hardened_malloc is a security-focused replacement for the C heap allocator, compiled as a shared library and used either via LD_PRELOAD or integrated directly into a libc such as Bionic on GrapheneOS. It implements the full malloc family (malloc/calloc/realloc/free, posix_memalign/aligned_alloc, malloc_usable_size) plus hardened extensions such as malloc_object_size, free_sized, and free_aligned_sized, along with C++ operator new/delete wrappers. Its architecture is a single monolithic C library: all mutable allocator state lives in one read-only-after-init metadata region; slab allocations are partitioned into per-size-class regions inside statically reserved address space, and large allocations are mmap-backed with randomized guard pages and a quarantine. It targets 64-bit Linux and currently builds against Bionic, glibc, and musl.
Vibe Check MCP is a production-ready MCP (Model Context Protocol) server that provides metacognitive oversight for AI agents. It implements the research-backed Chain-Pattern Interrupt (CPI) methodology to prevent reasoning lock-in by injecting reflective pauses during agent workflows. The server exposes six tools: `vibe_check` for generating clarifying questions via a secondary LLM, `vibe_learn` for logging patterns of mistakes and successes, and three constitution management tools (`update_constitution`, `reset_constitution`, `check_constitution`) for per-session behavioral rules. It supports multiple LLM providers (Gemini, OpenAI, Anthropic, OpenRouter) with automatic fallback to static questions when the LLM is unavailable, and maintains session history for context-aware feedback. The architecture is a monolithic MCP server with dual transport modes: stdio for local agent clients (Claude Desktop, Cursor, Windsurf, VS Code) and streamable HTTP for remote access. A CLI tool (`vibe-check-mcp`) automates installation into all major MCP client configurations with atomic writes and backup creation, handles secret management via interactive prompts or env files, and provides diagnostic commands. The server includes robust HTTP security hardening: DNS-rebinding protection via Host header validation, loopback-only CORS by default with a configurable allowlist, explicit JSON body size limits, and proper JSON-RPC error responses instead of HTML pages. The codebase is well-organized with separation of concerns, extensive unit and integration tests (over 30 test files), CI/CD with security scanning, and clean abstraction layers such as a central model registry and request-scoped transport wrappers.
This repository is a documentation/runbook, not a software application. It teaches how to secure a Linux server through a long, well-organized markdown guide aimed primarily at Debian-based systems. The content covers SSH key authentication and sshd_config hardening, PAM-based 2FA/MFA and password quality, UFW firewall configuration including Docker interactions, intrusion detection/prevention with fail2ban, CrowdSec, and PSAD, and auditing tools such as AIDE, ClamAV, rkhunter, chkrootkit, logwatch, Lynis, and OSSEC. It also includes a separate kernel sysctl hardening reference table and a short nginx security headers guide. In production, the repository itself does not run anything; its value is the curated collection of copy-paste-ready shell commands, configuration snippets, and operational guidance that a human administrator applies to a server. The architecture is a set of static markdown files with a consistent section pattern (Why, How It Works, Goals, Steps, References), backup-before-edit conventions, and validation steps after changes. The main README is effectively an evolving security runbook with a detailed table of contents, while the auxiliary markdown files serve as standalone reference assets. Recent updates show active maintenance: the guide has been revised for Debian 13 systemd-timesyncd, OpenSSH 9.1 RSA size enforcement, Docker and UFW bypass caveats, and CrowdSec installation. However, some older recommendations remain dated—for example, certain sysctl keys in the hardening table are obsolete or no longer present in modern kernels, and several linked references are from 2018-2019. Because this is a documentation repository rather than executable code, quality assessment focuses on information architecture, practical utility, and reusability rather than software engineering structure.
Claudoscope is a native macOS menu-bar application that serves as an observability and configuration management dashboard for Claude Code, Anthropic's AI coding assistant. It reads local Claude Code session transcripts (JSONL), caches parsed summaries in a GRDB-backed SQLite store, and presents analytics on token usage, cost, cache effectiveness, model distribution, and attribution per skill, MCP tool, or agent. The app also includes a comprehensive configuration linter (100+ rules for security, skills, hooks, routing, hardening, and more), an installer for Claude Code hardening baselines and agent routing stacks, real-time file monitoring via FSEvents, and an optional MCP server that exposes read-only tools for AI-driven querying. It operates as a background agent with a menu bar popover and a full dashboard window. The application is built as a monolithic SwiftUI macOS app with modular service actors, extensive unit tests (60+ test files), and a clean separation of concerns. Key entry points include the session parser, analytics engine, linter service, and installer file operations. It depends on Claude Code's local file structure and specific JSONL schemas, which drives a medium technical drift risk as those formats evolve. The codebase demonstrates high craftsmanship with reusable patterns such as pure analytic functions, atomic configuration writers, and a design token system, making it a strong example of a well-engineered developer tool.
