This repository implements an MCP (Model Context Protocol) server that exposes IDA Pro's disassembler, decompiler, debugger, and type system as a set of tools and resources consumable by LLM clients (Claude, Codex, Cursor, etc.). It operates in two distinct modes: an IDA GUI plugin that starts an MCP server on a configurable port, and a headless supervisor (`idalib-mcp`) that manages persistent worker processes for multiple databases. The architecture is a hybrid of a plugin and a standalone server, built on a custom, vendored MCP server implementation (`zeromcp`) with HTTP/SSE/stdio transports. The core API surface is defined via a decorator-based registration system (`@tool`, `@resource`, `@unsafe`, `@ext`) in `rpc.py`, which also handles output truncation middleware and JSON schema generation from TypedDicts. All IDA SDK calls are marshalled onto the main thread through a robust execution pipeline (`sync.py`) that manages timeouts, cancellation, and batch mode. The headless mode uses a supervisor/worker pattern (`idalib_supervisor.py`, `idalib_server.py`, `worker_lifecycle.py`) with health probing, idle TTL, and session management. A comprehensive compatibility layer (`compat.py`) provides version-gated shims for IDA 8.4 through 9.3. Key features include decompilation, disassembly, cross-references, memory read/write, patching, type declaration/inference, debugger control (breakpoints, step, registers), signature generation, and binary survey. Tool calls are always-on traced into the IDB as gzipped JSONL batches. The project includes an extensive test suite with a custom test framework, MCP spec regression tests, and CI running against multiple IDA versions in Docker containers. The codebase is actively maintained and demonstrates strong engineering practices, but the plugin mode is explicitly deprecated in favor of the official Hex-Rays IDA MCP Server. The heavy reliance on IDA's internal APIs and the vendored MCP server implementation represent ongoing maintenance risks. The code is well-structured with several genuinely reusable components, though some modules (e.g., `api_analysis.py`) are monolithic.
OpenStatus is a production-grade, self-hostable uptime monitoring, incident management, and status page platform. In production, it runs multi-region synthetic checks (HTTP, TCP, DNS, ICMP, gRPC) from Go-based checker and private-location services, streams check results into Tinybird for time-series analytics, persists workspace state (monitors, pages, incidents, API keys, OAuth clients) in SQLite via Drizzle ORM, and renders results through a Next.js dashboard and a public, i18n-enabled status page app with custom-domain proxy support, password/email/IP access gating, themes, and RSS/JSON/markdown feeds. A Hono-based API server exposes three API surfaces - a frozen legacy REST v1 (OpenAPI), tRPC, and ConnectRPC - plus an MCP server for AI agents and a Slack bot that can resolve incidents conversationally. The architecture is a deliberately polyglot monorepo: 8+ apps (dashboard, status-page, web marketing, Hono server, Go checker, Go private-location, Deno workflows, Go ssh-server) and 20+ internal packages. Business logic is centralized in packages/services behind a consistent ServiceContext + withTransaction + requireScope + emitAudit mutation pattern, then adapted to tRPC, ConnectRPC, and REST entry points. Multi-tenant workspaces include plan-based limits, API keys with scopes, a full OAuth 2.0 authorization server (PKCE), WorkOS SSO, Stripe billing, and append-only audit logging. Background Deno workflows handle cron maintenance: outbox draining, status drift repair, OAuth client pruning, and uptime freezing. Craftsmanship is strong: the service-layer pattern is applied uniformly, there is an explicit ServiceError hierarchy mapped to both tRPC and gRPC errors, external services (Upstash, Tinybird, Slack, analytics) have thorough test doubles, and several packages are genuinely standalone and reusable (CDN header analysis, assertion engine, schema-driven data-table filters, Effect-based status fetchers). Caveats are real but not disqualifying: the REST v1 API is explicitly frozen and bypasses the service layer, identical composition/chart utilities are duplicated across dashboard and status-page apps, a deprecated screenshot-service remains in-tree, the Go/TypeScript protobuf boundary requires manual synchronization, and an in-progress auth migration has left Clerk-era references alongside NextAuth. Overall this is a well-architected, actively maintained codebase that does what it claims.
