Open source frameworks for building AI agents: multi-agent orchestration, tool calling, and autonomous workflows.
Ranked by Discovery Score — our 0-100 composite of adoption, maintenance, community, and license health. How scoring works.
By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.
LangChain is the glue layer for LLM apps: one standard interface for models, vector stores and tools, plus create_agent, a small harness that builds an agent from a model, tools and a prompt. Swap OpenAI for Anthropic or local Ollama without a rewrite. LangChain, LangGraph and Deep Agents are all MIT and free.
There's nothing to host. uv add langchain and you're writing code. The ops work is upgrades: patches can land a few times a week, though since 1.0 breaking changes wait for major versions. Still on 0.3? Its maintenance window closes in December 2026.
The paywall is LangSmith, their hosted tracing, evals and deployment platform. Developer is free for one seat and 5k traces a month. Plus is $39 per seat per month with 10k traces, then usage billing. Self-hosted LangSmith is Enterprise only. Solo: free. Small teams: Plus, or send traces to Langfuse instead. Large teams: Enterprise for SSO or self-hosting.
The catch: a single chat call is simpler with the provider SDK, and when a chain misbehaves you debug LangChain's internals. Security too. langchain-core has shipped a steady run of advisories, including a critical serialization bug that could leak secrets (CVE-2025-68664). Pin versions and patch fast.
The framework is free under MIT. LangSmith is free for one seat and 5k traces a month; teams pay $39 per seat per month plus 0.005 LSU ($1 each) per trace past the 10k allowance.
**Free:** The framework is MIT with no feature gates: `langchain`, `langchain-core`, LangGraph, Deep Agents and the partner integration packages (OpenAI, Anthropic, Ollama, Groq, Mistral and more). LangSmith Developer plan: $0 for 1 seat, up to 5k base traces a month, community support, plus small monthly allowances for Fleet (7 LSU) and Sandboxes (8 LSU). **Self-hosted:** The framework is a library that runs inside your own process, so there's no server to run; you pay your model provider directly. Self-hosted or hybrid LangSmith is only available on Enterprise. Open source tracing alternatives such as Langfuse and Arize Phoenix plug into LangChain if you want observability without a LangSmith bill. **Paid:** LangSmith Plus is $39 per seat per month (unlimited seats, billed monthly, self-serve) with 10k base traces a month included, then pay-as-you-go at 0.005 LSU per extra base trace, where 1 LSU = $1. Base traces keep 14 days of history; extended traces keep 180 days for an extra fee. Plus also includes 1 free small serverless agent deployment, with further deployments metered by compute and memory. Enterprise is custom priced, invoiced annually, and adds custom SSO, ABAC/RBAC, a support SLA and cloud, hybrid or self-hosted LangSmith. VC-backed startups can get up to $10,000 in credits.
NemoClaw runs OpenClaw (the open source coding agent) inside NVIDIA's OpenShell sandbox with managed inference, solving the real security risk of agents executing arbitrary code on your machine. Your agent gets GPU-accelerated model inference through NVIDIA's infrastructure while staying sandboxed. This is NVIDIA saying 'run your coding agents on our hardware, securely.' You get the performance of NVIDIA GPUs for inference without managing the infrastructure yourself. The sandbox prevents the agent from doing anything destructive to your system. Apache 2.0 licensed. The catch: this ties you to NVIDIA's ecosystem. You need NVIDIA hardware or their cloud infrastructure, no running this on Apple Silicon or AMD GPUs. It's OpenClaw-specific, so Claude Code and Cursor users are out. And 'managed inference' is a gateway to NVIDIA's paid compute. The tool is free but the GPU time may not be.
Tool is free. GPU compute costs depend on whether you self-host or use NVIDIA's cloud.
Open source under Apache 2.0. The NemoClaw tool itself is free. Self-hosting requires NVIDIA GPUs. NVIDIA's managed inference (OpenShell) may have usage-based pricing for GPU compute; check NVIDIA's current pricing for NIM/OpenShell. Self-hosted: free if you already own NVIDIA hardware. Managed: likely usage-based GPU pricing through NVIDIA's platform.
DeerFlow is ByteDance's open source take on Manus and ChatGPT's agent mode: an agent harness that works one task for minutes or hours, researching, coding and building reports or slides. It gives the agent a sandboxed computer, persistent memory, skills and sub-agents, plus a web UI and chat bridges for Slack, Telegram, Discord and more. MIT licensed and free.
Version 2.1 shipped in September with SSO, role-based permissions and scheduled tasks. Self-hosting is real work: Python 3.12, Node 22, nginx and a make setup wizard, or Docker as the recommended path. Budget 4 vCPU and 8 GB of RAM to evaluate, 8 vCPU and 16 GB for a long-running server. Any OpenAI-compatible model API works.
Solo and small teams: free, plus tokens and hardware. Larger teams can run it multi-user, but multiple workers mean Postgres and Redis. Want orchestration as a library? LangGraph, which DeerFlow is built on, is lighter. OpenHands is the closest open comparison.
The catch: this thing runs commands. The README says it's built for a trusted local network and calls Gateway admin equivalent to code execution on the host. Expose it without auth and a firewall and you've handed strangers a shell.
Completely free and MIT licensed. Your bill is model tokens, a server with at least 8 GB of RAM, and any hosted sandbox or search API you opt into.
**Free:** Everything. MIT licensed with no paid tier, no hosted cloud and no enterprise SKU. deerflow.tech is a project site with demos and docs, not a SaaS. **Self-hosted:** The only mode. Docker is recommended (Compose v2.24+); local dev needs Python 3.12+, Node 22+, pnpm, uv and nginx. README sizing: 4 vCPU / 8 GB RAM / 20 GB SSD to evaluate, 8 vCPU / 16 GB / 40 GB as the starting point for a long-running server. SQLite is the default database; multi-worker deployments require Postgres plus the Redis stream bridge. Sandboxes run on the host, in Docker containers, on Kubernetes via a provisioner, or on third-party providers such as E2B and Tenki. **Paid:** Nothing from the project. Your bills are model tokens from whatever OpenAI-compatible provider you connect (the README pushes ByteDance Volcengine's coding plan, but it isn't required), any hosted sandbox or paid search API you opt into, and the server.
gstack is Garry Tan's Claude Code setup, open sourced by the Y Combinator CEO: 23 specialist slash commands that act like a virtual team (a CEO who rethinks the product, an eng manager who locks architecture, a designer, a reviewer, a QA lead who opens a real browser, a security officer and a release engineer), plus power tools like /office-hours, /review and /ship. All Markdown, MIT licensed. It's built for Claude Code, with experimental ports to Codex, OpenCode, Cursor, Factory, Kiro and Copilot CLI where its safety hooks are advisory rather than enforced. Install clones it into ~/.claude/skills/gstack and runs a setup script that needs Bun, and it keeps state in ~/.gstack too. Browser QA drives the Aside browser on macOS and falls back to its own Chromium. Solo founders and small teams who want an opinionated, ready-made workflow get the most here, free. Larger teams with their own conventions will mostly mine it for ideas. Telemetry stays off unless you opt in. The catch: it moves fast with no tagged releases, so your setup changes under you every time you pull. The optional GBrain setup can ask for a Supabase access token to create a project for you, so read what you're granting. And it's one person's taste, opinionated by design.
Completely free under MIT. You pay for the Claude Code usage it drives.
**Free:** Everything. MIT licensed, no hosted version, no paid tier. **Self-hosted:** Clones into ~/.claude/skills/gstack. Requires Claude Code, Git and Bun v1.0+ (plus Node.js on Windows). Keeps global state in ~/.gstack. Browser QA uses the Aside browser on macOS 15+ when present, otherwise a bundled Chromium. **Paid:** None. Costs are your Claude Code usage, plus optional third parties: a Codex CLI login for cross-model outside reviews, and Supabase if you set up GBrain.
PPT Master takes a PDF, Word doc, Markdown file, URL or pasted text and hands you back a native, editable PowerPoint: real shapes, text boxes and slide masters, not pictures of slides. A flag adds a second file with data-backed charts and tables you can open with Edit Data. Free, MIT licensed.
It's a skill, not an app: you run it inside Claude Code, Cursor or Codex with Python 3.10+ and one pip install -r requirements.txt. It can also build a template from your brand deck, refill an existing deck, add animations and narrate the speaker notes. The examples gallery holds dozens of single-pass decks, so judge first.
Solo builders and small teams turning reports into decks without a designer save hours. Larger teams with a brand group still want a human pass before anything goes external.
The catch: quality tracks the model, and the first model the README recommends, Kimi K3, comes from a paying sponsor behind an affiliate link. The README also pushes API relays advertising Claude and GPT at as little as 7% of official rates. Pick the model on merit, and keep client documents away from resellers. The optional PDF converter needs AGPL-licensed PyMuPDF.
Free. You pay only for the model tokens and image generation behind it, so choose the model on output quality, not on the README's affiliate links.
**Free:** Everything. MIT licensed, no hosted version, no paid tier. **Self-hosted:** Runs locally inside your AI agent (Claude Code, Cursor, Codex and others). Python 3.10+ plus `pip install -r requirements.txt`; Pandoc only for legacy formats like .doc, .odt and .rtf. The optional PDF input path depends on PyMuPDF, which is AGPL-3.0, worth knowing if you redistribute a bundle. Narration defaults to edge-tts, which sends your speaker notes to Microsoft's online voices. **Paid:** None from the project. Cost is the model you drive it with (tokens for content and layout) plus AI image generation if you use it, such as `gpt-image-2`. Bigger decks cost more. The project is funded by sponsor placements (from $500/month, $1,000/month for the lead slot) and PayPal or Alipay donations.
Hermes is Nous Research's open-source autonomous agent. It builds skills from experience, remembers them across sessions, and connects to Telegram, Discord, Slack, WhatsApp, Signal, and email out of the box. It drives more than 300 models through OpenRouter, OpenAI, Anthropic, Hugging Face endpoints, or Nous Research's own portal. MIT licensed.
Install is one curl command on Linux, macOS, WSL2, or Termux. After hermes setup, point it at any provider; switching models is a single CLI flag with no code changes. It runs on a $5 VPS or a GPU cluster, and releases land several times a month.
