ⭐ 246,468

GitHub　·　Python　·　MIT

• What it is: Nous Research's open-source "self-improving" agent — CLI and TUI both included — built around a closed learning loop: it generates skills from real tasks, those skills improve with use, it searches its own past conversations with FTS5, and it builds a persistent model of who you are across sessions.
• Why it matters: Most agent frameworks bolt memory on as an external vector database; hermes-agent writes learning straight into the main loop — skills are auto-generated after completing complex tasks and are compatible with the open agentskills.io standard, making "gets better at understanding you" the core pitch rather than a bolt-on feature. Its execution environment is also pluggable: seven terminal backends (local, Docker, SSH, Singularity, Modal, Daytona, Vercel Sandbox), with Modal and Daytona offering near-zero cost when idle — the agent can live in the cloud on standby instead of being tied to your laptop.
• Tech stack: Python + multiple terminal backends (local / Docker / SSH / Singularity / Modal / Daytona / Vercel Sandbox) + a gateway spanning Telegram, Discord, Slack, WhatsApp, and Signal
• Getting started: Easy — curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash and you're done; switching models is just hermes model, no code changes needed.

mksglu/context-mode ⭐ 23,362

GitHub　·　TypeScript　·　ELv2

• What it is: A context-window optimization layer for coding agents that intercepts at the MCP protocol layer and via hooks — sandboxing tool output, persisting session memory, and enforcing routing across 17 platforms, with a claimed 98% reduction in tool output size.
• Why it matters: It targets a very specific and common pain point — a single Playwright snapshot can cost 56 KB of context, 20 GitHub issues cost 59 KB, and after 30 minutes 40% of the context window is gone, with the agent forgetting what files it was editing once it compacts the conversation. context-mode intercepts at the MCP protocol layer so raw data stays in a sandboxed subprocess and never enters the context window — a project that reached #1 on Hacker News, suggesting context management is becoming its own discipline separate from raw model capability.
• Tech stack: TypeScript + MCP protocol-layer interception + pre/post-tool-use hooks (enforcement level varies by platform)
• Getting started: Easy to moderate — installs as an npm-based MCP server, but hook enforcement strength differs by harness; some platforms like Zed rely only on a weakly-enforced AGENTS.md convention, at roughly 60% compliance.

shinthink/blitzstrike ⭐ 634

GitHub　·　TypeScript　·　MIT

• What it is: A universal MCP penetration-testing toolbelt that packages a standard recon-analyze-validate methodology into three server-side tool tiers: BLITZ maps the attack surface, EAGLE-EYE traces source-to-sink data flow, and STRIKE performs live verification before anything is reported.
• Why it matters: It targets the two most common failure modes in automated security scanning — false positives from surface-level pattern matching, and findings reported without ever being confirmed live. Its core principle is that a scan hit is a hypothesis, not a verdict, and a single run_engagement call can drive the full pipeline from any MCP client (Claude Code, Cursor, Gemini, and others) — built for authorized penetration testing and red-team engagements.
• Tech stack: TypeScript / Bun + the MCP TypeScript SDK, compiled into a single binary via bun build --compile
• Getting started: Easy — npx blitzstrike install auto-detects and registers with every agent CLI already on your machine.

pliablepixels/gap-trap ⭐ 164

GitHub　·　Shell　·　MIT

• What it is: A Claude/Codex skill that reads your repository, writes rules tailored to that codebase, and attaches a CI gate to each rule so the agent can't skip past it.
• Why it matters: It names very specific agent failure modes — writing a helper that already exists, crossing a layer boundary because a shortcut happened to compile, writing a test that asserts the code ran rather than that it did the right thing, and forgetting a rule from the instructions file after a week. Instead of adding more text rules, gap-trap installs four concrete mechanisms: contracts (the one right way to do things per module), proven-red CI (a new test must first fail against the old code, proving it actually tests something), ratchets (known-problem counts that can only go down), and playbooks (hard-learned lessons written down so the next session doesn't relearn them).
• Tech stack: Language-agnostic — Node and Python repos get gates inside their native test suites; everything else (Go, Rust, Java, Ruby, .NET, PHP, Swift, C++) gets shell-based gates that only need git, grep, and awk
• Getting started: Moderate — npx skills add pliablepixels/gap-trap generates the rules automatically, but the author is explicit that you need to review every generated rule before trusting it — that step isn't optional.

Notable Releases

Pydantic AI v2.44.0

Release Notes

• Key changes: Fixes four security issues in one release, all reachable through web_fetch_tool or OpenTelemetry instrumentation — (1) an IPv6 zone identifier could bypass the cloud-metadata/private-IP blocklist (moderate); (2) web_fetch processed responses in superlinear time during HTML conversion and charset decoding, so a single attacker-chosen page could stall every agent in the process (moderate, DoS); (3) domain blocklists were compared against the raw spelling rather than the resolver's normalized form, so a differently-spelled domain could slip past a block (low); (4) with include_content=False set, spans still carried exceptions, error statuses, instructions, and the output template (low, data leakage).
• Breaking changes: None at the API level; the fix ships on two version lines — v2 in 2.44.0, v1 in 1.107.6.
• What it means for you: If your agent uses web_fetch_tool or has OpenTelemetry instrumentation turned on, upgrade — the DoS issue sits on a default code path, and the include_content=False bug is the kind of "you thought this was off but it wasn't" gap worth prioritizing.

CrewAI 1.15.22

Release Notes

• Key changes: Adds an llm_overlay context variable to dynamically route different agent roles to different models; deeper CrewAI Platform integration — deployment failure reasons are now recorded, platform tools are wired into the JSON crew wizard, and an application catalog is exposed; OpenRouter is added as a supported embedding provider.
• Breaking changes: None.
• What it means for you: llm_overlay is a direct cost win if you want secondary agents on cheaper models while your primary agent stays on a premium one; if you deploy through CrewAI Platform, the new failure-reason logging saves real debugging time.

Today's Takeaway

I used to think the "give agents memory" race was mostly about who has the smarter vector retrieval, but hermes-agent is a reminder that the execution environment itself can be a pluggable asset — seven terminal backends, near-zero cost when idle on serverless, meaning the agent no longer has to live on your laptop; it can be a standing service that packs up and moves. The same day, the four issues Pydantic AI patched point at another underrated attack surface: it's rarely the model itself that's the weak point — it's the web_fetch tool the agent uses to read the web.

References

• NousResearch/hermes-agent — GitHub
• hermes-agent README (self-improving learning loop, seven terminal backends)
• mksglu/context-mode — GitHub
• context-mode README (MCP protocol-layer interception, 98% output reduction)
• shinthink/blitzstrike — GitHub
• pliablepixels/gap-trap — GitHub
• Pydantic AI v2.44.0 Release Notes
• CrewAI 1.15.22 Release Notes
• GitHub Trending (Daily, captured 2026-09-18)