git-credential-keepassxc is a Rust-based Git credential helper that enables Git and shell scripts to store and retrieve credentials from KeePassXC. It implements the KeePassXC browser protocol to communicate with the password manager via socket/named pipe interfaces. The application provides subcommands for getting credentials (get), generating TOTP codes (totp), storing credentials (store), managing configuration (configure), verifying caller identity (caller), and other auxiliary functions. It features optional security enhancements including strict caller verification, YubiKey-based encryption of configuration files, and desktop notifications. The architecture follows a modular Rust CLI pattern with clear separation between argument parsing, configuration management, core protocol implementation, and utility functions.
recheck is a monorepo for a ReDoS (Regular expression Denial of Service) vulnerability checker, written in Scala 3 and cross-compiled to JVM and JavaScript via Scala.js. The system parses regular expression patterns, builds an execution model, and detects catastrophic backtracking vulnerabilities. It exposes multiple interfaces: a core library (`recheck-core`) with a high-level `ReDoS.check` API, a CLI (`recheck-cli`) with `check` and `batch` subcommands (the latter using JSON-RPC over stdio), JavaScript bindings (`recheck-js`) for browser/Node usage, and an ESLint plugin (`eslint-plugin-redos`) for CI integration. The architecture is a multi-module sbt build with Lerna/pnpm for JS workspace management, featuring clean separation between parsing, execution, unicode data, and platform-specific adapters.
Centerline is a Python library for computing the medial axis (centerline) of polygon geometries using Voronoi diagrams. It provides both a programmatic API via the Centerline class and a command-line interface (create_centerlines) for processing vector files. The library takes polygon/multipolygon inputs, generates a Voronoi diagram from densified boundaries, filters ridges contained within the input geometry, and unions them to produce a multilinestring output while preserving attribute data. The architecture separates core algorithmic logic (geometry.py) from I/O and CLI concerns (converters.py), with proper error handling via custom exceptions.
xword-dl is a command-line tool that downloads crossword puzzles from over 30 online outlets and saves them in the standard .puz format. The codebase implements a plugin-based architecture where each outlet (e.g., New York Times, Guardian, Los Angeles Times) has its own downloader subclassing a base class. The main entry point (xword_dl.py) discovers plugins via package walking, parses command-line arguments, and dispatches to the appropriate downloader. The download flow consists of locating the puzzle URL (by latest or by date), fetching solver data, parsing the outlet-specific format (JSON, XML, or obfuscated payload) into a unified Puzzle object, sanitizing content for the .puz format, and saving the file. Notable technical challenges handled include deobfuscating AmuseLabs' proprietary encoding using a brute-force BFS key search, authenticating with NYT's subscription API, and translating diverse grid/clue representations into a standardized binary format. The project is actively maintained with pinned dependencies, GitHub Actions CI, and a well-documented plugin pattern. While it lacks unit tests and some downloaders are disabled due to anti-scraping measures, the core architecture is clean and the deobfuscation module is a standout reusable asset.
cheek is a pico-sized declarative job scheduler written in Go. It reads a YAML schedule file defining jobs with cron expressions, retries, environment variables, working directories, and event-driven actions (webhooks, job chaining). The single binary provides a CLI (run, trigger, version) and an embedded HTTP server with a web UI for monitoring job execution and logs. Architecture is monolithic: the scheduler loop runs in a goroutine, executing jobs via os/exec with context cancellation for graceful shutdown. Job logs are persisted to SQLite. External dependencies include SQLite, cron parsing (gronx), HTTP routing (httprouter), CLI framework (cobra), config management (viper), and structured logging (zerolog). The codebase is well-tested, with comprehensive unit tests and CI/CD pipelines for cross-platform builds and Docker images.
