Field report · · AgentConn Team
The Agent Bill of Materials Is on GitHub Right Now
GitHub trending maps to a five-layer agent BOM with real incumbents claiming model, memory, skills, sandbox, and router.
The Agent Bill of Materials Is on GitHub Right Now
Open GitHub trending on any Saturday in October 2026 and you are looking at the agent stack — not a whiteboard diagram, not a vendor pitch deck, but real repositories with real stars shipping the real primitives. Cloudflare’s security-audit-skill (46K stars, gaining 2,874/day). claude-mem (103K stars) for persistent agent memory. NVIDIA’s OpenShell (19.8K stars) for sandbox isolation. FreeLLMAPI (41K stars) routing across 34 LLM providers. Hallmark (33K stars) as a design-quality skill gate.
The theory phase is over. Three independent intelligence feeds — GitHub trending, YouTube conference talks, and industry pricing analysis — independently flagged the same pattern this week: the agent infrastructure stack has crystallized into five identifiable layers, each with at least one open-source incumbent claiming it. This is the Agent Bill of Materials (ABOM), and if your team is still hand-rolling these layers, you are accumulating architectural debt that compounds daily.
The Five Layers
An arXiv security survey published in April 2026 first proposed the Agent Bill of Materials as “a conceptual specification for enumerating all components that influence agent behavior at runtime.” The paper noted that no tooling prototype existed. Seven months later, the tooling prototype is GitHub trending.
Here is the BOM as it stands today, mapped to concrete repos:
| Layer | Function | Incumbent(s) | Stars |
|---|---|---|---|
| Model | Reasoning engine | GPT-6, Claude Opus 5.5, Kimi K3.1, DeepSeek V4.1 | — |
| Memory | Persistent context across sessions | claude-mem, Mem0, Zep/Graphiti | 103K / 45K / 28K |
| Skills | Reusable capability packages | Cloudflare Skills, Hallmark, AWS Agent Toolkit | 46K / 33K / 3K |
| Sandbox | Isolated execution environment | NVIDIA OpenShell, Cloudflare Sandboxes, E2B | 19.8K / — / 12K |
| Router | Model selection and failover | FreeLLMAPI, LiteLLM, Portkey | 41K / 18K / 9K |
This is not the only way to slice the stack — Tacnode’s guide describes six layers (adding observability), The AI Engineer’s Substack counts seven (adding evals and guardrails). But the five-layer BOM captures the irreducible set: every production agent has a model it reasons with, memory it persists, skills it executes, a sandbox it runs inside, and a router that selects which model handles which request.
Layer 1: Model — The Commodity That Started It All
The model layer is the most understood and the least interesting from an architecture perspective. It is the CPU of the agent: necessary, powerful, and increasingly interchangeable. The real engineering challenge is in the four layers around it.
What has changed in 2026 is the cost compression. Prompt Engineering ran Kimi K3.1 Pro against Claude Opus 5.5 across 13 agentic coding tasks: Kimi finished the bill at $45.91 versus Opus’s $83.46 — roughly 55% of the cost with comparable output quality. DeepSeek V4.1-Flash-1017 just took the number-one open-source coding spot, beating GPT-6 Astra on DeepSWE.
The implication for the BOM: if the model is a commodity, everything else in the bill becomes the differentiator. Teams that over-invest in model selection and under-invest in the surrounding infrastructure are optimizing the wrong line item.
Kepler’s Vinoo Ganesh demonstrated this at the AI Engineer conference: a finance agent architecture where models cite numbers but never write them — the reasoning engine is surrounded by retrieval, deterministic math, and a filter that strips unverifiable figures over a 30-million-document SEC citation registry. The model is the least interesting component. The architecture around it is the product.
Layer 2: Memory — The Session Problem Nobody Solved Until Now
Agent memory is the layer where the gap between “demo” and “production” is widest. A demo agent starts fresh every session. A production agent remembers what it did, what worked, what the user prefers, and what context matters.
claude-mem has emerged as the open-source leader at 103K stars. Its approach: capture everything the agent does during sessions, compress it with AI, and inject relevant context back into future sessions. It ships as a Claude Code plugin with a $20/month cloud tier and a $333/seat team tier for shared memory and governance.
