Enroot is a CLI tool for creating unprivileged sandboxes from container images, particularly Docker images. It uses Linux namespaces and capabilities to provide isolation similar to containers but with reduced overhead, making it suitable for HPC environments. The architecture consists of a main bash script entry point, library functions in src/, and compiled C helper utilities for low-level operations like namespace handling and mounting. Key features include image import from registries, container creation and execution, bundling capabilities, and specialized hooks for GPU and Mellanox support.
KeyDive is a Python-based CLI tool designed for extracting Widevine L3 DRM keys from Android devices. It operates by establishing an ADB connection to a rooted device, injecting a Frida JavaScript script into the Widevine Content Decryption Module (CDM) process, and hooking specific native functions to intercept cryptographic material (client IDs, private keys, keyboxes). The tool supports multiple provisioning methods (Keybox, OTA, OEM Certificate) and exports data in formats compatible with pywidevine (.wvd). It is primarily used for DRM research, security analysis, and educational purposes regarding digital rights management on Android. The architecture consists of a Python core (`keydive.core.Core`) that manages device communication and Frida sessions, a JavaScript injection script (`keydive.js`) that performs the actual memory interception and data extraction, and a suite of modules (`keydive.drm`) for parsing and serializing DRM-specific binary formats like KeyBox and WVD. The tool handles complex C++ memory layouts (std::string, std::vector) across different Android ABIs and SDK versions, demonstrating significant reverse engineering capability.
vswhere is a command-line utility developed by Microsoft to locate installed instances of Visual Studio and related products (Build Tools, etc.). It queries the Visual Studio Setup Configuration API (ISetupConfiguration) and the Windows Registry to discover installation paths, versions, and workloads. The tool supports filtering by version range, product ID, workload requirements, and legacy installations. Output can be formatted as text, JSON, XML, or raw values, making it suitable for build scripts and deployment automation. The architecture consists of a core static library (vswhere.lib) containing the logic for parsing, querying, and formatting, linked against a minimal executable entry point (vswhere.exe). It relies on COM interfaces for setup configuration and standard C++17 libraries for string and filesystem operations.
Genql is a type-safe GraphQL query builder that generates TypeScript clients from GraphQL schemas. The core functionality resides in the CLI (@genql/cli) which introspects a GraphQL schema and emits a client enabling compile-time query validation and autocompletion. The repository also includes a Next.js website for documentation and a converter tool, plus a scraper subsystem that automatically discovers public GraphQL APIs via Sourcegraph, generates clients, and publishes them to npm. The architecture is a monorepo managed by pnpm with three main components: cli (code generation and runtime), website (documentation and converter), and scraper (automated discovery and publishing). Key features include batching queries, subscriptions, framework-agnostic design, and support for Node.js, browser, Deno, and Cloudflare environments.
MarkdownDB is a JavaScript library and CLI tool that parses markdown files to extract structured data (frontmatter, tags, links, tasks) and stores it in a queryable SQLite database (or JSON files). It provides a lightweight Node.js API for querying the indexed data and includes a command-line tool for indexing folders and executing scripts. The architecture follows a modular design with clear separation between markdown parsing, processing, storage, and querying layers. The system uses remark-family tools for markdown parsing, Knex.js for database operations, and Zod for schema validation. Key entry points are the CLI (`src/bin/index.js`) and Node.js API (`src/index.ts`).
Goca is a CLI tool for generating Go applications following Clean Architecture principles. It scaffolds complete projects with domain, usecase, repository, and handler layers, supporting multiple databases (PostgreSQL, MySQL, MongoDB, etc.) and protocols (HTTP, gRPC, CLI, worker). The tool includes safety mechanisms (dry-run, backup, force), dependency injection generation, middleware creation, and Model Context Protocol (MCP) integration for AI-assisted development. Its architecture emphasizes layer separation and dependency management, generating production-ready code with built-in validation, testing scaffolding, and CI/CD pipeline generation.
