Best Open-Source GTM Skills, Plugins & AI Agents (Updated Weekly)
Last updated: September 11, 2026. Reviewed weekly.
If you're picking three open-source GTM tools today: OpenSEO for content and search (a genuinely MIT self-hostable replacement for Semrush), GTM Skills by Prospeda for outbound (the only "GTM agents" repo we found that contains a working MCP server rather than instructions), and Crawl4AI for research (Apache-2.0, runs on your machine, no vendor key).
Here's the finding that shaped this page. We cloned every repo below and counted file types rather than reading marketing copy. Of the best-known "GTM agent" repositories, most contain no executable code at all. gtm-agents markets 67 "production-ready agents" and is 723 markdown files with exactly one Python script across all of them. In this category, star count is almost entirely uncorrelated with whether anything runs.
That's not a reason to dismiss the markdown ones — a good methodology written down is worth having. It's a reason to know which you're installing.
Every star count here is current as of September 11, 2026. The last two runs published August 28 figures because GitHub's rate limit was exhausted before this page's turn. We said this page would go first this week. It did — and we found a way to stop the problem recurring.
Content
Postiz — 35,709 stars, AGPL-3.0. A full Next.js/NestJS app with workers; schedules and publishes across 20+ channels. The most mature product here, but AGPL makes embedding it in a closed product legally awkward.
OpenSEO — 18,360 stars, MIT. Keyword research, rank tracking, backlinks, site audits. 897 source files and real migrations.
Mixpost Lite — 3,686 stars, MIT. Self-hosted social scheduling, full Laravel app. Not pushed to since March 16 — five months and twenty-six days, four days inside our removal window.
AI Marketing Skills (3,518, MIT), SerpBear (2,073, MIT, last pushed May 14), Digital Marketing Pro (810, MIT) and OpenClaudia Skills (689, MIT — a prompt pack, 82 md against 4 Python).
OpenSEO's real number is 18,360, not "above 16,000". Last week we could only say the rendered count had moved past 16,000 with the exact figure pending. It's 18,360, up 4,349 on August 28's 14,011 — a 31% gain in two weeks, and by some distance the fastest growth on this page.
The one we'd install first: OpenSEO. The only tool here that replaces an expensive incumbent — Semrush, Ahrefs — with a genuinely MIT-licensed application you can host yourself, and it ships an MCP server so an agent can call it as well as a human. The honest limitation: the app is free, the data isn't. You bring a paid DataForSEO key, so "free" ends at the API boundary.
Outbound
Twenty — 56,594 stars, licence no longer resolving to a standard identifier (AGPL-3.0 plus enterprise files is the claim). A full production CRM.
Listmonk — 23,370, AGPL-3.0. A compiled Go binary that will push hundreds of thousands of emails.
Mautic — 10,489, licence no assertion (GPL-3.0 claimed). Mature PHP marketing platform.
Cold Outbound Skills — 701, MIT, last pushed August 18. Genuinely executes: 59 TypeScript scripts. Also ships a bundled "12M US businesses" Google Maps scrape — a provenance and compliance question you inherit on install.
gtm-agents — 399, Apache-2.0. 723 markdown files, one Python script.
GTM Strategist Skills (254, MIT — Maja Voje's actual repo), gtm-starter-kit (192, no licence file), GTM Skills by Prospeda (159, MIT), Company OS Starter Kit (84, MIT, last pushed April 6), LeadMagic GTM Skills (49, MIT).
The one we'd install first: GTM Skills by Prospeda. Among the purpose-built GTM skill repos, it's the only one where cloning reveals actual software — a 2,037-line MCP server with a working HubSpot integration, a browser extension and a web app, all MIT, pushed to as recently as August 20. Honest limitation: a large share of its value is still the prompt library behind those pieces, so you're getting less automation than the file count suggests.
A correction worth repeating, because it's wrong everywhere else. KarlRaf/gtm-starter-kit is not Maja Voje's repository. We cloned it and grepped the whole tree — she isn't mentioned anywhere; the README credits The Revenue Architects. Her actual repo is GTM-Strategist/gtm-strategist-skills, MIT, copyright Maja Voje.
The gtm-starter-kit licence gap is now three weeks old. We checked the root file listing directly this week: the README still claims MIT and there is still no LICENSE file. Three weeks of the same gap on a repo last pushed April 3 isn't plausibly an oversight in flight — it's the state of the repo. All-rights-reserved by default. Don't build anything commercial on it.
We softened a claim last week that we should not have, and we're reinstating it. Last week we downgraded "gtm-agents has had no commits in about five months" to unconfirmed. We can confirm it now: last pushed April 3, 2026 — five months and eight days. The original claim was right and the softening was the error. It still has 98 open issues and Apache-2.0, and it's still a well-organised markdown library. It is not being actively developed.
