AI Agent Ecosystem Intelligence
For DevRel, ecosystem and partnership teams. Basis: 2,165 new GitHub repositories from 14 agent-related queries, filtered to 151 substantive projects; 865 existing projects for momentum; 1,392 npm packages with download counts. Public APIs only. Stars are attention snapshots as of 3 September, never growth rates. Method and limits at the end.
What visibly changed
One vendor launch reshaped the category: DeepSeek's plugin-first harness (DSH), released 13 August, spawned 41 satellite projects among the 151 most substantive newcomers, eleven of them shells for the same CLI. Outside that wave, the most-starred new repositories are not software but skill packs, Markdown files that change how coding agents behave, one published by JetBrains. On npm, MCP is splitting into a commodity layer (hundreds of single-service servers, median 6,800 downloads a month) and a plumbing layer (remote proxies, installers, agent-environment detectors) with millions. Coding-agent GUIs kept multiplying with near-identical features. Verification of agent output stays almost absent from new projects while three unrelated signals point at demand for it.
Observation, evidence, meaning, action
An ecosystem can form in three weeks, and it forms through satellites, not registries
41 of 151 filtered newcomers (27 %) are plugins, shells, bridges or catalogues for one harness: 11 desktop, mobile or terminal shells, 3 catalogues, 3 vision add-ons, 3 provider bridges (consumer ChatGPT, Claude or Grok subscriptions as providers; a rival harness’s extensions running unmodified), 1 bridge to nine chat platforms.
Two satellites already have 53 and 57 contributors and 22 and 24 releases. The host’s official skill package: 1.43 M npm downloads a month; 17 third-party satellite packages on npm: 44 k combined. A catalogue inside the ecosystem counts about 1,950 plugin repositories (its own figure).
Distribution runs through the host’s plugin mechanism and a GitHub topic, not through npm. The first partners to appear make the host usable elsewhere: shells, bridges, catalogues. Compatibility layers to a rival ecosystem arrived within two weeks.
Platform owners: ship plugin topic, official catalogue and reference shell as launch deliverables. Tool vendors: a plugin for a fast-forming host is a weeks-scale decision; bridges out of your ecosystem will appear whether you build them or not.
A middle layer is forming between the MCP protocol and agent products
Two organisations (the MCP project and Vercel) hold 72 % of downloads across 916 sampled packages; the top 50 hold 95 %; 256 packages are single-service servers around a 6,800 median.
Downloads concentrate in access and install plumbing: remote proxy 4.9 M, HTTP handler 3.6 M, stdio-to-HTTP gateway 689 k, self-hosted gateway 345 k, installers 7.9 M and 614 k, “am I inside an agent” detectors 13.8 M and 8.0 M. The TypeScript SDK split into core, client and server at 2.0 on 27 July; the 1.x monolith still carries 204 M downloads.
“MCP-compatible” no longer differentiates. Visibility depends on working through the proxies and installers developers actually use, and on behaving well when a library detects an agent environment.
Test your server through the two leading installers and the remote proxy; add agent-environment detection to CLI output; schedule the SDK 2.0 migration before the long tail forces it.
SKILL.md is becoming a packaging format for agent capabilities (not yet a standard)
3 of the 16 most-starred newcomers are skill packs; 32 of 151 are skill-labelled. Seven behaviour-correction skills (anti-laziness, anti-slop, scope-creep guards, token efficiency, commit gates) hold about 8,000 stars combined; one is JetBrains’ with a measured cost claim.
The largest skill/MCP installer: 7.9 M downloads a month; at least ten competitors between 3 k and 614 k. Adoption lags attention: one skill with 976 stars shows 1,683 downloads.
Developers increasingly reach agents through instruction files rather than SDKs. A platform without a first-party skill pack is absent from this channel, which still has no shared versioning, provenance or trust model.
Publish official skills, get listed in the leading installers and catalogues, measure downloads rather than stars.
Coding-agent workspaces are saturating; differentiation moved to team surfaces
70 of 151 newcomers match the shell/orchestrator pattern; at least 15 are new GUIs. Incumbents at 29 k to 131 k stars ship the same four features: parallel sessions, worktrees, approval UI, mobile remote.
Two incumbents’ commits are slowing (one from 1,248 to 253 in four weeks). The newcomers with real team signals are team-chat or shared-workspace products: 25 contributors and 10 releases in 17 days; 30 contributors; an established frontend vendor entering with governance framing.
Partnering with a single-user GUI buys little reach. Team surfaces that bring their own harness (“your Claude Code or Codex as the brain”) are the integration targets with growth.
Deprioritise GUI partnerships unless the GUI owns a distribution channel; prioritise team-collab surfaces and harness runtimes with release cadence.
Where the families stand
DSH satellite ecosystem; skill packs; MCP access plumbing; team-collaboration agent surfaces
coding-agent GUIs and orchestrators; single-service MCP servers; agent memory (89 npm packages, incumbents 30 k to 93 k stars); web access for agents (incumbents 29 k to 112 k stars)
agent-native primitives (email inbox per agent 439 k downloads, Postgres layer with 26 releases, device control 545 k, agent-env detection 13.8 M); model-cost arbitrage and routing; security and reverse-engineering agents; a Chinese-language short-drama vertical
verification, evaluation, observability (4 of 151 new repos; under 1 M npm downloads combined); agent payments and commerce (one vendor blueprint; 238 k downloads across 32 packages); cross-harness governance (vendor-supplied, 1 to 4 contributors each)
Seven families to watch
Chosen for strategic relevance, not size. Sources are GitHub repository paths and npm package names.