ThermalMarky is a web application and CLI tool that converts Markdown text into formatted ESC/POS commands for thermal receipt printers. The system is built with FastAPI for the HTTP server and python-escpos for printer communication. It features a clean web UI (single HTML page with Bootstrap) and a command-line interface for piping or file input. The architecture is a straightforward monolith: the web endpoint accepts markdown, saves it to a temporary file, then invokes the CLI script via subprocess. The core library modules handle configuration (with content overrides via HTML comments), input loading (stdin/file), markdown parsing into tokens with formatting (bold, underline, headers, alignment, QR codes), and printer output with line-width wrapping and truncation. The project includes proper Docker support and environment variable configuration. It demonstrates good separation of concerns and a non-trivial markdown-to-ESC/POS converter that handles inline format toggling and scaled text width calculations.
ClawScan is a Go-based CLI tool for composable security scanning of AI agent skills and plugins. It orchestrates multiple external scanners (e.g., Snyk, VirusTotal, Socket, AIG, Cisco, SkillSpector) against skill directories, collects raw evidence, and optionally feeds results to an LLM judge for evaluation. The tool supports profile-based configuration (built-in profiles like `clawhub` and `openclaw-install-policy`), Docker sandboxing, declarative gate rules for automated policy enforcement, and benchmark execution against datasets like SkillTrustBench and clawhub-security-signals. It is distributed via npm (`@openclaw/clawscan`) and GitHub Releases, with a rich CI/CD pipeline including automated runtime image builds, dependency updates, and a Hugging Face leaderboard for security signals research. While primarily an application, it has strong data/research elements through its benchmark infrastructure and leaderboard submission validation.
gitcrawl is a Go-based CLI and library for ingesting GitHub repository data (issues, PRs, comments, reviews, code files, workflow runs) into a local SQLite database, then searching and analyzing that data offline. It exposes commands like `gitcrawl sync owner/repo`, `gitcrawl search issues`, and `gitcrawl code index`, with optional full-text code search. The architecture is a layered CLI: a command layer, a GitHub GraphQL/REST client with rate-limit guarding, a sqlc-generated SQLite data-access layer, and a small TUI built on bubbletea/lipgloss. It also includes a separate metrics store with strict database-ownership validation and idempotent writes.
Sherlock is a monolithic Python CLI for username enumeration across social networks. For a given username it fans out concurrent HTTP probes to roughly 400 external sites (defined declaratively in sherlock_project/resources/data.json), then classifies each response as Claimed / Available / Unknown / Illegal / WAF using three detection modes: HTTP status code, presence/absence of a site-specific error message in the response body, or redirect behavior (redirects disabled, 2xx/3xx means claimed). Requests run in parallel via a requests-futures session capped at 20 workers; an optional per-site regex short-circuits illegal usernames without sending a request, and hardcoded fingerprint strings detect Cloudflare / PerimeterX / AWS WAF blocks. The CLI accepts one or more usernames, supports {?} wildcard expansion into `_`, `-`, `.` variants, and reports results to the terminal via a QueryNotify observer, with optional .txt, .csv, and .xlsx export. The system is fully data-driven: no per-site code exists. Each manifest entry declares the probe URL, error detection method, error signatures, optional headers/request method/JSON payload, and NSFW flag; a JSON Schema (data.schema.json) enforces conditional consistency (e.g., errorMsg required when errorType includes 'message'). By default the manifest is fetched live from https://data.sherlockproject.xyz, with an ephemeral false-positive exclusion list pulled from a dedicated GitHub branch; --local, --json, and --site flags override this behavior. Entry points are the `sherlock` console script, `python -m sherlock_project`, a Docker image entrypoint, and an Apify Actor (.actor/) that wraps the Docker image and pushes JSON results into an Apify dataset. Engineering strengths include the declarative manifest/schema design, a genuinely useful test suite (schema validation, live-target probe tests, randomized false-positive fuzzing, a Unicode regression test for issue #2730), and CI that runs a tox matrix across Python 3.10-3.14t on three OSes, validates only manifest entries modified by a PR, comments the validation summary back on the PR, and updates the exclusions list daily. Weaknesses: nearly all orchestration and output-format logic lives in a ~1,200-line sherlock.py; notify.py uses a module-global result counter; sites.py has mutable default arguments and a dead username_unclaimed parameter; the --print-found flag is always True (store_true combined with default=True); stem is an unused declared dependency; and the request layer relies on requests-futures, an effectively unmaintained library. The project is actively maintained and extremely popular (93k+ stars), and its health depends on hundreds of external sites remaining stable, hence the extensive removed-sites documentation and dedicated false-positive/false-negative issue templates. Technical drift is moderate rather than severe: the Python ^3.9 floor is now EOL, requests-futures is unmaintained, the WAF fingerprint catalog has not been extended since late 2024, and the PyPI readme still documents removed --tor flags.
