Seven open-source repositories are often pitched as ready-made businesses: the software is capable and the prices are for a service, but the gap between running the code and delivering the service is the whole job. No figure on this page is a forecast of what you would earn.
- The software is capable. All seven are serious projects with real adoption that can do the work described.
- The prices are for a service. The quoted prices are what the pitch charges for delivering a service, not rates for running the software.
- Two are AGPL-3.0. Modify one and let clients use it over a network, and you may owe them the source code — a question for a lawyer.
- Running costs sit outside the repository. Speech, telephony and hosting are billed separately, and at least one project, browser-use, recommends its own paid cloud for production.
- Finding clients is the hard part. None of these pitches say how you get a paying client, and a tool earns nothing until someone pays for the work.
A working assessment of seven repositories that keep appearing in "start an AI agency" lists — what each one actually does, what licence it carries, and what it costs to run as a business. Every figure carries its source and the date it was checked.
The seven repositories
Each of these is a serious project with real adoption. The column that matters is the third one.
| Repository | Sold as | What it actually takes |
|---|---|---|
| pipecat-ai/pipecatBSD-2 · ~13.9k stars | Voice agent, $8,000 | A real-time voice framework, and a good one. It does not include speech-to-text, text-to-speech or telephony — those are separate paid services, and they are where the per-minute cost lives. |
| cline/clineApache-2.0 · ~63.9k stars | Client website, $5,000 | A capable coding agent that genuinely accelerates a developer. It does not replace one. Published vulnerability rates in AI-generated code run roughly 40% to 70% depending on model and language. |
| gitroomhq/postiz-appAGPL-3.0 · ~34.7k stars | Social retainer, $2,000 | A solid scheduler. Scheduling is the least valuable part of social work — clients pay for judgement about what to post. AGPL licensed. |
| Mintplex-Labs/anything-llmMIT · ~64.6k stars | RAG setup, $3,500 | Genuinely strong, multi-user, Claude-compatible. The work is not installing it — it is the client's documents, which arrive unstructured and contradictory. |
| crewAIInc/crewAIMIT · ~56.9k stars | Agent retainer, $5,000 | Well-built multi-agent orchestration. Defaults to OpenAI; Claude via LiteLLM. Multi-agent is the least reliable pattern in production — more agents means more places to fail silently. |
| browser-use/browser-useMIT · ~109.3k stars | Automation, $1,200 | Excellent browser automation. Its own README recommends the paid cloud for production — the maintainers being honest about where self-hosting stops. |
| firecrawl/firecrawlAGPL-3.0 core · ~170k stars | Lead generation, $5,000 | The strongest scraping API in the category. Self-hosting deliberately omits the managed anti-bot and proxy layer, so success rates drop. Scraping for leads carries GDPR and terms-of-service exposure. |
Star counts are volatile, and that is a finding rather than a footnote. Firecrawl appeared as 123.5k in May 2026 and 137k in early August in secondary write-ups this site kept no links for, and 170,475 on GitHub's own organisation page in August 2026, when this table was checked. On 23 Sep 2026 GitHub’s API for firecrawl/firecrawl returned “stargazers_count: 183436”. Recompute rather than trust this page: api.github.com/repos/OWNER/NAME returns stargazers_count. A star count has a shelf life of weeks.
The prices are for a service. That is the point
The easy dismissal is that the numbers are invented. They describe services people do pay for, and that is why the pitch works; the exact figures on the slides are the pitch’s own and are not sourced here.Reasoning, September 2026 — this page prints no service rates of its own, having removed them as unsourced.
Agencies do charge monthly for voice agents and social management, with setup fees on top, and the retainers run into four figures for enterprise work. This page used to print rate ranges and margin percentages for each of those, and it has removed them. They were market figures asserted here without a named source — a margin range attributed to nobody in particular — and an unsourced rate on a page about a pitch full of unsourced rates is the wrong thing to be.
These are prices for a service. None of them is a rate for running a repository.
A client pays four figures for a website. The repository does not produce a website — it produces code. The distance between those two things is the job, and it is invisible on any slide.
The real cost structure
API bills, which come out of the margin
The advertised per-minute rate is a floor, not a total. It excludes the speech-to-text, text-to-speech and telephony legs a phone agent cannot function without, so the real cost per minute is some multiple of the headline — and the multiple depends on which providers you assemble.
A retainer that looks comfortable on a slide is materially thinner once the meter runs, and the meter runs whether or not the client is happy.
The licences
Two of the seven are AGPL-3.0 — postiz and firecrawl. Three are MIT, one is Apache-2.0 and one is BSD-2.GitHub, repository API for cline/cline, read at source 23 Sep 2026: “spdx_id”: “Apache-2.0”. First-hand: until 23 Sep 2026 this line said “Four are MIT, one is BSD-2”, which the table on this page already contradicted. Most write-ups treat all seven identically.
What the AGPL requires is narrower than usually stated, and worth getting right. Section 13 triggers when users interact with the program itself over a network — modify it and let clients use it remotely, and you owe them the source. Running an unmodified copy internally as a tool to produce a deliverable does not trigger it.Firecrawl LICENSE and README, github.com/firecrawl/firecrawl, checked 22 Aug 2026. SDKs and some UI components are separately MIT.
So the honest version is not "you cannot sell this." It is: the moment you modify an AGPL component and expose it to a client, you have an obligation nobody mentioned — and that is a question for a lawyer, not a caption.
