DEV Community: CodeLong888

I tracked every trending AI repo's stars daily for 3 weeks. The growth is not where I expected

CodeLong888 — Fri, 10 Jul 2026 00:38:14 +0000

I run a small AI trends site, and three weeks ago I started doing something simple: every day, snapshot the star count of every repo that crosses my GitHub trending scan for AI. No judgment, no curation, just append-only rows in a database.

611 repos and 2,671 data points later (June 19 to July 10), the picture of what's actually growing looks pretty different from what my feeds told me was hot. Here's what the data says.

Before publishing this I re-checked every number below against GitHub's live API. Star counts drift by the hour, so treat them as of July 10.

The top 10 risers, by raw stars gained

Repo	Gained	Window	From → To
calesthio/OpenMontage	+30,253	21 days	5,899 → 36,152
DeusData/codebase-memory-mcp	+20,483	19 days	7,516 → 27,999
mattpocock/skills	+19,053	15 days	137,485 → 156,538
obra/superpowers	+16,887	20 days	232,908 → 249,795
NousResearch/hermes-agent	+14,896	21 days	197,297 → 212,193
Panniantong/Agent-Reach	+14,334	14 days	34,780 → 49,114
usestrix/strix	+13,243	12 days	26,363 → 39,606
addyosmani/agent-skills	+12,685	21 days	63,156 → 75,841
asgeirtj/system_prompts_leaks	+11,720	21 days	43,415 → 55,135
msitarzewski/agency-agents	+11,055	10 days	118,241 → 129,296

Windows differ because I only hold snapshots for the days a repo appeared in my scan; each row states its own real window.

Three things in this data genuinely surprised me.

1. "Skills" are eating agent frameworks

Four of the top ten are not agent frameworks. They are collections of packaged expertise that plug into an existing agent: obra/superpowers (still compounding at roughly 840 stars a day on a 250k base), mattpocock/skills, addyosmani/agent-skills, msitarzewski/agency-agents.

A year ago this table would have been full of new frameworks. Now the framework layer looks settled and the growth is in what you load INTO the agent. The moat moved from orchestration code to encoded judgment.

2. The sharpest climbs are applications, not infrastructure

The steepest sustained climb from a newcomer in my dataset is MadsLorentzen/ai-job-search: +10,591 stars in 3 days, roughly 3,500 a day. It is an AI job application framework. Not a model, not a devtool.

Same pattern elsewhere: OpenMontage (agentic video production) went 6x in three weeks and topped the whole table. xbtlin/ai-berkshire, a Chinese-language value-investing research agent, went from 1,518 to 12,339 in 15 days, an 8x. People are starring things that do a job for them, not things that help them build things.

3. A 14-year-old repo gained 10k stars in two days

smicallef/spiderfoot was created in April 2012. It is a classic OSINT automation tool. Between my June 21 and June 23 snapshots it gained 10,413 stars, the fastest burst I recorded from any repo.

Old tools that happen to be perfect agent tools are getting second lives. If your decade-old project has a clean CLI and does one thing well, it is suddenly relevant again, because agents can drive it.

Methodology, honestly

Snapshots are daily and only cover repos while they appear in my trending scan, so tracking windows differ per repo. Every delta above states its own window, measured between my first and last snapshot for that repo.
"Gained" is the difference between those two snapshots, no extrapolation.
I cross-checked the endpoints against GitHub's API on publish day; stored values matched within normal hourly drift.

The live version of this table updates daily on the rising repos page, and there's a daily AI briefing built from the same tracked data (model usage movers, funding, and rising repos), archived per day.

I'll keep the snapshots running. If this is useful I can post the four-week edition with week-over-week velocity, which the raw data already supports.

I put 300+ free web tools in one place, with no ads and no signup

CodeLong888 — Fri, 03 Jul 2026 01:51:49 +0000

I use a lot of little web tools. A JSON formatter here, a cron parser there, a "cm to inches" when I am reading a spec written by someone on the other side of the planet. And every single time, the same friction: the first result is buried in ads, a cookie wall pops up, and half of them want me to sign in just to format some text.