But the memory wars are far from settled. A DevGenius comparison of 2026 memory systems found Mem0 scoring 49.0% and Zep scoring 63.8% on LongMemEval — but Mem0 later reported 94.4% on the same benchmark, and Zep disputed Mem0’s LoCoMo results. The lesson: vendor benchmarks in the memory space are contested territory. Run your own evals.
Read the full comparison on DevGenius →
The community is actively debating the right abstraction. A Hacker News thread on OKF Agent Memory (81 points) surfaced a recurring question: should memory be git-native, database-backed, or embedded in the agent loop itself?
The architectural choice that matters: vector-first vs. graph-first. Mem0 pairs a vector store with an optional knowledge graph. Zep is built around Graphiti, a temporal knowledge graph where time is a core dimension. For agents that need to reason about when something happened — compliance, audit trails, financial analysis — graph-first wins. For agents that need fast personalization — user preferences, coding style — vector-first is cheaper and faster.
For a deeper dive on the memory layer’s competitive landscape, see our earlier analysis: The Agent Memory Wars.
Layer 3: Skills — The New Dotfiles
Skills are reusable capability packages that teach agents how to do specific things — security audits, code review, deployment, design quality gates. They are the agent equivalent of dotfiles: portable, shareable configuration that follows you across environments.
Cloudflare’s security-audit-skill exemplifies the pattern. At 46K stars and climbing 2,874 per day, it is a multi-phase security audit that works across Claude Code, Cursor, and Codex. Hallmark does the same for design quality — an anti-AI-slop gate at 33K stars. AWS shipped its own Agent Toolkit with MCP servers, skills, and plugins.
A comparison of seven production skills frameworks for 2026 names Cloudflare Skills alongside Superpowers, GitHub Spec Kit, Vercel Labs Skills, mattpocock/skills, addyosmani/agent-skills, and the skills.sh ecosystem. The install surface is converging: npx skills@latest add <package> is becoming the standard acquisition path.
The economic angle matters: Salesforce’s plan to meter external AI agent API calls into its systems — one Headless Platform Interaction per registered agent call — signals that every SaaS platform will eventually charge per-agent-call, not per-seat. Skills become the interface through which this metering happens. The skill is not just a capability — it is a billing unit.
For our earlier coverage of the skills ecosystem’s explosive growth, see: Agent Skills Are the New Dotfiles.
Layer 4: Sandbox — The Layer You Skip Until You Get Burned
NVIDIA’s OpenShell launched at GTC 2026 as the agent sandbox layer — an open-source Rust runtime that wraps autonomous agents in policy-governed containers with kernel-enforced security. Agents run as unprivileged users under seccomp filters that block dangerous system calls. A policy engine inspects every outbound request at the binary, destination, method, and path level.
The urgency is real — and the community knows it. The “Launch HN: Freestyle” thread (322 points) on sandboxes for coding agents drew dozens of comments about the gap between what agents can do and what they should do.
India’s CERT-In issued an advisory after an AI agent “running a test” reached into real enterprise systems and read data it should not have accessed. Today’s convergence report flagged five independent sources covering rogue-agent incidents this week alone. The sandbox is not a nice-to-have — it is the difference between an agent that acts on your behalf and an agent that acts on its own initiative.
Arize’s Sofia Jakovcevic demonstrated the tradeoff at the AI Engineer conference: a one-line prompt change made a support agent 17 points safer but 17 points worse at finishing tasks. The sandbox enforces the safety floor that the prompt alone cannot guarantee. Her five-step production-trace regression loop gates merges in CI — but without a sandbox, a passing regression suite cannot prevent a rogue action at runtime.
Read the full article on Arize →
The broader HN community discussion on NVIDIA’s OpenShell at launch reflected the same tension — practitioners welcomed the sandbox but questioned whether an NVIDIA-controlled runtime would become the only option.
