Enterprises keep buying AI tools and wondering why output does not compound, when the real gap is governance: nobody can say which agent owns what, what it may touch, or what it cost. Ybkkasi answers those three questions in one console for every MCP server, skill, agent, and AI application you run. Register each asset and move it through a lifecycle state machine from discovery to retirement, with 85 permission points deciding who can view, call, publish, or approve at every step. Work itself is organized as goals that break into projects and tasks, assigned to digital employees who each carry a home organization, a human supervisor, and a roster status. Approvals route through a dedicated center where lifecycle changes and sensitive actions wait for a human decision instead of happening silently. Every call is metered, so usage and cost reports attribute spend by department, by agent, and by skill, making showback a query rather than an argument. The audit log records who did what to which asset and when, giving compliance a trail they can actually read. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

More than 70 automated checks sniff out broken links, redirect chains, and missing meta tags across your whole site, and SEOnaut, the self-hosted SEO audit crawler, sorts every finding into critical, alert, or warning so you know what to fix first. Add a website as a project, press Crawl Now, and watch URLs stream in with their status codes; a Stop button ends any run that wanders off. Reports also cover duplicate titles and descriptions, heading order, hreflang, canonicals, image alt text, thin content, orphan pages, and non-HTTPS URLs, while a passed-checks list shows what is already healthy. Dashboard charts follow crawl history, issue trends, status codes, link types, and page depth. Crawl options are set per project: ignore robots.txt, follow nofollow links, include noindex pages, read the sitemap, allow subdomains, check external links, or authenticate with HTTP Basic to audit a password-protected staging site. Page Details opens any URL with its inlinks, outgoing links, redirections, and images, and URL Explorer searches the crawled pages by term. Export sitemap.xml, CSV lists, or a replayable WACZ archive. Each person picks a light or dark theme and one of five interface languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Point your RustDesk clients at CortenDesk and the bare open-source server turns into a managed fleet console with a real address book, real access control, and a remote client that lives in the browser. One container runs the ID server, the relay, and the console together, and existing key pairs and device IDs move in unchanged, so migration is a hostname change rather than a rebuild. The fleet view shows live presence, platform, aliases, owners, and last-seen for every machine, organized into folders that double as the unit of access control. People see only their own devices plus the groups granted to them, and the same scoping is enforced in the RustDesk client API, not just the web pages. Policies push client settings over the heartbeat, covering permissions, password rules, and capture behavior, and enforced policies revert local changes automatically. Five audit logs record connections, file transfers, sign-ins, security alarms, and console actions, all filterable and exportable to CSV. When a browser is all you have, the built-in web client views and controls machines with file transfer, clipboard, audio, and multi-monitor switching, no installer required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

tirreno watches what accounts actually do inside your product, then surfaces the ones that look like account takeover, credential stuffing, fake signups, or insider abuse. Your backend reports events such as logins, registrations, page views, searches, email changes, and field edits through an SDK or one HTTP call, and a scheduled job turns them into per-user context: devices, IP addresses, sessions, and connected identities. Preset rules cover account takeover, credential stuffing, content spam, bot detection, multi-accounting, promo abuse, dormant accounts, API protection, and high-risk regions, and you can add rules of your own. Each rule adds to a risk score, and thresholds decide whether a user is flagged for manual review or suspended automatically. The review queue lists who needs a look, and the single user view shows behaviour patterns, risk scores, connected identities, and an activity timeline. A field audit trail records what changed and when, which supports compliance reviews, while the logbook lists every API request the instance received. Your application can ask a blacklist endpoint whether a user or IP should be blocked before it responds. An optional IP enrichment pack adds geolocation, ISP, and VPN or proxy detection. All event data stays on your own server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Audit season stops being a six week archaeology dig through shared drives when Conformiti keeps your whole compliance programme in one self-hosted system built for SOC 2, ISO/IEC 27001:2022, and PCI DSS v4.0.1. Its three complete control libraries hold 217 controls with a cross-framework crosswalk, so satisfying one requirement can answer its equivalents elsewhere instead of duplicating work. Evidence lives in a folder tree generated from those libraries, where every document declares which controls it satisfies and every control lists its documents, ending the hunt for proof at fieldwork time. Readiness is calculated rather than vibes: each control scores from implementation status, owner, evidence freshness, and testing, minus a penalty for open risks, and the dashboard tracks that score with daily snapshots. Documents carry review cadences with escalating email reminders before they expire, versions archive instead of overwriting, and uploads can pass through ClamAV scanning. A five by five risk register, vendor register with shared responsibility matrices, periodic access reviews, and a RACI matrix keep the rest of the programme beside the controls instead of in separate spreadsheets. When assessors arrive, you issue them a sealed, signed evidence package for a fixed window that verifies offline, rather than handing over drive access that outlives the engagement. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When an agent breaks production at 3 a.m., "the model did it" is no incident report: Bernstein decides in advance what your AI agents may touch, then keeps receipts proving what they did. You write policy as code: which roles may do what, what needs human approval, and what must be recorded before a task counts as done. A deterministic scheduler with no model in the coordination loop turns each goal into parallel tasks, so replaying yesterday's plan reproduces yesterday's task graph exactly. Every coding task runs in its own git worktree behind merge gates; nothing lands on your main branch until tests, lint, and type checks pass. It drives the CLI agents you already use (Claude Code, Codex, Gemini CLI, Aider, Goose, dozens more), mixing cheap local models with heavy cloud ones in one run. Approvals can demand a hardware key touch, and role fences hold whatever an agent tries inside its task. The journal, lineage record, and optional tamper-evident audit chain capture every step, sealed into an Ed25519-signed receipt verifiable offline from the file alone. Non-code work gets the same treatment: an artifact contract names the deliverable (report, dataset, audit evidence pack), and the task completes on a signed receipt instead of a commit. You supervise from the browser dashboard or terminal UI, watching tasks, agents, approvals, and costs live. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.