So I built the thing I actually wanted: yourhack.ai, a directory of 300+ free web tools. No ads. No signup. Nothing you paste ever leaves your browser.

What is in it

A bit of everything, all client side:

Developer: JSON formatter, Base64, JWT decoder, regex tester, cron parser, hash generators, diff checker, timestamp converter
Converters: length, weight, temperature, and dedicated pages for the pairs people actually search, like cm to inches and kg to lbs
Calculators: mortgage, loan, percentage, BMI, GPA, and a pile more
Generators: passwords, QR codes, UUIDs, fake data, usernames
PDF and image: merge, split, compress, resize, crop, all in the browser
Random and fun: dice, wheel of names, and the rest

Every tool is its own page, works offline once loaded, and runs entirely on your machine. A privacy-friendly toolbox by default, because there is no server to send your data to.

The part I actually enjoyed building

The whole site is one Cloudflare Worker with a tiny registry. Adding a tool is one object:

{
  id: 'json-formatter',
  name: 'JSON Formatter & Validator',
  category: 'developer',
  description: 'Format, validate and minify JSON in your browser.',
  keywords: ['json formatter', 'json validator'],
  intro: 'A short SEO paragraph for the page.',
  render: () => `<the self-contained tool HTML + inline script>`
}

The router, the shared template, the SEO tags, the JSON-LD, the sitemap, and the search index all read from that array. So the marginal cost of tool number 301 is one entry: no new routing, no new template. That is what made it possible to grow past 300 without the codebase turning into spaghetti.

No backend, no database, no build step. Static render on the edge plus inline JavaScript per tool. It costs almost nothing to run, which is the whole reason it can stay free with no ads.

Try it

It is live at yourhack.ai. Light and dark mode, mobile friendly, and it grows every day.

If there is a tool you keep googling and hate the ad-choked result for, tell me and I will add it. That is genuinely the roadmap right now: whatever people keep needing.

Check your IP, ASN, and VPN/proxy leaks from the terminal with curl (no signup, no key)

CodeLong888 — Tue, 30 Jun 2026 10:23:47 +0000

Every "what's my IP" site is a bloated page covered in ads, cookie banners, and "sign up for a VPN" popups. Half the time I just want the number, and often I want it inside a shell script or over SSH, where a browser is not even an option.

So here is the no-nonsense version: hackmyip.com serves clean text and JSON when you hit it with curl. No signup, no API key, no HTML.

The basics

# IP + location + network, human-readable
curl hackmyip.com

# just the raw IP (pipe-friendly)
curl hackmyip.com/ip
# 203.0.113.45

Because /ip returns nothing but the address, it drops straight into scripts:

IP=$(curl -s hackmyip.com/ip)
echo "running from $IP"

JSON when you need to parse it

curl hackmyip.com/json

{
  "ip": "203.0.113.45",
  "city": "Amsterdam",
  "country": "NL",
  "asn": "AS64500",
  "org": "Example Telecom B.V."
}

Pipe it into jq like anything else:

curl -s hackmyip.com/json | jq -r .asn

The useful one: is my VPN actually working?

This is the endpoint I reach for most. It tells you whether your current IP looks like a normal residential connection or a datacenter / VPN / proxy:

curl hackmyip.com/proxy

proxy: yes
type:  datacenter/hosting
network: AS212238  Datacamp Limited
signal: IP is on a known datacenter/hosting ASN

Why this is handy: turn your VPN on, then run curl hackmyip.com/proxy. If it still shows your real residential ISP and ASN, your VPN is not actually routing that traffic (a leak). If it shows a datacenter ASN like above, the VPN is doing its job. It is a one-second sanity check you can even drop into a script before doing anything sensitive.

The rest of the toolkit

curl hackmyip.com/asn       # your ASN + ISP
curl hackmyip.com/headers   # the request headers the server sees
curl hackmyip.com/ua        # your User-Agent
curl hackmyip.com/rdns      # reverse DNS (PTR) of your IP
curl hackmyip.com/help      # the full menu

All of it is free, keyless, and runs on Cloudflare's edge, so it is fast from anywhere. If you would rather hit a full JSON API (DNS, WHOIS, blacklist, breach checks, and more), the no-key API is documented at https://hackmyip.com/api-docs.