Nous now sells subscriptions alongside the free agent, which is the change worth knowing about. There is still a free tier, and the software itself has no paid edition or feature gate. The paid plans are model access: Plus at $20 a month, Super at $100, and Ultra at $200, each bundling 300+ models and the hosted tools Hermes calls into one bill instead of four provider accounts. Each tier carries a monthly credit allowance in the neighbourhood of what you pay for it. Solo builders can ignore all of it and bring an OpenRouter key. Anyone tired of managing separate provider keys has a reason to look.
The catch is that it is research-y. Nous is an AI research lab, not a SaaS company. Docs are dense, support is community-driven, and self-improving claims always come with caveats. Treat it as an experiment you are running, not a production-grade agent you are deploying.
The agent is MIT and free with no feature gates. Nous Research now sells optional model access at $20, $100 and $200 per month (Plus, Super, Ultra), each bundling 300+ models into one bill.
### Free (Open Source) - MIT licensed agent, one-command install on Linux, macOS, WSL2 or Termux - Skill accumulation across sessions, persistent memory - Built-in connectors for Telegram, Discord, Slack, WhatsApp, Signal and email - Provider-agnostic: OpenRouter, OpenAI, Anthropic, Hugging Face endpoints or a local model - No feature gates. Every capability is in the open source build - Nous Portal has a free tier if you want to try their model access without paying ### Paid Nothing for the software. Nous Research sells model access through Nous Portal, and Hermes can use it: - Plus: $20 per month. Super: $100 per month. Ultra: $200 per month - All paid tiers cover 300+ models, hosted tool use, higher rate limits and usage-cost discounts - Each tier includes a monthly credit allowance roughly equal to its price, with unused credit rolling over up to a cap. Nous does not publish the exact allowances outside the portal, so check them at signup rather than trusting a number quoted elsewhere ### Self-Hosted Costs A $5 per month VPS runs it. A dedicated box with more memory helps if you connect several messaging platforms at once. The dominant cost is inference, not hosting: an agent that acts on messages around the clock will spend far more on tokens than on the server. Local models drop that to electricity and hardware. ### When to Pay You never have to. Bring an OpenRouter key and skip the subscription entirely. Nous Portal is worth it when you would rather pay one bill than reconcile four provider accounts, or when the rate limits and usage discounts on Super or Ultra beat what you are paying retail. Do the arithmetic against your current token spend before subscribing, because the credit allowance roughly tracks the price of the plan.
MemPalace stores your AI conversation history verbatim and searches it semantically. Every Claude session, every project file, indexed locally. The structure is a metaphor: projects become wings, topics become rooms, so you can scope searches instead of querying a flat blob. It publishes 96.6% recall on LongMemEval with no LLM in the loop, and the benchmarks are reproducible from the repo. Install is pip plus pointing it at a directory. ChromaDB is the default backend, embeddings run on CPU with a 300MB model, no API key required. The MCP server exposes 29 tools so Claude Code can read and write the palace directly during a session. Solo developers using Claude Code heavily: install it. The 'wake-up' command that loads relevant context for a new session is the pitch and it works. Small teams: each engineer runs their own palace, there is no shared knowledge layer yet. The catch: it's about two weeks old. The benchmarks are real but the operational track record is not. Breaking changes will happen, and fast-growing projects attract impostor domains. The README has a scam alert for a reason.
Free and open source. Runs entirely offline if you want.
**Free and open source.** MIT license. `pip install mempalace` and you're running. ChromaDB is the default backend, all free. Embeddings run on CPU using a local model of about 300MB, no API key required. The full 96.6% recall path runs entirely offline. **Optional paid:** None from the project. If you swap in OpenAI embeddings or use an LLM for the rerank tier, you pay those providers directly. The core retrieval path has no cloud dependency. No Cloud tier, no paid version, no company behind it yet. That's a feature if you care about data control and a risk if you need support.
This is the framework that connects your code to LLMs. It handles the plumbing: talking to OpenAI/Anthropic/local models, managing conversation memory, chaining prompts together, and calling tools. What's free: Everything. MIT license, no paid tier in the library itself. LangSmith (their observability platform) has a free tier with limits. LangChain JS has become the default starting point for JS/TS AI applications. Active development, huge community. The abstractions for chains, agents, and retrieval are battle-tested. The catch: LangChain is famously over-abstracted. Simple things that take 5 lines with the OpenAI SDK directly take 20 lines through LangChain. The abstraction layers add latency and debugging complexity. If you're just calling an API and formatting the response, you don't need this. It earns its keep when you're building complex agent workflows with tool calling, retrieval-augmented generation (feeding your own documents to AI), or multi-step reasoning chains.
Library is free forever. LangSmith tracing costs $39/seat/mo when you need production observability. Your real expense is the LLM API bill.
### What's Free The entire LangChain JS library. MIT license, no restrictions. All chains, agents, retrievers, memory, and model integrations are free. ### What Costs Money (Ecosystem) - **LangSmith** (tracing/debugging): Free tier with 5,000 traces/mo. Pro at $39/mo per seat for unlimited traces. - **LangGraph Cloud** (hosted agent deployment): Pricing varies, starts around $50/mo. - **The LLM APIs you connect to**: OpenAI ($0.002-0.06/1K tokens), Anthropic (similar), etc. This is your real cost. ### The Hidden Cost LangChain's abstractions mean more tokens per request (system prompts, chain formatting). A direct API call might use 500 tokens where LangChain uses 800 for the same result. At scale, that's 60% more on your LLM bill. ### When to Pay for LangSmith When you're debugging agent behavior in production and need to see exactly what prompts were sent and what came back. The free tier is enough for development. Pay at $39/seat when you're running production agents and need full observability.
QwenPaw is a personal AI assistant you run yourself instead of renting from OpenAI. It ships with a local runtime so it works with no API key out of the box, and it also plugs into Ollama, LM Studio, and a dozen-plus cloud providers if you want bigger models. The hook is reach: it talks to you through Discord, Telegram, Lark, WeChat, DingTalk, even iMessage, and you extend what it can do with skills. It is open source under Apache-2.0, built by the team behind AgentScope, Alibaba's multi-agent framework. Self-hosting is the default here, not an afterthought. There is Docker support and a one-click path to deploy on Alibaba Cloud if you would rather not run it at home, in which case you pay for the cloud, not the software. It takes its own security seriously for a personal tool: a kernel-level sandbox, a Tool Guard, and a File Guard sit between the model and your machine, which matters once an assistant can run code and touch your files. For a solo developer or a tinkerer who wants an assistant that lives in their own chat apps and on their own hardware, this is one of the more complete self-hosted options going, and it costs nothing. Small teams can share an instance. There is no real large-team story here; it is a personal workstation, not a company-wide deployment, and that is fine. The catch is gravity. It is deep in the Alibaba and Qwen ecosystem, the docs are heavily multi-language, and a lot of the built-in channels (WeChat, DingTalk, Lark) point at a Chinese user base. None of that is a flaw, but if you expected a Western-defaults, English-first assistant, calibrate before you install.
Free and open source under Apache-2.0. You only pay if you choose cloud hosting or paid model APIs.
**Free:** Apache-2.0, the whole thing. Local runtime (no API key needed), all the chat-channel integrations, the skills system, the sandbox. **Self-hosted:** The primary way to run it. Docker locally, or one-click to Alibaba Cloud where you pay infrastructure costs, not a license. **Paid:** None for the software. Your only costs are optional: cloud hosting if you do not self-host, or API fees if you point it at paid model providers instead of the local runtime.
Supermemory is a memory and context engine for AI apps. It extracts facts from conversations and documents, keeps a profile of each user, and runs hybrid search that blends RAG with personalized recall, all behind one API. The company reports top scores on the major memory benchmarks. The main repository is MIT, and plugins exist for Claude Code, Cursor and Codex.
Running it locally is one command, npx supermemory local, which starts a single binary with the same API as the hosted platform. It works fully offline with a local model through Ollama, and your data stays on your machine. The local server is single-user and licensed for up to 10,000 documents, though, and the connectors for Google Drive, Gmail, Notion and OneDrive, plus the Supermemory MCP, only exist on the hosted platform.
Hosted pricing is published and credit-based. Free includes $5 of credits a month and pauses when they run out. Pro is $19/mo with pay-as-you-go top-ups, Max is $100/mo, and Scale at $399/mo adds S3 and web crawler connectors, unlimited seats and a self-hosted option. Teams building production memory will land on Pro or Scale.
The catch is maturity. The local server is still version 0.0.x, and one August release was an emergency patch after an upgrade silently wiped search vectors. The consumer app and browser extension were retired in September too. Build on the API, pin versions, and back up your data.
Free locally up to 10,000 documents, or with $5/mo of hosted credits. Hosted plans run $19, $100 and $399 a month.
**Free tier:** The main monorepo is MIT, the TypeScript and Python client SDKs are Apache-2.0, and plugin licenses vary. A free local server runs ingestion, memory extraction, hybrid search and the full API on your own model key or a local model, up to 10,000 documents. The hosted Free plan includes $5 of credits a month, all plugins, the full search and memory API, 1 team seat and unlimited end users, and pauses when credits run out. **Self-hosted:** Install with `curl -fsSL https://supermemory.ai/install | bash` or `npx supermemory local`. The server ships as a prebuilt binary called supermemory lite, is licensed for up to 10,000 documents with the cap enforced at the API, runs a single org with one auto-generated API key, and stores data locally. Extraction runs on whatever model you point it at, including Ollama. Connectors and the Supermemory MCP are hosted-only. Production self-hosting of the full platform is a Scale and Enterprise feature. **Paid:** Pro is $19/mo ($20 of credits, pay-as-you-go top-ups, 3 seats). Max is $100/mo ($130 of credits, Gmail connector). Scale is $399/mo ($600 of credits, S3 and web crawler connectors, unlimited seats, SOC 2, HIPAA BAA, self-hosted option). Enterprise is custom with SSO, air-gapped self-hosting and an uptime SLA. Usage bills per unique SM token: memory at $0.005 (plain text) or $0.010 (rich content) per 1K, SuperRAG at $0.001 or $0.002 per 1K, and search at $0.005 per 1K queries.
Deep Agents is LangChain's batteries-included agent harness. Where the base LangChain agent gives you a minimal loop, Deep Agents bundles the pieces you always end up building yourself: a filesystem, sub-agent delegation, context management, shell execution, persistent memory, human-approval steps, and reusable skills. It runs on any LLM that supports tool calling, MIT licensed and free.
