gstack Review: Garry Tan's Claude Code Setup Goes Viral

A sitting Y Combinator president just open-sourced his own dev setup, and the internet's reaction wasn't "neat side project" — it was nearly 140,000 stars in under two weeks. This gstack review looks at what gstack actually does, what Garry Tan claims it does for his own output, and the one default setting in its own privacy docs that's worth turning off before you install it on a real codebase.

gstack review: what it actually is

gstack is a free, MIT-licensed collection of Markdown-based slash commands for Claude Code (with partial support for Codex, Cursor, and Gemini CLI). Its own README sums up the pitch in one line: it "turns Claude Code (and other coding agents) into a virtual engineering team." That team, per the README, breaks down into:

• A CEO who rethinks the product.
• An eng manager who locks architecture.
• A designer who catches AI slop.
• A reviewer who finds production bugs.
• A QA lead who opens a real browser.
• A security officer who runs OWASP + STRIDE audits.
• A release engineer who ships the PR.

"All slash commands, all Markdown, all free, MIT license," the README adds.

In practice, that means commands like:

• /office-hours — reframes a product idea into a design doc.
• /review — hunts for production bugs that pass CI.
• /qa — explores browser, API, CLI, job, and webhook behavior to reproduce bugs, then writes failing regression tests and fixes the cause before re-verifying.
• /ship — runs tests and review, then opens the pull request.

All of it follows a fixed process — Think → Plan → Build → Review → Test → Ship — per the project's own docs.

Install is a clone-and-run — the README's own section header calls it "Install — about 30 seconds." It requires Claude Code, Git, and Bun 1.4.2+, plus Node.js if you're on Windows.

From zero to #3 on GitHub trending in eleven days

The timeline is the actual story. gstack's first tagged release, v1.91.242.0, shipped October 26, 2026, and its own release notes call it exactly that — "First tagged release" — bundling 96 prior untagged versions from the week before. Eleven days later, on November 6, the repo sits at roughly 140,000 stars and 20,700 forks, and placed #3 on GitHub's daily trending leaderboard with 612 stars gained that day alone — a live, constantly-moving number as of this writing.

The commit history and CHANGELOG confirm it isn't a one-time viral tweet followed by abandonment: the project shipped five separate point releases on November 4 alone (v1.95.1.0 through v1.95.5.0, right after v1.95.0.0 the day before), and its newest release, v1.96.0.0, landed November 5 — a cadence of multiple ships per day that most week-old open-source projects don't sustain. A companion repo, gbrain ("Garry's Opinionated OpenClaw/Hermes Agent Brain," also MIT), gives agents persistent memory and sits at roughly 31,600 stars and 4,700 forks on its own.

For comparison, we've covered this same "viral GitHub-trending dev tool" pattern before with Graphify's knowledge-graph CLI and Treg's agent-tool API gateway — but neither came from someone running Y Combinator, which is most of why gstack's star count is this big this fast.

The 810x claim, and Tan's own caveats about it

gstack ships with its own defense document, docs/ON_THE_LOC_CONTROVERSY.md, responding to an earlier, separate controversy from April 2026 when Tan said he'd shipped 600,000 lines of production code in 60 days and critics called it AI slop. The doc's table, dated April 18, 2026, lays out the self-reported math: 14 logical lines of code per day in 2013 (part-time, alongside a day job) versus 11,417 lines/day across a 108-day window in 2026 — an 810x multiple. Total logical lines went from 5,143 to 1,233,062 (240x), while commit counts only grew 4.9x (71 to 351).

Tan's own document doesn't just assert the number — it stress-tests it. It runs deflation scenarios assuming AI-generated code is more verbose than human code: at 2x verbosity the multiple drops to 408x, at 10x it's 81x, and at 100x verbosity it's still 8x. It also reports quality metrics for the same 351 commits: a 2.0% revert rate (7 commits), a 6.3% post-merge-fix rate (22 commits), and test counts growing from about 100 in January to over 2,000 by the time of writing — across 41 repositories, 15 of them public. The document itself concedes caveats: the analysis covers greenfield work, the 2013 baseline has survivorship bias, and quality-adjusted productivity "isn't fully proven." These are self-reported figures from Tan's own document, not independently audited, and we're flagging them as such.

That self-skepticism shows up again in docs/SLOP_SCAN.md, a static-analysis tool baked into gstack that scores the codebase for "sloppy" AI-generated patterns — the doc reports the project's own score dropping from 432.8 (100 findings) to 358.1 (90 findings) after a cleanup pass, while warning the team not to chase the number for its own sake.

The default setting worth changing before you install it

Here's the part that didn't show up in gstack's launch buzz: by default, gstack sends your code to a second AI vendor. Its own docs/privacy.md has a section header reading "Outside reviews (on by default; the first one prints a notice)." The next line spells out what that means: "That sends the review prompt and the relevant code, diff or plan to that provider, using your own Codex or Claude Code login." In other words: review and design skills can hand your actual code and diffs to a provider other than the one you're already running. That happens by default, opt-out rather than opt-in — a real consideration if you work in a codebase under an NDA or a regulated data-handling policy. It's disabled with gstack-config set codex_reviews disabled, but you have to know to look.

The rest of the telemetry picture is more defensible: usage telemetry itself is opt-in and off by default, and when enabled it sends operational metadata only — skill name, outcome, duration, OS/CPU architecture, a capped and redacted error message — explicitly never code, file paths, repo names, branch names, or prompt content, going to a Supabase backend with a published schema. A separate, always-on update check pings GitHub for the latest version (GitHub sees your IP, nothing else), which can be turned off with gstack-config set update_check false.

The takeaway

gstack is a real, actively-shipping, MIT-licensed project — not a vaporware repo riding one famous name — and its release cadence, test-count growth, and self-published slop-scan numbers back that up. But the viral star count is inseparable from who built it: a sitting YC president posting his own setup is a very different distribution event than an anonymous maintainer's tool climbing the same chart, something worth keeping in mind the next time a free dev tool jumps GitHub's leaderboard overnight. If you're going to try it, read docs/privacy.md yourself first, and decide deliberately whether you want /review and the other outside-review skills sending your diffs to a second AI vendor by default — because right now, that's the setting you'd be shipping with on day one.