Here is today’s look at what developers are starring on GitHub, plus the latest product updates from the GitHub changelog. Star counts below are exactly as shown on GitHub Trending and its language pages (Python, JavaScript, TypeScript, PHP) on the evening of 13 November 2026 (IST). They change every hour, so expect different numbers when you click through.

The big theme: tools that make agents cheaper and safer

Agent skills and plugins still dominate Trending, but today’s most interesting entries are about the plumbing around agents: reviewing the code they write, shrinking what they read, and giving them real devices and video tools to work with. Alongside that, a networking tool from Tailscale and a self-hosted invoicing app show that classic developer tools still get attention.

Trending repositories

1. alibaba/open-code-review

A code review tool from Alibaba with a hybrid design: deterministic pipelines plus an LLM agent. Its description promises precise line-level comments and a built-in multi-language ruleset covering issues such as null pointer exceptions, thread safety, XSS and SQL injection, and it works with OpenAI- and Anthropic-compatible APIs.

  • Language: Go
  • Stars: 50,318 (206 today)
  • Why devs care: pure-LLM reviewers are noisy. Pairing fixed rules with an agent is a practical way to get fewer, more targeted comments on pull requests, and it is self-hostable.

2. headroomlabs-ai/headroom

Compresses tool outputs, logs, files and RAG chunks before they reach the LLM. The project claims 20% fewer tokens for coding agents and 60-95% fewer for JSON with the same answers, and it ships as a library, a proxy and an MCP server.

  • Language: Python
  • Stars: 79,556 (125 today)
  • Why devs care: context is the main cost of running agents. A proxy that trims bulky tool output can cut bills without changing your agent code. Measure the savings on your own workloads rather than relying on the headline numbers.

3. tailscale/tailcat

Described as “like netcat, but over Tailscale’s data plane, without Tailscale’s control plane”. In other words, a small tool for piping data between machines over Tailscale’s encrypted transport.

  • Language: Go
  • Stars: 9,286 (173 today)
  • Why devs care: netcat is one of the most used debugging tools in networking. A version built on WireGuard-based Tailscale transport is interesting for quick, encrypted transfers and for anyone curious about how Tailscale’s data plane works.

4. a2ui-project/a2ui

An open-source generative UI framework: agents stream layout data, and apps render it with native components in React, Angular, Lit, Flutter, SwiftUI and Jetpack Compose.

  • Language: TypeScript
  • Stars: 17,288 (121 today)
  • Why devs care: instead of an agent replying with a wall of text or raw HTML, it sends structured layout that your app renders with its own components. That keeps your design system and accessibility in control. It pairs well with today’s Vercel UI SDK news if you are exploring agent-built interfaces.

5. kajisho5/ffmpeg-skill

A local video editor for coding agents: 42 FFmpeg tools with a machine-readable contract and an MCP server, for Claude Code, Cursor and Codex. It covers cuts, captions, reframing, loudness and platform exports, with no cloud and no API keys.

  • Language: Python
  • Stars: 5,394 (224 today)
  • Why devs care: FFmpeg is powerful but its flags are hard to remember. Wrapping common edits as typed tools lets an agent do reliable video chores, such as exporting a vertical Short from a landscape recording, on your own machine.

6. callstack/agent-device

An open-source device layer for AI coding agents from Callstack: a CLI, an MCP server and a typed Node.js API to control mobile, web, TV and desktop apps on devices and simulators, locally or in the cloud.

  • Language: TypeScript
  • Stars: 5,371 (26 today)
  • Why devs care: browser automation for agents is common, but mobile apps have been harder. A single API across iOS and Android simulators makes it easier for an agent to actually run and check the React Native or native app it just changed.

7. InvoiceShelf/InvoiceShelf

An open source invoicing solution for individuals and businesses, and today’s fastest riser on the PHP Trending page.

  • Language: PHP
  • Stars: 1,979 (75 today)
  • Why devs care: freelancers and small agencies often pay monthly for invoicing SaaS. A self-hosted PHP app is easy to run on the same cheap hosting many PHP developers already have, and it is a readable real-world codebase to learn from.

GitHub changelog: what shipped in the last day

Manage AI Scan for repositories with the REST API (13 Nov)

Code scanning’s AI Scan for repositories can now be turned on or off with the REST API at organization and repository level, in public preview. A new repository_scan setting joins the existing pr_scan setting on GET/PATCH /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan. Organization settings are inherited by repositories, enterprise policy can block it with a 422, and enabling it does not start a scan by itself; scans still run on demand and consume GitHub Code Security AI credits. (changelog)

Actions ends ARM32 support on hosted runners (12 Nov)

GitHub Actions hosted runners will stop supporting ARM32 job execution on Windows and Linux by 8 December 2026, following the end of support for node20, since Node 24 does not support ARM32. If you build for 32-bit ARM, plan to move those jobs to self-hosted runners or cross-compile on 64-bit runners. (changelog)

Secret scanning detects Cloudflare service tokens (12 Nov)

Secret scanning now detects Cloudflare Access service tokens (cloudflare_access_service_token). If you have ever committed one, expect an alert. (changelog)

Direct links for public monitoring alerts (12 Nov)

For GitHub Enterprise Cloud customers with Secret Protection or Advanced Security, each public monitoring alert now has its own URL you can bookmark or share with teammates who have access. (changelog)

How to use this list

  • Running agents in production? Look at headroom for token costs and open-code-review for safer automated reviews.
  • Building mobile or media apps with agents? agent-device and ffmpeg-skill give agents real tools instead of guesswork.
  • Maintaining CI? Check for ARM32 jobs before 8 December.

Takeaway

Today’s Trending page is less about new chatbots and more about the infrastructure that makes agents practical: compression, review, devices, media and structured UI. Star a couple of these, read their READMEs critically, and try one on a side project before it lands in your main workflow. See you in tomorrow’s roundup.