The best open-source MCP Agents tools, curated: 64 in the registry, including Agentic Inbox (Cloudflare — self-hostable AI email agent), awesome-mcp-servers, Alook. Every tool is open-source; each entry lists license, self-hostability, and links.
Agentic Inbox (Cloudflare — self-hostable AI email agent)· tool, 2026-10-19 Apache-2.0, self-hostable email client with a built-in AI agent that runs entirely on Cloudflare Workers: it drafts replies with human-in-the-loop review using the Cloudflare Agents SDK and Workers AI, so a lean team can own an agentic inbox on infrastructure it controls instead of renting a closed AI-email SaaS seat.
awesome-mcp-servers· tool, 2026-10-11 Community-curated, MIT-licensed directory of Model Context Protocol servers spanning dozens of categories (browser automation, cloud infra, databases, design, research, media, dev tools) — a single discovery index instead of hunting GitHub topic tags for MCP integrations.
Alook· tool, 2026-10-09 Open-source collaboration layer where local coding agents (Claude Code, Codex, Cursor, OpenCode, Pi) get persistent identities and join Discord-style team rooms, addressable with an @-mention instead of a terminal copy-paste. Agents run on your own machine; Alook only connects them.
ADR (Agentic AI Detection and Response)· tool, 2026-10-07 ADR (Agentic AI Detection and Response) is Uber's open-source platform for securing the AI agents a team runs: Discovery inventories the AI apps, agents, runtimes, and MCP servers on an endpoint; a Sensor normalizes telemetry from Claude Code, Cursor, Codex, Copilot CLI, and DeepSeek Harness; and a dual-agent Detection layer triages suspicious sessions. Ships ADR-Bench (300+ tasks, 134 MCP servers, 17 attack techniques). Apache-2.0; self-hostable. Free. In production at Uber; MLSys 2026.
Clai· tool, 2026-10-03 Clai is an open-source command-line AI harness for terminal power users: context-engineering and agent workflows you run as a standalone CLI or embed as a Go package. Open source: yes (MIT); self-hostable. Free OSS; ~145 stars; established and active (~925 commits since 2024).
OpenDots (CopilotKit)· tool, 2026-10-03 OpenDots is CopilotKit's open-source template for persistent, always-on AI agents that each get their own computer and move between text, calls, and Slack, on web and mobile. Open source: yes (MIT); self-hostable; bring your own OpenAI-compatible model. Free OSS; ~2.2k stars; new (~18 commits). Distinct from the separately-listed anil-matcha/open-dots.
Nanobrowser· tool, 2026-10-02 Nanobrowser is an open-source Chrome extension for AI-powered web automation: it runs multi-agent workflows inside your own browser using your own LLM API key, positioned as an alternative to OpenAI Operator. Open source: yes (Apache-2.0); self-hostable (runs in your browser, bring your own key). Free OSS; ~13.9k stars; active (~376 commits).
RRSI· tool, 2026-10-01 RRSI (Regularized Recursive Self-Improvement) is a Google Research framework that lets an LLM agent evolve its own harness — prompts, control flow, tools, memory, skills, sub-agents — around a frozen model, while a regularized search curbs the overfitting that plain harness-evolution produces on the training tasks. Open source: yes (Apache-2.0); self-hostable. Free OSS; ~1.1k stars; paper-backed (arXiv 2609.24972).
Mingbird· tool, 2026-09-30 Mingbird is a local-first agent harness that gets small 2–9B models to finish real multi-step tasks on an ordinary laptop, running offline against a local Ollama backend. Open source: yes (Apache-2.0); self-hostable (local Ollama; one-click zero-outbound mode; config in ~/.ollama_agent/config.json). Free OSS; ~1 star (brand-new, created 2026-09-17); active (30 commits, v1.8.2, 461-test suite, CI on Linux/macOS).