It installs as a Python package (uv add deepagents) and one call to its create_deep_agent helper gives you a working agent with your model, tools, and prompt. Under the hood it is built on LangGraph, so you inherit streaming, persistence, and checkpointing. Running it yourself costs nothing beyond your model's token bill, and a JavaScript/TypeScript port exists too.
For a developer who wants a capable agent without wiring every subsystem by hand, this is a strong starting point at any team size. The money in the ecosystem is LangSmith for tracing and deployment: a free developer seat with 5K traces a month, then $39 per seat per month on Plus. A hosted Managed Deep Agents runtime is in private preview with no published price.
The catch is the LangChain gravity. The package installs the LangSmith client plus Anthropic and Google integrations as required dependencies, and the production path points at LangSmith. If you like the batteries, it is a fast path. If you want a thin, transparent agent loop, this is more framework than you asked for.
Free MIT framework. You pay for tokens, and for LangSmith Plus at $39 per seat per month if you want its tracing and deployment.
**Free tier:** The framework is MIT licensed with nothing held back: filesystem, sub-agents, context management, shell execution, persistent memory, human-in-the-loop approvals and skills, built on LangGraph and usable with any tool-calling model. A JavaScript/TypeScript port is also free. **Self-hosted:** Runs wherever Python 3.11+ runs. Install with `uv add deepagents`; your cost is model tokens. `langsmith`, `langchain-anthropic` and `langchain-google-genai` install as required dependencies. **Paid:** Nothing for the framework. LangSmith, LangChain's commercial platform, has a free Developer plan (1 seat, 5K base traces a month) and Plus at $39 per seat per month (10K base traces, deployment access, one free small serverless deployment), with pay-as-you-go usage beyond that. Enterprise is custom. Managed Deep Agents, a hosted runtime inside LangSmith, is in private preview.
elizaOS started as a framework for AI agents and now calls itself an agentic operating system. It's a runtime for agents that act across your chat apps, email, calendar, browser and wallet, plus a consumer Eliza app for web, desktop and mobile. It ships memory, document ingestion and connectors for Discord, Slack, Telegram, WhatsApp and X, and works with OpenAI, Anthropic, Gemini, Grok, OpenRouter or local models through Ollama. MIT licensed. Running it yourself is real work. The repo pins Node 24 and Bun, you bring model keys or run local models, and turning a demo into something reliable is a project, not an afternoon. Eliza Cloud is now the hosted route: sign-in, model routing and agent deployment, billed on credits. Its pricing sits behind a login. Solo builders who want control over their agent stack: a strong start. Teams that want a library rather than a whole runtime should look at mastra-ai/mastra or LangChain. Larger teams get the same code with no license ceiling. The catch is churn. The last stable npm release is from January, the repo's main branch is a v2 beta, and third-party plugins are no longer accepted, so older tutorials break. The official docs also carry tokenomics pages for an elizaOS crypto token.
The framework is free and MIT. Eliza Cloud hosting is credit-billed with no public price list; your real bill is LLM tokens.
**Free tier:** The framework and app code are free under MIT: agent runtime, memory, document ingestion, chat connectors, CLI and a local model registry for on-device inference. **Self-hosted:** Bring your own LLM keys or local models, and your own infrastructure. The repo pins Node 24 and Bun. The official deploy guide covers Docker, Railway and Phala (confidential compute); anything else is on you. **Paid (Eliza Cloud):** Optional hosted service for accounts, model routing and agent deployment, billed on prepaid credits. Pricing is behind a login and not published. The open-source cloud code bills running agents by the hour and passes model costs through with a platform markup, but treat those constants as indicative, not a price list. **The real cost:** LLM tokens. Every agent burns them continuously, and that bill dwarfs hosting for most setups.
OpenClaw is a personal AI assistant that runs on your own machine and answers you inside chat apps you already use: WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Teams and 20+ more. It's MIT licensed and run by the OpenClaw Foundation, a nonprofit. No paid tier, no hosted service, no token. An install script and onboarding wizard set up a background service called the Gateway. Each channel has its own login: WhatsApp links by QR code, Telegram needs a bot token, iMessage needs a Mac. A laptop works; a small VPS keeps it on around the clock. Free software, not free to run: you pay a model provider per token or sign in with a ChatGPT or Claude subscription. Solo: free on a laptop. Small teams: free on one shared Gateway. Larger teams: free, if someone owns security updates. The catch is the blast radius. Tools run directly on the host unless you turn on sandboxing, and the project has published hundreds of security advisories in under a year. Its skill marketplace, ClawHub, was hit by hundreds of malware-laced skills in early 2026. Treat every skill as code you run yourself.
The software is free with no paid tier at all. Your bill is the model, per-token API pricing or a ChatGPT or Claude subscription you already pay for, plus a small always-on server if you want it reachable 24/7.
**Free:** Everything. MIT licensed (copyright OpenClaw Foundation), stewarded by the OpenClaw Foundation, an independent 501(c)(3). The README states it "has no paid tier, hosted service, or token." The Gateway, Control UI, CLI, TUI and the macOS, iOS, Android, Windows and Linux companion apps are all included. **Self-hosted:** The only way to run it. The official install script (bash or PowerShell) provisions Node.js and starts onboarding; npm install needs Node 24.16+ or 26.1+. Docker and Nix paths are documented. The Gateway runs as a daemon on a laptop, VPS, home server or Raspberry Pi-class box. WhatsApp links as a WhatsApp Web device via QR (Baileys); iMessage needs a Mac signed into Messages, reached over SSH from a Linux Gateway. A daily update check is on by default and anonymous feature statistics are opt-in; `update.checkOnStart: false` disables both. Tools run on the host for the main session unless you configure sandboxing. **Paid:** No paid tier. Your real costs are the model (API key billed per token, or OAuth reuse of a ChatGPT/Codex login or the Claude CLI, or a local model on your own hardware) and, for always-on use, a small server.
ECC (formerly Everything Claude Code) is a big bundle of agents, skills, hooks, MCP configs and security tooling you install into Claude Code through the plugin marketplace. It covers code review, security analysis, planning, per-language reviewers, TDD workflows and even video editing. The repo is MIT licensed. It works best in Claude Code, has a supported Codex sync path, and offers capability-limited adapters for Cursor, OpenCode, Gemini, Zed, Copilot and others, so don't assume parity outside Claude. The bundle grows every release, now dozens of agents and a few hundred skills, and slash commands are being phased out in favor of skills. Install only from the official repo, npm packages or ecc.tools: the README warns third-party mirrors may carry malware. The repo is free. ECC Pro, a hosted GitHub App, is $19 per seat a month or $190 a year and adds private-repo analysis, PR-triggered config audits and deeper AgentShield scanning; Enterprise adds SSO and custom policy packs. Solo devs: install the free bundle and keep what you use. Teams that want automatic config audits on private repos: that's what Pro sells. The catch: that much surface area is a lot to audit. Hooks run automatically on editor events, and pulling in agents and skills you didn't ask for makes your setup harder to reason about. One maintainer ships it weekly across several harnesses, so expect churn.
The bundle is free under MIT. ECC Pro, the hosted GitHub App for private repos, is $19 per seat a month.
**Free:** The whole OSS bundle under MIT: agents, skills, hooks, MCP configs, install profiles. The hosted GitHub App's free tier covers public repos only, 10 analyses a month. **Self-hosted:** Nothing to host for the bundle; it installs into Claude Code (plugin ecc@ecc) or via the ecc-universal npm package. **Paid (GitHub App):** Pro $19 per active developer seat per month, or $190 a year, with 50 analyses per seat pooled, private-repo analysis, PR-triggered audits, AgentShield-backed scanning and priority support. Enterprise is contact sales: unlimited analyses, SSO-ready governance, audit logs, custom rules and policy packs, SLA.
Graphify turns a codebase, plus its docs, SQL schemas, PDFs and images, into a knowledge graph your AI coding assistant queries instead of grepping through files. Code is parsed locally with tree-sitter: no LLM, no API key, nothing leaves your machine. The CLI is Apache 2.0 and free.
Install with uv tool install graphifyy (double y; other graphify packages on PyPI aren't theirs), then graphify install adds a /graphify skill to Claude Code, Cursor, Codex and 20+ others. Docs, PDFs and images go through a model, so a docs-heavy repo costs tokens. Code alone costs nothing.
Graphify Labs now sells Graphify Cloud: one always-on graph across repos, with PR review and formal verification. Free covers 3 repos, Pro is $10/month billed yearly, Teams starts at $20/seat billed yearly. Solo and small teams: the free CLI. Many repos: that's the Cloud pitch.
The catch is the moving target. It changed orgs, relicensed from MIT to Apache 2.0 in July, and is now a YC company shipping almost daily. The "80% fewer tokens" headline is about the paid Cloud, not the free CLI.
The local CLI is free under Apache 2.0 and code graphs cost nothing to build. You pay only for the hosted cross-repo graph and PR review: $10/month billed yearly for Pro, or $20/seat/month billed yearly on Teams.
**Free:** The CLI and assistant skill are Apache 2.0 (relicensed from MIT on 2026-07-22; the old MIT text is kept as LICENSE-MIT) with no account. Code-only graphs need no API key and run offline. Graphify Cloud also has a Free plan: one developer, 3 repositories, 25,000 graph nodes per repo, 10 push builds per repo/day, 15 PR reviews per workspace/month and 1 formal verification run/day, no card. Cloud is also free for qualified non-commercial OSS projects under MIT or Apache licenses. **Self-hosted:** The CLI runs on your machine (Python 3.10+, uv or pipx) and writes graph.html, GRAPH_REPORT.md and graph.json; `graphify hook install` rebuilds on commit, and the graph can be served over stdio or HTTP MCP. Optional extras add PDF, Office, video/audio (local faster-whisper), Neo4j and FalkorDB push, Ollama and more. The semantic pass over docs, PDFs and images uses your assistant's session model or an API key (Gemini, Kimi, Claude, OpenAI, DeepSeek, Azure, Bedrock or local Ollama); headless auto-detection checks Gemini first and Kimi second, and Kimi routes to Moonshot AI servers in China, so pass `--backend` explicitly if data residency matters. Self-hosting the full Cloud product (cross-repo graph, PR review, verification) is Enterprise only. **Paid:** Graphify Cloud. Pro: $10/month billed yearly ($120/year) or $15 billed monthly, one developer, unlimited repos, uncapped graph size. Teams: $20/seat/month billed yearly for the first 100 teams, then $28 ($29 and $40 billed monthly), minimum 2 seats, shared graphs and Slack support. Enterprise: custom, self-hosted, SSO/SAML, GitHub Enterprise, licensed per developer seat. Pro and Teams have a two-week trial that requires a card. Pre-seed and seed startups under $1M revenue get 50% off Teams for up to 6 months.