NetEase-MusicBox is a Python 3.10+ terminal client for NetEase Cloud Music (music.163.com), sold as the `musicbox` command. It is a hybrid application: an interactive curses TUI, an agent-facing stateless CLI, and a resident background daemon (`musicboxd`) that owns playback state. The TUI and daemon are mutually exclusive via a flock single-owner lock; control commands reach the daemon over a 0600-permission Unix domain socket using newline-delimited JSON-RPC. Audio plays through subprocess backends (mpg123 for MP3, mpv for FLAC/hi-res with IPC seek/volume control), and all NetEase API access goes through reverse-engineered weapi/eapi encryption (RSA+AES and AES-ECB with PKCS7/gzip handling). Login is QR-code scan only; session cookies and player state persist to XDG-compliant JSON/text files.
Flux2 is a CLI tool (the `flux` command) for implementing GitOps workflows on Kubernetes. It manages the lifecycle of Flux-specific Kubernetes resources (GitRepository, HelmRepository, OCIRepository, Kustomization, HelmRelease, ImageRepository, etc.) by generating manifests, applying them via server-side apply, and monitoring reconciliation status. The CLI is built with Cobra and provides subcommands for bootstrap, install, create, get, reconcile, suspend, resume, export, delete, diff, build, push, pull, tag, trace, tree, events, logs, check, migrate, uninstall, and plugin management. It supports multiple Git providers (GitHub, GitLab, Gitea, Bitbucket Server), OCI registries, Helm repositories, and cloud authentication (AWS, Azure, GCP). The architecture follows an adapter pattern where each resource type implements a common interface, enabling generic command implementations. Key data flows include: (1) bootstrap: clone a Git repository, generate manifests, push sync config, wait for readiness; (2) install: deploy Flux controllers and CRDs onto a cluster; (3) reconcile: fetch desired state from a source (Git, OCI, Helm), compute diff, apply via Kubernetes API, wait for convergence; (4) artifact management: build tarballs from manifests and push to OCI registries with metadata. External dependencies include Kubernetes controller-runtime, go-containerregistry, go-git, and various cloud SDKs. The repository also serves as the distribution hub for Flux controller manifests and includes a GitHub Action for installing the CLI in CI pipelines.
MQTTX is a cross-platform MQTT 5.0 client tool developed by EMQ, available as a desktop application (Electron + Vue), a web application (Vue), and a command-line interface (Node.js). It allows users to connect to MQTT brokers, publish and subscribe to topics, inspect messages, and manage connections with support for MQTT 5.0 features, TLS, WebSocket, and various payload formats (JSON, Base64, Hex, CBOR, MsgPack, Protobuf, Avro). It also includes an AI Copilot for MQTT assistance, a dashboard with real-time widgets, and scripting capabilities for payload transformation. The desktop app uses Electron with Vue 2, Element UI, TypeORM with SQLite for persistence, and MQTT.js for MQTT protocol. The web app shares many Vue components but uses lowdb/LocalStorage. The CLI is a separate Node.js package with its own test suite. The codebase is organized into shared utilities, database services, Vue components, and AI integration modules. Key entry points include src/background.ts (Electron main process), src/main.ts (render process), cli/bin/index.js (CLI), and web/src/main.ts (web app). Data flows involve MQTT connection lifecycle, message buffering via RxJS, payload conversion pipelines, and database persistence for messages, subscriptions, and settings. External dependencies include MQTT.js for MQTT protocol, TypeORM for database ORM, Electron for desktop, Vue 2 and Element UI for UI, Monaco Editor for code editing, ECharts for charts, and various AI SDKs (OpenAI, Anthropic, etc.) for the Copilot feature. The project also includes custom patches for third-party libraries (Monaco clipboard, MCP SDK, Azure SDK). The CLI depends on commander, chalk, and @faker-js/faker for simulation. While primarily an application, MQTTX includes data-oriented features such as message history querying with SQL recursive CTEs, topic tree persistence, data export/import in multiple formats, and IoT data simulation scenarios. These elements serve the application's debugging and testing purpose but demonstrate data engineering patterns.
