cdncheck is a Go library and CLI tool for identifying whether an IP address or domain belongs to a CDN, WAF, or cloud provider. It uses embedded CIDR range data (compiled from ASN, URL, and static CIDR sources) and efficient IP matching via the `bart` radix tree. The library provides a clean `Client` interface with methods like `CheckCDN`, `CheckCloud`, `CheckWAF`, and `CheckDomainWithFallback` that also resolve DNS and check CNAME suffixes. The CLI wraps this with input/output handling, filtering, and JSON output. The codebase is well-structured, with clear separation between core logic, data generation, and CLI runner. It is actively maintained by ProjectDiscovery and used in their security scanning ecosystem.
This repository is a Bilibili automation tool designed to automatically claim live stream rewards (drops) and complete watching time tasks. It features a dual-mode interface with both a PySide6-based GUI and a CLI entry point. The core functionality involves browser automation via Selenium to extract necessary credentials (cookies) and task information from Bilibili's web interface, followed by API interactions using signed requests (WBI) to claim rewards and report watch time via x25Kn heartbeat protocols. The application includes a notification system supporting multiple services (Gotify, Server酱, WeCom, Apprise) and persists configuration via JSON files and Qt settings. The architecture is modular, separating concerns into distinct modules for API client logic, worker management, GUI components, and utilities.
Patina is a deterministic, pattern-based AI text detection and humanization tool, primarily targeting Korean but supporting English, Chinese, and Japanese. It operates as a Node.js CLI (`patina-cli`), a web API (Vercel serverless), and an agent skill (Claude Code, Codex, Cursor). The core workflow: analyze source text for AI-typical patterns (stylometry, lexicon, discourse tells), build a structured prompt, invoke an LLM backend (OpenAI, Claude, Gemini, Kimi, etc.), verify meaning preservation (MPS/fidelity), and output a humanized rewrite with a deterministic audit trail. It enforces strict meaning guards (number safety, polarity, causation) and provides scoring, diff, and verification modes. The architecture is modular: a shared deterministic analysis core (`src/features/`) runs identically in Node and browser; a prompt builder assembles context from pattern packs, document types, and personas; multiple backend adapters abstract LLM invocation; and a verification pipeline ensures fidelity. The project includes extensive research infrastructure (benchmarking, human evaluation panels, corpus management) and a commercial Pro tier with Polar license validation. It is well-tested with over 200 unit/e2e tests, CI/CD, and security hardening (SSRF guards, input fencing, atomic writes).
AXorcist is a Swift library and CLI tool for macOS accessibility automation, wrapping the Accessibility (AX) APIs to inspect, query, and control UI elements programmatically. The core library provides a typed `Element` struct over `AXUIElement`, a command-response protocol with JSON envelopes, a powerful observer system with retry/backoff and process-generation tracking, input simulation (mouse, keyboard), and tree traversal with search criteria. The CLI (`axorc`) exposes commands like `find`, `tree`, `raw`, `permissions`, and `observe`, all producing structured JSON output. The architecture is modular with heavy use of Swift extensions, `@MainActor` isolation, and async/await concurrency. The codebase is well-structured, extensively tested (unit and integration tests), and follows modern Swift practices with pinned dependencies (Commander, swift-log) and strict concurrency checking. It is actively maintained with CI workflows for building, linting, and security scanning.
This repository provides a robust, well-tested JavaScript/TypeScript library and CLI tool for converting CSV strings into Markdown table format. The core function `csvToMarkdown` accepts a CSV string, delimiter, header flag, and optional configuration (enclosure, escape, newline replacement, cell filter, pretty-print). It leverages the `csv-walker` library for CSV parsing and outputs a properly formatted Markdown table with aligned columns. The package is distributed in UMD, ESM, and CommonJS formats, making it usable in browsers, Node.js, and bundlers. The codebase demonstrates high craftsmanship: clean TypeScript with strict options, comprehensive test coverage (including CLI, type declarations, and edge cases), automated CI/CD with linting and formatting, and a well-structured build pipeline using Rollup. The CLI tool reads from stdin and supports various delimiters and header options. The repository is actively maintained with recent commits, up-to-date dependencies, and zero open issues.
