Pelican Wings is a production-grade game server management daemon (agent) built in Go. It serves as the control plane for the Pelican Panel, managing Docker containers that run game servers. The daemon exposes a comprehensive HTTP API for server lifecycle operations (start, stop, install, backup, transfer), real-time WebSocket streams for console output and server stats, and a built-in SFTP server for file management. It communicates with a remote Panel API to synchronize server configurations, validate user credentials, and report activity logs. The codebase demonstrates strong systems engineering with a focus on security (sandboxed filesystem using openat2 syscalls, token authentication, download IP filtering), performance (disk-space caching, atomic generics), and reliability (crash detection, state persistence, cron-based backups). It supports multiple backup backends (local disk, S3), parallel server bootstrapping, and self-update via GitHub releases. The architecture follows a modular pattern with clear separation between API routing, server management, filesystem operations, and integration adapters. While the code is a fork of Pterodactyl Wings with some incomplete rebranding, it remains actively developed and production-ready.
sbomqs is a command-line tool and Go library for evaluating the quality and compliance of Software Bill of Materials (SBOM) documents. It parses SBOMs in CycloneDX, SPDX 2.x, and SPDX 3.0 formats and scores them against multiple industry standards: NTIA Minimum Elements (2021/2025/2026), BSI TR-03183-2 (v1.1, v2.0, v2.1), FSCT v3, OpenChain Telco v1.1, and an Interlynk comprehensive profile. The tool outputs scores, detailed compliance reports, and feature lists, and can be integrated with Dependency-Track and policy engines. It is used in production by several platforms and has been cited in academic research evaluating over 78,000 SBOMs. The codebase is well-structured with clean interfaces, extensive test coverage, and a modular architecture that separates parsing, scoring, compliance checking, and reporting. A notable architectural trade-off is the coexistence of two scoring engines (legacy v1 and v2), which adds complexity but allows incremental migration. The library is embeddable as a Go module, and the CLI supports multiple output formats (basic, detailed, JSON).
imsgcrawl is a local-first CLI tool for reading, archiving, and searching Apple iMessage data. It operates by taking a read-only snapshot of the macOS Messages SQLite database (`chat.db`), extracting handles, chats, messages, and deletion events, then merging them into a local SQLite archive. The tool provides bounded commands for metadata, status, sync, chats, messages, full-text search, and phone-only contact export. It outputs both human-readable text (with terminal control escape protection) and stable JSON for automation. The architecture is cleanly separated into packages for archive management, message extraction (including attributed body decoding and edit/unsend reconstruction), and portable SQLite snapshotting with macOS copy-on-write support. The codebase demonstrates strong engineering practices: thorough test coverage including fuzzing, explicit privacy boundaries, identity validation for source databases, and careful handling of edge cases like malformed UTF‑16, hardlinked sidecars, and concurrent sync locking.
PicoClaw is an ultra-lightweight personal AI agent platform written in Go, engineered to run on hardware as small as $10 RISC-V boards while providing a full-featured chat agent experience. In production it is a daemon (picoclaw) that connects 30+ LLM providers (OpenAI, Anthropic, Gemini, Azure, Bedrock, Claude CLI, Codex, Ollama, etc. behind a common provider factory) to 19+ messaging channels (Telegram, Discord, WhatsApp, WeChat, WeCom, Slack, IRC, Matrix, DingTalk, Feishu, MQTT, etc.), exposing an agent loop with tool calls, MCP server integration, session management, voice I/O (ASR/TTS), cron jobs, skills marketplace, and hardware tools (I2C, SPI, serial). A companion launcher binary (picoclaw-launcher) runs a Go web backend with an embedded React/TypeScript frontend for configuration, model/channel/credential management, logs, and live chat.\n\nThe architecture is a modular monolith: pkg/agent implements the turn pipeline (context assembly, thinking levels, tool loop, streaming, stop handling), pkg/providers abstracts LLM backends with rate limiting, cooldown tracking, and fallback chains driven by an error classifier, pkg/channels provides a factory-registered channel abstraction over a shared base, and pkg/bus + pkg/events carry inbound/outbound messages and typed runtime events with backpressure. Agents are defined by AGENT.md/SOUL.md workspace files and support delegation/spawning. An experimental evolution subsystem clusters learning records and generates skill drafts via LLM, and the seahorse SQLite FTS5 store provides compacted short-term memory with BM25 retrieval and summary trees. Legacy OpenClaw configs can be migrated.\n\nThe codebase is heavily tested (500+ test files across nearly every package), uses cross-platform build tags for Windows/Linux/Unix/Android, and ships Docker images plus a self-update mechanism. Strong engineering practices include atomic file writes, zip-slip and SSRF protection utilities, typed event buses, factory registries, and a ToolResult structure separating LLM-facing vs user-facing output. The project is pre-1.0 with rapid release cadence; the evolution subsystem, some platform-specific hardware stubs, and the large channel/provider surface are the least mature areas. It is not a data-research repository - the LOCOMO memory benchmark and LLM-as-judge evaluation code in cmd/membench support engineering measurement rather than producing research artifacts.
