Top 19 Trending Go Projects on GitHub

October 2026 trending Go repos

The Go ecosystem continues to thrive, and this month’s trending list is heavy on AI agent infrastructure. This overview analyzes the top trending Go repositories on GitHub this month.

If you’re new to Go, check out our Go Cheatsheet for a quick language overview.

This article is part of our Developer Tools: The Complete Guide to Modern Development Workflows.

Most Popular Go projects - racing gophers

Seven of the nineteen entries are agent-related: two memory layers, two autonomous pentesting systems, a sandboxing runtime, a workflow engine from GitHub itself, and the local LLM runtime that powers much of the rest.

Overview

Based on data from GitHub’s trending page, here are the 19 most actively growing Go projects this month, with data collected on October 25, 2026. Each entry includes total stars, monthly growth, license, and a description of what makes the project noteworthy.

1. PentAGI - 7,574 ⭐ this month

Metric Value
Repository vxcontrol/pentagi
Total Stars 32,327
License MIT
Category AI Security

PentAGI is a fully autonomous AI agents system capable of performing complex penetration testing tasks. It runs as a Docker-based stack with a web dashboard, isolates agents’ tooling in containers, and supports a long list of LLM providers: OpenAI, Anthropic, Google Gemini, AWS Bedrock, DeepSeek, GLM, Kimi, Qwen, MiniMax, Mistral, xAI, and local models through Ollama.

Key Features:

  • Autonomous agents for complex pentesting workflows
  • Agent Docker access without exposing the host
  • 12+ LLM providers including Ollama for local inference
  • Monitoring and observability out of the box
  • Knowledge graph integration (Graphiti) and optional Langfuse tracing

2. Ollama - 4,044 ⭐ this month

Metric Value
Repository ollama/ollama
Total Stars 184,674
License MIT
Category LLM Runtime

Ollama is the most popular way to run large language models locally. Its README now leads with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, and Gemma, and it provides a simple CLI and API for local AI inference. If you want to run LLMs on your machine without sending data to the cloud, see our Ollama cheatsheet for commands and configuration tips.

Key Features:

  • One-command model downloads (ollama run llama3)
  • OpenAI-compatible API endpoint
  • Multi-model management
  • GPU acceleration support
  • Modelfile customization

3. Caddy - 2,484 ⭐ this month

Metric Value
Repository caddyserver/caddy
Total Stars 78,372
License Apache-2.0
Category Web Server

Caddy is a fast and extensible multi-platform web server with automatic HTTPS, serving HTTP/1, HTTP/2, and HTTP/3. It remains the default answer for developers who want TLS certificates handled without extra tooling, and its steady release cadence keeps it visible on the trending page.

Key Features:

  • Automatic HTTPS with Let’s Encrypt by default
  • HTTP/1, HTTP/2, and HTTP/3 support
  • Caddyfile configuration and a JSON API
  • Extensible via Go modules
  • Single static binary deployment

4. Agent Substrate - 2,103 ⭐ this month

Metric Value
Repository agent-substrate/substrate
Total Stars 5,778
License Apache-2.0
Category Agent Infrastructure

Agent Substrate is a security-hardened, zero-trust runtime for sandboxed agents on Kubernetes, engineered to run large agent fleets with roughly 10x higher density than standard containers. It supports microVMs and gVisor as sandbox technologies and maps stateful agent workloads (“actors”) onto a smaller pool of ready workers: idle agents are snapshotted out of memory and restored on demand.

Key Features:

  • Zero-trust sandboxing with microVMs and gVisor
  • Resume from snapshot in under 400ms, 1,500+ activations per second
  • Isolated compute, identity, networking, and storage per agent
  • Credentials kept out of reach from untrusted code
  • Runs on standard Kubernetes primitives

5. TUIOS - 2,036 ⭐ this month

Metric Value
Repository Gaurav-Gosain/tuios
Total Stars 5,842
License MIT
Category Terminal Multiplexer

TUIOS (Terminal UI Operating System) is a terminal multiplexer and window manager with a vim-like modal interface, multiple panes, workspaces, BSP tiling, kitty graphics protocol support, and a command palette. A daemon keeps sessions alive across restarts and other machines, and lets the coding agents running in your panes report their state and message each other through a shared inbox. It is built on the Charm stack (Bubble Tea v2, Lipgloss v2); if you are weighing terminal UI toolkits yourself, our BubbleTea vs Ratatui comparison covers the trade-offs.