xk6 is a command-line tool and Go library for building custom k6 binaries with extensions, enabling developers to create, test, and distribute k6 extensions. The tool provides scaffolding for new extensions, a build system that integrates with k6's module system and automatically resolves the correct k6 major version, a linter for extension compliance (including security, licensing, and quality checks), a test runner for k6 scripts, and a dependency synchronizer to keep extension dependencies aligned with k6. It also ships as a Docker image and a Dev Container feature. The codebase is a well-structured Go application using cobra for CLI, with clean separation of concerns across internal packages for linting, scaffolding, sync, and testing. It demonstrates high craftsmanship with proper error handling, logging, and test coverage.
Agent Reach is a Python CLI tool that serves as a capability layer for AI agents, giving them one-click access to ~15 internet platforms (Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu, LinkedIn, etc.) without requiring manual setup. It does not wrap these platforms itself; instead, it selects, installs, health-checks, and routes to the most reliable upstream CLI tools (e.g., twitter-cli, yt-dlp, gh CLI, OpenCLI, mcporter) for each platform. The architecture is built around a multi-backend channel pattern: each platform has an ordered list of backends (primary + fallbacks), and the `doctor` command probes each candidate in order to determine the active backend. This design handles upstream tool instability gracefully by allowing fallback routing without code changes. The codebase demonstrates strong engineering practices: a clean Channel ABC with `check()` and `can_handle()` contracts, a robust probe system that distinguishes missing/broken/timeout/error by actual execution, security-hardened file operations (atomic private writes, symlink rejection, bounded reads), and SSRF protection in URL normalization. The CLI provides commands for installation (safe-by-default, read-only mode), diagnostics, configuration, and skill registration for agent environments (Claude Code, OpenClaw, Cursor, OpenCode). An optional MCP server exposes read-only status. Agent Reach is purely an application — there are no notebooks, data pipelines, or ML components. Its value lies in reducing the friction of giving agents internet access, with a focus on zero-config defaults for public platforms and cookie-based auth for login-required ones. The project is actively maintained, with documented responses to upstream API changes (e.g., Bilibili blocking yt-dlp, Twitter API pay-per-use).
This repository provides an all-in-one CLI/TUI application for launching and managing security testing tools. It features a curated catalog of 215+ tools across 21 categories, defined declaratively in YAML files and loaded into Python tool classes. The interactive REPL supports commands like /run, /search, /tags, /ai, /goal, and /find, with a rich console interface using prompt_toolkit and Rich. A headless engagement mode runs YAML-defined pipelines (e.g., subfinder → httpx → nuclei) and generates structured findings and Markdown reports. AI features are opt-in and use OpenAI-compatible endpoints or local Ollama, with built-in safety guardrails (charter injection, sanitization, anti-fabrication checks) and graceful degradation to offline behavior. The architecture is monolithic but modular, with clear separation between the tool catalog, execution engine, AI integration, and discovery module. The codebase demonstrates strong engineering practices: safe subprocess execution (list-form, cwd, skip if present), declarative YAML overlays, a fixed tag taxonomy enforced by tests, and extensive test coverage including monkeypatching of subprocess and AI transport. While the catalog inherently drifts as upstream tools become archived, the project includes audit scripts to manage this. Overall, it is a well-crafted, production-quality application for authorized security testing.