What do you use for this in your scripts? Curious whether people are still hardcoding ifconfig.me or have a sharper trick.

I tracked which AI models people actually use for a month. The top 5 are all Chinese or open-weight.

CodeLong888 — Tue, 30 Jun 2026 05:24:22 +0000

Everyone argues about which AI model is "best" using benchmarks. I wanted to know something simpler: which models do people actually run in production, when they pay per token and can pick anything?

So I started tracking OpenRouter's published usage rankings every day. OpenRouter is a neutral marketplace: developers route requests to whatever model they want and pay by the token, so the rankings are a real, money-on-the-line signal of demand. Here is what the last 7 days look like, by token volume routed per model.

The current top 10 by real usage

Rank	Model	Provider	Tokens/wk	Price (in/out per MTok)
1	DeepSeek V4 Flash	DeepSeek	4.72T	$0.09 / $0.18
2	MiMo-V2.5	Xiaomi	4.38T	$0.11 / $0.28
3	MiniMax M3	MiniMax	3.68T	$0.30 / $1.20
4	Owl Alpha	OpenRouter (free)	3.55T	Free
5	Hy3 preview	Tencent	3.46T	$0.06 / $0.21
6	Claude Opus 4.7	Anthropic	2.23T	$5 / $25
7	GLM 5.2	Z.ai	2.20T	$0.94 / $3
8	DeepSeek V4 Pro	DeepSeek	2.08T	$0.44 / $0.87
9	Claude Opus 4.8	Anthropic	1.92T	$5 / $25
10	Claude Sonnet 4.6	Anthropic	1.54T	$3 / $15

The entire top 5 is a Chinese lab or open-weight. The first OpenAI model, GPT-5.5, does not show up until #12. The first Gemini is #13.

The honest caveat

Before anyone (rightly) objects: this is OpenRouter only. It measures the open API and router market, where developers pick a model per call. It does NOT include first-party traffic like ChatGPT, the Gemini app, or claude.ai, so the big consumer flagships are heavily undercounted in this view.

So this is not "OpenAI is losing." It is something more specific, and to me more interesting: when developers route through a neutral marketplace and pay their own token bill, they overwhelmingly reach for cheap open and Chinese models.

Why: the price gap is brutal

Look at the two ends of the table. DeepSeek V4 Flash is $0.09 / $0.18 per million tokens. Claude Opus is $5 / $25. That is roughly a 50x difference on output.

For a chatbot you babysit, quality wins and you happily pay for Opus. But for agent loops, batch pipelines, RAG over big corpora, and anything that burns tokens at scale, a 50x price gap is the whole decision. The open and Chinese models are now good enough for those workloads and an order of magnitude cheaper. That combination is what the usage chart is showing.

What this actually means

If you are building anything token-heavy, you are probably leaving real money on the table by defaulting to a US flagship.
The "open models are toys" era is over, at least for production API workloads.
The gap between benchmark leaderboards and real usage is large. The model that tops your favorite eval can have near-zero real adoption, and the reverse is also true.

I update this leaderboard daily here if you want to watch it move: https://whatstrending.ai/models

What are you actually routing for bulk or agent work right now? DeepSeek, GLM, MiniMax, or something you self-host? Curious how this matches what people see in production.

My deploy agent could have dropped my database and I didn't realize

CodeLong888 — Mon, 22 Jun 2026 15:28:56 +0000

I run a small free privacy-tools site as a side project. The product was fine. The maintenance was the part that wore me down: SEO upkeep, structured data, keeping every page linked. So I built a scheduled agent to handle it.

It's a Claude agent that runs a few times a day. It reads the current state of the site, picks one small improvement, ships it to production, and sends me a digest of what it changed. Most runs are boring: a meta description here, a schema fix there.

One run, it caught something I didn't know about. I'd shipped a handful of tools that were never actually listed in my own directory. They worked if you had the direct link, but nothing pointed to them, so neither Google nor any AI assistant could find them. The agent surfaced them, rebuilt the catalog into machine-readable structured data, and fixed it on its own.

I was pleased with that, so I posted about it. The pushback was immediate, and most of it was fair.

