HyperFrames: Write HTML, Render Video, Let an Agent Do Both (GitHub, Scanned)

HyperFrames turns a web page into a video. You write HTML and CSS, add media and seekable animations, and it renders the result frame by frame into a deterministic MP4. A CLI scaffolds a project, previews it in the browser with live reload and renders locally or in the cloud; a desktop app does the same for macOS, Windows and Linux; and a registry of about 450 blocks covers transitions, kinetic captions, charts, maps, 3D and camera moves so a named effect is an install rather than a rebuild.

The reason it is on this list is the agent side. HyperFrames ships seven skills that teach Claude Code, Codex, Cursor or Gemini CLI its production loop: plan the video, write valid HTML, wire the animations, add media, lint, preview and render. Ask for a ten-second product intro with a fade-in title, background video and music and the agent builds it. A media-use skill finds or makes music, voiceover, avatars and footage with HeyGen or free local tools, and a remotion-to-hyperframes skill migrates existing Remotion projects.

It is built by HeyGen, Apache-2.0 licensed, and grew from a March 2026 start to about 77,000 stars by November with releases most days and 125 contributors. Think of it as the agent-first answer to Remotion, which is also on this list: plain HTML instead of React, and a licence with no company tier.

• Repository: github.com/heygen-com/hyperframes
• Licence: Apache-2.0 (Apache License 2.0)
• Language: TypeScript. Stars: 76.6K. Forks: 7,003. Last push: Nov 1, 2026.
• Scan: safe, Nov 1, 2026, commit a2c5a8a

Who it is for

Creators and marketers who would rather describe a video than keyframe it, developers building automated video pipelines from data or docs, and teams with Remotion projects they want an agent to maintain.

Getting started

1. Claude Code: add the plugin marketplace, inside Claude Code

claude plugin marketplace add heygen-com/hyperframes

2. Then install the plugin and use /hyperframes

claude plugin install hyperframes@hyperframes

3. Any other agent: install the core skills

npx hyperframes skills update

4. Or work by hand: scaffold, preview and render (Node 22+ and FFmpeg)

npx hyperframes init my-video && cd my-video && npx hyperframes preview

Rendering drives a headless browser, so the first render pulls one down. The HeyGen-powered parts of the media skill need a HeyGen account; everything else runs on your machine.

Safety scan

We cloned heygen-com/hyperframes at commit a2c5a8a on Nov 1, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• Two secret hits in 9,555 files and 1.95 million lines: an AWS access key in examples/aws-lambda/scripts/check-sam-deploy.sh that is the AKIAFAKE placeholder the script checks against, and a private-key header inside a content extractor unit test. Neither is a credential.
• Four pattern hits. Two very long lines are generated inline bundles (position-edits-render-inline.ts and hf-early-stub-inline.ts). Two download-piped-to-shell hits are both curl bun.sh/install | bash: one in the Cloud Run Dockerfile, pinned to bun 1.4.4, and one in scripts/test-skills-fresh.sh that only prints the command as advice.
• The npm prepare hook installs lefthook git hooks, and only when a .git folder exists, so an npm install of the package does nothing. 28 committed binaries are .bin files: the registry's local vector index and the catalog fetch mirror, data rather than executables.
• Twenty workflows, none using pull_request_target, and all 54 third-party action uses pinned to commits. Security policy, CodeQL, Renovate, a contributing guide and a code of conduct are all present, which is the strongest hygiene on this list.
• Dependencies: the one lockfile the scanner reads is a registry block's package-lock.json, 32 packages with no advisories. The main workspace locks in bun.lock, which this scan does not parse, so the JavaScript packages you install were not checked. Network hosts are cdn.jsdelivr.net, Google Fonts, static.heygen.ai and example hosts in docs and tests.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 1.1M, HTML 321K, Markdown 306.3K, JavaScript 181.2K, JSON 58K, YAML 6,135.

Questions

Is HyperFrames free?

Yes. The framework, CLI, desktop app, skills and registry are Apache-2.0, free for commercial use. Cloud rendering and HeyGen's avatars, voices and generated video are paid services you can leave out.

HyperFrames or Remotion?

Remotion builds videos as React components under a licence that charges companies with more than three employees. HyperFrames uses plain HTML and CSS, is Apache-2.0 and was designed for agents from the start, with a skill that converts Remotion projects frame by frame.

Do I need to know how to code?

Not to get a video: with the plugin installed you describe it and the agent writes the HTML. Knowing a little HTML and CSS helps when you want to tweak the result by hand, and the desktop app lets you preview and scrub without touching a terminal.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.