arkade is a command-line tool that functions as a marketplace and installer for developer tools and Kubernetes applications. It provides two primary workflows: downloading CLI binaries (over 200 tools) and installing Kubernetes Helm charts (over 50 apps) with custom overrides. The tool also supports OCI image installation/publishing, Helm chart image version upgrades, system-level package installation (e.g., Node.js, Caddy), and self-updating with SHA-256 verification. The architecture is a monolithic Go CLI built with Cobra, where each subcommand (get, install, update, system, oci, chart, etc.) is a separate command tree. Entry points include main.go (root command) and the various command files under cmd/. External dependencies include GitHub releases API, Helm CLI, kubectl, Docker (for qemu-static), and OCI registries. The codebase demonstrates solid engineering with reusable patterns such as template-based tool definitions, safe archive extraction, and a builder pattern for installer options, though it suffers from a large manual catalog that requires ongoing maintenance.
chrome-remote-interface is a well-crafted Node.js library that provides a clean, dynamic API for interacting with the Chrome DevTools Protocol (CDP). It connects to a remote debugging endpoint (e.g., Chrome with --remote-debugging-port), fetches the full protocol descriptor dynamically, and generates typed JavaScript methods and events for every domain, command, and notification. The library supports callback and Promise patterns, includes a comprehensive CLI with an interactive REPL, and works across multiple implementations (Chrome, Node.js, Edge, Firefox, etc.). It does not bundle a browser; instead, it focuses on low-level protocol access, making it a foundational tool for browser automation, debugging, and custom DevTools clients.
HeadlessX is a self-hosted web scraping and browser automation platform with anti-detection capabilities. It provides a Next.js 16 dashboard, an Express 5 API with Prisma/PostgreSQL, a BullMQ queue worker, and a published CLI. The core value proposition is anti-detection scraping via the headfox-js package (Camoufox-compatible Firefox bundles), fingerprint generation, CAPTCHA solving, and LLM-friendly markdown output. The system supports multiple operators: website scraping/crawling/mapping, Google AI Search, Tavily search, Exa search, and YouTube extraction. It includes sidecar services for HTML-to-Markdown (Go) and YouTube extraction (Python FastAPI). The architecture is a monorepo with Nx orchestration, Docker Compose deployment, and an MCP endpoint for AI assistant integration. External dependencies include Redis, Postgres, Playwright, MaxMind GeoIP, and external APIs (Tavily, Exa, Google). The codebase is well-structured with clear separation of concerns, modern TypeScript, and reusable patterns in both frontend and backend.
StaSh is a full-featured interactive shell for iOS Pythonista, also running on desktop via Tkinter. It provides a Bash-like environment with command parsing, auto-completion, aliases, environment variables, pipes, redirects, job control, command history, and virtual keys. The architecture is modular: a core runtime (ShRuntime) manages execution, threading, and state; a parser/expander handles shell grammar; a terminal emulation buffer (ShChar/ShSequentialScreen) renders output; and multiple UI backends (Pythonista native, Tkinter, stub) abstract the display layer. The shell ships with 30+ built-in commands (pip, git, ssh, scp, sqlite, ping, etc.), a filesystem interface (FSI) for local, FTP, Dropbox, and zip mounts, a monkey-patching framework for iOS compatibility, and a package manager with Pythonista-specific workarounds. The codebase is well-structured with clear separation of concerns, but shows signs of technical drift: Python 2 remnants, some deprecated library usage (e.g., telnetlib), incomplete Python 3 porting, and fragile workarounds for iOS limitations. It is not a data research project.