Career-ops turns the AI coding CLI you already use into a job-search filter. Paste a posting and it checks the job is still open, scores it 1 to 5 against your CV in an A-through-H report, then drafts a tailored resume PDF, cover letter and form answers. It never hits Submit. MIT licensed, no paid tier.
Setup is one npx @santifer/career-ops init. Open Claude Code, Codex, OpenCode, Antigravity, Copilot or another CLI in the folder and it interviews you about your CV and targets. The scanner ships with 100+ companies preconfigured, a Go terminal dashboard tracks the pipeline, and an opt-in web UI is still alpha. Your data stays local except what goes to your AI provider.
Solo job seekers: install it. The tool is free; your cost is the model, and free or local models work. One trap: an ANTHROPIC_API_KEY in your shell overrides a Claude Pro or Max login and bills per token. Small teams and larger orgs: not the audience.
The catch: an LLM is rewriting your CV. A check blocks invented numbers, but its own FAQ says it doesn't yet verify job titles or judge rewording, so read every resume before it goes out.
Free and MIT with no paid tier. Your only cost is the model behind your CLI, and free or local models work.
**Free:** Everything. MIT license, no paid tier, no account, no telemetry. The project site says it's community-funded through Open Collective and sponsors, not premium features. **Self-hosted:** Runs locally: `npx @santifer/career-ops init` (or git clone plus `npm install`), then `npx playwright install chromium` for PDF generation. Your CV, reports and tracker are markdown, YAML and TSV files on your machine. Optional plugins (Gmail, Notion, Apify and a community registry) are off by default. **Paid:** Nothing from the project. The cost is the AI engine underneath: a paid CLI plan like Claude Code or Codex, per-token API billing, or $0 on free and local models (Ollama, OpenRouter free models, Antigravity CLI's free tier, or the standalone Gemini API script on Google's free tier).
CrewAI builds a team of AI agents in Python. Each agent gets a role, a goal and tools, and a Crew passes tasks between them, in order or under a manager agent. Flows cover the opposite case: event-driven, step-by-step control when you don't want agents improvising. The framework is MIT and free.
Setup is uv tool install crewai, then crewai create crew scaffolds a project where agents live in JSONC files. It's a standalone framework, not a LangChain wrapper. There's no server to run. Agents call OpenAI by default, and local models work through Ollama.
The paid side is CrewAI AMP, a hosted platform with a visual editor, tracing and deployment. The free Basic plan gives you 50 workflow executions a month. Past that it's Enterprise, custom pricing only, which adds SSO, RBAC and deployment in your own VPC. No self-serve middle tier. Solo and small teams: free framework. Larger teams: Enterprise, or deploy it yourself.
The catch: multi-agent setups multiply LLM calls and are hard to debug. Anonymous telemetry is on by default. And in March 2026 CERT/CC disclosed four flaws, including prompt injection to code execution via the Code Interpreter Tool, which CrewAI then removed.
The framework is free under MIT. Hosted AMP is free up to 50 workflow executions a month, then jumps straight to custom-priced Enterprise with no self-serve tier in between.
**Free:** The framework is MIT with nothing gated: Agents, Tasks, Crews (sequential or hierarchical process), Flows, tools, memory and MCP support. CrewAI AMP Basic is also free: the Studio visual editor and AI copilot, GitHub integration, 2 automations and 50 workflow executions a month (hard cap, no overage), tracing, OpenTelemetry export and community support, hosted on CrewAI cloud only. **Self-hosted:** The framework runs anywhere Python 3.10 to 3.13 runs; you pay only your model provider. There is no server component unless you build one. Running the AMP control plane in your own VPC or on your own infrastructure is Enterprise only. **Paid:** AMP Enterprise is custom priced with no published rate. It adds enterprise connectors, executions sized to your workflows with flexible overage, SSO (Microsoft Entra, Okta), role-based access control, dedicated VPC or on-prem deployment, dedicated and on-site support, and a 45-day onboarding. There is no self-serve paid tier between Free and Enterprise. LLM API costs are always separate.
ZeroClaw is a self-hosted runtime for an autonomous AI assistant that lives on your hardware instead of someone's cloud. It connects to 20-plus model providers and 30-plus channels like Discord, Telegram, Matrix, and email, and acts through shell, browser, HTTP, and custom MCP tools. Written in Rust, dual licensed MIT or Apache 2.0, and free. You bring your own model keys, sign in with a Codex or Claude subscription, or run local models with Ollama. Running it is moderate work: you host the runtime, wire up the channels you want, and supply the models. It installs as a system service on Linux, macOS, or Windows, and now includes a web dashboard. It does not ship wide open. The default autonomy level is supervised, meaning medium-risk operations need approval and high-risk ones are blocked, with workspace boundaries, command policy, and OS-level sandboxes. A YOLO mode exists for trusted dev environments. Solo and small teams: free, and you pay only for model usage. Anyone who wants something vetted with support should stay with ChatGPT, Claude, or Copilot. The catch is still trust. An agent with shell access is only as safe as the policy you leave on and the model's judgment, so resist the urge to loosen the defaults. The newest release also adds ZeroRouter, a hosted model gateway in beta that needs a key and has no published pricing.
Completely free and open source. You bring your own model keys and run it yourself.
**Free:** Dual MIT or Apache 2.0, fully free. The project's site says there is no subscription and no hosted seat. You supply your own LLM API keys, a supported subscription login, or local models through Ollama. **Self-hosted:** The only mode. You host the runtime, wire up channels, and provide the models. Costs are your hardware and your model usage. **Paid:** None for ZeroClaw itself. ZeroRouter, an OpenAI-compatible model gateway from the same team, launched in beta with a public hosted deployment that requires a key. Its pricing is not published in readable form, and it can be self-hosted under AGPL.
agentmemory gives your coding agent a memory that survives the session. It hooks into Claude Code, Cursor, Codex, Gemini CLI and more, records what the agent did, and hands the relevant pieces back next time, so you stop re-explaining your stack. It's Apache-2.0, runs on your machine, and it's free.
Setup is one npx -y @agentmemory/agentmemory@latest, which wires your agents and starts a local server plus a pinned iii engine binary. No external database, but it wants Node 20 and four local ports, and native Windows means installing the engine by hand. Default search is keyword-only; EMBEDDING_PROVIDER=local adds free on-device semantic recall.
There is no paid tier. Your only bills are an optional LLM provider and a small server if a team wants shared memory. Solo: free, an easy win. Small teams: free. Larger teams: free, but you're self-supporting a pre-1.0 project.
The catch: the "#1" in the tagline is marketing. The headline 95.2% is retrieval recall on LongMemEval-S, not that benchmark's official QA score, and the project's own report lists MemPalace higher at 96.6%. Compare Mem0, Zep and Letta yourself. Also, the required iii engine is Elastic License 2.0, not Apache.
Free with no paid tier. The only money involved is an optional LLM or embedding provider, and a small VM if a team wants one shared memory server.
**Free:** Everything. Apache-2.0 code, no account and no API key required. You get the local memory server, 54 MCP tools, 12 auto-capture hooks for Claude Code (fewer on other agents), 17 skills and a real-time viewer on port 3113. Keyless mode searches with BM25; `EMBEDDING_PROVIDER=local` adds on-device semantic search with the free all-MiniLM-L6-v2 model. **Self-hosted:** Local by default via `npx -y @agentmemory/agentmemory@latest` (Node.js 20+). It runs a pinned iii-engine v0.22.1 binary (or the `iiidev/iii:0.22.1` Docker image) and uses ports 3111, 3112, 3113 and 49134. For a shared team server there are one-click templates for Fly.io and Railway plus Render and Coolify guides; only port 3111 is published and requests need `AGENTMEMORY_SECRET`. Hosting costs are yours. **Paid:** No paid tier and no hosted cloud from the project. Optional costs only: an LLM provider if you turn on LLM-written compression (`AGENTMEMORY_AUTO_COMPRESS=true`), or a paid embedding provider such as Voyage AI instead of the free local model.
OpenCLI turns websites into terminal commands and lets an AI agent drive your logged-in Chrome. Built-in adapters like opencli hackernews top return tables or JSON, and opencli browser commands let an agent navigate, click, fill forms and extract from any page without an adapter. It's free and Apache 2.0.
Setup is an npm install plus the Browser Bridge Chrome extension, which talks to a local daemon and drives separate Chrome windows that reuse your site logins. Agents get it through skills (npx skills add jackwener/opencli). The adapter list covers 100+ sites with a heavy lean toward Chinese platforms like Bilibili, Zhihu and Xiaohongshu. The optional OpenCLIApp tray app is closed source.
There's no paid tier. You pay only for the LLM tokens your agent spends. Solo and small teams: free, for automating your own accounts. Larger teams: it's per-person tooling, not shared infrastructure; for headless browsers at scale, look at Browserbase.
The catch: an agent in your logged-in browser can do anything you can on every site you're signed into. The extension requests debugger, cookie and all-sites access to do it. It also sheds features fast: the CLI hub and desktop-app automation were cut from the main branch this fall.
Free with no paid tier. The only bill is the LLM tokens your agent spends driving it.
**Free:** Everything: the CLI, the Browser Bridge extension, the built-in adapters, the agent skills and the plugin system, all Apache 2.0. **Self-hosted:** Runs on your own machine. `npm install -g @jackwener/opencli` (Node.js 20.18.1 or later) or OpenCLIApp (macOS Apple Silicon signed and notarized .pkg, Windows x64 unsigned installer; app source not public). Install the extension from the Chrome Web Store or load the unpacked zip from GitHub Releases; it talks to a local daemon on localhost:19825. Video downloads need `yt-dlp`. **Paid:** No paid tier and no hosted version. The only cost is the LLM tokens of whatever agent (Claude Code, Cursor, etc.) drives it.