Cloudreve is a production-grade, self-hosted file management system (v4) built with Go, Gin, and the ent ORM. It provides a full-featured cloud storage platform supporting multiple storage backends (local, S3, Aliyun OSS, Tencent COS, Huawei OBS, Qiniu, Upyun, OneDrive), WebDAV, WOPI for online Office editing, OAuth2, WebAuthn passkeys, full-text search via Meilisearch, thumbnail generation (vips, ffmpeg, LibreOffice), media metadata extraction (EXIF, ffprobe), and a background task queue for async operations like archive creation, remote downloads, and indexing. The architecture follows a layered pattern with dependency injection, a database-backed filesystem (DBFS) with navigators, an event hub for real-time file events, and a master-slave cluster for distributed nodes. The codebase is well-organized into reusable packages (e.g., pkg/request, pkg/queue, pkg/cache, pkg/auth) and includes a comprehensive admin panel for managing users, groups, storage policies, tasks, and nodes. While primarily an application, it also incorporates data engineering patterns like media metadata extraction and full-text indexing for user-facing features.
Gopeed is a high-performance, cross-platform download manager written in Go with a Flutter frontend. It supports HTTP/HTTPS, BitTorrent, Magnet links, ed2k, and HLS streaming protocols. The backend provides a REST API, CLI, and an MCP server for AI agent integration. The frontend is a full-featured Flutter app for desktop (Windows, macOS, Linux), mobile (Android, iOS), and web. Key features include multi-connection downloads with slow-start and work-stealing, a JavaScript extension system (goja) with polyfills for fetch, XHR, Blob, and streams, archive extraction (zip, 7z, rar), webhook/script notifications, and browser impersonation via TLS fingerprinting. The architecture is modular: protocol-specific fetchers implement a common interface, the download engine manages task lifecycle and persistence (BoltDB), and the UI communicates via RPC or FFI. The codebase is well-tested with extensive integration tests and includes a legacy Flutter UI (ui/flutter_old) alongside the current one, indicating an ongoing migration from GetX to Riverpod.
Pterodactyl Panel is a production game-server management control panel. It manages a fleet of game servers (Minecraft, Source Engine, Rust, voice servers, etc.) running in Docker on remote nodes, coordinated by the companion Wings daemon. The PHP/Laravel backend provides a session-based admin UI, a JSON:API-style application API for provisioning, a permission-scoped client API for end users, and a remote API used by Wings for server installation, transfer, backup status, and SFTP authentication. The React/TypeScript frontend handles the modern client experience—console, file manager, databases, backups, schedules, network allocations, account management, and 2FA—while the admin area remains classic Blade/jQuery views. Data flows from MySQL/MariaDB through Eloquent repositories and service classes, then to Wings over HTTP via Guzzle; Redis is used for queues, cache, and sessions, and optional anonymous telemetry is collected. Architecturally this is a Laravel monolith with a clean layered separation: FormRequest validation, service classes, Eloquent repositories behind interfaces, Fractal transformers, event/observer hooks, and a sophisticated activity-logging subsystem. The frontend is organized into reusable components, custom hooks, and pure utility functions, many of which are isolated enough to lift into other projects. The codebase is mature and actively maintained with CI, integration tests, and security patch releases, but it carries visible technical debt: a dual UI stack (Blade plus React), older React 16 tooling (easy-peasy v4, react-hot-loader), 190+ migrations spanning a decade, and a few deprecated models/fields. The repository is clearly an application, not a data/research project; although it stores substantial operational data, its purpose is real-time system control rather than analysis.