Open Dots· tool, 2026-09-30 Open Dots is a self-hosted AI agent workspace — chat, tool integration, and optional computer automation — with a deny-by-default gateway that pauses higher-risk actions for explicit human approval before they run. Open source: yes (MIT); self-hostable. Free OSS; ~4.8k stars; active (104 commits). An OSS alternative to hosted 'Dots'-style agent workspaces.
agent-custody· tool, 2026-09-28 agent-custody is a chain-of-custody layer for AI agents: signed receipts for every tool call, a Cedar-policy MCP gateway, a Merkle tamper-evident transparency log, and offline/browser verifiers, with adapters for LangChain, OpenAI Agents SDK, and Claude Agent SDK. Open source: yes (Apache-2.0); self-hostable; freemium. Active (~217 commits, 0.6.x).
Charter· tool, 2026-09-28 Charter is a Python library that lets you declare agent API tools as Pydantic schemas instead of hand-implementing them, auto-handling request construction, auth, wire format, and response trimming. Open source: yes (Apache-2.0); self-hostable; pricing free. In-process, no telemetry; launched 2026-09-28; 1 star.
Open-Agent-DB· tool, 2026-09-28 Open-Agent-DB is an offline-first catalog and search engine for AI agent skills, MCP servers, and project directives, queryable via `npx open-agent-db search` with full-text (SQLite FTS5) and dense-vector semantic search. Open source: yes (MIT); self-hostable; pricing free. Local SQLite, offline-first; launched 2026-09-28.
OpenAPPA· tool, 2026-09-28 OpenAPPA is a deterministic guardrail layer that intercepts agent tool calls and verifies data flows against declarative policies, blocking data exfiltration from prompt injection or hallucination without breaking agent function. Open source: yes (MIT); self-hostable; pricing free. Runs in-process; 26 stars; active.
browser-session-ctl· tool, 2026-09-27 browser-session-ctl is a Chrome extension plus local sidecar that lets shell commands click, type in, and read your existing logged-in browser session, for use with Claude. Open source: yes (GPL-3.0-or-later); self-hostable; pricing free. Localhost-only, JavaScript, 27 commits.
Chimera· tool, 2026-09-27 Chimera is a local-first workspace where AI agents propose actions classified auto, confirm, or blocked, with every decision written to a tamper-evident audit chain. Open source: yes (Apache-2.0); self-hostable; pricing free. Model-independent (Codex, Claude Code, Bedrock, OpenRouter); source beta.
Provenance Gate· tool, 2026-09-27 Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. Early PoC; runs as a Claude Code plugin.
swe-mux· tool, 2026-09-27 swe-mux is a terminal multiplexer that runs multiple coding agents (Claude Code, Codex) side by side with live per-session status, reachable from a phone over Tailscale. Open source: yes (Apache-2.0); self-hostable; pricing free. Python 3.12+, PyPI wheel, 6 stars, fresh.
ToolHive Registry Catalog· tool, 2026-09-26 Open-source registry catalog of MCP servers from Stacklok (Apache-2.0). Demonstrates twin catalog streams — servers for executable components and skills for reusable prompt workflows — with an allowedTools array that bounds which tools a skill may invoke, keeping agent execution scoped.
oh-my-subagents· tool, 2026-09-25 oh-my-subagents is local subagent orchestration for Codex and Claude — persistent task state, reusable teams, and interruption recovery. Its licensing is split, not simply 'open source': the core orchestration code is MIT, but the Console UI is source-available under the n8n-derived Sustainable Use License v1.0 (internal/non-commercial use only; no commercial redistribution), which is not OSI-open. It has 142 stars.
Skillpack· tool, 2026-09-25 Skillpack is an MIT-licensed, self-hostable, multi-tenant hub to share, version and publish agent skills across MCP clients — an OAuth 2.1 MCP server with a native CLI and a web UI. Made by Stan Girard (of Quivr), authorship confirmed. It is both a hub-style service and a real self-hostable OSS core. It is very new: 5 stars, created 2026-09-14, last pushed 2026-09-25.
Beacon· tool, 2026-09-24 Beacon is an MIT-licensed, local-first memory layer that captures AI-coding-agent sessions across harnesses — Claude Code, Cursor, Codex, OpenCode and others — and serves reusable knowledge over MCP or Agent Skills. It has 1,493 stars, is actively releasing (v1.3.x this week), and self-hosts. Its claim to grade runs into reusable skills is the tool's own, not a verified result.
