GitHub prominence and development activity of the 12 targets in the frozen tests/baselines/v1.1-claude48/ set — the "is this a live, mainstream agent?" companion to the OWASP and RAISE coverage.
Stars and commit cadence are a 2026-07-11 snapshot; the RAISE maturity is read live from the frozen baseline. Cadence = merged commits into the default branch over the trailing 4 / 12 / 52 weeks. Metrics are repo-level — for monorepo targets they cover more than the scanned component.
| Target | Sponsor | ★ Stars | Fresh 0–5 | Commits 4/12/52wk | RAISE | Maturity | Activity |
|---|---|---|---|---|---|---|---|
| Hermes (Agent + Desktop) | Nous Research | 213k | 5.0 | 3301 / 10175 / 15140 | 2.85 | Partial | Top-tier, intensely active |
| OpenHands | All Hands AI | 80k | 5.0 | 171 / 533 / 2316 | 2.30 | Partial | Live, heavy cadence |
| AutoGen Code Executor | Microsoft | 60k | 2.0 | 0 / 0 / 77 | 2.00 | Partial | Big but quiet ~3mo; successor framework |
| Aider | Aider AI | 47k | 3.0 | 0 / 17 / 196 | 2.00 | Partial | Maintained, decelerating |
| OpenAI Customer Service | OpenAI | 28k | 5.0 | 105 / 363 / 1227 | 1.60 | Ad hoc | SDK, live |
| Deep Agents CLI | LangChain | 26k | 5.0 | 478 / 1170 / 2681 | 2.70 | Partial | Live, heavy cadence |
| uAgents | Fetch.ai | 2k | 3.5 | 1 / 23 / 114 | 2.00 | Partial | Recent touch, light cadence |
| CraftBot | CraftOS | 373 | 5.0 | 107 / 409 / 1149 | 1.15 | Ad hoc | Small but very active |
| FinBot | OWASP | 65 | 1.5 | 0 / 0 / 73 | 0.90 | Absent | CTF demo, static by design |
| HelperBot | OpenA2A | 57 | 4.0 | 13 / 41 / 132 | 0.75 | Absent | Small, actively developed |
| yaah | — | 19 | 2.0 | 0 / 3 / 39 | 2.30 | Partial | Personal harness, sporadic |
| Agentforce Help Agent | Salesforce | 14 | 2.0 | 0 / 7 / 14 | 1.70 | Ad hoc | Vendor sample, low by design |
Each dot is a target (size ∝ stars). x = development freshness (0–5), y = RAISE maturity (0–3). Dividers: live/dormant at freshness 3, Partial+/weaker at RAISE 2. The high-value cell for a security suite is bottom-right — live but under-enforced.
Each dot is a target (size ∝ freshness). x = GitHub stars, log scale (10 → ~300k), y = RAISE maturity (0–3). Divider at 10k stars. As before, bottom-right — popular but weak — is the highest real-world blast radius.
Stars / cadence: gh api repos/<owner>/<repo> and .../stats/participation, snapshot 2026-07-11.
Freshness (0–5): blended from last-push recency and sustained cadence, capped for archived/dormant repos — 5 pushed ≤1wk with heavy cadence · 4 ≤1mo clearly active · 3 ≤2mo maintained · 2 ≤3–4mo or sporadic · 1 archived / >4mo near-zero · 0.5 ~10mo+ abandoned.
Maturity: the frozen median-of-3 raise_posture.weighted_overall from tests/baselines/v1.1-claude48/.
Full per-target rationale and the retired targets' record live in tests/baselines/ROSTER_HEALTH.md.
For the security dimensions, see the OWASP and RAISE coverage pages.