This is a library of more than 2,000 reusable SKILL.md playbooks for coding agents. Skills are structured prompts that teach an agent a specific job (write tests, harden a web app, run a data pipeline), and the project installs them into Claude Code, Cursor, Codex, Gemini CLI, Kiro, OpenCode and others. MIT for the code, CC BY 4.0 for the content unless an upstream notice says otherwise, free.
You install with npx agentic-awesome-skills plus a tool flag like --claude, and the installer now makes you choose: named skills, a risk, category or tag filter, or explicit consent for the whole catalog. The project itself says to start with a focused plugin instead. Newer releases add AAS Core, an optional local CLI and MCP server that lets an agent search the catalog and validate the skills it picks.
For anyone building an agent workflow, this is a fast way to skip writing every skill from scratch. Solo developers and teams get the same value, since skills are just files you version alongside your project.
The catch is curation. Thousands of community skills mean variable quality and overlap, and an installed skill is a prompt your agent will follow. The catalog labels some skills critical or offensive, and an audit command flags network, credential and destructive signals, but the project calls that a review aid, not a safety certificate. Read the ones you install.
Free and open source. The real cost is the time it takes to vet the skills you install.
**Free tier:** MIT code and CC BY 4.0 content, where more specific upstream notices can override: 2,000+ skills, the installer CLI, focused plugins, bundles, risk labels, an audit command, and the AAS Core preview. Funding comes from optional GitHub Sponsors and Buy Me a Coffee. **Self-hosted:** Nothing you have to run. Skills install as files into your agent's config directory through `npx`. AAS Core's `aas` CLI and MCP server run locally if you opt in; its apply and recovery features are still experimental. **Paid:** None.
LangGraph builds AI agents as graphs: nodes do work, edges decide what happens next, and state persists between steps, so an agent can pause for human approval, recover from failures and pick up where it left off. It's from LangChain but works without it. The library is MIT and ungated. Run it anywhere Python or JavaScript runs, with a Postgres or SQLite checkpointer for persistence. LangGraph 1.0 shipped in October 2025 as a long-term-support release with a semver promise, so minor upgrades shouldn't break you; the churn now lives in beta features and the wider LangChain ecosystem. Two high-severity auth advisories in the SDK landed in August and September 2026, so stay current. The money is in LangSmith. Tracing is free for one seat with 5,000 base traces a month; Plus is $39 per seat a month with 10,000 base traces, then $5 per 1,000 more. LangChain's production Agent Server (task queues, cron, streaming endpoints) runs on LangSmith Deployment, metered by compute on Plus, and self-hosting that server requires Enterprise. Solo and small teams: free library plus your own server. Larger teams that want the managed runtime: budget for LangSmith. The catch: the free path means building your own serving layer. The moment you want LangChain's runtime on your own hardware, you're in an Enterprise sales conversation.
The library is free. LangSmith tracing is $39 per seat, and LangChain's managed agent runtime is metered or Enterprise-only to self-host.
**Free:** The LangGraph library (Python and JS), MIT, no gates. LangSmith Developer: 1 seat, 5,000 base traces a month. **Self-hosted:** Run graphs in your own app or worker with a Postgres or SQLite checkpointer at no cost. LangChain's own Agent Server, self-hosted, requires an Enterprise plan and license key. **Paid (LangSmith):** Plus $39 per seat per month, 10,000 base traces included, then pay as you go at 0.005 LSU per base trace (1 LSU = $1, so $5 per 1,000). Plus includes one free small serverless deployment; more deployments meter compute and memory in LSUs. Enterprise is custom, invoiced annually, with self-hosted and hybrid options, SSO and an SLA.
CopilotKit puts an AI agent inside your own app instead of bolting a chat bubble to the corner. The agent reads your app's state, calls your functions and renders real UI in the conversation, across React, Angular, Vue and React Native, plus Slack and Teams bots. Its makers also created AG-UI, the open protocol linking agents to frontends. The SDK is MIT licensed and free.
The free setup is npm packages in your app plus a TypeScript runtime endpoint, with no extra service. Your real bill is LLM tokens, which grow with how much app state you hand the agent every turn. Telemetry is on by default; set COPILOTKIT_TELEMETRY_DISABLED=true to turn it off.
The paid layer is CopilotKit Intelligence: threads that resume across devices, user memory, analytics and managed channels. Hosted is free for 1,000 interactions a month, then $49/month per organization with 10,000 included. Solo and small teams: free SDK. Medium teams wanting history without building storage: pay as you go. Large teams: Annual for SSO and offline installs.
The catch: the free line is narrower than the MIT badge suggests. Only the TypeScript runtime works without Intelligence; the Python, Go, Ruby and .NET runtimes require it.
The SDK is free and MIT with a TypeScript runtime. Persistent threads, memory, analytics and non-TypeScript runtimes need Intelligence: free for 1,000 hosted interactions a month, then $49/month per organization with 10,000 included.
**Free:** The whole SDK is MIT: React, Angular, Vue, React Native and web-component packages, the TypeScript runtime, generative UI, shared state, human-in-the-loop, a SQLite agent runner and the self-hosted Channels adapters for Slack, Teams, Discord and WhatsApp. Bring your own LLM keys. Separately, hosted Intelligence has a free plan with 1,000 interactions per organization per month, and the Developer Edition runs Intelligence locally for non-production use on a renewable 30-day license. Development, staging, test and demo usage is not charged. **Self-hosted:** The SDK needs no extra service if your runtime is TypeScript. Python, Go, Ruby and C#/.NET runtimes require Intelligence (cloud or self-hosted). Self-hosted Intelligence is a Helm chart (app-api, app-frontend, optional realtime-gateway) that needs Kubernetes 1.28+, your own Postgres 14+, Redis 7+, an OIDC provider and a license key, at the same price as hosted. Telemetry is on by default; COPILOTKIT_TELEMETRY_DISABLED=true turns it off. **Paid:** Intelligence pay as you go is $49/month per organization (billed monthly, no annual commitment) with 10,000 interactions included across all apps, then graduated per-interaction rates. Unlimited developers and users. One completed agent request is one interaction; tool and model calls inside it are not counted. Self-hosted pay as you go must report usage over the internet. Annual is custom-priced, adds SSO, offline deployment and up to 24/7 support, and is sold through AWS Marketplace.
Cua gives AI agents a computer of their own: a full macOS or Linux desktop they can click and type through, instead of your screen. The repo bundles Cua Driver (agents operate native apps on macOS, Windows and Linux), Lume (local VMs on Apple Silicon), an SDK and CLI, and Cua Bench for testing agents. Driver, Lume and the SDK are MIT and free.
Setup is a curl | sh installer. The Spaces app needs macOS 26 or later, Lume needs Apple Silicon, and Windows is a preview. You bring the machines: your Mac, a spare Mac mini, or VMs in your own AWS, Google Cloud or Modal account. Cua rents nothing, so it isn't a drop-in for E2B.
Spaces is free for 2 live sessions and 20 relay hours a month; local-network Spaces don't count. Pro is $18/month, Teams $30/seat/month. Solo: free. Small teams: free on one network or over Tailscale; Teams once you want shared machines with roles. Larger teams: wait, SSO hasn't shipped.
The catch: this project deprecates its own floor fast. Five packages are retired (one with known security issues), hosted Cloud Fleets end on October 16, 2026, and Spaces is FSL, not MIT, until each release converts two years out.
Free covers one person on their own machines with up to 2 relayed sessions and 20 relay hours a month. Pro at $18/month ($180/year) lifts that to 5 sessions and 200 hours; Teams at $30/seat/month ($300/seat/year) is for sharing machines with roles, and still lacks SSO.
**Free:** Most of the repo is MIT: Cua Driver (desktop automation for agents on macOS, Windows and Linux, via CLI, MCP or SDKs), Lume (macOS and Linux VMs on Apple Silicon), the `cua` SDK and CLI (Python, TypeScript, Swift, Kotlin) and Cua Bench. The Cua Spaces app is free with no account needed to start: Spaces on every computer you connect, Teleport, sharing a Space with named people, and the hosted relay up to 2 live sessions and 20 relay hours a month. Spaces you reach on your own network skip the relay and don't count. **Self-hosted:** Everything runs on hardware you own or rent: macOS Spaces are Lume VMs, Linux runs on Docker (gVisor sandboxes via `cua sb create`), or VMs in your own AWS, Google Cloud or Modal account, which that provider bills you for. Spaces installs on macOS 26 or later, with Linux and a Windows preview. The Spaces app, cua-spacesd, cua-relay, Keyvault and Teleport are source-available under FSL-1.1-MIT: free to use, modify and self-host, but no competing hosted service, and each release becomes MIT two years after it ships. Cua Driver Bench moved from MIT to FSL on 11 Oct 2026. Remote access normally goes through the cua.ai relay, which is what Pro and Teams meter. A host can also be reached directly over Tailscale or a LAN with no relay and no account, and the relay itself is FSL and self-hostable. **Paid:** Pro is $18/month or $180/year for one person: up to 5 live sessions and 200 relay hours a month (expiring share links and 90-day audit history are listed as coming soon). Teams is $30/seat/month or $300/seat/year, 1 to 100 seats: each seat adds 5 sessions and 200 relay hours to a shared pool, plus shared team machines, roles and device approval. SSO and audit export are not included yet. Going over doesn't cut you off; the app shows an upgrade notice. No trial; yearly plans are refundable within 14 days. You still pay for your own machines, cloud VMs and whatever model API your agent uses. The hosted Cua Cloud Fleets product shuts down 16 Oct 2026.
Mastra is a TypeScript framework for building AI agents into a web app: agents with tools and memory, workflows that can pause for a human to approve and then resume, RAG, evals and tracing. It routes to 40+ model providers through one interface and drops into a Next.js or Node app, or runs as its own server. The core is Apache 2.0, from a Y Combinator company.
Self-hosting the framework just means deploying your app. The paid layer is Mastra Platform for tracing and hosted deployment: free for 100K events and 24 CPU hours a month, then Teams at $250/mo for 1M events, 250 CPU hours, six months of retention and SSO. Enterprise is custom.
TypeScript teams who don't want to live in Python: this is the most complete option. Solo and small teams: the free framework plus the free platform tier. Compare it with langchain-ai/langchainjs for a bigger ecosystem, or Vercel's AI SDK for something lower-level.