This repository implements an AI-powered code review CLI tool (`ocr`) that analyzes Git diffs or full file contents using configurable Large Language Models (LLMs) such as Anthropic, OpenAI, and AWS Bedrock. It originates from Alibaba Group's internal code review assistant, validated at massive scale (tens of thousands of developers, millions of code defects). The core workflow involves loading a diff or file set, dispatching review tasks to an LLM agent with tool-use capabilities (file reading, code search, comment posting), and collecting structured review comments with line-level precision. It supports multiple review modes (workspace changes, single commit, branch range), full-file scanning, session persistence with resume capability, token budget management, and output in text, JSON, and SARIF formats. The architecture is a Go CLI with a Cobra command tree, complemented by a VS Code extension (TypeScript/Preact), plugins for Claude Code, OpenCode, and other coding agents, and CI/CD integration examples for GitHub Actions, GitLab, Bitbucket, Gerrit, GitFlic, and Alibaba CodeUp. A local web viewer (`ocr viewer`) and a public documentation/marketing website (React) are also part of the repository. The codebase exhibits strong engineering practices: extensive test coverage (unit, integration, manual e2e), clean package separation, thread-safe components, and careful error handling (retry observers, host guard for the viewer). Key reusable patterns include a retry collector for LLM API calls, a state-machine-based run manifest builder for coverage tracking, an abstract file reader for workspace vs git-ref reads, and a worker pool with per-key async processing.
Yazi is a blazing-fast terminal file manager written in Rust, built on async I/O and a modular crate architecture. It provides a full-featured TUI with file operations (copy, move, delete, rename, trash), multi-tab support, visual mode, and extensive plugin system via Lua scripting. The architecture is event-driven with an actor model, a generic task scheduler for background operations, and a virtual filesystem abstraction supporting local, SFTP, and custom Lua backends. It includes image preview via multiple protocols (Kitty, Sixel, Chafa, etc.), clipboard integration, and a distributed data service for cross-instance communication. The codebase is highly modular with over 30 internal crates, each with a single responsibility, and demonstrates strong engineering practices including custom serialization (Wire protocol), cross-platform abstractions, and lock-free data structures. It is actively maintained with frequent commits, comprehensive CI/CD, and a detailed coding style guide (AGENTS.md).
Codewhale is an open-source, terminal-native AI coding agent that operates as a TUI (ratatui), CLI, headless runtime, MCP server, and a web frontend. It manages full development workflows: reading repositories, editing files, running commands, reviewing changes, and orchestrating multi-agent fleets. The codebase is a Rust monorepo with ~52 crates, a Next.js website with 18+ locales, a VS Code extension, packaging for npm/Homebrew/Arch/Windows, and companion pet apps. The architecture is event-driven with a pluggable tool system, model-agnostic provider routing, session-based journaling, and a contract-based command framework. It supports dozens of LLM providers (DeepSeek, OpenAI, Anthropic, Ollama, etc.) and features sandboxed execution, telemetry with a strict no-IP privacy contract, and a plugin marketplace. The project is heavily tested with unit, integration, PTY/Cucumber, and hermetic bash tests, and enforces budgets for dead code and blocking calls.
Nushell is a modern, cross-platform shell that treats data as structured (tables, records) rather than raw text streams. It features a pipeline-based architecture where commands process structured data and can be composed using the pipe operator. The shell is built as a modular Rust workspace with distinct crates for the core engine, parsing, command implementation, plugin system, and CLI interface. Nushell emphasizes extensibility through a plugin system where plugins run as separate processes communicating via JSON-RPC, providing isolation and language flexibility. Key features include built-in support for various data formats (JSON, CSV, Excel, Parquet), SQL-like querying capabilities, interactive exploration, and cross-platform compatibility with Windows, macOS, and Linux.
croc is a secure, peer-to-peer file transfer tool that operates via a relay server for NAT traversal. It uses Password Authenticated Key Exchange (PAKE) for authentication and end-to-end encryption (AES-GCM or ChaCha20-Poly1305) to protect data in transit. The application consists of a Go CLI client, a standalone web server (croc-web), and a React/Vite web frontend that uses WebAssembly to perform crypto operations in the browser. Files are split into chunks, optionally compressed, and transferred over multiple TCP connections with resume support. The tool also supports an asynchronous 'stored transfer' mode where encrypted files are temporarily stored on the relay server and can be downloaded by recipients using access tokens. The codebase is well-structured with a custom CLI framework, modular crypto and compression packages, and a comprehensive test suite covering core transfer logic, security properties, and end-to-end browser tests. The web client includes a blog with deep technical articles about the protocol design.
