This week's list is less about one “do-everything” tool and more about clear project boundaries: OpenAI's public mathematics research collection, Rust desktop applications from the ArtCraft team, agent skills for visual explanations and real-device control, plus security testing, graphics drivers, and personal-finance software that deserve careful adoption.
The observation window is 2026-10-05 through 2026-10-11. This is an independent review based on GitHub's public API, not GitHub's official Trending list; Stars measure attention, not code quality, security, or long-term maintenance. I read each pinned README revision for all ten projects. No listed repository code was cloned, installed, or executed.
Top 10 projects
1. openai/math
Core functionality: A public collection of mathematical manuscripts and proof artifacts. Its README says the catalogue contains 719 manuscripts in 372 families, organized by discipline, with Lean formalizations, a formalization catalogue, and summaries of model reasoning for selected results.
Usage and boundaries: Start with overview.pdf or CONTENTS.md, then follow the citation and build instructions in preprints/; the Lean directory contains verification configurations. The README says about 42% of top-line results are formalized and warns that unformalized results may contain issues. Revisions are published as new versions while older releases remain available. The repository metadata declares Apache-2.0.
Attention snapshot: 14.2K Stars · 1,595 forks · Lean · Apache-2.0 · fixed reviewed revision fd4aeeb2ee4f
2. storytold/wordcraft
Core functionality: A pure-Rust reimplementation of the Word workflow, with .docx read/write, styles, tables, track changes, comments, references, mail merge, PDF export, and ODT, RTF, HTML, Markdown, LaTeX, and TXT formats. It also exposes a CLI, JSON control channel, and MCP for agent-driven document commands.
Usage and boundaries: Run the desktop sample with cargo run --release -p wordcraft -- --sample; the CLI converts, inspects, and saves documents, while the Web version runs from apps/wordcraft-web with Trunk. The README lists macOS, Windows, Linux, BSD, and WebAssembly support, but calls the project alpha: about 88% of ribbon features exist as commands, while overall replacement estimates remain around 60%; charts, SmartArt, pagination fidelity, stability, and native printing remain on the roadmap. MIT or Apache-2.0; spelling and grammar run offline.
Attention snapshot: 6,506 Stars · 1,834 forks · Rust · MIT/Apache-2.0 · fixed reviewed revision 4fb9c2cb2ac3
3. wheresryan22/anatomy
Core functionality: An Agent Skill for Claude, OpenCode, and Codex that turns technical concepts into interactive isometric figures. It supports standalone SVG, SVG with WebGL, and a 3D mode still marked beta, with examples, geometry audits, screenshots, and browser checks.
Usage and boundaries: Install it with npx skills add wheresryan22/anatomy -g -a codex, then invoke $anatomy in Codex; examples can also be built with their Node scripts. The README requires Node.js 20.10 or later and says the core needs no API key or npm install, using only built-in Node modules. The 3D mode is beta, and browser checks can be affected by local Chrome or Codex sandbox restrictions. MIT licensed.
Attention snapshot: 3,815 Stars · 299 forks · JavaScript · MIT · fixed reviewed revision 689dcf966e63
4. alchaincyf/huashu-art-motion
Core functionality: An art-animation Agent Skill with 35 style recipe cards, nine explainer grammars, eight parameterized clips, example scenes, camera and transition libraries, plus qa.py, film_gate.py, and deliver.py for checks and delivery.
Usage and boundaries: Install it with npx skills add alchaincyf/huashu-art-motion; rendering examples requires uv, ffmpeg, and Playwright Chromium, with commands documented through uv run --with playwright ... render.py. The ninth finance-explainer grammar requires your own character assets, and the full-narration examples are reference code snapshots rather than guaranteed ready-to-render projects. Code and documentation are MIT, but character art, demo videos, fonts, and derived data carry separate terms; the Clawd example is an unofficial fan work unrelated to Anthropic. Optional media capabilities require explicit selection and authorization.
Attention snapshot: 3,425 Stars · 385 forks · JavaScript · MIT with stated exceptions · fixed reviewed revision 9ff59339f934
5. mhtsec/ARTEX
Core functionality: An AI autonomous penetration-testing system with a Go backend and Next.js frontend. Its UI covers tasks, sessions, tool calls, exploration graphs, findings, asset maps, traffic recording, human-in-the-loop approvals, Agent management, and LLM configuration. It can also sync domains, IPs, ports, sites, and endpoints from ScopeSentry.
Usage and boundaries: PostgreSQL is required, and exploration needs ANTHROPIC_API_KEY or OPENAI_API_KEY. The recommended ./install.sh offers Docker or local compilation, then serves http://localhost:8787 with an administrator setup at /setup; Docker Compose can build from source. The online demo is frontend-only with mock data. The README says the original image source is gone, so local source builds are the fallback if the maintained image cannot be pulled. ScopeSentry sync needs its URL and API key; upgrades restart tasks and should be preceded by backups. Penetration testing and traffic operations must be restricted to authorized targets.
