The problem: a one-person agency ships software with AI helpers, but clients only trust apps where (1) the tools the AI used are themselves safe and current, (2) every machine-checked claim comes with a real, dated report, and (3) agents don't leak passwords and API keys into code. "It works on my machine" is not production-ready; "here is the scan report from today" is.
The solution in today's radar: five fresh, verified finds. wshobson/agents is a big library of ready-made expert instructions you can drop into your AI coding IDE. agent-fleet-o is a self-hosted mission-control for agent teams with human-approval gates. Titus is a fast secret scanner that turns "no leaked keys" into a machine-generated report. mcp-accessibility-scanner lets your AI agent audit websites for accessibility failures (WCAG) with real keyboard tests. shadcn-admin is a free, MIT-licensed admin dashboard you own component-by-component — a reusable component for every future business web app.
Coverage note: nothing major launched in the last 24 hours specifically, so this report uses the allowed 7-day window (Oct 16–23, 2026). Prior reports were available (Oct 20: SkillSpector, vercel-labs/skills, OMA, Strix, agent-device; Oct 21: Trivy, OSV-Scanner, Playwright, Orchestrator.inc, Orca; Oct 22: OpenCode 2.0, promptfoo, ai-memory, google/skills, CommitShield) — none of today's picks repeat them. Star counts and license fields were read from each repo; release dates from official release pages and verified coverage. Per your standing preference set Oct 19, the Ethiopia business-opportunity section remains removed.
The criticism: "AI-built apps aren't production-ready" is an evidence problem. Claims like "no secrets in the code", "the dashboard works", or "the agent followed best practices" are worthless unless a tool produced them — with a date, a format, and a pass/fail result your gate engine can read.
Today's answer: Titus produces SARIF/JSON secret-scan reports from your whole repo and git history; mcp-accessibility-scanner produces per-page WCAG violation reports from real browser sessions; wshobson/agents replaces vague "the agent knows testing patterns" hopes with reviewed, versioned instruction files; shadcn-admin replaces "the AI will design a consistent dashboard" with components you read and own before shipping.
Why this maps to Agency OS: your governance demands VERIFIED evidence before a gate advances. Today's tools are external evidence producers your gate engine can consume. None of them replaces the gate engine or project-state.json — they feed it.
git commit --no-verify — exactly the anti-gate-bypass pattern Agency OS cares about.gh skill install wshobson/agents <skill>) or npx skills add, or clone into your IDE's skills folder. Always read a skill's full text before installing — a skill is executable influence over your agent.make workflows — runs on Windows through Docker Desktop, but it is a real self-hosting commitment, not a quick install. LLM providers need your own API keys.make build. Pure-Go fallback exists for platforms without Hyperscan/Vectorscan, so Windows is supported. No daemon, no subscription.titus report (human), --format json, --format sarif for CI.--validate (live credential verification) sends candidate secrets to provider APIs — never run it on client credentials without explicit approval; scanning public repos you don't own may raise legal/authorization questions; findings need triage — score ≠ confirmed leak.mcp-accessibility-scanner. Uses local Playwright browsers (free download); no paid API required.npm install, npm run dev — standard Vite workflow on Windows. Requires Node.js.make build per the README.titus scan path\to\scratch; (3) run titus report --format json and titus report --format sarif; (4) make it a git repo, commit a fake key, delete the file, commit again, then titus scan --git path\to\repo — the "deleted" key should still be found in history.--validate (it contacts provider APIs); don't scan public repos you have no authorization to test; download only from the official repo; keep the binary out of client repos (run it from a tools directory).--validate, and any scan of third-party assets.titus scan --git parses full git history and reports the "deleted" secret; that failing report is exactly the gate evidence that turns the agent's "resolved" claim back into BLOCKED until the key is rotated.