The catch is the ee folders. RBAC, SSO, fine-grained permissions and the visual agent builder sit under a separate Enterprise license: readable, but not for production without a paid key. Mastra has rewritten that license three times this year. Know which imports you're pulling in.
The core framework is free under Apache 2.0. SSO and RBAC need an Enterprise key, and hosted Teams is $250/mo.
**Free (self-hosted):** The core framework (agents, workflows, memory, RAG, MCP, evals) is Apache 2.0. Deploy it anywhere you run Node. **Enterprise features (source-available):** Anything under an `ee/` directory, including RBAC, SSO, fine-grained authorization and the agent/workflow builder, is under the Mastra Enterprise Edition License. You can read and test it, but production use needs a signed agreement and a license key. Self-hosted Enterprise is one flat annual fee, price on request. **Mastra Platform (hosted):** Starter $0/mo with 100K observability events (then $10 per 100K), 24 CPU hours (then $0.35/hr) and 15-day retention, unlimited users. Teams $250/mo with 1M events (then $8 per 100K), 250 CPU hours (then $0.25/hr), 6-month retention, SSO and SOC 2 docs. Enterprise is custom, with RBAC, audit logs and SLAs. **The real cost:** LLM tokens from whichever providers your agents call.
Haystack is an open-source Python framework for building LLM applications: retrieval-augmented generation, semantic search, and increasingly, autonomous agents. In plain terms, it is the plumbing that connects your documents and data to a language model and back out as an answer, with explicit control over each step. Apache 2.0 licensed, free via pip install haystack-ai, built by deepset. The design is modular pipelines: you chain swappable components (retrievers, rankers, generators, memory, tool-calling) into a workflow you can actually reason about. Version 2.x widened the scope from pure RAG to agent workflows, tool use, and multimodal apps, so the same framework that builds a document Q&A system now builds an agent that calls tools and keeps memory. Running it yourself is moderate work: the framework is free, but you supply the vector store, the LLM, and the infrastructure around them. Solo and small teams: pip install and go, then budget for the LLM API calls and a vector database, not for Haystack itself. Larger orgs that want managed deployment, observability, and governance can look at Haystack Enterprise, deepset's paid tier, available cloud or self-hosted. The framework gives you the control; Enterprise sells the operations layer on top. The catch is that Haystack's flexibility is also its learning curve. The pipeline model is powerful, but you have to design it, and you are on the hook for the costs it orchestrates: every LLM call and every vector query is your bill, not deepset's. Compare it against LlamaIndex and LangChain before committing, since all three cover overlapping ground with different opinions.
Framework is free and open source under Apache 2.0. You pay for the LLM APIs, vector store, and infra you plug into it. Haystack Enterprise adds managed deployment and governance for larger teams.
### What's Free The entire framework. Apache 2.0, installed with pip install haystack-ai. Pipelines, agents, retrievers, rankers, generators, memory, tool-calling, and evaluation are all open source with no feature gate. ### Self-Hosted The framework is free; the stack around it is not: - **LLM**: an API (OpenAI, Anthropic, and others) or a local model you host. - **Vector store**: bring your own (Postgres/pgvector, Qdrant, Weaviate, Elasticsearch). - **Infra**: you deploy and scale the app yourself. ### Paid Option Haystack Enterprise (by deepset) layers support, templates, managed deployment, observability, and governance on top, available as cloud or self-hosted. Pricing is enterprise sales; the core framework stays free. ### vs Alternatives - **LangChain**: larger ecosystem, more integrations, busier API. - **LlamaIndex**: data and RAG first, excellent for indexing-heavy apps. - **Haystack**: clean pipeline model with explicit control, strong for production RAG and agents.
jev-ultrafast is Browser Use's speed demo for a new kind of model. Normal browser agents ask a chat model to write out its next step. This one hands Jev, a decision model from TypeSafe AI that returns typed choices instead of text, a numbered list of page elements and gets back which one to click. A small text model only writes the words that need typing. The README's showcase is a Zurich to London search on Google Flights in about seven seconds. MIT licensed. It is source code, not a product: uv sync, a local Chrome with remote debugging on, and two paid keys. One is a TypeSafe key for Jev, which bills $0.042 per million input tokens with free output and is waitlisted right now. The other is an OpenRouter key for the text model. No releases, version 0.1.0, and the README calls it an MVP. Solo builders curious about decision models: worth an evening once you clear the waitlist. Teams that need browser automation today should use the same company's main browser-use library, or Skyvern. The catch: the benchmark is three repeats of one task on one browser profile, and the README says so. Shadow DOM, iframes, canvas, uploads, and pop-up tabs are out of scope. And the whole thing depends on a closed API you cannot self-host.
Free MIT code that cannot run without two paid API keys, one of them for a closed, waitlisted model.
**Free:** The MIT source code: a Python browser agent that uses Jev for element decisions and a small text model for typed input. **Self-hosted:** Runs on your machine against a local Chrome. There is no way to self-host the model it depends on, because Jev is a closed API. **Paid:** Nothing to Browser Use. Every run makes paid API calls to two outside services: TypeSafe AI's Jev at $0.042 per million input tokens (output tokens free, access currently waitlisted) and an OpenRouter-hosted text model. The repo also promotes a waitlist for Browser Use Cloud.
Browser Harness lets your coding agent (Claude Code, Codex or Cursor) drive your real Chrome, logged in as you: open pages, click, type, read and download. It talks to Chrome over the DevTools Protocol, and when a helper is missing the agent writes one. Free and MIT licensed, from the Browser Use team.
Setup is one prompt pasted into your agent, which installs it with uv and has you tick remote debugging in chrome://inspect. Cursor and other MCP clients use the bundled MCP server. It's no longer a tiny script: it ships interaction guides and a growing library of site-specific skills. In Browser Use's own benchmark, no tool beat it on score and it used the fewest tokens.
Local use costs nothing. Browser Use Cloud is pay-as-you-go at $0.02 per browser-hour plus $5/GB for residential proxies. Solo and small teams: free on your own Chrome. Larger teams running many browsers: the cloud is cheap.
The catch: it gets your whole logged-in browser, and telemetry is on by default. Each run sends the script your agent wrote and up to 20,000 characters of its output to PostHog, which can include page text from your accounts. Run browser-harness telemetry disable first.
Free and MIT on your own Chrome. Cloud browsers are pay-as-you-go at $0.02 per browser-hour plus traffic, with no subscription.
**Free:** The harness is MIT licensed with full local functionality against your own Chrome, plus `browser-harness-mcp` for MCP clients. Telemetry is opt-out (`browser-harness telemetry disable`). **Self-hosted:** Runs on your machine: install with uv (Python 3.11+ per PyPI, the setup prompt asks for 3.12), then tick remote debugging in `chrome://inspect` on Chrome 144+, or point it at any CDP endpoint. No server to run. **Paid:** Browser Use Cloud is optional and has no subscriptions; credits never expire. Cloud browsers cost $0.02/browser-hour, managed residential proxy traffic $5/GB, direct or bring-your-own-proxy egress $0.20/GB. Free accounts get a one-time $1 credit (eligible Google, GitHub or Microsoft signups) and 10 concurrent sessions. Top-ups start at $5; total paid unlocks concurrency ($100 for 50 sessions, $1,000 for 250, $5,000 for 500, $25,000 for 1,000). Enterprise adds custom concurrency, SLAs, HIPAA and zero data retention at custom pricing.
Odysseus is a self-hosted AI workspace: chat with local or hosted models, autonomous agents with tools and MCP, deep research, blind side-by-side model comparison, a writing editor, an email inbox with triage and reply drafts, notes, tasks and calendar sync. Its Cookbook looks at your hardware, recommends models that fit, then downloads and serves them for you through vLLM, SGLang, llama.cpp, MLX or Ollama. It's AGPL-3.0. Docker Compose gets it running at localhost:7000, with NVIDIA and AMD GPU overlays; pin the immutable image tag rather than latest. On Apple Silicon, Docker can't reach the GPU, so use the native install. Its own threat model says to treat it like an admin console: a logged-in admin can run shell commands, read and write files and send email. Keep auth on and never expose it directly to the internet. No paid tier; your costs are hardware and any hosted-API tokens. Solo tinkerers with a decent GPU get a lot for free. Small trusted teams on a private network can share it. Anything bigger needs a security review first. AGPL means that if you modify it and let others use it over a network, you owe them your source. The catch: it's young, the issue tracker is enormous, and it touches your email and your files. Without a capable GPU or plenty of RAM you're limited to small local models.
Free under AGPL. You pay for the hardware and any hosted-model tokens.
**Free:** Everything. AGPL-3.0-or-later (changed from MIT in June 2026). Bundled components keep their own licenses (llmfit and opencode code is MIT). **Self-hosted:** Docker Compose with the official multi-arch image, NVIDIA and AMD GPU overlays, or a native install (Python 3.11+, tmux). Apple Silicon needs the native install for GPU-accelerated serving. Designed for trusted users on a private network only. **Paid:** None. Costs are your hardware and any hosted-model API tokens.
Diagram-design is an agent skill that makes your coding agent draw diagrams a designer wouldn't wince at. Ask in plain words for an architecture sketch, flowchart, sequence diagram, Sankey or Gantt chart, and it picks from more than 40 types and writes one self-contained HTML file with inline SVG. MIT licensed and free.
It's no longer Claude Code only. npx skills add cathrynlavery/diagram-design installs it into Cursor, Codex, Copilot, Gemini CLI, Cline and other skill-aware agents; plugin marketplaces add updates and slash commands. Point it at your website and it pulls your palette and fonts, checks contrast, and every diagram after that matches your brand. It also redraws draw.io, Mermaid and Excalidraw files and exports SVG or PNG.
Solo writers and technical bloggers: install it. Small teams: save a brand profile everyone uses. Larger teams with a design system: test it first, because the style is opinionated on purpose (one accent color, hairlines, no shadows).
The catch: the output is a finished picture, not a source file. Nothing to diff in a pull request, no canvas to drag, and the same prompt can lay out differently twice. For docs that change every sprint, its own README says Mermaid fits better.
Free and MIT. The only cost is the AI agent you already run it in.