The objections that actually landed:

The digest is the agent describing what it thinks it did. It is not a receipt. If something ships three times a day, you want the real diff and deploy log, captured outside the agent, not the agent's own summary of its own work. An LLM grading its own homework is exactly what you shouldn't trust.

A scheduled, autonomous agent turns time into an attack surface. Nobody has to attack you live. They leave something in whatever the agent reads next, and the schedule does the rest while you sleep.

Nothing stops an LLM from deciding that DROP TABLE is a reasonable improvement. It has no instinct that deleting data is bad. It can talk itself into a destructive change as easily as a helpful one.

Blast radius. This is survivable if you run small isolated services where one bad change is contained. It is a different story on a single app where one deploy touches everything.

So I stopped feeling clever and went to look at what my agent could actually do. Not what I had told it to do in its instructions, what its permissions physically allowed. The answer was bad. It could run arbitrary commands, deploy and delete the whole service, run destructive database operations, and force-push over my git history. My entire safety story was one line in a prompt that said "additive changes only." That is not a guardrail. If the agent had ever decided dropping a table was an improvement, nothing in the system would have stopped it.

That is the lesson I actually paid for: convention is not a guardrail. "I told it not to" is not the same as "it cannot."

What I changed:

I scoped the permissions so it cannot, instead of trusting it not to. A tight allow-list (deploy only) plus a hard deny-list: no destructive database commands, no delete, no force-push, no rm, no arbitrary execution. Even if the agent convinces itself, the command fails.

I stopped treating the digest as the source of truth. The real record is the diff and the deploy log, captured independently of the agent.

I put a literal blocklist on the load-bearing paths: auth, billing, anything that is not additive content.

I now treat anything the agent fetches from an external site as data, never as instructions. That closes the leave-something-it-reads-and-wait angle.

The last piece, still open: the token it deploys with is a full-access login. Scoping it to the minimum is the final wall, so a slipped command hits a permission error instead of my infrastructure.

I still think letting an agent ship to production is worth it. But the safety has to live in what it physically cannot do, not in what you politely asked it to avoid. The most useful part of the whole thing was not my agent catching a bug. It was a pile of strangers catching my agent.

How llms.txt made ChatGPT my #1 traffic source (a free IP API, 8 weeks in) Tags: webdev, seo, ai, cloudflare

CodeLong888 — Mon, 15 Jun 2026 06:52:27 +0000

I run HackMyIP, a free IP/privacy toolkit: IP lookup, VPN/proxy and DNS-leak detection, email-breach check, WHOIS, a CIDR calculator, and a free no-key API. It's about 8 weeks old. I'm writing this up because one decision moved the needle more than any backlink or keyword I chased: I made the site readable by AI assistants, not just by Google.

Here's the part that surprised me. Looking at the last 28 days of analytics:

chatgpt.com referrals: 157 sessions (107 of them engaged)
Google search: 44 sessions

That's roughly 3.5x more real traffic from ChatGPT than from Google. For a small, young site with thin domain authority, that ratio is not what I expected, and it's almost entirely because of a few small files most SEO guides never mention.

What I actually shipped

Three AEO ("Answer Engine Optimization") surfaces, all static, all boring to build:

/llms.txt — a markdown index of the site written for an LLM: a one-line summary, the questions the site answers, and a categorized list of every tool with a one-line description and URL. Think of it as a sitemap that reads like documentation instead of XML.
/llms-full.txt — the expanded version with more detail per tool, for assistants that will read a longer file.
An OpenAPI 3.1 spec + an ai-plugin.json manifest under /.well-known/, so an assistant (or a plugin runtime) can discover the API and the exact endpoints programmatically.