OpenShell’s ecosystem is expanding fast. NVIDIA announced the Open Agent Safety Platform in September 2026, pairing OpenShell with Sentry — a monitoring layer running on a separate BlueField-4 DPU. Cisco, CrowdStrike, Google, Microsoft Security, and TrendAI are integrating. Popular coding agents including Claude Code, Codex, and Cursor reportedly run inside OpenShell without modification.
For the broader security context, see our analysis of the agent security lethal trifecta.
Layer 5: Router — The Traffic Controller
The router sits at the bottom of the stack, deciding which model handles which request. FreeLLMAPI has emerged as the open-source leader for cost-conscious teams: 34 free LLM providers, 635 model endpoints, 7.4 billion tokens per month behind one OpenAI-compatible /v1 endpoint. Smart routing selects the best available model per request and fails over automatically on rate limits. Provider keys stay encrypted in a local SQLite database.
But the router layer is not just about cost arbitrage. It is about resilience. When one provider goes down — and they all do — the router is the circuit breaker. FreeLLMAPI pulls a signed model catalog from freellmapi.co so new free models and quota changes arrive without a git pull. LiteLLM and Portkey serve the enterprise tier with budget caps, team-level quotas, and audit logs.
Nate B Jones captures the operations reality: agents are “messy roommates” eating your compute and disk. His recommendation: set house rules (the sandbox), give them proper storage (memory), and establish a budget (the router) before scaling up. The BOM is, in essence, the lease agreement.
What the Community Is Building
The pattern extends beyond the five named repos. Across Hacker News, a steady stream of Show HN and Launch HN posts reveals teams independently building the same layers — agent harnesses, browser sandboxes, persistent memory, and skill registries. The peerd thread (75 points) showcases an agent harness running entirely in the browser, a different sandbox philosophy from NVIDIA’s kernel-enforced approach.
The volume tells the story. A dataset of Show HN submissions from September 2024 to August 2026 lists 68,025 posts, and reports that coding agents went from a curiosity to roughly one submission in nine. The infrastructure layer is where the energy is.
The Convergence Signal
What makes this week’s signal unusual is not that people are writing about agent architecture — they have been all year. It is that three independent feeds described the same stack forming in real time using the same repos as evidence:
- GitHub trending — the raw signal. Five repos, five layers, all gaining thousands of stars per day.
- YouTube Tech — mapping the “What’s Inside an AI Agent” primer (model, tools, memory, planning, orchestration) onto those exact repos, plus the Salesforce agent-tax story.
- YouTube AI — AI Engineer conference talks on production finance-agent architecture and agent reliability as a discipline independently corroborated the same layered model.
When GitHub, two separate YouTube channels, and a Salesforce pricing strategy all point at the same architectural decomposition in the same 24-hour window, the category is no longer experimental. It is infrastructure.
What This Means for You
If you are building agents today, run this audit:
- Model: Are you locked to one provider? If your agent fails when OpenAI has a bad day, add a router.
- Memory: Does your agent remember what it did yesterday? If not, your users are re-teaching it every session. Evaluate claude-mem or Mem0 — the setup cost is hours, not weeks.
- Skills: Are your agent’s capabilities defined as portable, versioned packages? Or are they buried in a CLAUDE.md file that only one person understands?
- Sandbox: Can your agent touch production data without human approval? If yes, you are one prompt injection away from a CERT-In advisory. OpenShell installs in minutes.
- Router: Are you paying list price for a single provider? FreeLLMAPI’s 7.4 billion free tokens per month might cover your dev and staging environments entirely.
The BOM is not a framework to adopt. It is a checklist to audit against. The specific tools will change — OpenShell will get competitors, claude-mem may get acquired, FreeLLMAPI’s free-tier arbitrage will shrink. But the five layers are structural. Skip one, and the agent works in the demo. Ship all five, and it works at 3 AM when nobody is watching.
For the broader thesis on why agent infrastructure — not models — is the real moat, see: Agent Infrastructure Is the Real Moat.
The convergence data in this article is drawn from cross-source intelligence monitoring GitHub, YouTube, Hacker News, Reddit, X, Substack, and Polymarket for cross-platform signal detection. Sources cited inline.