**Free:** Everything. MIT licensed skill, templates and scripts. Per its privacy policy there is no server, no accounts, no analytics and no telemetry. **Self-hosted:** Nothing to host. Install with `npx skills add cathrynlavery/diagram-design` or a plugin marketplace (Claude Code, Codex, GitHub Copilot, Factory Droid, Pi). Saved brand profiles in `~/.diagram-design/profiles/` survive updates, but direct edits to the installed `style-guide.md` can be overwritten by package updates, so clone and symlink if you customize it. PNG export needs Playwright and Chromium. Diagrams load fonts from Google Fonts unless you ask for system fonts. **Paid:** No paid tier. It runs inside an AI agent, so the cost is whatever plan or tokens that agent already uses.
AutoGen is Microsoft's framework for building multi-agent AI systems, where several agents with different roles and tools work together, or alongside a person, to finish a task. You define the agents and AutoGen handles how they talk, call tools, run code in a sandbox, and pause for your approval. The code is MIT, the docs and examples are CC-BY-4.0, and all of it is free. Here is the part that matters before you build on it: AutoGen is in maintenance mode. Microsoft named microsoft/agent-framework as the successor and steers new users there. AutoGen still runs and the v0.7 line is stable, but its Python packages have not shipped a release since September 2025 while the successor ships roughly every week. Contributions are limited to bug fixes, security patches, and docs. Already running it in production? You are fine for now, but put a migration to microsoft/agent-framework on the roadmap instead of treating this as permanent. Picking a framework today: start with the successor, or look at crewAIInc/crewAI and langchain-ai/langgraph, which most people find easier for simpler workflows. Solo and small teams: still a good way to learn the patterns, you are just learning a frozen API. The catch is that, plainly: Microsoft stopped developing this. The pile of existing tutorials makes it look like the safe default, and maintenance mode means no fixes for new model behaviors and no new capabilities. Building something long-lived on a frozen framework is a decision, not a default.
Free framework. Your cost is LLM API usage, which multi-agent patterns multiply significantly.
Fully open source. The framework code is MIT, documentation/examples are CC-BY-4.0. No paid tier from Microsoft for AutoGen itself. **Your costs are LLM API calls:** - OpenAI GPT-4o: ~$2.50/1M input tokens, $10/1M output - Azure OpenAI: similar pricing - Local models via Ollama: free but slower Multi-agent systems multiply your API costs because agents converse with each other. A 4-agent workflow processing one task might use 5-10x the tokens of a single-agent approach. Budget accordingly. Autogen Studio (the visual UI) is also free and included.
OpenHuman is a desktop AI agent that connects to more than a hundred services, pulls your data in on a schedule, and builds a memory it can act on, with web search, voice, code execution and a talking desktop mascot built in. It's repositioning as an agent harness with a Rust core. The app is GPL-3.0; the managed services behind it are not. Install is native: Homebrew cask, .dmg, .msi, .deb or AppImage, no Docker. By default you sign in and use the TinyHumans managed route for models, search and integrations. Bring-your-own keys for 26 providers and local models through Ollama, LM Studio or MLX are options, and a local-only privacy mode keeps inference on the device. Integrations run through TinyHumans' backend via Composio by default. It was never fully free. TinyHumans sells credit plans: Basic $20 a month or $200 a year with $21 of credits, Pro $200 a month or $2,000 a year with $210, and pay-as-you-go top-ups from $5, all non-refundable. Solo users running local models can avoid paying. Everyone on the default managed route is buying credits. The catch: the local-memory pitch is going away. The development branch replaces the on-disk Markdown memory and Obsidian vault with CortexDB, hosted by TinyHumans or self-hosted by you; with neither, memory is off. It's also an early beta with hundreds of open issues.
Free app if you bring keys or run local models. The default managed route bills TinyHumans credits from $20 a month.
**Free:** The GPL-3.0 desktop app. Free to run with your own API keys or local models (Ollama, LM Studio, MLX). **Self-hosted:** Native desktop installers for macOS, Windows and Linux. The hosted pieces (CortexDB memory, the integration proxy, billing) are not in the repo. Upcoming memory changes require either TinyHumans' hosted CortexDB or your own CortexDB endpoint. **Paid (TinyHumans credits, USD):** Basic $20/month or $200/year, $21 of credits a month. Pro $200/month or $2,000/year, $210 of credits a month. Enterprise custom. Pay as you go from $5. All sales are final. The managed route covers LLM inference, search, embeddings, media generation, integrations and voice.
OpenViking is a context database built specifically for AI agents. Instead of the usual pile of vector embeddings, it organizes an agent's memory, retrieved documents, and skills the way a filesystem organizes files: directories you can navigate, tag, and search recursively. It is open source under AGPL-3.0. Setup is heavier than a typical pip install. You will need Python 3.10+, a Rust toolchain for building the RAGFS component, and a C/C++ compiler for the core extensions, on top of wiring up a vision-language model and an embedding model (Volcengine Doubao, OpenAI, or others) before it does anything useful. Once running, it compresses conversation history automatically and shows you the retrieval path it took to answer a query, so debugging why an agent recalled the wrong thing is actually possible. There is a hosted demo, OpenViking Studio, if you want to try the retrieval and memory features before committing to the build. Solo devs experimenting with agent memory: worth the setup time if you are hitting the limits of flat vector search. Teams building production agents: the tiered loading, it only pulls in the context tier it actually needs, is the real selling point for cutting token costs at scale. It is AGPL-3.0, not MIT or Apache. If you build a hosted product on top of OpenViking and offer it as a network service, the license requires you to open source your modifications too. That is a real constraint for anyone planning to build a commercial product on this, not just an internal tool.
Completely free and open source, but AGPL-3.0 comes with real strings attached if you are building a commercial product on top of it.
**Free (only option):** OpenViking is fully open source under AGPL-3.0. No paid tier, no hosted managed offering beyond a browser demo. **Self-hosted:** Requires Python 3.10+, a Rust toolchain (Cargo) to build the RAGFS component, and a C/C++ compiler for core extensions. You also need to bring your own vision-language model and embedding model, so add whatever those API calls cost. **Paid:** None currently. The AGPL-3.0 license means if you build a commercial hosted product on top of it, you are required to open source your changes.
Hermes WebUI is a browser frontend for Hermes Agent, a self-hosted autonomous AI agent that holds memory across sessions, runs scheduled jobs, and integrates with messaging platforms. Free and MIT-licensed. Setup is moderate. You bring your own LLM API key (OpenAI, Anthropic, Google, DeepSeek, OpenRouter, others) and run the agent plus WebUI on your own hardware or VPS. Once running, the agent persists conversation context, learns from interactions, and can be triggered on a schedule. The web UI mirrors the CLI experience without locking you out when you close the terminal. For solo developers and small teams who want an AI agent that isn't tied to ChatGPT or Claude.ai, this is a real option. Your conversations, your memory, your hardware. The cost is your LLM API bill, which can climb fast if the agent is making frequent calls. Solo: probably $10 to $50 per month in API spend depending on usage. The catch is that "autonomous AI agent" is doing a lot of work in the description. These systems still hallucinate, still drift, still need supervision. Don't wire it into anything destructive without guardrails.
The software is free. Your real cost is the LLM API bill, which you control by your usage patterns.
**Free (software):** Hermes Agent and Hermes WebUI are both MIT-licensed. All features included. **Self-hosted reality:** Moderate. Standard web app stack, plus you wire in API keys for whichever LLM provider you choose. Nothing exotic, but configuring scheduled jobs and integrations takes some work. **LLM API costs:** Pay-as-you-go to your chosen provider. A casual user might spend $10 to $50 per month. An agent making frequent automated calls or running heavy reasoning loops can run several hundred per month.
watermarks-remover strips AI provenance marks: invisible Unicode in text, and C2PA, EXIF and XMP metadata from images, PDFs, Office files, audio and video. Optional add-ons go after the statistical watermarks hidden in AI text and pixels, including SynthID-class marks. Visible stock-photo watermarks are untouched. It ships as an agent skill and Claude Code plugin over a local Python service, MIT licensed and free.
The core is easy: make serve or Docker Compose, and the skill calls it over HTTP. A hook can check every file your agent writes. The add-ons are not: text rewriting needs an LLM backend, and pixel removal wants a GPU and about 10GB of models from an upstream repo with no license file.
There's no paid tier. Solo and small teams: free, and the metadata cleanup is useful hygiene. Larger teams: free, but get legal sign-off before anyone runs the removal add-ons.
The catch: this grew from hygiene into attacks. v0.7.0 added a watermark-stealing module, audio and video watermark removal, and its rewrite benchmark scores human-likeness with Pangram, a commercial AI-text detector. Its own ethics page rules out passing AI text off as human. China bans tools that help others maliciously strip AI labels.
Free and MIT. The real costs are optional: an LLM API for text rewrites, a GPU for pixel removal, and legal review, since two upstream add-ons carry non-commercial or no license at all.
**Free:** Everything, MIT. The core scripts are Python stdlib; exiftool, qpdf and c2patool are optional helpers. Two skills ship: `remove-ai-marks` (service-backed) and `clean-user-facing-text` (text only, self-contained). **Self-hosted:** Run the HTTP service locally (`make serve`, default 127.0.0.1:8765) or via Docker Compose; install the skill for Claude Code, Codex, Cursor, Grok or Cowork, or as a Claude Code plugin with a PostToolUse hook (check mode by default). Optional backends each add cost or license risk: Layer B rewriting needs a local Ollama model or an OpenAI-compatible API you pay for; CtrlRegen pixel removal wants a GPU, about 10GB of model downloads and an HF_TOKEN for gated models, from an upstream repo with no LICENSE (the project treats it as all-rights-reserved); the reverse-SynthID scorer is under a non-commercial Research License; MarkLLM is Apache 2.0. **Paid:** No paid tier. Simple Unmark, an unaffiliated third party, offers a hosted text-only web app built on it.
img2threejs takes a reference image and rebuilds the object in it as procedural Three.js code, using primitives and shaders instead of a downloaded mesh. It is an agent skill, not a library: you install it into Claude Code, Codex, or OpenCode and the agent runs the pipeline. Apache 2.0 since July 2026, when it moved off MIT. The design is the interesting part. Deterministic Python scripts handle validation, quality gates, and code generation using only the standard library, while the model's tokens go to the visual judgment steps: look at the image, assess it, review the render. Version 2.0 turned it into a plugin system with an img2 installer, official plugins for characters and Counter-Strike 2 weapons, and a GLB export path. Web developers who need 3D objects and would rather not model them or license assets are the audience, mostly solo and small teams. Subjects are classified as object, character, or hybrid, and characters route through an anatomy-aware track. The catch: it is strongest on hard-surface objects, and the project says so. Characters come out as stylized reconstructions, not photoreal likeness, even with the new opt-in projection path. It is also token-hungry by the README's own admission, estimating roughly 80k to 180k tokens per object. It will tell you when an image cannot reach the fidelity you asked for.