Key Features:

  • Tiling panes, workspaces, and sessions that survive restarts
  • Daemon connects sessions across machines
  • Agent inbox: panes report state and message each other
  • Kitty graphics protocol passthrough with near-zero idle CPU
  • Command palette and vim-like modal control

6. Go - 1,622 ⭐ this month

Metric Value
Repository golang/go
Total Stars 139,522
License BSD-3-Clause
Category Programming Language

The Go project’s own repository trends periodically, usually around releases and release-candidate discussion cycles. Its presence on a list otherwise full of third-party tools is a reminder that the language itself still draws steady attention from newcomers and contributors alike.

7. Kubernetes - 1,526 ⭐ this month

Metric Value
Repository kubernetes/kubernetes
Total Stars 128,617
License Apache-2.0
Category Container Orchestration

Kubernetes is the production-grade container scheduling and management system, and its appearance on a monthly trending list alongside agent infrastructure is no coincidence: Agent Substrate in this list runs on it, and most agent platforms target Kubernetes deployments from day one.

8. Beacon (agent-beacon) - 1,302 ⭐ this month

Metric Value
Repository Asymptote-Labs/agent-beacon
Total Stars 2,781
License MIT
Category AI Agent Memory

Beacon is a cross-harness, self-improving memory layer for AI coding agents. It captures full session history from Claude Code, Cursor, Codex, OpenCode, Cline, and 20+ other harnesses into one OpenTelemetry-based trace format, then turns reviewed workflows, corrections, and debugging patterns into reusable knowledge that future agents retrieve through MCP or Agent Skills. The open-source CLI is local-first: every extracted lesson requires human review, and cloud forwarding is optional — recent reviews note that the installer preselects Beacon Cloud, so choose Local explicitly if you want sessions to stay on your machine. For a deeper take on self-hosted agent memory, see our Hindsight for Hermes guide.

Key Features:

  • Cross-harness session capture from 20+ coding agents
  • Exact session replay: prompts, responses, tools, edits, tokens
  • Reviewed knowledge reuse via MCP or Agent Skills
  • Durable JSONL storage with no harness lock-in
  • Optional SIEM export for agent activity auditing

9. OpenBao - 1,231 ⭐ this month

Metric Value
Repository openbao/openbao
Total Stars 8,693
License MPL-2.0
Category Secrets Management

OpenBao manages, stores, and distributes sensitive data including secrets, certificates, and keys. It is the community-governed fork of HashiCorp Vault under the Linux Foundation, kept MPL-2.0 licensed, and adoption continues as teams look for a vendor-neutral Vault alternative.

Key Features:

  • Secrets, certificates, and key management
  • MPL-2.0 license under Linux Foundation governance
  • Vault-compatible API surface
  • Transit encryption and dynamic secrets
  • HA deployment options

10. go-music-dl - 876 ⭐ this month

Metric Value
Repository guohuiyuan/go-music-dl
Total Stars 5,598
License AGPL-3.0
Category Media Downloader

go-music-dl is a music search and download tool for mainstream Chinese platforms, including NetEase Cloud Music, QQ Music, Kugou, Bilibili, and Qishui Music. It runs in both CLI and web-service modes, with concurrent multi-source search and lossless-audio resolution.

