Miniflux is a self-hosted, minimalist RSS/Atom feed reader implemented as a monolithic Go web application. It relies exclusively on PostgreSQL for persistence and serves a server-rendered web UI, a comprehensive REST API, and compatibility endpoints for the Fever and Google Reader APIs. The application is designed for low resource consumption and easy deployment, evidenced by its single-binary nature and extensive packaging (Docker, RPM, Deb, systemd). The core strength of the codebase lies in its feed ingestion pipeline, which demonstrates exceptional defensive programming against the chaotic and non-standardized world of web feeds. This pipeline includes robust format detection (RSS, Atom, RDF, JSON Feed), character encoding detection for legacy charsets, a port of the Mozilla Arc90 readability algorithm for content extraction, a highly restrictive HTML sanitizer with SSRF protection, and a DSL-based content rewrite engine. The system supports multi-user authentication (local, OAuth2, WebAuthn), extensive third-party integrations (Discord, Slack, Telegram, Pinboard, etc.), and background job processing for feed refreshes. The codebase exhibits high craftsmanship with clean abstractions, consistent builder patterns, and thorough testing (unit, integration, fuzz). Several components, such as the SSRF-safe HTTP client builder, the readability extraction algorithm, the i18n pluralization engine, and the HTML sanitizer, are isolated, well-documented, and could be extracted for use in other Go projects. The project is actively maintained with modern Go features, zero Dependabot alerts, and a strong CI/CD pipeline. The main maintenance burden is the sprawl of third-party integrations and the monolithic JavaScript frontend, but the core Go server code is exceptionally well-engineered.
Memos is a self-hosted, full-stack memo/note-taking application with a Go backend and React/TypeScript frontend. It provides rich features including markdown editing with inline images and math, attachment management (images, video, audio, motion photos), spaces for collaboration, calendar and map views, AI-powered audio transcription, webhooks, SSO/OAuth2 identity providers, and a CEL-based filter engine for advanced querying. The architecture is layered with enforced import rules: internal utilities, provider interfaces (AI, storage, IDP), core business logic, a store layer with driver abstraction supporting SQLite, MySQL, and PostgreSQL, and a server layer exposing ConnectRPC/gRPC and HTTP APIs. The frontend uses CodeMirror 6 for the editor, TanStack Query for data fetching, and extensive custom hooks and UI primitives. The codebase is well-tested with unit, integration, and benchmark tests across both backend and frontend. Notable engineering highlights include a custom Common Expression Language (CEL) engine that compiles user-defined filters to SQL, a sliding window rate limiter, a thread-safe in-memory cache with TTL, and a protocol abstraction layer that transparently handles gRPC and ConnectRPC headers.
LibreChat is a self-hosted, multi-tenant AI chat platform that unifies access to major LLM providers (OpenAI, Anthropic, Google, AWS Bedrock, Azure, and custom OpenAI-compatible endpoints) through a single web interface. The architecture is a monolithic Express.js/Node.js backend serving a React (Vite) SPA, backed by MongoDB (Mongoose), Redis for caching/rate-limiting, MeiliSearch for full-text search, and PostgreSQL (pgvector) for RAG embeddings. The codebase is organized as a monorepo with shared packages: `data-schemas` (Mongoose models/methods with multi-tenant isolation), `data-provider` (Zod schemas, API types, React Query hooks), `api` (MCP management, streaming, auth, SSRF protection), and `client` (reusable React component library). Key data flows include: user requests hitting Express routes, middleware performing JWT/OAuth/LDAP/SAML auth and RBAC checks, agent orchestration via `@librechat/agents` with tool execution (MCP, code interpreter, web search), and SSE streaming with resumable stream support via Redis-backed job management. The system implements a sophisticated multi-tenant isolation layer using Mongoose plugins (`tenantIsolation`) that automatically scope queries by tenant, an ACL/permissions system with bit-flag-based permission checks, and SSRF protection with DNS resolution validation for MCP server URLs. The MCP (Model Context Protocol) subsystem is particularly well-developed, featuring OAuth flow management with reconnection tracking, tool discovery, and both stdio and HTTP/SSE transport support. The streaming architecture supports horizontal scaling with Redis-backed event transport and job stores, enabling resumable streams across multiple server instances.
nette/http is a standalone PHP library providing HTTP abstraction for request/response handling, URL manipulation, session management, and file uploads. It is part of the Nette Framework ecosystem but is usable independently. The library offers immutable `Request` and `UrlImmutable` objects for safe processing, alongside mutable `Response` and `Session` for stateful operations. It includes security-focused features such as input sanitization, CSRF protection via `Sec-Fetch-*` headers (with fallback), SSRF protection via `UrlValidator` and `IPAddress`, and a proxy trust model for client IP resolution behind reverse proxies. The codebase is well-structured, with clear separation of concerns, comprehensive test coverage (Nette Tester), and strict static analysis (PHPStan level 8). It requires PHP 8.3-8.5 and depends on `nette/utils`. The repository is actively maintained with recent commits, CI on multiple OSes, and an issue tracker.