Jitsu is an open-source event data platform (alternative to Segment) that ingests events from websites, apps, and servers, transforms them via user-defined functions (UDFs) and built-in destination functions, and delivers them to data warehouses (ClickHouse, BigQuery, Snowflake, Redshift, Postgres, S3, GCS) and SaaS tools (Amplitude, PostHog, HubSpot, etc.). The architecture is multi-service: a Go-based bulker handles ingestion and warehouse delivery, a TypeScript-based rotor executes event transformations and profile building, a Next.js console provides the management UI and API, and a CLI tool supports project management and function deployment. The data flow is: HTTP ingest → Kafka → rotor (functions) → bulker (SQL/file destinations) → ClickHouse/PostgreSQL for metrics and logs. External dependencies include Kafka, PostgreSQL, ClickHouse, Redis, MongoDB, and Google Cloud Storage. The console supports multi-tenant workspaces, authentication (Firebase, OIDC, NextAuth), billing, audit logging, rate limiting, and an MCP server for AI tool integration. The codebase is a monorepo with pnpm workspaces and Go modules, featuring extensive test suites (unit, integration with testcontainers, e2e) and CI/CD pipelines. It demonstrates strong engineering practices with reusable libraries (juava, jitsubase), custom high-performance JSON parsers, and well-abstracted repository and configuration patterns. However, there is some technical drift: duplicate JSON libraries (jsoniter and jsonorder), commented-out code, and ESLint disable comments in admin routes. Overall, it is a mature, actively maintained platform suitable for production use.
Diun is a Docker image update notifier written in Go that monitors container images across various platforms (Docker, Kubernetes, containerd, Nomad, Swarm, and file-based configurations) for updates. It periodically checks image manifests against a stored state (using BoltDB) and sends notifications via multiple channels (Slack, Telegram, email, etc.) when updates are detected. The application features a modular architecture with pluggable providers and notifiers, a gRPC interface for external interaction, Prometheus metrics, and structured logging. The system is designed for self-hosted environments to automate the detection of base image updates, application releases, and security rebuilds. Key components include a CLI for management, a scheduler for periodic checks, a template system for customizable notifications, and secret handling utilities. Diun's strength lies in its extensibility and wide platform support, making it a versatile tool for DevOps workflows.
M3 is a distributed time-series database and metrics platform originally developed by Uber and now under the Linux Foundation. It provides a full-stack solution for collecting, aggregating, storing, and querying high-volume metric data at scale. The system comprises multiple services: m3dbnode (storage node with custom encoding and persistence), m3coordinator (routing and downsampling gateway), m3aggregator (clustered metrics aggregation with quantile estimation), and m3query (PromQL/Graphite query engine). These services communicate via Thrift, gRPC, and HTTP, and are coordinated through an etcd-based cluster management layer that handles placement, leader election, and configuration distribution. The architecture is highly performance-oriented, featuring extensive object pooling, zero-copy I/O, custom bit-level encoding (m3tsz), and an inverted index (m3ninx) backed by FST segments and Roaring Bitmaps for fast metadata search. The codebase is written in a custom Go-like transpiled language and includes generated code for mocks, protobuf, and Thrift bindings. It integrates deeply with Prometheus (remote write, scrape, and query) and Graphite protocols, and provides a React-based admin UI (m3ctl) for namespace and rule management. The repository also contains a comprehensive suite of unit, integration, and property-based tests, along with Docker-based development and CI environments.
Tracee is a runtime security and observability tool that uses eBPF to trace system events and detect threats. It consists of multiple Go binaries: a main security agent (`tracee`) that loads eBPF programs, collects kernel events, and runs detection rules; a gRPC client (`traceectl`) for remote management; an event generator (`evt`) for stress testing; and a Kubernetes operator. The architecture is modular with a clear separation between eBPF event collection, event derivation and enrichment pipelines, data stores (process tree, container info, DNS cache, kernel symbols), a detection engine supporting both Go signatures and YAML-based rules using CEL expressions, and filtering/policy subsystems. The system operates as a daemon with HTTP/gRPC endpoints for metrics, health, and streaming event output, and integrates deeply with Kubernetes via CRDs and controllers. The codebase demonstrates strong engineering with clean abstractions (filter interfaces, data store registries, event derivation framework), reusable utility packages (bucketcache, changelog, string interning, fuzzy parsing), and comprehensive testing including unit, integration, and e2e tests. However, it exhibits technical drift in areas like multiple Go modules with `replace` directives, hardcoded kernel version checks in eBPF probe logic, legacy signature conversion code planned for removal, and some global mutable state. The eBPF C code is complex and kernel-version-sensitive, requiring ongoing maintenance. Overall, it is a well-crafted, production-grade security tool suitable for container and Kubernetes environments.