Key Features:

  • CLI and web service modes
  • 10+ supported music platforms
  • Concurrent multi-source search
  • Lossless audio quality resolution

11. Engram - 828 ⭐ this month

Metric Value
Repository Gentleman-Programming/engram
Total Stars 7,598
License MIT
Category AI Agent Memory

Engram is a persistent memory system for AI coding agents, shipped as a single agent-agnostic Go binary. It stores decisions, preferences, corrections, and project knowledge in SQLite with FTS5 full-text search, and exposes it through an MCP server, HTTP API, CLI, and TUI. It connects to Claude Code, OpenCode, Gemini CLI, Codex, VS Code, and more over MCP stdio — memory without a database stack to maintain.

Key Features:

  • One Go binary, SQLite + FTS5 storage in ~/.engram/
  • MCP server, HTTP API, CLI, and TUI interfaces
  • Works with 14 agent harnesses
  • Health-checked capability negotiation for strict clients like Codex
  • Optional Git sync for portable memory

12. TruffleHog - 715 ⭐ this month

Metric Value
Repository trufflesecurity/trufflehog
Total Stars 28,691
License AGPL-3.0
Category Secrets Detection

TruffleHog finds, verifies, and analyzes leaked credentials across git repositories, filesystems, and CI pipelines. With agent tooling multiplying the number of tokens and API keys in circulation, secret scanning keeps drawing fresh interest.

Key Features:

  • Hundreds of credential detectors with live verification
  • Scans git history, filesystems, and containers
  • CI/CD integration for pre-merge checks
  • Custom detectors for private secret formats

13. Trivy - 703 ⭐ this month

Metric Value
Repository aquasecurity/trivy
Total Stars 38,698
License Apache-2.0
Category Vulnerability Scanning

Trivy finds vulnerabilities, misconfigurations, secrets, and SBOM issues in containers, Kubernetes clusters, code repositories, and cloud infrastructure — one scanner covering the surfaces most security reviews touch.

Key Features:

  • Container, filesystem, git, and Kubernetes scanning
  • IaC misconfiguration checks (Terraform, CloudFormation, Helm)
  • SBOM generation and license scanning
  • Secrets detection built in

14. Xray-core - 658 ⭐ this month

Metric Value
Repository XTLS/Xray-core
Total Stars 42,306
License MPL-2.0
Category Proxy Platform

Xray-core is an open proxy platform and the most actively developed successor to v2ray-core. It remains the core of many self-hosted proxy setups and continues to attract stars as its protocol work evolves.

Key Features:

  • Multi-protocol proxy platform (VLESS, VMess, Trojan, and more)
  • XTLS and REALITY transport innovations
  • Cross-platform single-binary deployment
  • Routing and inbound/outbound rule engine

15. Terraform - 613 ⭐ this month

Metric Value
Repository hashicorp/terraform
Total Stars 50,114
License BUSL-1.1
Category Infrastructure as Code

Terraform lets you safely and predictably create, change, and improve infrastructure by codifying APIs into declarative configuration files. It moved to the source-available BUSL-1.1 license in 2023, which spurred the OpenTofu fork, yet the original remains a trending fixture. Our Terraform cheatsheet covers the everyday commands.

Key Features:

  • Declarative infrastructure as code
  • Provider ecosystem covering hundreds of platforms
  • Plan/apply workflow with state tracking
  • Modules for reusable configurations

16. Pentest Swarm AI - 497 ⭐ this month

Metric Value
Repository Armur-Ai/Pentest-Swarm-AI
Total Stars 3,049
License AGPL-3.0
Category AI Security

Pentest Swarm AI is an autonomous API and web-application pentester built on a swarm of AI agents. Specialist agents handle recon, classification, exploitation, and reporting with ReAct-style reasoning, chaining attacks such as BOLA/IDOR, JWT forgery, mass assignment, SSRF, and injection, then scoring attack paths against live state. The project positions itself as an open-source alternative to XBOW, aimed at pentesters, bug bounty hunters, and red teamers.

