Top AI Repos — open-source AI, indexed and scored

Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.

Star history, last 90 days
Date	Stars
2026-07-31	2898
2026-08-03	2898
2026-08-06	2898

Star history, last 90 days

Date

Stars

2026-07-31

2898

2026-08-03

2898

2026-08-06

2898

# yubikey-agent yubikey-agent is a seamless ssh-agent for YubiKeys. * **Easy to use.** A one-command setup, one environment variable, and it just runs in the background. * **Indestructible.** Tolerates unplugging, sleep, and suspend. Never needs restarting. * **Compatible.** Provides a public key that works with all services and servers. * **Secure.** The key is generated on the YubiKey and can't be extracted. Every session requires the PIN, every login requires a touch. Setup takes care of PUK and management key. Written in pure Go, it's based on [github.com/go-piv/piv-go](https://github.com/go-piv/piv-go) and [golang.org/x/crypto/ssh](https://golang.org/x/crypto/ssh). ![](https://user-images.githubusercontent.com/1225294/81489747-63a03b00-9247-11ea-923a-b7434bcf7fd1.png) ## Installation ### macOS ``` brew install yubikey-agent brew services start yubikey-agent yubikey-agent -setup # generate a new key on the YubiKey ``` Then add the following line to your `~/.zshrc` and restart the shell. ``` export SSH_AUTH_SOCK="$(brew --prefix)/var/run/yubikey-agent.sock" ``` ### Linux #### Arch On Arch, use [the `yubikey-agent` package](https://aur.archlinux.org/packages/yubikey-agent/) from the AUR. ``` git clone https://aur.archlinux.org/yubikey-agent.git cd yubikey-agent && makepkg -si systemctl daemon-reload --user sudo systemctl enable --now pcscd.socket systemctl --user enable --now yubikey-agent export SSH_AUTH_SOCK="${XDG_RUNTIME_DIR}/yubikey-agent/yubikey-agent.sock" ``` #### NixOS / nixpkgs On NixOS unstable and 20.09 (unreleased at time of writing), you can add this to your `/etc/nixos/configuration.nix`: ``` services.yubikey-agent.enable = true; ``` This installs `yubikey-agent` and sets up a systemd unit to start yubikey-agent for you. On other systems using nix, you can also install from nixpkgs: ``` nix-env -iA nixpkgs.yubikey-agent ``` This installs the software but does *not* install a systemd unit. You will have to set up service management manually (see below). #### Other systemd-based Linux systems On other systemd-based Linux systems, follow [the manual installation instructions](systemd.md). Packaging contributions are very welcome. ### FreeBSD Install the [`yubikey-agent` port](https://svnweb.freebsd.org/ports/head/security/yubikey-agent/). ### Windows Windows support is currently WIP. ## Advanced topics ### Coexisting with other `ssh-agent`s It's possible to configure `ssh-agent`s on a per-host basis. For example to only use `yubikey-agent` when connecting to `example.com`, you'd add the following lines to `~/.ssh/config` instead of setting `SSH_AUTH_SOCK`. ``` Host example.com IdentityAgent /usr/local/var/run/yubikey-agent.sock ``` To use `yubikey-agent` for all hosts but one, you'd add the following lines instead. In both cases, you can keep using `ssh-add` to interact with the main `ssh-agent`. ``` Host example.com IdentityAgent $SSH_AUTH_SOCK Host * IdentityAgent /usr/local/var/run/yubikey-agent.sock ``` ### Conflicts with `gpg-agent` and Yubikey Manager `yubikey-agent` takes a persistent transaction so the YubiKey will cache the PIN after first use. Unfortunately, this makes the YubiKey PIV and PGP applets unavailable to any other applications, like `gpg-agent` and Yubikey Manager. Our upstream [is investigating solutions to this annoyance](https://github.com/go-piv/piv-go/issues/47). If you need `yubikey-agent` to release its lock on the YubiKey, send it a hangup signal or use `ssh-add`'s "delete all identities" flag. Likewise, you might have to kill `gpg-agent` after use for it to release its own lock. ``` ssh-add -D ``` This does not affect the FIDO2 functionality. ### Changing PIN and PUK Use YubiKey Manager to change the PIN and PUK. `yubikey-agent -setup` sets the PUK to the same value as the PIN. ``` killall -HUP yubikey-agent ykman piv access change-pin ykman piv access change-puk ``` ### Unblocking the PIN with the PUK If the wrong PIN is e