OpenYurt is a Kubernetes-native edge computing platform implemented as multiple Go binaries. The codebase contains a set of operators, node agents, proxies, and CLIs rather than a single monolith. YurtHub is an edge-side reverse proxy that intercepts kubelet and other node traffic, applies pluggable filters, caches API responses on disk, multiplexes list/watch requests, and can serve from local cache when the cloud API server is unreachable (node autonomy). Yurt-Manager is a controller-runtime manager with about twenty controllers and webhooks for NodePool, YurtAppSet, YurtStaticSet, service topology, Raven gateway networking, hub leader election, load balancer sets, CSR approval, and EdgeX PlatformAdmin. YurtTunnel provides a secure tunnel for kubectl exec/logs and other traffic between cloud and edge nodes. Yurtadm is a CLI for bootstrapping, joining, and resetting nodes, and yurt-iot-dock bridges OpenYurt IoT CRDs to EdgeX Foundry.
Themis is a cross-platform cryptographic library developed by Cossack Labs, providing high-level security primitives such as Secure Cell (symmetric encryption with three modes: Seal, Token Protect, Context Imprint), Secure Message (asymmetric encryption and digital signing), Secure Session (mutual authentication and key exchange), Secure Comparator (zero-knowledge password comparison), and key generation (EC, RSA, symmetric). The core is implemented in C with a cryptographic engine abstraction layer (Soter) that supports OpenSSL, BoringSSL, and a custom Ed25519 implementation. The library exposes consistent APIs across 13+ language wrappers including Python, Go, Rust, Java, Swift, Objective-C, JavaScript (Node.js and WebAssembly), PHP, Ruby, C++, and React Native. The codebase is well-structured with extensive unit, integration, and fuzz testing, CI/CD pipelines for each wrapper, and cross-language compatibility tests. While the repository has deprecated older APIs and maintains multiple backends, it remains actively maintained with regular releases, security patches, and community engagement.
Wormhole is a generic cross-chain messaging protocol that allows smart contracts on different blockchain networks to communicate with each other. This monorepo contains the full protocol implementation: a guardian node (Go) that observes events on supported blockchains, signs Verifiable Action Approvals (VAAs), and relays them; smart contracts deployed on Solana, Ethereum, CosmWasm, NEAR, Sui, Aptos, Algorand, and a custom Cosmos SDK chain (Wormchain); multi-language SDKs (JavaScript, Go, Rust) for integrating with the protocol; and a CLI tool for governance and bridge operations. The system supports token bridging, NFT bridging, cross-chain queries (CCQ), and native token transfers (NTT) with an accountant contract for balance tracking. The architecture follows a microservices pattern within the guardian node: chain-specific watchers feed events into a processor that builds VAAs, which are signed by a quorum of guardians and then broadcasted via P2P/gRPC. On the smart contract side, each blockchain has its own implementation of core bridge logic, token bridge, NFT bridge, and governance modules. The codebase uses a variety of frameworks including Solitaire (a custom Solana framework), Anchor (for SVM shims), CosmWasm contracts, and standard Solidity patterns. Extensive testing infrastructure exists with unit tests, integration tests (some hitting live testnets), and formal verification (KEVM for EVM contracts). While the code is large and spans many languages, the core abstractions (VAA structs, guardian set management, watcher interfaces, supervisor pattern, and the Solitaire framework) are well-designed and demonstrate professional engineering maturity. The monorepo also includes generated protobuf code, deployment scripts, devnet configurations, and audit reports, making it a complete reference implementation but also introducing maintenance complexity and some technical debt (e.g., deprecated chain handling, hardcoded keys in tests, and occasional use of panic).
This repository is a production full-stack application for browsing, searching, downloading, and publishing galgame (visual novel) sticker packs. It is a pnpm monorepo containing a Nuxt 4 SSR frontend (`apps/web`) and a Go Fiber v3 API (`apps/api`) backed by PostgreSQL. The API exposes both internal service endpoints and a public read-only OpenAPI "face" for sticker content, while integrating with external ecosystem services: an OAuth 2.0 identity provider (PKCE, httpOnly session cookies, BFF pattern), a centralized content-addressed image service, a catalog service for games/characters, and a community service for comments, notifications, and reactions. Deployment is Docker images to GHCR via Dokploy, with versioned SQL migrations and GitHub Actions CI building all images on push to the `svelte-kit` branch. The backend is well-layered: handlers own HTTP concerns, services contain business logic without importing Fiber, repositories use GORM, and repeated cross-service communication is isolated in reusable `pkg` clients. Noteworthy engineering includes batch hydration for pack covers/tags/authors, trigram GIN search over flattened multilingual text, cursor pagination for notifications, and RFC 9457 problem-detail error responses in the public API. The frontend is organized into feature modules and includes a race-condition-safe catalog picker, OAuth PKCE utilities, and server-side OG image generation. The codebase is maintained and technically current, though some operational risks remain: dual error dialects between internal and public APIs, silent degradation when optional upstream services are down, and a few hardcoded backfill mappings in one-time scripts.