- 01
DSH satellite layer (family)
whatShells for every OS, three catalogues, provider and IM bridges, a compatibility layer to Pi extensions.
whyFastest observed plugin-ecosystem formation; shows what partners build first.
relationshipPlugin target for tool vendors, attention competitor for harness vendors.
deepseek-ai/deepseek-harnessomdsh-dev/DSH-better-sidebarccch1mneyyy/dsh-TUIleenkcool/Blue-Whale-Harnessweijiafu14/pi2dsh - 02
Harness and provider bridges (family)
whatA self-hosted unified interface for agent harnesses (654 stars, 11 releases, organisation-owned); a bridge using consumer subscriptions as providers; ChatGPT planning while Codex executes (2,333 stars in six days).
whyInterop is being built by third parties; your harness may be bridged into another ecosystem without you.
relationshipMonitor, possibly co-opt.
HarnessRouter/harnessrouterV1ki/dsh-plugin-subscriptionsXiaoDuoYa/codex-with-chatgpt - 03
Skill and MCP installers and catalogues (family)
whatagent-install 7.9 M, add-mcp 614 k, skillfish, openskills, axm.sh; a 125-skill pack (1,143 stars); the vendor-run plugin directory (35,858 stars).
whyChoke points of the skill channel.
relationshipGet listed, test compatibility.
npm: agent-installnpm: add-mcpnpm: skillfishnpm: openskillsnpm: axm.shcbrock84/headcountanthropics/claude-plugins-official - 04
Team-collaboration surfaces
whatCumora (3,444 stars, 25 contributors, 10 releases in 17 days; BYO Claude Code/Codex), Lody (868, 30 contributors; share coding agents with a team), OpenBot by CopilotKit (4,023, 22 contributors; agents with their own computer, actions decided before and logged after).
whyWhere agents meet teams and BYO-harness makes your product the brain.
relationshipIntegration target.
yetone/cumoraLodyAI/LodyCopilotKit/OpenBot - 05
Agent-native primitives (family)
whatEmail inbox per agent (truespar/sentio, 5 releases; npm agentmail 439 k), Postgres for agents (pgrundev/pgbot, 26 releases in three weeks), phone control (ShawnPana/phone-harness, 2,268 stars; npm agent-device 545 k), env detection (npm @vercel/detect-agent 13.8 M).
whyEach defines “agent-ready” for one infrastructure surface.
relationshipInfrastructure partners; checklist for your own readiness.
truespar/sentionpm: agentmailpgrundev/pgbotShawnPana/phone-harnessnpm: agent-devicenpm: @vercel/detect-agent - 06
Verification newcomers (family)
what2akouwu/reverify (672 stars in three days; results checked against the binary), azrtydxb/procoder (commit gate), tanishqkancharla/calldiff (call-stack diffs for agentic review), npm dsh-verify, npm agent-inspect (24 k).
whyThe thin supply side of this issue’s largest gap.
relationshipEarly partners for a quality narrative.
2akouwu/reverifyazrtydxb/procodertanishqkancharla/calldiffnpm: dsh-verifynpm: agent-inspect - 07
Fast-moving harnesses (momentum)
whatcode-yeongyu/oh-my-openagent (68,600 stars; releases 36 vs 14 in the prior 30 days; commits 2,769 vs 1,706) and esengine/DeepSeek-Reasonix (35,400; releases 82 vs 18).
whyCadence this high outruns docs and breaks integrations.
relationshipNeeds a maintained adapter, not a one-off.
code-yeongyu/oh-my-openagentesengine/DeepSeek-Reasonix
Two gaps, evidence separated from interpretation
Verification and quality of agent output is under-supplied relative to demand signals
(a) about 8,000 stars on skills that exist because agents cut corners; (b) security newcomers selling “checked against ground truth”; (c) small, specific npm quality gates and trajectory testers; (d) 4 of 151 new repos and under 1 M npm downloads in evaluation and observability.
Creation and orchestration are crowded, independent verification is not; a quality narrative is currently cheap for a platform to own.
Verification may collapse into CI plus better prompts; the demand signals are indirect.
The skill and plugin channel has no trust or provenance layer
Ten-plus installers with no shared versioning; a roughly 1,950-repo plugin ecosystem with three competing catalogues in three weeks; an MCP security scanner and CI gate appeared on npm; a curated vendor directory draws 35,858 stars.
Cross-harness discovery, versioning and safety for skills is an open surface because every harness vendor prefers its own directory.
GitHub plus vendor directories may be good enough until an incident forces the issue.
Five questions the next issue must answer
- 1.Satellite survival
How many of the 41 DSH satellites still push commits in 30 days; whether the two 50-contributor satellites keep growing. Ecosystem or wave?
- 2.Newcomer-to-momentum transitions
Whether Cumora, Moli, Rakazo and pgbot keep release cadence and land on npm with real downloads.
- 3.SDK 2.0 crossover
@modelcontextprotocol/core and client (13.9 M and 9.8 M) against the 1.x monolith (204 M). The crossover is the day the long tail must move.
- 4.Installer concentration
Whether agent-install stays an order of magnitude above add-mcp and whether any catalogue or scanner bundles provenance. Where G2 opens or closes.
- 5.Verification supply
Whether any verification newcomer crosses 150 stars or 10 k downloads, and whether governance repos gain more than four contributors. If neither moves, G1 stays open.
Method and limits
GitHub REST API, npm registry and download counts, PyPI RSS; window 4 Aug to 3 Sep 2026; 14 queries, top 200 by stars each, nine filters (no forks or archives, description, code volume, language, pushed within 10 days, at least 150 stars). Momentum covers only the 106 most-starred existing projects. No star history; commit counts can be inflated by agent-authored commits; 474 scoped npm packages lack download values (rate limit). No Product Hunt or Hacker News data, no personal data, no README or code content reproduced, no claim of complete coverage.