Lemonade is a local AI inference server that provides an OpenAI-compatible API for LLM chat, completions, embeddings, image generation, TTS, audio transcription, and 3D model generation. It features a multi-backend architecture supporting over 20 inference engines (llama.cpp, vLLM, Stable Diffusion, Kokoro, Moonshine, ONNX Runtime, etc.) with automatic model management, intelligent routing policies, and a desktop GUI built with Tauri and React. The system includes a CLI tool for model management and benchmarking, a web app for browser-based interaction, and extensive platform support (Linux, Windows, macOS, Docker). Key architectural patterns include a plugin-based backend system with declarative descriptors, a routing policy engine with classifier-based and deterministic rules, a streaming proxy for SSE forwarding, and platform abstraction layers for processes, paths, and system metrics. The codebase demonstrates high craftsmanship with well-isolated components, comprehensive testing, and attention to cross-platform compatibility. While primarily an application, it also includes data-oriented components such as model metadata extraction from GGUF files, benchmarking infrastructure, and telemetry collection for inference monitoring.
Pomerium is an identity-aware access proxy that provides zero-trust security for internal web applications and services. It acts as a reverse proxy that authenticates users via OIDC/OAuth2 providers, authorizes access based on policy rules (Pomerium Policy Language evaluated via OPA/Rego), and proxies HTTP, gRPC, WebSocket, and SSH traffic. The system is built as a multi-service architecture with gRPC-based inter-service communication, using Envoy as the underlying proxy engine. Key components include an authentication service, authorization service with policy evaluator, a distributed databroker for session/config storage (with Raft consensus), and a control plane that generates Envoy configuration dynamically. It supports multiple identity providers (Google, Okta, Azure, Auth0, etc.), mTLS client certificates, WebAuthn, and SSH tunneling with a TUI client. The codebase also includes a Model Context Protocol (MCP) implementation for AI tool access control, and a 'Zero' cloud-managed mode for enterprise deployments. External dependencies include Envoy, PostgreSQL, Pebble (RocksDB), and cloud blob storage (S3, GCS, Azure Blob). Architecturally, Pomerium follows a modular design with clear separation of concerns: configuration management (layered sources, validation, envoy config builders), policy engine (parser, generator, criteria matchers), storage abstraction (in-memory, file, postgres, blob with caching and querier patterns), telemetry (OpenTelemetry, Prometheus, health checks), and utility packages (cryptography, HTTP, gRPC, protobuf, retry, fanout). The system is highly configurable with runtime flags and supports hot-reload via config diffing. The codebase demonstrates strong engineering practices with extensive unit, integration, and end-to-end tests (Playwright-based acceptance suites). Data flows: Incoming requests are intercepted by Envoy, which forwards them to the Pomerium proxy service. The proxy authenticates the user via the authenticate service (OIDC/OAuth2 flows), then authorizes via the authorize service (policy evaluation with OPA/Rego). Session and user data are stored in the databroker (distributed key-value store with Raft replication). Configuration is managed centrally and distributed to all services via gRPC streams. Telemetry data (traces, metrics, logs) is exported via OpenTelemetry and Prometheus.
OxyGent is a production-grade Python multi-agent system (MAS) framework that unifies LLMs, agents, tools, and flows into a declarative component model. It provides a runtime container (MAS) that orchestrates agent loops (ReAct, Chat, Workflow, PlanAndSolve, Parallel, Reflexion), tool execution (via MCP protocol, FunctionHub decorators, HTTP tools, bank tools), and communication (SSE streaming, A2A protocol for cross-framework interop). The framework ships with a FastAPI web service offering chat, evaluation, prompt management, and SSE endpoints, as well as a built-in web UI. A reference application, OxyBank, demonstrates full-stack data annotation with document ingestion, vector search (Vearch), and annotation agents. The architecture is plugin-based: components reference each other by name, and the MAS container handles lifecycle, wiring, and persistence (Elasticsearch, Redis, Vearch, local fallbacks). OxyGent supports distributed deployments via SSEOxyGent and A2AClientAgent, and integrates with LangChain, LangGraph, AgentScope, and Google A2A SDK. The codebase is well-tested with unit, integration, and regression tests, and includes extensive bilingual documentation.