C2Rust is a compiler toolchain that translates C99 code into unsafe Rust, then applies static analysis and refactoring to produce safer, more idiomatic Rust. The pipeline consists of four main stages: transpilation (c2rust-transpile) using a Clang-based AST exporter to produce initial Rust code; static analysis (c2rust-analyze) that infers pointer permissions and rewrites raw pointers to safe references using a Polonius-based borrow checker; refactoring (c2rust-refactor) which applies dozens of AST transformations (e.g., ownership splitting, macro collapsing, control flow reconstruction) to improve code quality; and postprocessing (c2rust-postprocess) that leverages large language models to transfer C comments and align definitions. The project also includes a cross-checking framework that instruments both C and Rust code to compare runtime behavior via hashing, a program dependence graph (PDG) builder for memory safety analysis, and dynamic instrumentation for event logging. It is primarily a CLI tool (c2rust) that orchestrates these components, with extensive integration tests on real-world C projects (nginx, curl, sqlite, ruby, python2, libxml2, zstd, lua). The codebase is substantial and actively maintained, but relies heavily on unstable rustc internal APIs and LLVM/Clang, introducing maintenance risk. Several components exhibit high craftsmanship and are reusable in isolation.
discrawl is a Go CLI application for archiving and searching Discord data. It syncs messages from the Discord API, imports Discord desktop cache, stores raw JSON in SQLite via sqlc-generated code, and provides subcommands for sync, publish, subscribe, share import, and remote status. It also exports/imports compressed JSONL snapshots with manifests and commits them to a Git snapshot repo using NUL-delimited path-only commits to preserve unrelated staged work. The repository is primarily an application, but it also vendors agent skills (autoreview, crabbox, discrawl) under .agents/skills, making it a hybrid monorepo.
This repository provides a comprehensive, modular set of Bash scripts to automate the installation and configuration of Apache Guacamole—an open-source remote desktop gateway. The primary orchestrator '1-setup.sh' handles interactive prompts and silent install variables to deploy Guacamole server and client from source, integrate MySQL/MariaDB as the backend database, set up Nginx as a reverse proxy, and optionally configure TLS (self-signed or Let's Encrypt), multi-factor authentication (TOTP, Duo, LDAP), and extra UI features like quick-connect and session recording storage. The scripts are well-structured with extensive error checking, logging, distro-specific workarounds, and support for modular post-install add-ons. Though not a library for reuse, the code demonstrates solid shell scripting craftsmanship, security hardening (fail2ban integration, firewall rules), and separation of concerns. The repository serves as a turnkey deployment toolkit for production-grade Guacamole environments.
This repository is a comprehensive, curated collection of step-by-step privacy configuration guides for a wide range of software, services, and operating systems (e.g., browsers, messaging apps, social media, Windows, Android, macOS). It is purely documentation—no executable code, APIs, or data pipelines. The content is organized into Markdown files under 'Privacy Settings' and 'Extensions Settings', with a central README serving as an index. The guides are consistently formatted, include notes and tips, and are actively maintained with regular updates reflecting the latest stable versions. While not a software application, it serves as a high-quality reference for users seeking to harden privacy settings across their digital footprint.
This repository serves as the central community hub for the freeRASP mobile security SDK. It does not contain any source code itself; instead, it aggregates platform-specific implementations (Android, iOS, Flutter, React Native, etc.) via Git submodules. The actual security detection logic, integration APIs, and threat monitoring are implemented in the respective submodule repositories. This meta-repo provides documentation, issue tracking, and release coordination across platforms. It is well-maintained with active issue triage and a CI workflow for issue monitoring. The project is licensed under MIT with a fair usage policy.
The repo is a monorepo with the TypeScript library in the root and the autoreview skill duplicated across `.agents`, `.claude`, `skills`, and `$AGENTS_HOME`. Entry points include `test/protocol.test.ts`, `.agents/skills/autoreview/SKILL.md`, and `scripts/check-pack.mjs`. External dependencies include Node.js, pnpm, git, and external AI CLIs. The codebase has strong security hardening but also a monolithic autoreview script (~80k tokens), tight coupling between tests and internal helper names, and platform-specific skips that create drift risk.