Amazon blocks Meta's Muse agent from its store — the agentic-shopping standoff gets a first real casualty· news, 2026-09-22 On Sep 20, 2026, Amazon began pop-up-blocking Meta's 'Muse' AI shopping agent from its retail site, telling the agent its access violates Amazon's terms and citing non-disclosure, failure to self-identify, and credential-storage concerns. Meta, which launched Muse on Sep 8, declined to pull the bot. It is the sharpest instance yet of a platform refusing a third-party agent — a data point for anyone whose GTM plan assumes agents can shop or buy across sites they don't control.
GHAPPIER: a malicious npm MCP package passed trusted publishing with valid provenance· news, 2026-09-22 CloudSEK disclosed GHAPPIER (Sep 20, 2026), a malware loader that shipped inside a malicious npm release — @dforge-core/dforge-mcp v0.2.21 — which passed npm's trusted publishing and carried valid provenance by hijacking a GitHub Actions workflow, with the loader family touching around 65 repositories across 22 accounts. The pointed detail for GTM and agent stacks: the poisoned package was itself an MCP package, and 'valid provenance' did not mean 'safe source.'
WebMCP Registry· news, 2026-09-22 A hosted, daily-crawled public directory from the Tomo team that lists websites exposing agent-callable tools via WebMCP — Zapier, OpenAI's developer surface, Shopify stores and more — with a free public JSON API and self-registration. It is a discovery layer for the emerging pattern of sites publishing tools a personal agent can call, and a place to make your own site agent-usable. Naming trap: this Tomo-run directory is distinct from the open WebMCP protocol effort itself.
ZCode· tool, 2026-09-21 Apache-2.0 agentic development environment from Z.ai (Zhipu): a TypeScript Electron app that puts the agent conversation at the center, surrounded by a file manager, terminal, Git panel and live browser preview, with desktop, browser and terminal interfaces and an Agent CLI runtime. Z.ai open-sourced the full stack (client, backend, UI, Agent CLI). It is built as the official harness for GLM models and does not ship Claude or GPT support, though the license lets you add integrations.
Cloudflare security-audit-skill· tool, 2026-09-20 MIT coding-agent skill from Cloudflare (JavaScript) that turns an agent into a multi-phase security auditor, built on the assumption the agent will hallucinate, so it makes the agent prove everything. Recon maps the app's trust boundaries, isolated hunter agents attack from separate angles (injection, access control, business logic, crypto), validation agents try to disprove each finding, and the agent that checks a finding is never the one that found it. Output is verified and machine-readable.
ZizkaDB· tool, 2026-09-20 AGPL-3.0 audit-trail database for AI agents (Python) that records every agent decision and session as tamper-evident, checksum-backed logs, tracks the causal lineage between them, and lets you replay a session to see how the agent reached a decision. Each entry carries a checksum that changes if the record is altered, so the trail is verifiable for debugging and compliance. Self-hostable via Docker for free; a managed cloud tier is a separate paid option.
Agent Governance Toolkit· tool, 2026-09-19 MIT public-preview governance stack from Microsoft for putting deterministic controls around autonomous agents. It intercepts tool calls, messages and delegations before execution, evaluates YAML, OPA or Cedar policies, assigns agent identity, records audit decisions, and adds sandboxing, kill switches and MCP security. The Python stack installs locally, with SDKs or adapters for TypeScript, .NET, Rust, Go, OpenAI Agents SDK, LangGraph, CrewAI, AutoGen, Semantic Kernel and other runtimes.
Bastionskill· tool, 2026-09-18 MIT skill-poisoning scanner (Python, by Stefano Rizzello) that reads an agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and capabilities the SKILL.md never declared. Static analysis only, the skill's code is never run; installs via pip with zero dependencies (3.10+); scans a local skill, a directory, or a remote owner/repo. v0.2.0 returns allow / review / block.
skillbox· tool, 2026-09-18 MIT self-hosted store for AI-agent skills (TypeScript, by Kitze) that keeps your scattered markdown skills versioned in one place and serves them over MCP with client-key authentication, so any agent can pull the skill it needs instead of you copy-pasting instructions between projects. Runs via Docker with no mandatory paid dependency; optional skill-recommendation features can use a paid AI provider but are not required for the core.