This repository implements an MCP (Model Context Protocol) server that serves as a bridge between MCP clients (like Claude Code) and OpenAI's Codex CLI. It exposes Codex CLI functionality as MCP tools, enabling AI-powered code analysis, generation, and review within editor environments. The server handles stdio communication, manages conversational sessions, spawns Codex CLI processes with appropriate arguments, and processes their output to provide structured responses to clients. The architecture follows a modular design with clear separation between server setup, tool definitions, handlers, session management, and command execution utilities.
n8n is a production-grade workflow automation and AI agent platform. In production, it runs as a Node.js Express server with a Vue 3 frontend, executing user-defined workflows composed of nodes (triggers, actions, LLM calls). Workflows can be triggered manually, via webhooks, schedules, or events, and the execution engine handles concurrency, retries, errors, and data passing between nodes. The platform supports AI agents through an SDK that manages LLM calls, tool execution, memory, conversation loops, and MCP (Model Context Protocol) integration, enabling autonomous multi-step agents. Architecturally, the monorepo is organized into backend (packages/cli, packages/core, @n8n/engine), frontend (packages/frontend/editor-ui), database layer (@n8n/db with TypeORM), AI/agent packages (@n8n/agents, @n8n/ai-utilities, @n8n/instance-ai), and a vast node/credential library (packages/nodes-base, @n8n/nodes-langchain). Dependency injection is handled by @n8n/di, controllers are decorated with @RestController, and database models use a forked TypeORM. The system supports multiple database backends (PostgreSQL, SQLite) and can scale with Redis and worker processes. Key data flows: Workflow definitions are persisted in the database with version history. Execution data (inputs, outputs, binary data) is stored for monitoring and replay. The AI agent runtime uses a persistent message store for conversation memory, supports checkpoint/restore for long-running agents, and integrates with external LLMs (OpenAI, Anthropic, etc.) via a unified model factory. The platform exposes REST APIs for CRUD operations on workflows, credentials, users, and executions, as well as WebSocket push for real-time UI updates. External dependencies include a database, optional Redis for scaling, and numerous third-party services via nodes and credentials.
Open WebUI is a full-stack, self-hosted AI chat platform that provides a feature-rich interface for interacting with local and cloud-based large language models (Ollama, OpenAI-compatible APIs, Anthropic). The system is built as a monolith with a Python FastAPI backend and a Svelte (SvelteKit) frontend, deployed via Docker. It supports retrieval-augmented generation (RAG) with multiple vector database backends (Chroma, Qdrant, Milvus, pgvector, Elasticsearch, etc.), web search integration (20+ providers), document loading (PDF, DOCX, YouTube, web pages), and a plugin system for custom filters, actions, tools, and pipelines. Additional features include user/group management with granular access control, real-time collaboration via WebSockets, automations with RRULE scheduling, calendar, notes, channels, code execution (Pyodide/Jupyter), image generation (ComfyUI), voice/video calls, and comprehensive analytics. The architecture emphasizes extensibility through abstract base classes (vector DB, reranker, storage provider) and a valve-based configuration system for plugins.
WorldMonitor is a full-stack, open-source global intelligence platform providing real-time monitoring of geopolitical, economic, military, supply chain, and natural events. The codebase is overwhelmingly an application (single-page web dashboard, Vercel Edge API, Convex backend, Tauri desktop app, CLI, and SDKs) with a secondary data pipeline character (consumer price scraping, external API seeding). It powers a commercial SaaS with free and Pro tiers, featuring a map-based dashboard with 100+ configurable panels, an MCP (Model Context Protocol) server for AI agents, and extensive multi-language support (28 locales). The architecture follows a seed-cache pattern where Railway cron jobs fetch external data into Redis, and serverless Edge functions read cached JSON for low-latency responses. The frontend uses vanilla TypeScript with Vite, deck.gl/MapLibre for mapping, and a panel system for modular UI composition. The system is actively maintained, with daily commits, comprehensive test coverage (unit, integration, E2E with Playwright), and a well-documented API surface with 298 protobuf definitions across 36 domain services. While the codebase is large and occasionally duplicates shared constants across modules, it demonstrates strong software engineering practices including circuit breakers, idempotency keys, rate limiting, and a consistent handler pattern.