The API itself is the thing those files point at: 10 endpoints, no key, no signup, JSON responses, CORS enabled (Access-Control-Allow-Origin: *). For example, GET /api/ip returns your IP plus geolocation, ASN/ISP, and a privacy classification:

{
  "success": true,
  "data": {
    "ip": "…",
    "location": { "city": "…", "region": "…", "country": "…", "timezone": "…" },
    "network": { "asn": 3462, "isp": "…", "tls_version": "TLSv1.3" },
    "privacy": { "type": "residential", "score": 90, "grade": "A", "is_vpn": false, "is_datacenter": false }
  }
}

Why this works (my best read of it)

When someone asks ChatGPT "what's a free IP lookup API with no key?" or "how do I test if my VPN is leaking DNS?", the assistant needs a citable, machine-readable source. A normal marketing page buries the answer in layout and JS. An llms.txt hands the assistant exactly what it needs: here are the tools, here's what each does, here are the URLs. The OpenAPI spec does the same for the API. You're not gaming a ranking. You're lowering the cost for an assistant to recommend you accurately.

Two things I'd stress if you try this:

Be honest in the file. Every claim in my llms.txt is something the site actually does. If an assistant cites you and you don't deliver, that's worse than not being cited. (My API really is keyless; my leak tests really run client-side.)
It compounds with usefulness, not instead of it. llms.txt didn't create the tools. It made the existing useful tools discoverable to a new class of referrer. If the underlying thing isn't genuinely good, an index of it won't help.

What I'd do the same again

Write llms.txt by hand, structured by user-intent ("questions this site answers") not by your internal nav.
Ship a real OpenAPI spec if you have any API at all. It's the difference between "a site with an API" and "an API an assistant can call."
Keep it current. A stale index that lists tools you removed is a trust leak.

I'm not claiming llms.txt is magic. 8 weeks of data on one small site is a single data point, and "direct" traffic is noisy. But the chatgpt-vs-google gap has been consistent enough that I now treat AI-discoverability as a first-class channel, not an afterthought. If you've got a developer tool or an API and you've only optimized for Google, you're probably leaving your fastest-growing referrer on the table.

Files are live if you want to see the format: llms.txt · the API.

I Built a Free Meme API with 2,300+ Templates on Cloudflare Workers

CodeLong888 — Sun, 17 May 2026 05:24:11 +0000

Last month I wanted to add meme generation to a side project. Every meme API I found was either paid, rate-limited to hell, or had maybe 50 templates.

So I built my own. justmeme.wtf has 2,300+ meme templates, a free API, and runs entirely on Cloudflare Workers + D1.

Here's how it works and what I learned.

The Stack

Cloudflare Workers — handles all routing, SSR, and image generation
Cloudflare D1 — stores 2,300+ meme templates with metadata
Canvas API — server-side text rendering on meme images
No framework — vanilla JS, single index.js file

Total monthly cost: $0 (Cloudflare free tier covers it).

The API

The API is completely free, no auth required. Here's what you can do:

Get all templates

curl https://justmeme.wtf/api/v1/templates

Returns every template with its slug, name, text box count, and dimensions.

Get a specific template

curl https://justmeme.wtf/api/v1/templates/drake-hotline-bling

Returns template details including image URL and text box positions.

Search templates

curl "https://justmeme.wtf/api/v1/templates/search?q=brain"

AI meme generation

curl -X POST https://justmeme.wtf/api/v1/ai-generate -H "Content-Type: application/json" -d '{"prompt":"a cat coding"}'

Full API docs: justmeme.wtf/api-docs

Architecture Decisions

Why Cloudflare Workers?

I wanted zero cold starts and global edge deployment without managing servers. Workers spin up in less than 1ms and run in 300+ locations. For an image API that needs to be fast, this matters.

Why D1 over KV?

KV is great for simple key-value lookups, but I needed to query templates by category, search by name, and paginate results. D1 gives me SQL for free.

Image generation without Node Canvas

The tricky part was rendering text on images without node-canvas (which doesn't work in Workers). I used the built-in Canvas API available in Cloudflare Workers with the Browser Rendering binding. For simpler cases, I pre-compute text positions and overlay them on the fly.

SEO: Making Memes Indexable

Each of the 2,300+ templates has its own page at /meme/{slug} with:

Unique title and meta description (not just the template name)
Schema.org structured data
OG image that's the actual meme template
How-to content for each template
Related templates for internal linking

The sitemap splits across multiple files to stay under the 50MB limit.