Workout Gate is a CLI tool that gates AI coding prompts (Claude Code and Codex) behind a physical exercise challenge. It installs a UserPromptSubmit hook that counts prompts and, when a challenge is due, blocks the prompt and opens a webcam window to count push-ups or squats via MediaPipe Pose. Each rep is persisted to disk immediately, so progress is saved if the window is closed. The system tracks debt (owed reps), stats, and streaks, and provides a CLI and web dashboard for configuration. The architecture is modular, with clear separation between the hook, challenge logic, pose detection, state persistence, and user interfaces. Key strengths include robust cross-process locking for shared state, a reusable hysteresis counter for rep counting, and thoughtful escape hatches to prevent lockout.
Octopool is a production-grade GitHub API relay and caching proxy, deployed as a Cloudflare Worker with a companion Go CLI. It pools multiple GitHub identities (PATs, GitHub App installations) to share API quota, caches responses in D1 and edge cache, and applies string-rewrite policies to protect sensitive data. The CLI acts as a drop-in `gh` shim, routing eligible read commands through the relay before falling back to native `gh`. The system also supports token-free transports (public web pages, raw content, Git smart HTTP) to minimize API consumption. Architecture includes Durable Objects for coordination (pool identity selection, cache-fill ownership, policy revisioning), D1 for persistent cache and audit, and edge cache for low-latency reads. The codebase is dual-language (TypeScript for Worker, Go for CLI) with extensive unit and e2e tests, CI/CD, and a dashboard for monitoring.
This repository is the official open-source companion to Anthropic's Claude Code—an agentic AI coding assistant that operates in the terminal. It is not the core Claude Code binary (distributed separately via npm/brew/install scripts), but rather the plugin ecosystem, example configurations, CI automation scripts, and infrastructure-as-code templates that extend and support the tool. The repo contains 13 first-party plugins (e.g., security-guidance, code-review, feature-dev, commit-commands, pr-review-toolkit, hookify, plugin-dev), each defining hooks, commands, agents, and skills that integrate with Claude Code's extensibility framework. It also provides production-grade Terraform modules for deploying a Claude Code Gateway on AWS (ECS Fargate + RDS + Bedrock) and GCP (Cloud Run + Cloud SQL + Vertex AI), along with enterprise MDM settings (macOS plist/mobileconfig, Windows ADMX, Intune scripts) and managed settings templates. A suite of GitHub Actions workflows handles automated issue triage, duplicate detection, lifecycle management, and code review, all using Claude Code itself as the automation engine. The repository is primarily a configuration and extension catalog rather than a standalone application; its value lies in demonstrating the plugin architecture and providing reusable patterns for AI-assisted development workflows.
Bruno is a comprehensive API client and testing tool built with Electron, React, and Redux. It provides a full-featured interface for creating, sending, and analyzing HTTP/WebSocket/gRPC/GraphQL requests, similar to Postman but with an open-source core. The application features a modular architecture with separate packages for the GUI (bruno-app), Electron main process (bruno-electron), CLI (bruno-cli), request handling (bruno-requests), file storage (bruno-filestore), and shared utilities (bruno-common). Key capabilities include environment and variable management with secure secret handling, pre-request and test scripting using a custom BruJS runtime, collection organization and workspaces, import/export from formats like Postman, OpenAPI, and Insomnia, mock server functionality, and code generation from requests. The UI uses styled-components for theming with light/dark/system themes, and incorporates advanced features like AI-assisted request building and OpenAPI synchronization. The codebase demonstrates strong engineering practices with extensive unit and end-to-end testing, TypeScript throughout, and a clean separation of concerns between the main and renderer processes via IPC. Notable reusable components include a secure variable interpolation system, cross-platform detection utilities, persistent state hooks, and a worker-offloaded file format parser.