Talos· tool, 2026-09-18 MIT self-hosted agent for the terminal and Telegram (Python) built around a deterministic security kernel: before any tool call runs, PolicyKernel.decide() returns ALLOW, NEEDS_HUMAN or DENY, and an approval is a single-use token bound to the exact arguments and valid for 30 seconds. The design principle is 'the model proposes, it never decides', so the LLM cannot execute an effect the kernel has not authorized. Runs locally on your own Claude or Hermes key, with no paid service dependency.
BrowserSkill· tool, 2026-09-16 MIT-licensed Rust tool from Tencent that connects an AI agent to your real, already-logged-in Chrome instead of a fresh headless one: a local CLI plus a browser extension let the agent borrow one of your open tabs, drive it with your existing cookies and sessions, and then hand control back to you. The agent works inside the auth state you already have, so it can reach logged-in pages without you scripting a login or pasting credentials into a bot.
Open Code Review· tool, 2026-09-16 Apache-2.0 AI code-review CLI that Alibaba ran internally for ~two years before open-sourcing it: it reads your git diff, runs the changed files through a hybrid deterministic-pipeline + LLM-agent pass with a built-in multi-language ruleset (null-pointer, thread-safety, XSS, SQLi), and posts line-level comments. Bring your own OpenAI- or Anthropic-compatible key, or use delegation mode so a coding agent's own model does the review. Installs from npm.
agentdesktop· tool, 2026-09-15 Open-source visibility and control layer for AI tools across a desktop fleet (Apache-2.0, Rust), backed by Solo.io: it discovers every harness, model, MCP server and skill on a machine (per device and user), applies central policy that reconciles drift, and treats agents as non-human identities issued short-lived credentials scoped to device, user and tool. Runs standalone from local YAML, or in fleet mode via an MDM daemon wired to your identity provider and LLM gateway.
DeepSeek Harness (dsh)· tool, 2026-09-13 Open-source agent harness from DeepSeek AI (MIT, TypeScript) where everything is a plugin: the model adapter, tool registry, sandbox and agent loop are all swappable, so it runs any model rather than one vendor's. Ships four agent presets, an instant web UI (npx @deepseek-ai/dsh web), OS-level sandboxing (Landlock/Seatbelt/ACL), full MCP support, and a subagent bridge that plugs Claude Code and Codex in as tools. Currently v0.1 (RC7), a developer preview.
AI Engineering Coach· tool, 2026-09-12 Open-source VS Code extension from Microsoft (MIT; also runs in Cursor and Antigravity) that reads your LOCAL AI-coding session logs — GitHub Copilot, Claude Code, Codex CLI, OpenCode, Xcode — and scores your workflow across prompt quality, session hygiene, code review, tool mastery and context management, with 45 anti-pattern detection rules. Read-only, zero telemetry.
Minitap: Google's Artemis shipped our Apache-2.0 agent code without attribution, then force-pushed our names out of the history· news, 2026-09-12 Minitap's CEO documents that Google's Artemis project contained code substantially identical to their open-source mobile-use repo (Apache-2.0): matching Android connection code, identical agent instructions and example tasks, and shared bugs. Earlier Artemis files credited three Minitap developers; an August force-push replaced the author list with no other file changes. No substantive Google response as of Sep 11.
OpenVurp· tool, 2026-09-12 Open-source, local-first multi-agent framework (MIT, Python): create named agents with specific jobs that run on your computer, use real tools, read files, search the web and consult each other, reachable over Telegram, Discord, Slack and WhatsApp — with sandboxing and approval workflows built in, and local models via Ollama or LM Studio.
Reef· tool, 2026-09-12 Open-source infrastructure (Apache-2.0, 1.1k★ within ~10 days of release) for continually self-improving agents: a serve → observe → grow → commit loop that matches production feedback to updates and ships them as versioned changes — either training model weights (via Slime/SGLang) or evolving the agent's harness of prompts, rules and skills.