OneFileLLM is a versatile CLI tool and web application designed to process diverse inputs (local files, GitHub repositories, YouTube transcripts, arXiv papers, web pages, etc.) into a single structured XML-like output optimized for LLM consumption. The system features format-specific processors that extract and convert content (e.g., Excel to markdown, PDF text extraction, Jupyter notebook to code), token counting via tiktoken with optional NLTK-based compression, and metadata reporting. It includes a Rich-powered terminal interface with colored output and progress bars, a Flask-based web app with Server-Sent Events for real-time progress updates, and an alias system for JSON-stored shortcuts with placeholder substitution. Security is prioritized through SSRF protection, local path validation, and offline mode support. The architecture separates core processing logic (onefilellm.py), CLI handling (cli.py), utilities (utils.py), and web components (extras/web_app.py), enabling modular reuse.
New API is a full-stack AI gateway/proxy service that provides a unified interface for multiple AI model providers (OpenAI, Claude, Gemini, etc.). It features user authentication and authorization, API key/token management with quota tracking and billing, administrative dashboard for configuration and monitoring, intelligent routing between providers, format conversion between different AI APIs, payment integrations, webhook support, and a playground for testing models. The backend is built with Go using the Gin web framework and GORM ORM, while the frontend is a React/TypeScript application built with Bun. The system implements a modular architecture with clear separation of concerns across controller, service, model, and relay layers.
WhoDB is a self-hosted, multi-database workspace and management platform by Clidey (Apache-2.0). The production system is a Go backend (chi router, gqlgen GraphQL API, BAML-generated LLM clients) served alongside a React/TypeScript SPA (Vite, Apollo, Redux), plus a Cobra/Bubbletea CLI/TUI, a Wails desktop app, an MCP server exposing database tools to AI agents, and multi-language SDKs (Python, TypeScript, Go, Rust, Java) targeting the hosted platform API. It lets users browse/edit/query rows, inspect schemas and relationships, run arbitrary SQL/NoSQL commands, import/export CSV and Excel, generate mock data, and chat with an AI assistant that produces SQL, explains queries, and executes verified operations. Supported engines include PostgreSQL, MySQL/MariaDB, SQLite, CockroachDB, TiDB, DuckDB, ClickHouse, QuestDB, YugabyteDB, MongoDB, Redis/Valkey/Dragonfly, Elasticsearch/OpenSearch, and Memcached, with automatic discovery of cloud-hosted instances on AWS, Azure, and GCP. Architecturally the backend is a database-plugin registry: every engine implements a PluginFunctions interface, mostly by embedding a shared GORM-based SQL plugin and overriding dialect specifics (constraint parsing, batch operations, SQL builders); non-relational stores use native adapters. Security is treated seriously: a SQL guard classifies commands as read-only vs mutating across SQL/MongoDB/Redis, egress validation blocks SSRF targets including cloud-metadata IPs, sessions use hashed cookie tokens with CSRF double-submit, and audit logging classifies events into telemetry/access/compliance. The frontend uses registry patterns (component-registry, route-registry, sidebar-registry) to keep CE/EE edition differences declarative. The most reusable pieces are security components (sqlguard read-only classification, egress SSRF filter), the mock-data generator's column-pattern matching, and the schema-diff engine — all self-contained enough to extract into other projects. The codebase is actively maintained with extensive CI/CD (Docker, npm, Snap, Windows Store, macOS releases), per-database e2e suites, and accessibility checks. Weaknesses are inherent complexity: five SDKs must stay synchronized with a generated manifest, BAML generation introduces platform-specific build stubs, cloud-provider connectivity logic is duplicated across AWS/GCP/Azure, and the broad plugin interface gives new database adapters a large implementation surface.
This repository is a Ruby gem for parsing CSS that implements CSS specification compliance including selector specificity calculation, property parsing, shorthand expansion/creation, and CSS cascade merging. It handles CSS imports, media queries, and URL resolution with built-in SSRF protection. The library processes CSS input (files, URIs, strings) into RuleSet objects that can be queried, manipulated, and merged according to W3C CSS standards. Key features include robust parsing of complex CSS, handling of edge cases in shorthand properties, and security measures against remote file inclusion attacks.
This is a favicon API service built with TypeScript, Hono, and Bun that fetches and serves website favicons. The application provides a single HTTP endpoint that accepts a domain parameter, discovers favicons from multiple sources (HTML link tags, web manifest, common locations), optionally falls back to Google's favicon API, processes images (resize/format conversion), and returns either the image or JSON metadata. It's designed to be stateless and deployed behind a caching layer (CDN or reverse proxy) for production use. The codebase demonstrates strong modular architecture with clear separation of concerns, proper error handling, security features like SSRF protection, and comprehensive test coverage.
Besticon is a Go-based application and library designed to discover and generate website icons (favicons, apple-touch-icons, etc.). It functions as a monolithic service that can be deployed as a web server, a CLI tool, or imported as a library. The core logic scans HTML for icon links, parses .ico files, extracts dominant colors from images, and generates letter-based placeholder icons when no icons are found. It exposes an HTTP API with endpoints for icon fetching and a web UI for demonstration. The architecture separates concerns into a core library (`besticon`), a command-line interface (`besticon/cmd.go`), and a web server (`iconserver`). The server integrates Prometheus metrics for observability and implements SSRF protection to prevent security vulnerabilities during external HTTP requests. The codebase utilizes Go's standard library for image processing and HTML parsing, with external dependencies for caching (`groupcache`) and metrics (`prometheus`). A notable engineering practice is the use of VCR (Video Cassette Recorder) cassettes for testing HTTP interactions, allowing deterministic testing without live network access. The project also employs the functional options pattern for configuration, ensuring a clean API for the library consumers. However, the `go.mod` file specifies a future Go version (1.26), which indicates a configuration anomaly that may hinder standard builds.