DeepTutor is a full-stack AI-powered learning companion that provides chat, problem-solving, research, visualization, and structured learning capabilities. The system features a modular architecture with a Python/FastAPI backend, Next.js/React frontend, and a CLI interface. It implements an agent-based system where capabilities like deep solve, deep question, and deep research are implemented as loop capabilities with access to tools such as web search, code execution, and knowledge base retrieval. The platform includes a three-layer memory system for contextual awareness, supports multiple RAG backends (LlamaIndex, PageIndex, GraphRAG, LightRAG, IMA), and enables integration with external knowledge bases (Obsidian, MarginNote 4) and partner agents (Claude Code, Codex). The application employs a plugin architecture for extensibility, allowing new capabilities, tools, and subagents to be added via entry points. Configuration is managed through JSON/YAML files with runtime overrides, and services are decoupled via provider abstractions for LLMs, embeddings, search, and media generation. Real-time communication is facilitated by WebSockets and an internal event bus (StreamBus). The system supports multi-user deployments with role-based access control, isolated workspaces, and grant-based resource sharing for skills, knowledge bases, and partners. Deployment options include local installation, Docker containers, and CLI-only mode. The codebase demonstrates strong engineering practices with extensive unit testing, clear separation of concerns, and reusable patterns such as the capability protocol, tool composition, and atomic file operations. While the system's feature richness introduces complexity, its modular design allows for selective adoption of components.
This repository is a production-grade Agent Skill and CLI tool for generating geometry-safe technical diagrams from structured JSON or natural language descriptions. It produces SVG, PNG, animated GIF, and offline interactive HTML outputs across 12 visual styles (11 generator-driven, 1 AI-authored) and supports 14 UML diagram types with domain-specific semantic contracts for C4, cloud, event, and ops profiles. The system features a deterministic orthogonal routing engine, composition quality gates, a validated SVG-to-GIF motion pipeline with per-style animation contracts, and a strict validation framework. It is distributed as an npm package and a Claude Code skill, with a nested mirror for `npx skills add` installation. The codebase is well-tested with extensive regression and pixel-level gates, though it suffers from some duplication between the root and skill mirror directories and hardcoded contract constants.
Buildah is a command-line tool for building OCI-compliant container images without requiring a daemon. It focuses on image creation tasks such as building from Dockerfiles/Containerfiles, managing working containers, committing images, and pushing/pulling to registries. The architecture is modular, separating CLI command handling (using Cobra), core build logic, storage abstraction, and utility packages. Key features include rootless operation, multi-platform support (Linux/FreeBSD), SBOM generation, and confidential workload encryption via SEV/SNP. The tool is designed for integration with container ecosystems like Podman and Kubernetes, emphasizing security and flexibility in image building workflows.
Shower is an HTML presentation engine built as a monorepo containing a core library, two CSS-only themes (Ribbon and Material), a CLI tool, and a starter template. The core engine, written in vanilla JavaScript, handles slide management, keyboard and touch navigation, inner slide steps, progress bar, timer, full-screen support, and accessibility. The CLI provides commands for creating, serving, bundling, archiving, and publishing presentations, as well as PDF export via a self-downloading Chrome engine. Themes use advanced CSS features like custom properties and the tan(atan2()) scaling trick, and are entirely decoupled from the engine. The repository is well-tested with Playwright and GitHub Actions CI, uses modern Node.js (ESM, workspaces), and demonstrates clean architecture with lazy-loaded CLI commands and a plugin-based core.
Invoke is a Python library and command-line tool for task execution and automation. It enables users to define Python functions as tasks that can run shell commands, manage dependencies via pre/post tasks, and be organized into hierarchical namespaces. The system is commonly used for build automation, deployment, and general scripting, featuring a layered configuration system, sophisticated argument parsing, and automated subprocess interaction via responders. The architecture centers around a task system (@task decorator and Collection objects), a configuration manager with layered merging (defaults, files, environment, runtime, code), and an executor that handles task invocation and command execution. Key components include the Config class for configuration management, the Parser/ParserContext for CLI argument handling, and the Responder/FailingResponder classes for automating responses to subprocess prompts (e.g., sudo passwords). The design emphasizes modularity, with clear separation between task definition, configuration, execution, and CLI interfacing. Invoke demonstrates strong engineering practices through its vendored dependencies (fluidity, lexicon, PyYAML) to ensure stability, comprehensive test suite, and support for modern Python versions (3.9+). The codebase avoids tight coupling in core utilities like configuration and argument parsing, making them suitable for extraction. Recent activity (commit within 30 days) indicates active maintenance, and the project shows low technical drift with up-to-date dependency management and no evident deprecated patterns.
Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
fselect is a Rust command-line tool that enables searching the filesystem using SQL-like queries. It parses a SELECT-FROM-WHERE-GROUP BY-HAVING-ORDER BY-LIMIT syntax, traverses directories, and extracts rich metadata from files including size, timestamps, permissions, media information (EXIF, audio/video dimensions, duration), cryptographic hashes, MIME types, extended attributes, ACLs, git status, and more. The tool supports aggregation functions, subqueries (both FROM-subselects and correlated IN/EXISTS), and multiple output formats (tabular, CSV, JSON, HTML). It can accelerate searches via external indexes (Everything on Windows, plocate on Linux) and includes an interactive REPL mode. The architecture is a single binary with clean separation of concerns: lexer/parser for query processing, a searcher module for filesystem traversal and expression evaluation, utilities for metadata extraction, and pluggable output formatters.
yutto is a production-grade CLI application for downloading videos, subtitles, danmaku (bullet comments), and metadata from Bilibili. In production it resolves user-supplied URLs (UGC videos, bangumi anime, paid cheese courses, favourites, collections, watch-later lists) against Bilibili's private JSON APIs, normalizes responses into typed Pydantic download requests, and runs a planner/executor pipeline: immutable DownloadPlan construction (output paths, codec/quality selection), concurrent range-based downloading, FFmpeg muxing, and writing of NFO/SRT/ASS artifacts. It also ships an experimental WebSocket JSON-RPC server mode (`yutto serve`) for remote task submission, querying, cancellation, and live event streaming with token authentication.
The RustSec monorepo is a multi-crate workspace that provides the official security audit toolchain for the Rust ecosystem. Its flagship product is `cargo-audit`, a CLI subcommand for Cargo that scans `Cargo.lock` files against the RustSec Advisory Database to detect known vulnerabilities, unmaintained or unsound crates, and yanked packages. The workspace also includes the `rustsec` core library for managing the advisory database (fetched via git, indexed, and queried), `cargo-lock` for parsing and manipulating Cargo.lock files (supporting V1 through V4 format), `cvss` for parsing and scoring CVSS vectors (v2.0, v3.x, v4.0), `platforms` for programmatic access to Rust target triples, and `admin` for maintaining the advisory database and generating the rustsec.org website. Although primarily an application and library toolset, the repository has data-oriented aspects: the advisory database is a curated set of Markdown files with TOML front matter, and `platforms` is auto-generated from rustc target information. The architecture is modular, with each crate independently usable and well-tested, and CI pipelines ensure cross-platform releases and static analysis.
Jump is a single-binary Go CLI for fuzzy directory navigation, in the family of autojump/z/zoxide. It integrates with bash, zsh, fish, PowerShell, and Nushell by emitting a shell function (default `j`) that hooks PWD changes and calls `jump chdir`, which persists a scored database of visited directories as JSON files under ~/.jump or $XDG_CONFIG_HOME/jump. When the user types `j wc`, the shell function invokes `jump cd wc`, which ranks all entries by longest-common-subsequence fuzzy match against a cleverly normalized path (basename-only unless separators are given, case-sensitive when any capital letter is typed) and prints the best path for the shell to cd into. The tool also supports pins, relative jumps, repo-root-based mode via `j .`, reverse jumps via an empty term, stale-entry cleanup, and exact-match proximity heuristics. The codebase is cleanly layered: cli (argument parsing and command dispatch), cmd (command implementations), config (an interface with file- and in-memory implementations over atomic JSON persistence), scoring (frequency+recency weighted ranking and fuzzy sort), fuzzy (LCS algorithm and path normalizer), importer (parsers for autojump.txt, z's .z file, and zoxide's binary db.zo), and shell (Go-embedded integration scripts compiled via text/template). Everything is local files; there is no daemon, server, or network dependency. Test coverage is thorough across all packages, including adversarial importer tests for truncated, oversized, and corrupt zoxide databases and shell template compilation tests. Craftsmanship is strong: the atomic file helper, LCS implementation, path normalizer, and zoxide binary parser are genuinely reusable modules. Minor blemishes include a global command registry, duplicated version constants (0.67.0 in cmd/version.go vs 0.69.0 in the Makefile), a leftover defunct .travis.yml CI config, and a copy-paste error in the settings error message (--preserve validation prints 'slash, ignore' instead of 'true, false'). Overall this is a mature, well-maintained developer tool with an elegant core search/scoring design.