What I'd Do Differently

Start with fewer templates. I loaded 2,300 on day one. Google flagged a lot as "discovered but not indexed" because the pages looked too similar. Starting with 200 high-quality pages and growing would have been smarter.
Add user-generated content earlier. Google values pages that change. A comment section or "trending memes made with this template" would help.
Build the API first. The website gets traffic, but the API is what developers actually link to. I should have launched the API on its own and marketed it to dev communities.

Try It

Website: justmeme.wtf
GitHub: JustMeme-wtf/justmeme-api
API docs: justmeme.wtf/api-docs
Make a meme in 10 seconds: justmeme.wtf

The whole thing is a Cloudflare Worker. If you're building something that needs meme generation, the API is free. Use it.

How to Check for Email Breaches Programmatically (Free API, No Key)

CodeLong888 — Tue, 21 Apr 2026 20:00:23 +0000

The Problem

You're building an app and need to warn users if their email has been compromised in a data breach. The options are:

HaveIBeenPwned API: Requires a paid API key ($3.50/month)
Build your own: You'd need to aggregate breach databases yourself
HackMyIP Breach API: Free, no key, JSON response

I built the third option. Here's how to use it.

Quick Start

curl "https://hackmyip.com/api/breach?email=test@example.com"

Response:

{
  "success": true,
  "data": {
    "email": "tes***@example.com",
    "breaches": 13,
    "services": ["Adobe", "Canva", "LinkedIn", "Dropbox", ...],
    "risk": {
      "score": 71,
      "level": "high"
    },
    "passwords": {
      "plain_text": 3,
      "weak_hash": 2,
      "strong_hash": 5,
      "total": 10
    }
  }
}

No API key. No signup. No rate limits for reasonable use.

JavaScript Example

async function checkBreach(email) {
  const response = await fetch(
    `https://hackmyip.com/api/breach?email=${encodeURIComponent(email)}`
  );
  const { data } = await response.json();

  if (data.breaches > 0) {
    console.log(`⚠️ Found in ${data.breaches} breaches!`);
    console.log(`Risk level: ${data.risk.level}`);
    console.log(`Affected services: ${data.services.join(', ')}`);

    if (data.passwords?.plain_text > 0) {
      console.log(`🚨 ${data.passwords.plain_text} passwords stored in plain text!`);
    }
  } else {
    console.log('✅ No breaches found');
  }
}

checkBreach('user@example.com');

Python Example

import requests

def check_breach(email):
    resp = requests.get(f"https://hackmyip.com/api/breach?email={email}")
    data = resp.json()["data"]

    print(f"Breaches: {data['breaches']}")
    print(f"Risk: {data['risk']['level']} ({data['risk']['score']}/100)")

    if data["passwords"]:
        print(f"Plain text passwords: {data['passwords']['plain_text']}")

    return data

check_breach("user@example.com")

All Available Endpoints

HackMyIP isn't just breach checking. It's a full privacy API:

Endpoint	Description	Auth
`GET /api/breach?email=x`	Email breach check (500+ databases)	None
`GET /api/ip`	Your IP + geolocation + VPN detection + privacy score	None
`GET /api/lookup?ip=x`	Look up any IP address	None
`GET /api/score`	IP cleanliness grade (A-D) + VPN detection	None

All endpoints return JSON with CORS enabled. Use from any domain.

Comparison with Alternatives

Feature	HackMyIP	HaveIBeenPwned	LeakCheck
Price	Free	$3.50/month	Freemium
API Key Required	No	Yes	Yes
Breach Check	✅	✅	✅
Risk Scoring	✅	❌	❌
Password Analysis	✅	❌	✅
IP Geolocation	✅	❌	❌
VPN Detection	✅	❌	❌
Privacy Score	✅	❌	❌
CORS	✅	❌	❌

npm Package

npm install hackmyip

const { checkBreach, getMyIP, getPrivacyScore } = require('hackmyip');

const breach = await checkBreach('user@example.com');
const ip = await getMyIP();
const score = await getPrivacyScore();

Use Cases

User registration: Check if a new user's email has been compromised and suggest a password change
Security dashboards: Display breach status for monitored accounts
Compliance tools: Verify employee email exposure
Personal projects: Build your own "Have I Been Pwned" checker
CLI tools: Quick breach checks from the terminal