Matterpoll is a Mattermost plugin that enables users to create and manage polls directly within the chat platform. It provides a slash command (`/poll`) and interactive dialogs for creating polls with options like multi-vote, anonymous voting, progress display, and public add-option. The server-side is written in Go, handling HTTP API endpoints, slash commands, and poll state persistence via Mattermost's KV store. The webapp component, built with React and TypeScript, renders rich poll attachments, a right-hand side card, and handles user interactions. The plugin supports 11 languages via go-i18n and follows Mattermost's plugin development patterns with comprehensive testing and CI/CD. It is a well-structured, production-quality plugin that demonstrates clean separation of concerns, testable interfaces, and localization best practices.
vexctl is a command-line tool for creating, applying, and attesting VEX (Vulnerability Exploitability eXchange) data. It is built as a single binary using Cobra for CLI, with subcommands for creating VEX documents, merging them, filtering SARIF scanner results, generating attestations, and validating documents against the OpenVEX specification. The tool integrates with Sigstore for keyless signing and supports multiple VEX formats (OpenVEX native, CSAF, CycloneDX). It can attach VEX attestations to container images via OCI referrers API or legacy tag layout. The architecture follows a clean separation of concerns: CLI handlers in `internal/cmd/` delegate to a core library in `pkg/ctl/`, which uses an interface (`Implementation`) for testability. The `pkg/attestation/` package handles in-toto attestations and Sigstore signing independently. The codebase demonstrates strong engineering practices with dependency injection, options struct patterns, and comprehensive test data. While primarily an application, it also processes vulnerability data (SARIF, VEX documents) and includes validation logic that could be reused in other security tooling.
Yaegi is a Go interpreter written in Go, designed for embedding scripting capabilities into Go applications, running Go scripts, or providing an interactive REPL. The architecture consists of a core interpreter package (`interp`) that parses Go source code into an AST, performs type checking and control flow graph (CFG) generation, and executes the CFG via a runtime engine. Standard library support is provided through auto-generated reflective wrappers (`stdlib/`) that expose Go's standard library symbols to the interpreter. A command-line tool (`cmd/yaegi`) offers subcommands for running scripts, testing, and extracting stdlib wrappers. The project also includes code generators (`internal/cmd/genop`, `extract/extract.go`) that automate the creation of operator implementations and stdlib bindings. External dependencies are limited to the Go standard library; the interpreter itself has no third-party runtime dependencies. Key entry points are `interp.New()`, `interp.Eval()`, and `interp.Use()` for embedding, and the `yaegi` CLI for standalone use.
Parca is a continuous profiling platform that collects, stores, queries, and visualizes pprof profiles in real time. The Go backend ingests profiles via gRPC (both pprof and OpenTelemetry OTLP), normalizes them into Apache Arrow columnar format, and stores them in either FrostDB (default) or ClickHouse. It provides a rich gRPC+JSON API for querying profiles (flamegraph, table, source view, callgraph, pprof download), scraping Prometheus-style targets, managing debug information for symbolization, and sharing profiles via links. The TypeScript/React frontend delivers an interactive profiling UI with flamegraphs, tables, source views, metrics graphs, sandwich views, and comparison mode, all backed by efficient Arrow-based querying. The codebase demonstrates strong engineering with reusable patterns (generic caching, signed request abstraction, Arrow compaction), but carries some drift risk from dual storage backends, generated protobuf code, and a complex UI state layer built with multiple state management strategies.
Bumblebee is a production-grade supply-chain inventory collector for macOS and Linux developer endpoints. It scans the filesystem for package metadata from lockfiles (npm, pnpm, yarn, bun, gomod, rubygems, composer), install receipts (Homebrew, Python dist-info, Go sum), extension manifests (VS Code, browser extensions), and MCP configuration files. The system outputs NDJSON records of installed packages and can optionally match them against operator-supplied threat intelligence catalogs to emit findings for known malicious packages. It is a single Go binary with zero runtime dependencies, designed for offline, read-only operation. Architecturally, it follows a modular scanner pattern with a generic filesystem walker, per-ecosystem scanners, an exposure catalog loader, and a pluggable output sink (stdout, file, or HTTP with bearer/HMAC auth and gzip). The repository also includes a threat_intel directory of curated supply-chain attack data and a tool to convert OSV records into its catalog format. Although primarily an application, it has a strong data component through its structured threat intelligence catalogs, making it a hybrid that leans towards a security scanning tool.