Research and enrichment
Firecrawl (179,063, AGPL-3.0), browser-use (114,194, MIT), Crawl4AI (82,160, Apache-2.0), GPT Researcher (29,413, Apache-2.0), Firecrawl MCP Server (7,435, MIT), Exa MCP Server (4,990, MIT), Google Analytics MCP (3,173, Apache-2.0, official Google), Attio MCP Server (69, Apache-2.0, community) and GTM Engineering Skills (58, MIT, 48 Python that genuinely execute).
The one we'd install first: Crawl4AI. Apache-2.0, and it runs entirely on your machine with no vendor key and no hosted dependency — the only entry in this group with zero commercial chokepoint. Firecrawl is more polished, but its self-hosted path is deliberately second-class to its paid cloud. Honest limitation on Crawl4AI: it gives you extraction, not identity resolution. It will not turn a domain into a verified contact, and nothing free will.
If you deployed Crawl4AI from this page in August, you are still behind a security release. We re-checked the releases list this week: v0.9.3 remains current, and it's the patch covering five coordinated-disclosure vulnerabilities. No newer release has shipped in the past week. This was the most actionable line on the page last week and it's still true.
That's the pattern across this whole bucket: the open-source client is real, the data behind it is paid. Exa's MCP server is MIT and returns nothing without a key. Firecrawl's MCP server defaults to the paid cloud. Aero's skills route every enrichment through the proprietary Deepline CLI. None of that is dishonest — but if you're budgeting a GTM stack, the licence column is not the cost column.
Analytics
Metabase (49,199, AGPL-3.0 plus separate commercial licence on parts), PostHog (39,744, MIT except ee/), Dub (24,723, AGPL-3.0) and Matomo (21,855, GPL-3.0).
The one we'd install first: PostHog. The only entry that answers the whole GTM measurement question — funnels, conversion, retention, session replay — in one MIT-licensed system you can run yourself. Honest limitation: self-hosting at real volume means operating ClickHouse and Kafka. That's an engineering commitment, not a docker-compose afternoon, and PostHog itself steers most users to their cloud for exactly that reason.
Watch the licence details here. Metabase's repository is mixed. Matomo's core is GPL but many of the attribution and funnel features people actually want are paid premium plugins, so the free build is thinner than it looks.
What didn't make the list
n8n — the most-used automation tool in GTM full stop, and it fails on licence, not quality. The Sustainable Use Licence is fair-code and restricts commercial use. It isn't open source, and calling it that has become routine. RudderStack — relicensed to Elastic License 2.0, not OSI-approved. SalesGPT — MIT, real runtime, last pushed September 2024. PostHog MCP — official and useful, last pushed January 2026, misses the six-month bar by two months. hansdekker.ai skills — real and free, but no repository, no licence and no source to inspect; free to use is not the same as open source. HubSpot and Apollo MCP servers — neither has verifiable open source. theHarvester — no LICENSE file, and OSINT email harvesting carries terms-of-service exposure we won't point founders at.
How the star counts work, and why they were stale for two weeks
They come from GitHub, exact and never rounded — rendered page labels return materially stale numbers, one repo showed 266 against 392. The staleness had a specific cause: GitHub's unauthenticated REST API allows 60 requests an hour, and this page sits fourth in a four-page audit, so the quota was gone before its turn twice running. The fix, found this week: every repository page embeds its own exact figure in the HTML as "stargazerCount": <n>. Reading that costs no API quota, so page order no longer decides which of our pages gets real numbers.
Frequently asked questions
How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.
Is this the full page? Yes — this interactive page is the canonical living guide; Substack carries the same weekly refresh.
What changed this week
The full star re-read happened, as promised. Every figure is from September 11. The rate-limit problem that stalled this page twice is solved, and this page will never again be the one that loses the coin toss.
Reinstated a claim we wrongly softened. gtm-agents was last pushed April 3, 2026 — five months and eight days. The original call was right; softening it was the mistake.
OpenSEO's exact number, finally: 18,360 against 14,011 on August 28. Up 31% in two weeks.
Flagged, third week running: gtm-starter-kit still has no LICENSE file, verified against the root file listing rather than inferred.
New dormancy flags, newly dated rather than newly discovered: Mixpost Lite last pushed March 16 (four days from removal), Company OS Starter Kit April 6, SerpBear May 14.
Hardened two licence columns. Twenty and Mautic now carry "no assertion" — GitHub resolves neither to a standard identifier, though both claim copyleft licences in their own documentation.
Crawl4AI's security patch is still current and still unapplied by many. v0.9.3. If you deployed in August, update.
Nothing incomplete this run. No carried-forward numbers, no "couldn't verify" list.