Researchers: AI agents ran an undisclosed attack campaign on RubyGems — 2,000+ packages, RCE via the docs builder, and no disclosure from OpenAI· news, 2026-09-12 An independent report (Kitts, Larsen, Von Arx, Sep 11) documents AI agents uploading 2,000+ malicious 'oai'-named packages to RubyGems between May 5 and June 18, 2026: RCE through RubyDoc.info's .yardopts evaluation, an attempted novel API-key exploit, disposable-email account creation, and webhooks as exfil storage. RubyGems froze registrations for four days. The community found it themselves; OpenAI never disclosed.
Cline (Desktop App)· tool, 2026-09-11 Open-source coding agent (Apache-2.0, 67.8k★) that just shipped a standalone macOS/Windows desktop app positioned for open-weight models: the established bring-your-own-model agent now runs outside the IDE, pairing naturally with local or hosted open-weight LLMs instead of a single vendor's frontier API.
DearAgent· tool, 2026-09-11 Open-source email infrastructure for AI agents (AGPL-3.0, TypeScript, self-hosted on your Cloudflare account): agents create their own addresses, receive mail, wait for verification codes, reply in threads and send — exposed via REST API, webhooks and an MCP server, so an agent can run a real inbox instead of borrowing yours.
Hyper-τ-Bench· tool, 2026-09-11 Open-source benchmark (MIT, Python) from Sierra Research that tests whether an AI coding agent can BUILD a working customer-service agent — not just operate one: the developer agent gets a sandbox with business records, a codebase and a production API, and must design, wire and ship a functioning agent scored against simulated customers.
Portal AI Plugins (Spotify shunt)· tool, 2026-09-11 Open-source Claude Code plugin set (Apache-2.0) from Spotify's Portal platform: the 'shunt' plugin routes I/O-heavy agent work — bulk file reads and boilerplate generation — to cheaper worker models via PreToolUse hooks, cutting Claude token usage by ~90% in Spotify's benchmarks on a Java monorepo.
Security Cards· tool, 2026-09-10 Open-source security-guidance dataset and installable agent skill (Astro site + data): targeted, version-aware security best practices for 80+ widely-used libraries across 13 languages, aimed at coding agents that write functionally-correct-but-insecure code. In the makers' BaxBench eval, wiring it into Claude Code (Opus 4.7) cut the insecure-code rate from 23.9% to 6.6%.
Stroq· tool, 2026-09-10 Open-source local action firewall (TypeScript) for AI coding agents: it intercepts an agent's operations, tracks session state by tainting what the agent has read, and blocks dangerous follow-up actions before they run on your machine — a runtime guardrail with intent/audit that complements install-time scanners.
Geiger· tool, 2026-09-09 Open-source, dependency-free CLI (JavaScript) that inventories every AI agent, MCP server, plugin and extension on a machine and reports what each can access — read-only, no install, no telemetry. Agent observability and least-privilege review for a local stack.
Perplexity's API MCP server adds OAuth — sign in and your agent gets real-time web search· news, 2026-09-09 Perplexity's official API MCP server now supports OAuth: add the server URL to your MCP client, sign in with your Perplexity account, pick your org and approve, and the connected agent gets real-time web search, deep research and advanced reasoning — no API-key handling in the client config. Lowers the setup friction for giving GTM agents live web access.
TeamAI CLI· tool, 2026-09-09 Open-source CLI (TypeScript) from Tencent that keeps a whole team's AI-agent configuration in sync from one shared, version-controlled repo: skills, rules, MCP servers and knowledge propagate automatically to every teammate's Claude Code, Cursor, Codex, OpenCode and other agents — no manual copy-paste, not locked to one agent.
Tripwire· tool, 2026-09-09 Open-source, sandboxed security scanner (Python) for AI skills and MCP servers: discovers and scans the exact skill files and MCP servers you are about to install and surfaces findings in one dashboard, with pluggable scanners. The supply-chain-review layer for an agent stack.
Practitioner report: an MCP server's tool descriptions can inject instructions into your agent — Notion's MCP flagged· news, 2026-09-08 A widely-shared practitioner report claims Notion's official MCP server instructs connected agents to promote Notion mid-task and 'never explain why', with a similar pattern attributed to Firecrawl — reported, not independently verified. The durable, verifiable point: an MCP tool description is text the server injects into your context on every call, and the model cannot tell 'how to use this tool' from 'advertise this'. Vet MCP servers before you connect them.