Gita is a CLI tool that manages multiple git repositories from a single command. It allows users to register repositories, organize them into groups, and perform batch git operations such as fetch, pull, status, and custom commands across all or selected repos. The tool also displays a side-by-side summary of repository states including branch, commit message, time, and status symbols for staged/unstaged/untracked changes and local-remote branch relationships. The architecture is a monolithic Python application with a clear separation of concerns: `__main__.py` defines the CLI interface via argparse and delegates to action functions; `utils.py` provides file I/O, configuration parsing, and async execution utilities; `info.py` contains all logic for gathering and formatting repo status information; `common.py` handles config file paths; and `io.py` parses clone configuration files. The tool uses subprocess and asyncio to run git commands concurrently for multiple repos, falling back to synchronous execution for interactive commands like difftool or when only one repo is targeted. Gita stores repository metadata in CSV files under `$XDG_CONFIG_HOME/gita/` and supports extensive customization via additional config files for colors, symbols, displayed info columns, and custom commands defined in JSON. The codebase is well-tested with pytest and exercised on CI across multiple Python versions and operating systems. While the core functionality is tightly integrated with its own config schema, several internal patterns (async subprocess execution, git status extraction via diff --quiet) are cleanly abstracted and could be repurposed in other git tooling with minor adaptation.
fastmod is a high-performance CLI tool for large-scale codebase refactoring, designed as a faster replacement for the original codemod. It recursively searches files in a directory tree using the `ignore` and `grep` crates (the same underlying libraries as ripgrep), applies regex-based substitutions, and presents diffs for interactive review or accepts all changes automatically. The tool supports multiline regex, glob/extension filtering, case-insensitive matching, fixed-string mode, external diff tools, and hidden/ignored file traversal. The architecture is a single Rust binary with two source files: `main.rs` containing all core logic (argument parsing, file walking, patching, and interactive prompts) and `terminal.rs` wrapping `crossterm` for terminal color and clearing. Execution can be either interactive (user reviews each diff) or fast (batch apply with optional `--accept-all`). The code is well-structured, leverages parallelism via `ignore::WalkParallel`, and includes a suite of integration tests. It does not expose a library API; all functionality is encapsulated in the binary.
octosuite is a Python command-line and interactive terminal (TUI) application for querying and analyzing public GitHub data. It provides a library interface for programmatic access and a CLI/TUI for interactive use. It wraps the GitHub REST API v3 with an in-memory cache and data sanitization. It supports users, organizations, repositories, and search. The codebase is well-structured with clear separation between API layer, models, CLI argument parsing, and TUI using questionary and rich. It is published on PyPI and uses modern Python packaging (uv). However, it lacks automated tests and does not handle GitHub API authentication or rate limiting, which limits its production readiness. The code is clean and follows good practices, making it a solid foundation for extension.
PayKit is an open-source, embedded billing framework for TypeScript applications. It provides a core library (`paykitjs`) that handles subscription management, metered usage tracking, feature entitlements, and webhook processing – all backed by PostgreSQL and currently integrated exclusively with Stripe as the payment provider. The monorepo includes a CLI for project scaffolding and migration, a client SDK, a dashboard plugin (`@paykitjs/dash`), a documentation website (Next.js + Fumadocs), a demo application, and a webhook tunnel worker (Cloudflare Workers + Durable Objects). The architecture is modular: a core `createPayKit()` instance orchestrates services for customers, subscriptions, entitlements, products, and invoices, each following a service pattern with Drizzle ORM models. A plugin system allows custom endpoints, and a provider abstraction (currently only Stripe) handles payment operations. The codebase is well-structured with TypeScript end-to-end, extensive E2E testing against Stripe test clocks, and a clean separation of concerns. However, it is in alpha stage, has duplicated UI component libraries across apps, and is tightly coupled to Stripe – factors that limit immediate reuse without adaptation.