Key Features:

  • Swarm of specialist agents: recon, exploitation, reporting
  • Attack chaining: BOLA/IDOR, JWT forgery, SSRF, injection
  • Adaptive attack-path scoring with reinforcement of what works
  • Proof-of-vulnerability output at machine speed

17. whatsapp-mcp - 421 ⭐ this month

Metric Value
Repository lharries/whatsapp-mcp
Total Stars 6,713
License MIT
Category MCP Server

whatsapp-mcp is a WhatsApp MCP server that lets LLM agents search your message history and send messages on your behalf. The repository has not been updated since mid-2025, so its trending appearance is a viral revival — worth checking the open issues before relying on it against current WhatsApp clients.

18. ZITADEL - 370 ⭐ this month

Metric Value
Repository zitadel/zitadel
Total Stars 15,425
License AGPL-3.0
Category Identity

ZITADEL is identity infrastructure: login, SSO, OIDC/OAuth2, and multi-tenancy in a single self-hostable server. It sits in the same self-hosted band as OpenBao on this list — teams consolidating identity and secrets onto infrastructure they control.

Key Features:

  • OIDC, OAuth2, and SAML out of the box
  • Multi-tenancy with organizations and projects
  • Self-hosted with a cloud offering available
  • Actions for custom authentication flows

19. GitHub Agentic Workflows (gh-aw) - 309 ⭐ this month

Metric Value
Repository github/gh-aw
Total Stars 5,462
License MIT
Category AI Workflow Automation

GitHub Agentic Workflows is a GitHub CLI extension that compiles AI-powered repository automation, written in Markdown with YAML frontmatter, into standard GitHub Actions workflows. Built-in engines include GitHub Copilot, Claude Code, OpenAI Codex, Google Gemini, and Pi. Agent jobs are read-only and sandboxed by default, with writes applied through validated safe-outputs jobs with scoped permissions — GitHub’s answer to delegating chores like issue triage and PR review the way CI delegates builds. For the surrounding machinery, see our GitHub Actions cheatsheet.

Key Features:

  • Agentic workflows defined in Markdown + YAML frontmatter
  • Engines: Copilot, Claude Code, Codex, Gemini, Pi
  • Sandboxed, read-only agent jobs by default
  • Safe-outputs system limits what agents can write
  • GitHub dogfoods it on the gh-aw repo itself

Summary Table

Rank Project Stars/Month Total Stars Category
1 PentAGI 7,574 32,327 AI Security
2 Ollama 4,044 184,674 LLM Runtime
3 Caddy 2,484 78,372 Web Server
4 Agent Substrate 2,103 5,778 Agent Infrastructure
5 TUIOS 2,036 5,842 Terminal Multiplexer
6 Go 1,622 139,522 Programming Language
7 Kubernetes 1,526 128,617 Container Orchestration
8 Beacon 1,302 2,781 AI Agent Memory
9 OpenBao 1,231 8,693 Secrets Management
10 go-music-dl 876 5,598 Media Downloader
11 Engram 828 7,598 AI Agent Memory
12 TruffleHog 715 28,691 Secrets Detection
13 Trivy 703 38,698 Vulnerability Scanning
14 Xray-core 658 42,306 Proxy Platform
15 Terraform 613 50,114 Infrastructure as Code
16 Pentest Swarm AI 497 3,049 AI Security
17 whatsapp-mcp 421 6,713 MCP Server
18 ZITADEL 370 15,425 Identity
19 gh-aw 309 5,462 AI Workflow Automation

Agent infrastructure owns the top of the list. PentAGI, Agent Substrate, Beacon, Engram, and gh-aw all serve the same shift: running autonomous agents safely and giving them memory that survives sessions. The AI-focused cross-language roundup covers these and the rest of the AI stack, grouped by the job a project does instead of by language.

Security agents went autonomous. Both PentAGI and Pentest Swarm AI don’t just scan — they chain exploits and report findings, which is moving pentesting from periodic audits toward continuous automated testing.

The classics keep drawing stars. Caddy, Kubernetes, Terraform, and Go itself share the page with brand-new repositories, and TruffleHog and Trivy ride the same security wave the AI pentesters started.

Sources

Subscribe

Get new posts on AI systems, Infrastructure, and AI engineering.