Free and Apache 2.0. You pay for agent tokens, and the project estimates 80k to 180k of them per object.
**Free:** Everything. Apache 2.0 (relicensed from MIT in July 2026). There is no hosted version and no paid tier, because it is a skill that runs inside an agent you already pay for. The project is funded by sponsors and donations. **Self-hosted:** Nothing to host. The core needs Python 3.10 or later and only the standard library. The plugin installer runs through npx, and optional components (SAM2 masks, depth estimation, the GLB pipeline) bring their own dependencies. **Paid:** None. Your spend is agent tokens. The project's own engineering estimate is roughly 80k to 180k tokens for one object and 150k to 350k for a character.
Ponytail is a free rules pack that talks your coding agent out of writing code. Before typing, the agent climbs a seven-rung ladder: does this need to exist, is it already in the codebase, the standard library, a native platform feature, an installed dependency, one line, and only then the minimum that works, plus one small test for real logic. MIT licensed, nothing to host. Claude Code and Codex install it as a plugin in two commands. Windsurf, Cline, Aider, Zed and Kiro take a copied rules file without the slash commands. Commands cover intensity (lite, full, ultra), diff review, a whole-repo audit and a tech-debt ledger. Version 5's own benchmark (39 tasks, Opus 5.5, Claude Code) reports 53% less code, 26% lower cost and 41% faster runs than no skill. It's the maintainer's harness, so treat it as directional. Solo and small teams: free. Medium and large teams: free, and worth putting the review command into PRs. The catch: "write less" is a judgment call. A minimalist agent makes quieter mistakes, like reused code that almost fits. Start on lite and read what it declines to build.
Free and MIT licensed, and one of the few free tools that claims to cut a bill you already pay: its own v5 benchmark puts Claude Code sessions about 26% cheaper.
**Free:** All of it, MIT licensed. Every intensity level, all six commands (`/ponytail`, `/ponytail-review`, `/ponytail-audit`, `/ponytail-debt`, `/ponytail-gain`, `/ponytail-help`) and every agent integration. No account, and the lifecycle hooks make no network calls. **Self-hosted:** Nothing to host. Plugin install for Claude Code and Codex, per-agent installs for Copilot CLI, Gemini CLI, OpenCode, Devin CLI, Qoder and others, or a copied rules file (`AGENTS.md`, `.cursor/rules/`, `.windsurf/rules/`, `.clinerules/`, `.kiro/steering/`) for agents without plugin support; rules-file agents get the always-on ruleset but not the commands. The Claude Code and Codex plugins (and Cursor hooks) run small Node.js hooks, so `node` should be on your PATH; without it the skills still work but each hook call prints a `node: command not found` error. Optional default level via `~/.config/ponytail/config.json` or `PONYTAIL_DEFAULT_MODE`. **Paid:** No paid tier. You still pay for the agent and model it runs inside. The v5 benchmark measured mean cost per Claude Code session at $0.200 with no skill and $0.142 with Ponytail 5 (list price). The maintainer runs an email waitlist at ponytail.dev/soon for an unnamed upcoming product; nothing is priced yet.
Cloudflare's security-audit skill turns a coding agent into a code auditor. A skill is a packaged set of instructions an AI agent loads for one job. This one maps your app's trust boundaries, sends isolated hunter agents through a coverage plan, then hands every candidate to a fresh agent that tries to disprove it before anything gets reported. It's the seed of Cloudflare's own fleet scanner, MIT licensed and free.
Install is one command, npx skills add, then ask your agent to audit the repo. You need an agent that runs parallel sub-agents, plus Node for the bundled validators. It only executes the target's code inside a network-off sandbox. Without one, leads stay marked needs_validation.
There's no paid tier. The bill is model tokens, and a full run spawns a lot of agents. Solo devs and small teams: free and a strong first pass. Larger teams: one input next to a human review.
The catch: one run isn't enough. Cloudflare says a single run finds about half of what repeated runs catch, skewed toward simpler bugs. And its prompts don't tell agents to ignore instructions planted in the code they read, so a hostile repo could steer the audit.
Free and MIT licensed. The real cost is model tokens across many sub-agents, and since one run finds about half of what repeated runs do, budget for several.
**Free:** MIT licensed with no license fee. Install through the Skills CLI (`npx skills add`, pointed at the repo with `--skill security-audit`) and run as many audits as you want. Security questions get a lighter guidance mode; the full six-phase workflow runs when you ask for a codebase audit or pen-test. **Self-hosted:** Runs inside your own coding agent, so there's no service to operate. Requirements: an agent whose model supports tool use and parallel sub-agents, and Node.js for the zero-dependency findings and coverage-ledger validators. Confirming findings by running the target's code needs an OS-enforced sandbox (no external network, allowlisted environment, resource limits); without it the skill stays read-only and leaves leads as needs_validation. Output defaults to `~/security-audit-skill/<repo-name>/run-<N>`. **Paid:** No paid tier for the skill. Your spend is model tokens, and it scales with agent count: each coverage unit is roughly one hunter assignment and each surviving candidate one or two verifier assignments. You can set a budget as a maximum number of agent invocations. Multiple runs are additive, and Cloudflare reports a single run finds roughly half of what repeated runs find, so plan for more than one.
Anatomy makes Claude explain a technical idea by drawing a machine that does it. Ask how a token-bucket rate limiter works and you get an interactive isometric figure built from dozens of shaded SVG parts, with live numbers from the same model that moves them. WebGL handles fire, water and glow; a beta 3D mode turns parts in true depth. MIT, free, no API keys.
Install is one npx skills add line, and it also loads in Codex, OpenCode, Antigravity and MiniMax Code. The kit uses only Node's built-in modules, but the self-checks need Node 20.10+ and Chrome, driven headless to screenshot and audit every joint. Eight examples ship in the repo, from a dial gauge to a Raptor engine. Solo writers, devrel folks and small docs teams: free. Larger teams with designers will still hand final art to an illustrator.
The catch is time, which means tokens. The author publishes his own numbers: a watch movement took 1 hour 54 minutes of Claude working, the Raptor engine 10 hours 33 minutes, a turbofan 14 hours. The skill demands at least 40 parts per figure and won't trade detail for speed unless you ask. Ask for a quick figure first.
Free and MIT, but a detailed figure can burn hours of agent time; the author's own builds ran from about 2 to 14 hours.
**Free:** The skill, the drawing kit, the audit and capture scripts, and eight example figures are MIT. No API keys and nothing to `npm install`. **Self-hosted:** Runs locally inside Claude Code, Codex, OpenCode, Antigravity or MiniMax Code. Needs Node.js 20.10+ for builds and checks, Chrome or Chromium for the headless screenshot and audit scripts, and React 18+ only if you want component output. The skills CLI copies the whole repo, examples included, about 10 MB. A separate MIT npm package, anatomy-figures, ships the author's finished figures as React components. **Paid:** No paid tier. The cost is agent time: the author reports 1 h 54 min of Claude's active time for a watch movement, 10 h 33 min for the Raptor engine and 14 h for a turbofan, review rounds included. Budget your agent plan or API spend accordingly.
Dify is a visual builder for AI apps: chatbots, RAG over your documents and agent workflows on a visual canvas, each exposed as an API. It works with hundreds of hosted and local models. Picture n8n rebuilt around LLMs. The Community Edition is free to self-host.
Self-hosting starts with docker compose up -d on a box with 2 cores and 4 GiB of RAM, but the default stack is about 15 containers: API, workers, web, Postgres, Redis, code sandboxes, a plugin daemon, SSRF proxies, Nginx and Weaviate. Read release notes before upgrading: 1.17.1 required a staged manual Weaviate upgrade or vector search could silently break.
Dify Cloud has a free Sandbox tier. Professional is $59 per workspace a month for 3 members; Team is $159 a month for 50. Self-hosted Community is one workspace, and SSO is Enterprise only, custom priced. Solo: self-host free. Small teams: self-host, or Professional to skip the ops. Larger orgs: Enterprise once you need SSO.
The catch is the license: Apache 2.0 plus conditions. No multi-tenant hosting and no removing the Dify logo from the frontend without a commercial license. Security has been rough too, with a run of cross-tenant bugs through 2026. Patch fast.
Self-hosting is free for a single workspace if you keep the logo and don't resell it as multi-tenant SaaS. Cloud runs $59 or $159 per workspace a month ($590 or $1,590 a year), and SSO or multiple workspaces means an Enterprise contract.
**Free:** Self-hosted Community Edition: all core features in the public repo (workflow canvas, RAG pipeline, agents, prompt IDE, model management, APIs), limited to a single workspace and bound by the Dify Open Source License. Dify Cloud Sandbox is also free: 200 message credits, 1 member, 5 apps, 50 knowledge documents, 50MB storage, 30 days of logs, 5,000 API calls a month. **Self-hosted:** Docker Compose on at least 2 CPU cores and 4 GiB RAM. The default profile starts about 15 services (api, api_websocket, worker, worker_beat, web, Postgres, Redis, two sandboxes, plugin_daemon, agent_backend, two Squid SSRF proxies, Nginx, Weaviate); MySQL and about 15 other vector stores are optional profiles. You bring your own model API keys. Upgrades can need manual steps: 1.17.1 required a staged Weaviate upgrade from 1.27.0 to 1.39.2. The license forbids running it as a multi-tenant service (one tenant = one workspace) or removing the logo and copyright from the web frontend without a commercial license. The pricing page frames Community as for "non-commercial projects", but the LICENSE itself allows commercial use outside those two conditions. **Paid:** Dify Cloud Professional: $59 per workspace per month or $590 per workspace per year (annual saves 17%), 5,000 message credits a month, 3 members, 50 apps, 500 knowledge documents, 5GB storage. Team: $159 per workspace per month or $1,590 per year, 10,000 message credits a month, 50 members, 200 apps, 1,000 documents, 20GB storage. Prices exclude tax. Enterprise (self-hosted or cloud): custom pricing, adds a commercial license, multiple workspaces, SSO, negotiated SLAs and official support.