A production-grade AI coding agent (the Codex CLI) that operates as a terminal-based assistant. It provides a multi-modal, extensible platform for thread-based conversations with language models (OpenAI, Bedrock, Ollama), including sandboxed code execution, MCP tool integration, plugin/skills/hooks extension system, and state persistence via SQLite. The architecture is a Rust monorepo with a client-server split: a high-level TUI or CLI sending JSON-RPC messages to an app-server that manages session state, model routing, and execution policies. The system supports cross-platform sandboxing (Linux bubblewrap, Windows managed sandbox, macOS seatbelt) and includes comprehensive telemetry, rollout tracing, and guardian approval pipelines. It is a fork of OpenAI's Codex CLI, with significant Rust rewrite and enhanced extensibility. While the codebase exhibits strong engineering practices (extensive testing, layered configuration, well-defined protocol types, and platform-agnostic abstractions), it is a large monorepo with many interdependent crates, some legacy modules, and platform-specific workarounds that reduce overall cohesion. Key reusable components include the protocol type definition crate (with clever no-op macro optimizations for build speed), a RAII OpenTelemetry timer, a RedactedString wrapper for secret handling, and token-aware text truncation utilities.
drawDB is a free, open-source, client-side web application for designing relational database schemas and generating SQL. It provides an interactive ER diagram editor with support for multiple database dialects (MySQL, PostgreSQL, SQLite, MariaDB, MSSQL, Oracle), import/export in SQL, DBML, JSON, Mermaid, and Markdown, and features like auto-arrange, auto-connect foreign keys, schema validation, migration generation, and versioning via GitHub Gists. The architecture is a React single-page application (Vite + Tailwind CSS + Semi UI) with state managed through custom React Contexts and hooks, persistence via IndexedDB (Dexie), and an optional cloud backend through an extension system. It is primarily an application, with no data research or ML components.
AgentScope is a full-stack, production-grade multi-agent orchestration platform. The core library (`src/agentscope/`) provides a FastAPI-based agent service with CRUD endpoints for agents, sessions, credentials, channels, knowledge bases, schedules, and SOPs. It features a modular middleware onion pattern for agent lifecycle hooks (reply, reasoning, acting, tool execution), a pluggable storage abstraction (Redis, SQL with Alembic migrations, S3 blob store), and a message bus (in-memory or Redis) for inter-session communication and distributed coordination. The system supports real-time voice (WebRTC, DashScope/OpenAI/Gemini/xAI), RAG pipelines with document parsing and vector stores (Qdrant, Milvus, MongoDB, Elasticsearch), channel integrations (Feishu, DingTalk, Discord), and sandboxed workspace backends (Docker, Kubernetes, E2B, Daytona, Apple Containers, Bubblewrap, OpenSandbox). A full React/TypeScript web UI (`examples/web_ui/frontend`) provides chat, channel management, schedule calendar, knowledge base browsing, and MCP hub browsing. Additionally, a terminal console and a goal-oriented pipeline are provided for developer workflows. The framework emphasizes transparency, controllability, and separation between agent logic and infrastructure, supporting multi-agent collaboration, human-in-the-loop permissions, and long-term memory via ReMe and mem0 middleware.