Everything between the demo and the invoice
Discovery. Integration with systems the client already runs. Data cleanup — the real content of any "an afternoon of work" claim. Testing. Liability when it fails at 2am. Support. Churn.
And client acquisition, which is the actual hard part of any agency and appears in none of these pitches. A tool that does the work is worth nothing until someone is paying for the work.
The claim with evidence against it
"A client project, minus the developer" is the one assertion here that published research directly contradicts — and the figure usually quoted for it is stated wrongly, which is worth correcting.
The line in circulation is "Snyk 2026: 40% of AI-generated code contains a critical vulnerability." That conflates two separate findings.
The Snyk half of that line could not be confirmed: no Snyk publication stating 48% or “nearly half” was found at source when this was re-checked on 11 Sep 2026.Not read at source: the Snyk figure was searched for on 11 Sep 2026 and not found; see Auditing AI Work.
The 40% figure traces to Pearce et al., 2022 — the original study of GitHub Copilot, which found roughly 40% of 1,689 generated programs contained vulnerabilities, split about 50% in C against 39% in Python.Pearce, Ahmad, Tan, Dolan-Gavitt & Karri, "Asleep at the Keyboard?", IEEE S&P 2022, read at source 10 Sep 2026: across 89 scenarios “producing 1,689 programs”, “we found approximately 40% to be vulnerable”
Neither source supports the word "critical" attached to 40%. Published rates range roughly 40% to 70% depending on model, language and method. The honest statement is a range, not a decimal.Pearce et al., Asleep at the Keyboard?, 2022: “we found approximately 40% to be vulnerable”. Veracode, 2025 GenAI Code Security Report: “45% of code samples failed security tests”, with Java at “a 72% security failure rate across tasks”. Both as read at source for Auditing AI Work, 11 Sep 2026.
More directly relevant to anyone assembling a business from repositories: Snyk's February 2026 audit of the agent-skills ecosystem scanned 3,984 skills and found 13.4% contained at least one critical-severity issue, alongside 76 skills confirmed to contain malicious payloads.Snyk, "ToxicSkills", 5 Feb 2026, read at source 11 Sep 2026 and quotes re-read 17 Sep 2026: “13.4% of all skills, or 534 in total, all contain at least one critical-level security issue” across 3,984 skills scanned from ClawHub and skills.sh; “over a third of the ecosystem is affected: 36.82% (1,467 skills) have at least one security flaw”, and “our human-in-the-loop process confirming that 76 of Agent Skills contained malicious payloads”.
The direction is not in dispute even where the decimals are. Code that ships without a developer reading it is code that went out unread.
A worked example, verified
The argument on this page is that the repository is the engine, not the car. Here is the arithmetic on a real one.
OpenReply — open-source Instagram comment-to-DM automation, MIT licensed, a disclosed fork of an earlier MIT project with the billing layer removed. Landed on GitHub 17 July 2026; 680 stars in fourteen days, ~1.2k now. Genuinely good software.Not read at source since 22 Aug 2026, when it was verified: github.com/diwenne/openreply. The repo is linked so the current state can be checked directly.
Its own README says the quiet part: the code deploys in minutes, but the Meta app setup is the part that takes real time. Meta scrutinises automated-DM apps and often rejects the first submission.
Free to clone, not free to run, and a business registration document before anyone but you can use it.
None of that makes it a bad project — it is a well-built one, honestly documented. It is the distance between "free repository" and "business" made numeric, which is the whole point of this page.
How to evaluate any repo pitched as a business
Four questions, ordered by how fast they resolve it:
- Is the price a rate for the tool, or a rate for the service? Almost always the second. The repository is the engine; the client is buying the car.
- What is the licence? Thirty seconds on the repository page. AGPL changes what you may build and sell.
- What does the project's own README recommend for production? In the table above, browser-use’s recommends its paid cloud. That is maintainers being honest, and it belongs in your costing.
- Where is client acquisition? Any pitch that promises revenue without addressing how you find the client is describing a tool, not a business.
Every repository here is genuinely useful and worth your time. The repo is the engine, not the car. The chassis, the wheels, the insurance and the driver are the business — and that is what a client is actually paying for.
See also when not to use AI for the same arithmetic from the other side, prompting agents for how these fail in production, and guardrails for what you owe a client whose systems you have automated.
Quick answers
Are these repositories good?
Yes, as software. All seven are serious projects with real adoption that can do the work described. The question is not whether the software works but what it costs to run as a business, and the gap between running the code and delivering the service is the whole job.
Which of these are AGPL licensed?
Two of the seven: postiz and firecrawl, whose core is AGPL-3.0 while its SDKs and some UI components are separately MIT. Section 13 of the AGPL triggers when users interact with the program itself over a network: modify it and let clients use it remotely, and you owe them the source. Running an unmodified copy internally as a tool to produce a deliverable does not trigger it. Whether your own setup does is a question for a lawyer.
Does AI-generated code really contain vulnerabilities?
Published studies find vulnerabilities in a large share of it. The original study of GitHub Copilot (Pearce et al., 2022) found roughly 40% of 1,689 generated programs contained vulnerabilities, and published rates range roughly 40% to 70% depending on model, language and method. The line in circulation, “Snyk 2026: 40% of AI-generated code contains a critical vulnerability”, conflates two separate findings: the Snyk half could not be confirmed at source, and neither source supports the word “critical” attached to 40%.Reasoning, September 2026 — restates figures sourced above in The claim with evidence against it, where each carries its source and the date it was read.