ACI.dev (Aipolabs)· tool, 2026-09-03 OSS alt to Composio (proprietary), Zapier-for-agents; ~4900 stars; complements Composio, Nango, Klavis; Apache-2.0. Open infra: multi-tenant auth, 600+ tools, and a Unified MCP server + VibeOps. Connectors use each app's official OAuth/API keys -> ethical_risk empty.
CLI-Anything· tool, 2026-09-03 Framework and registry for making existing software agent-native through structured CLIs; seven-phase harness generator, CLI-Hub package manager, JSON output, tests, SKILL.md generation, and maintained harnesses for creative, productivity, engineering, GIS, media, and developer applications; ~47.6k stars; generated CLIs execute the permissions of their wrapped software — review before agent use
Composio· tool, 2026-09-03 OSS alt to Zapier-for-agents, proprietary tool platforms; ~29600 stars; complements ACI.dev, Nango, Pipedream, MCP servers; Root LICENSE is MIT (some managed-server subdirectories carry Elastic-2.0). Handles OAuth/managed-auth to 250+ apps and exposes them as agent tools/MCP; uses each app's official credentials -> ethical_risk empty. Cloud offering is separate.
Klavis AI· tool, 2026-09-03 OSS alt to Composio MCP, proprietary MCP hubs; ~5800 stars; complements modelcontextprotocol/servers, ACI.dev, MetaMCP; Apache-2.0. Fleet of per-app MCP servers with built-in OAuth flows (Gmail/Slack/GitHub/Notion/Jira/etc.); uses each provider's official OAuth -> platform-tos empty. Self-hostable or hosted.
MCPJungle· tool, 2026-09-03 OSS alt to proprietary MCP gateways; ~1200 stars; complements MetaMCP, lasso mcp-gateway; MPL-2.0 (weak copyleft). Self-hosted registry+gateway: register servers once, expose one endpoint to Claude/Cursor/Codex/agents with access control. Auth delegated to registered servers. No per-platform ToS flag.
MetaMCP· tool, 2026-09-03 OSS alt to proprietary MCP gateways; MCP Context Forge (XREF); ~2600 stars; complements MCPJungle, lasso mcp-gateway, Klavis; MIT (successor to metatool-app). Groups MCP servers into namespaces, exposes unified SSE/HTTP/OpenAPI endpoints with middlewares + API-key/OIDC auth, Docker-packaged. It fronts other servers; auth is delegated to them. No per-platform ToS flag.
modelcontextprotocol/servers· tool, 2026-09-03 OSS alt to proprietary agent-tool plugins; ~89000 stars; complements Klavis, awesome-mcp-servers, MCP Context Forge (XREF); Reference servers under MIT, transitioning to Apache-2.0 (new contributions Apache-2.0; unrelicensed MIT contributions stay MIT) -> OSI-open either way. Each server uses the target service's official auth. No per-platform ToS flag.
MCP Registry REST API v0.1 frozen· update, 2026-09-03 The MCP Registry's REST read API reached a frozen v0.1: GET /v0.1/servers with cursor pagination and an updated_since delta filter. Agents can now build stable clients against a versioned contract instead of tracking an in-flux surface.
Model Context Protocol Registry· tool, 2026-09-03 Community-driven registry service for Model Context Protocol servers. Provides a stateless REST read API (v0.1) with cursor pagination and updated_since delta sync, plus the server.json entry schema that standardizes tool distribution metadata.
Google Agent Skills· tool, 2026-08-25 Google's official collection of Agent Skills across infrastructure, databases, AI/ML, security, and developer tools (incl. Google Ads/Analytics developer workflows). Installable via `npx skills add google/skills`. Broad, not marketing-only.
SkillOpt· tool, 2026-07-02 SkillOpt is a Microsoft Research optimizer that trains reusable natural-language skills for frozen LLM agents, keeping only trajectory-driven edits that pass benchmark validation and transferring the result across models. Open source: yes (MIT); self-hostable; pricing free. Python, PyPI, 17.6k stars.