Keydd is an HTTP(s) proxy tool that performs sensitive information detection and AI-driven API business logic analysis. It acts as a MITM proxy to intercept traffic, matches content against 30+ regex patterns for credentials/API keys, and optionally uses LLMs to analyze API endpoints for business purpose, sensitivity, and penetration priority. The architecture features separate layers for proxy handling, rule-based detection, AI analysis (with rate limiting, token tracking, and metrics), database persistence (SQLite/MySQL/PostgreSQL), and notifications. Key entry points include main.go for startup, proxy/handler.go for traffic processing, and cmd/match_rules.go for sensitive pattern matching.
TrendRadar is a configurable news aggregation and trend analysis system that crawls hot lists from 11+ Chinese platforms (Zhihu, Weibo, Douyin, Bilibili, etc.) and RSS/Atom feeds, filters content via keyword DSL or AI-based interest matching, performs AI-powered analysis (sentiment, controversy, topic trends), generates rich HTML reports, and pushes notifications to 9+ channels (Feishu, DingTalk, Telegram, Email, ntfy, Bark, Slack, WeCom, generic webhook). It is primarily an application (with CLI entry points, scheduling via timeline.yaml, Docker/GitHub Actions deployment) but incorporates data-pipeline patterns such as multi-stage ETL (crawl → store → filter → analyze → report), SQLite storage with optional S3 remote sync, and AI batch processing. The architecture is a modular monolith: the core `trendradar` package handles all orchestration, while a separate `mcp_server` package exposes 20+ tools via Model Context Protocol (MCP) for LLM integration. The system is heavily config-driven (YAML and text files) and includes a standalone web-based config editor. External dependencies include the third-party newsnow API (for hot lists), LiteLLM (for AI model abstraction), and various notification service APIs. The codebase demonstrates good craftsmanship with clean abstractions (storage backends, notification dispatcher, AI client), though some duplication exists between the core and MCP notification logic, and the extensive configuration surface requires careful maintenance.