RocketRide is an open-source AI pipeline orchestration platform that enables building, running, and deploying complex multi-step AI workflows. The system is built as a multi-language monorepo with a high-performance C++ engine core (apLib/engLib) that executes declarative JSON pipelines (.pipe files) composed of 100+ modular Python nodes covering LLM providers (OpenAI, Anthropic, Gemini, Mistral, DeepSeek, Ollama, etc.), vector databases (Pinecone, Qdrant, Milvus, Chroma, Weaviate, Elasticsearch), document processing (OCR, parsing, chunking, embedding), agent frameworks (CrewAI, LangChain, LlamaIndex, DeepAgent), and external tool integrations (Slack, Gmail, Google Drive, Microsoft 365, GitHub, Notion, etc.). The engine supports local, on-premise, Docker, and cloud deployment modes with GPU acceleration and real-time observability (token usage, latency, memory, call-tree tracing via WebSocket DAP channel). The architecture follows a modular plugin pattern: each pipeline node implements a consistent IGlobal/IInstance lifecycle with beginGlobal/endGlobal hooks, dynamic dependency loading via a depends() mechanism, and declarative configuration via services.json files. The platform includes multiple front-end applications: a VS Code extension (visual pipeline builder with engine management), a web shell (Module Federation host for cloud/on-prem UIs), and specialized apps (SQL explorer, file dropper, event monitor, chat widget, chaos testing tool). Client SDKs in Python and TypeScript allow embedding pipelines into external applications, and an MCP server exposes pipelines as tools for AI assistants. The system also provides an n8n integration, an embeddable chat widget, and a Helm chart for Kubernetes deployment. Key data flows begin with pipeline definition (JSON or visual canvas), which is parsed and validated by the engine. The engine resolves node configurations, installs required dependencies, and executes nodes in topological order, passing typed data (text, documents, images, audio, tables, embeddings) through the pipeline graph. Nodes communicate via a shared context and can branch, merge, loop, and invoke sub-pipelines. Results are streamed back through WebSocket connections for real-time UI updates, and full execution traces are stored for debugging and observability. The platform also includes a model server for GPU-accelerated inference (OCR, embeddings, vision, TTS) with device locking and proxy mode. External dependencies are extensive: the C++ engine relies on OpenSSL, libcurl, libxml2, and platform-specific system calls; Python nodes depend on dozens of AI/ML libraries (transformers, sentence-transformers, openai, anthropic, langchain, llama-index, crewai, etc.); TypeScript/React frontends use MUI, ReactFlow, and RJSF. The build system uses pnpm workspaces, vcpkg for C++ dependencies, and a custom builder script. The project is MIT-licensed with an active community (17.7k stars, 7.5k forks) and regular releases with semantic versioning.
ipatool is a cross-platform command-line tool that acts as an unofficial Apple App Store client. It enables searching, purchasing, and downloading iOS/iPadOS/tvOS/watchOS/visionOS/macOS applications and packages directly from Apple's servers. The tool implements Apple's private SAP authentication and signing protocol by emulating Apple's StoreAgent binary in-process using the Unicorn CPU emulator, allowing it to generate kbsync blobs and decrypt macOS packages. It also includes low-level parsers for Apple's proprietary formats (AEA encrypted archives, APFS filesystems, dyld shared caches) to extract assets from macOS restore images. The architecture is modular: a CLI layer (using cobra) dispatches to domain logic in pkg/appstore, which relies on a generic HTTP client (pkg/http), keychain storage (pkg/keychain), and platform abstractions (pkg/util). An MCP (Model Context Protocol) server subcommand exposes the same functionality over stdio. The codebase is heavily tested with unit and integration tests, and CI builds for macOS, Linux, Windows, and iOS. While primarily an application, it contains significant reverse-engineering and protocol-analysis components, giving it a hybrid character.
VoltAgent is a large TypeScript monorepo for building, deploying, observing, and evaluating AI agents. The core package provides an agent runtime with tool calling, memory, subagents, guardrails, workflow orchestration, MCP client integration, A2A protocol support, voice, and OpenTelemetry-based observability. Framework adapters expose this runtime as HTTP/SSE/WebSocket servers via Hono, Elysia, and serverless function providers, while a CLI scaffolds projects and manages VoltOps deployment/auth flows. The repo is fundamentally an application framework, though it contains hybrid data-oriented subsystems: a RAG package with many document chunking strategies, vector adapters, and BM25 search, plus evaluation/scoring packages used for LLM benchmark experiments.
HyperDX / ClickStack is a full-stack observability platform for ingesting, storing, querying, and visualizing logs, traces, metrics, and session replays. The system is architected as a monorepo with a Next.js frontend (React, Mantine, CodeMirror, Recharts), an Express.js API backend (MongoDB metadata, ClickHouse primary data store), a CLI tool (ink-based TUI), and an OpenTelemetry collector for ingestion. Key capabilities include real-time dashboards with drag-and-drop tile layout, multi-channel alerting (webhook, Slack, incident.io), advanced search with Lucene and SQL, log pattern mining (Drain algorithm), session replay, service maps, Kubernetes monitoring, and a Model Context Protocol (MCP) server that exposes observability tools to AI assistants. The platform supports authentication via local accounts or OIDC, OpAMP agent configuration, and includes an evaluation framework (hdx-eval) for benchmarking agent performance on SRE scenarios. Although the repo is primarily an application, it contains data-intensive components like the log miner and analytics query engines that cross over into data engineering territory.