sqlmap is an automated penetration testing tool that detects and exploits SQL injection vulnerabilities in web applications. Its core functionality includes database fingerprinting, data extraction (tables, columns, users, passwords), file system read/write, OS command execution, and out-of-band exfiltration via DNS or ICMP. The architecture is a modular monolith: a central controller orchestrates DBMS-specific plugins (30+ databases), injection technique engines (boolean blind, error-based, UNION, time-based, stacked queries, DNS, OData, SPARQL, JWT, NoSQL, etc.), and tamper scripts for WAF bypass. The tool exposes both a CLI (sqlmap.py) and a REST API (sqlmapapi.py). External dependencies are minimal—most third-party libraries are vendored (chardet, colorama, beautifulsoup, pydes, fcrypt). The codebase demonstrates deep knowledge of SQL dialects, HTTP protocol handling, and security research, with extensive offline test suites and deterministic test harnesses. Notable technical strengths include pure-Python protocol clients (TDS, Kerberos, gRPC-Web), disk-spilling data structures (BigArray), and a safe JSON serializer that replaces pickle. Drift risks include remnants of Python 2 compatibility shims, bundled crypto implementations, and static fingerprinting data that may lag behind new DBMS versions.
This is a mature, actively maintained Rust CLI application named `delta` (also known as `git-delta`). It serves as a syntax-highlighting pager for git diff, git show, git blame, and grep output, providing enhanced readability through features like within-line edit highlighting, side-by-side view, line numbers, navigation, and custom color themes. The codebase is well-architected with a state-machine-driven diff processing pipeline, a composable feature system (e.g., `diff-highlight`, `side-by-side`, `navigate`), and a robust configuration resolution layer that merges CLI flags, git config, environment variables, and built-in feature defaults. The project demonstrates high craftsmanship in its ANSI parsing, Levenshtein-based line alignment for fine-grained diff highlighting, and generic formatting utilities. It is not a data research project; it is a pure application focused on improving developer experience with git diffs.
OfficeCLI is a cross-platform CLI application written in C#/.NET that creates, reads, and mutates OOXML Office documents (Word .docx, Excel .xlsx, PowerPoint .pptx) without requiring Microsoft Office. It is explicitly engineered as an agent-facing tool: every document element is addressable through a uniform path syntax (e.g. /slide[1]/shape[2]), all commands emit structured JSON with error codes and suggestions, and it ships AI-skill files for Claude/Copilot/Cursor/Codex, an MCP server, plus Python and Node SDKs. The core operation model is a batch command language: documents are mutated by replayable JSON items (add/set/remove/get) executed atomically through the CLI or over a named pipe to a resident process. Architecturally the repo is a single .NET binary (embedded runtime) with a CommandBuilder layer, a DocumentHandlerFactory dispatching to three large partial-class handlers (WordHandler, ExcelHandler, PowerPointHandler), and a shared Core layer containing chart-to-SVG rendering, a formula evaluator implementing 350+ Excel functions with statistical distributions, pivot table construction, Mermaid diagram parsing, OOXML theme/table-style resolution, HTML/PNG/SVG preview rendering, and a plugin protocol for foreign-format dump-readers and exporters. Security is taken seriously: SsrfGuard validates remote fetch targets, HyperlinkUriValidator allowlists URI schemes, XmlTextValidator and DocumentLimits guard against decompression bombs and DOM sprawl, and AtomicPackageWriter prevents torn file writes. Quality is strong but carries real maintenance debt. The code demonstrates deep OOXML craftsmanship - schema-order-correct XML insertion, exact EMU unit round-trips, Lanczos-based gamma functions, and curated chart-style galleries. However, handlers are split across dozens of partial-class files that evolved from former god methods, the property API is stringly-typed (props dictionaries parsed per key), examples must be maintained in parallel shell and Python twins, and the tool deliberately tolerates 'UNSUPPORTED props' warnings (exit code 2), which can mask incomplete feature coverage. The best reuse targets are the self-contained Core utilities rather than the format handlers. The project is actively maintained with multi-platform CI publishing to npm and PyPI.