Attention snapshot: 3,299 Stars · 5,712 forks · Go · AGPL-3.0 · fixed reviewed revision a9d11cb852ea
6. zhongerxin/iPhone-use
Core functionality: Lets Codex control a real iPhone over USB: launch apps, inspect controls and screenshots, tap, swipe, type, collect lists, and show a live screen in the sidebar. It includes a local MCP service, setup guidance, batch actions, and screenshot fallback, using WebDriverAgent and Appium.
Usage and boundaries: It runs on macOS and requires full Xcode, your own Apple development team, a USB-connected iPhone, Python 3.9+, Node.js 20.19+/22.12+/24+, and npm 10+. Sign and run your own WDA Runner in Xcode before running sh scripts/install.sh. Passwords, verification codes, Face ID, and final submissions remain with the user, and text is not submitted automatically by default. Anonymous analytics can be disabled with IPHONE_USE_ANALYTICS=0 or DO_NOT_TRACK=1; screen streams are not written to disk, and remote WDA_URL values are rejected. MIT, with separate third-party notices.
Attention snapshot: 3,160 Stars · 316 forks · Python · MIT · fixed reviewed revision 08ed5b009650
7. storytold/gridcraft
Core functionality: A pure-Rust Excel workflow implementation with XLSX, CSV, TSV, 500+ formulas, dynamic arrays, tables, conditional formatting, charts, PivotTables, validation, printing, and PDF export. Agents can read and write workbooks through the CLI, JSON control channel, or MCP.
Usage and boundaries: Run cargo run --release -p gridcraft -- --sample sales for a sample; the Web build requires Trunk and the wasm32-unknown-unknown target. The README lists macOS, Windows, Linux, BSD, and WebAssembly support. Old .xls files mainly preserve values, formulas, and number formats; XLSB and ODS imports use saved values rather than formulas, and entities not modeled by GridCraft are not retained on save. No subscription, license server, or telemetry; MIT or Apache-2.0.
Attention snapshot: 3,089 Stars · 1,277 forks · Rust · MIT/Apache-2.0 · fixed reviewed revision 3926d21aa9a7
8. storytold/cadcraft
Core functionality: A Rust CAD tool with DXF read/write, DWG read and R2000 write, 2D drawing, constraints, layers, dimensions, blocks, hatching, layouts, plotting, and SVG/PNG/PDF export. It also offers a CLI, MCP server, and JSON control channel.
Usage and boundaries: Start the desktop sample with cargo run --release -p cadcraft -- --sample; the Web version runs under apps/cadcraft-web with Trunk. Desktop and Web UI builds need Rust 1.95+, while the core workspace minimum is 1.90. The README says unmodeled entities are not retained on save, SHX fonts are not read, and text output depends on system or optional font packages. Windows graphics problems can be troubleshot with WGPU_BACKEND. MIT or Apache-2.0; brand marks are separately restricted and the project is not affiliated with Autodesk.
Attention snapshot: 2,811 Stars · 1,295 forks · Rust · MIT/Apache-2.0 · fixed reviewed revision c57879a5c8f5
9. nullmoth/nvidia-macos-driver
Core functionality: A driver for NVIDIA Turing-and-later GPUs on Intel Macs and OpenCore systems running macOS 15 Sequoia, exposing Metal, display, OpenGL, OpenCL, Core Image, and Core ML interfaces.
Usage and boundaries: The recommended path is to download a release archive, verify SHA256SUMS, run sudo ./install.sh, and reboot; macOS must approve the extensions. The 1401 Mac app can install, roll back, and prepare reports, while source builds require Xcode 16, Rust, Meson/Ninja, and a specified NVIDIA open-kernel-module version. The project has been tested on an RTX 5060 with macOS 15.7.x/15.8.1; the device table is broader than physical validation. OpenCore, specific SIP/boot arguments, and BIOS settings are required. The code uses PolyForm Noncommercial 1.0.0, with LGPL-3.0 for the translator and no commercial use permitted.
Attention snapshot: 2,582 Stars · 235 forks · Rust · no single SPDX license declared · fixed reviewed revision de9b33aa98dc
10. LosaLosSantos/aurelio-finance
Core functionality: A self-hosted wealth-management and financial-planning app for banks, brokers, positions, fund look-through, homes, debts, cash flow, and goals. An optional AI advisor answers from local records, turns changes into confirmation cards, and can search the web.
Usage and boundaries: It requires Git, Node.js 22+, and uv. On macOS/Linux use ./start.sh --demo; on Windows PowerShell use ./start.ps1 -Demo to try invented data, then remove the demo flag for personal data. Records live in backend/data.db, with a neighboring copy made before format-changing updates. AI requires an OpenRouter account, credit, and API key; the README gives October 2026 test costs and allows another model. Local storage does not mean AI requests stay local, so sensitive-data and spending decisions remain the operator's responsibility. MIT.
Limitations
The GitHub Search API is a collection-time snapshot, so Stars can change after publication. Repository descriptions come from their authors and do not replace README review or real validation. No listed code was executed, installed, or security-audited here. Before adoption, inspect the pinned README, license, dependencies, and recent maintenance history.
Source: GitHub Search API · Collected 2026-10-12 (Asia/Singapore)