ByteRover CLI is an AI-powered development assistant that provides persistent, structured memory for AI coding agents through a context tree. It features a multi-layered architecture with CLI (OCLIF), TUI (React Ink), and WebUI (React/Vite) interfaces, backed by a daemon service handling core agent logic. The system enables knowledge curation, synthesis, version control for context trees, swarm-based querying across multiple LLM providers, and integration with external AI agents via MCP. Key capabilities include tool execution (file operations, code execution), review workflows for AI-generated changes, and telemetry tracking.
AgentSkillsHub is a production-grade web application that indexes, grades, and surfaces open-source AI agent skills, MCP servers, and Claude/Codex skills. It operates as a full-stack directory with a trust-layer differentiator: each skill receives a deterministic security grade (SAFE/CAUTION/UNSAFE/REJECT) from a rule-based scanner (35 patterns across 11 categories) and a composite quality score (10 signals). The system is architected as a FastAPI monolith (backend) with a React SPA frontend pre-rendered for SEO via 13+ build-time generators, backed by Supabase (PostgreSQL) and triggered by GitHub Actions every 8 hours. It ingests data from the GitHUB Search API through a 6-phase pipeline (search → metadata → README fetch → scoring → classification → composability), then serves the catalog via static HTML pages, REST API endpoints, an MCP server, and a CLI tool. Monetization includes a Pro tier with paid deep search, a $49 deep-audit per skill, and enterprise subscriptions. The codebase also produces original research: a published dataset of 130k+ graded skills, an arXiv paper on security distributions, a 12-chapter Blue Book, and extensive SEO/GEO strategy documents. Despite its hybrid nature (both a software application and a data research project), the dominant character is application because the running web service is primary; the research outputs are byproducts of the operational pipeline.
Golem is a production-grade, self-evolving GeoAI agent purpose-built for geospatial (GIS) workflows. It bridges natural language with professional GIS tooling (GDAL, PostGIS) and operates as a standalone application with three access modes: a terminal TUI (Bubbletea), an embedded WebUI (Vue.js), and multi-channel IM bots (Telegram, Discord, Slack, Feishu, WhatsApp, QQ, DingTalk, MaixCam). The architecture is a modular monolith in Go, centered around an agent loop that processes messages, executes tools via a guarded registry, enforces policy (strict/relaxed/off), and supports human-in-the-loop approval. It includes a message bus for decoupling, a session manager for persistent conversation history, and a context builder that dynamically composes system prompts from workspace files with cache invalidation. The system also features a learned pipeline reuse mechanism, a spatial SQL codebook with verified PostGIS patterns, and a skill telemetry system for self-improvement. While primarily an application, it incorporates data-intensive components like the geo codebook and pipeline learning, giving it a hybrid character with a strong application dominance.
ECC (Everything Claude Code) is a comprehensive meta-harness toolkit for AI coding assistants. It provides a universal install system, lifecycle hooks, skill management, multi-agent orchestration, evaluation harnesses, and safety validation across multiple agent IDEs (Claude Code, Codex, Cursor, Gemini, OpenCode, and others). The codebase is primarily a Node.js CLI application (published as `ecc-universal`) with secondary Python and Rust components. It includes a sophisticated hook engine (pre/post bash, session lifecycle, tool use), a manifest-driven installer with ownership tracking and path-safety guards, an eval-harness framework with deterministic replay and effect-class isolation, a skill evolution system with provenance tracking, and a multi-agent proximity coordination system. The repository also bundles a large collection of domain-specific skills (video production, compliance checking, visa document translation, financial market data) and extensive documentation translated into multiple languages. While the core architecture is well-structured and demonstrates high craftsmanship in security-critical components, the codebase suffers from some duplication (e.g., taste-application/taste-distillation skills), legacy shims, and a sprawling surface area that increases maintenance burden. The Rust TUI control-plane (`ecc2/`) is explicitly alpha. Overall, it is a production-grade, actively maintained platform with strong engineering practices in its core modules.