NanoClaw is a self-hosted, multi-agent AI orchestration platform that runs containerized agent sessions, integrates with a wide range of chat channels (Slack, Discord, Telegram, WhatsApp, iMessage, etc.), and provides a CLI-based admin interface. It is architected as a host service (Node.js/TypeScript, SQLite) that manages per-session agent containers (Bun runtime) isolated via Docker. The system features a typed guard/approval system for privileged actions, a plugin-based skill system for extensibility, and a structured migration framework for database schema evolution. Key operational flows include inbound message routing from channel adapters, session lifecycle management with two-DB mailbox split (inbound/outbound SQLite), container orchestration with credential injection via OneCLI vault, and host sweep for periodic maintenance. The CLI (`ncl`) provides resource CRUD with hooks, command guard integration, and a socket-based transport protocol. The project emphasizes a small, auditable codebase, skill-based feature installation over configuration, and deterministic setup/upgrade workflows with Claude Code fallback for error recovery.
Pipenv is a Python dependency management CLI tool that unifies dependency resolution, virtualenv management, and environment setup. It provides commands like install, lock, sync, shell, and run, operating on Pipfile/Pipfile.lock files. The architecture is a monolithic Python application built around a custom resolver subprocess with a typed JSON protocol, a pluggable resolver backend system (currently defaulting to a heavily patched and vendored copy of pip), and a set of utility modules for lockfile handling, source management, virtualenv discovery, and credential security. It heavily vendors pip, rich, urllib3, packaging, and other libraries to ensure consistent behavior across environments. Pipenv also includes experimental support for a new pylock.toml format and a pure-Python PEP 691 client, showcasing modern packaging ecosystem integration. The codebase is well-structured with clear separation of CLI, routines, utilities, and resolver components, and has an extensive unit and integration test suite. While some modules are tightly coupled to internal state, several components (atomic file writes, parallel fetching, disk caching, credential redaction) are well-isolated and could be reused in other Python tooling projects.
Gum is a command-line tool for creating glamorous shell scripts. It provides a collection of highly configurable, ready-to-use utilities for common interactive tasks such as choosing from a list, confirming actions, filtering items, prompting for input, writing multi-line text, displaying spinners, rendering tables, paging through content, styling text, joining text, formatting markdown/code/emoji, logging, and picking files. Each command is a standalone subcommand that reads from stdin and writes to stdout, making it composable in shell pipelines. The architecture is a monolithic Go application using the Kong argument parser to define subcommands. Each subcommand is implemented as a separate package with a model-view-update pattern using the Bubbles library for terminal UI components and Lip Gloss for styling. The main entry point (main.go) parses arguments and dispatches to the appropriate command. Configuration is done via command-line flags and environment variables, allowing deep customization of colors, borders, padding, and keybindings. Gum relies on several Charmbracelet libraries: Bubbles for interactive UI widgets (text input, textarea, spinner, table, viewport, file picker, paginator), Lip Gloss for text styling, Glamour for rendering markdown and code with syntax highlighting, and Log for structured logging. It also uses Kong for argument parsing, fuzzy matching library, and PTY handling for running commands with spinners. The codebase is well-structured, with clear separation of concerns and extensive use of Go's type system.
inshellisense is a terminal-native runtime that provides IDE-style autocomplete for shells. It integrates with shells via OSC sequences to display real-time suggestions as users type, drawing from the autocomplete project's database of 600+ command line tools. The architecture consists of a CLI entry point, runtime components for parsing and generating suggestions, UI components for rendering and managing suggestions, and shell integration scripts for various shells (bash, zsh, fish, powershell, etc.). Key features include keybindings for navigation (tab, up/down, esc), shell-specific configuration generation, and performance monitoring.