Teams that cannot send messages through someone else's cloud run Mattermost - the open-core, self-hosted alternative to Slack. It provides public and private channels, threaded discussions, unlimited search history, file sharing with previews, one-to-one audio calls, and screen sharing, with desktop clients for Windows, macOS, and Linux plus iOS and Android apps. Messages support full Markdown, which suits engineering conversations with code blocks and logs. Playbooks turn repeatable processes such as incident response and release management into checklist-driven workflows with automated triggers and retrospectives. Integration is a core strength: prebuilt connectors for GitHub, GitLab, Jira, ServiceNow, and PagerDuty, plus webhooks, slash commands, bots, a REST API, and a plugin marketplace with 700+ entries - together making it a working surface for ChatOps rather than just a chat room. Playbooks add keyword and event triggers, task assignment, status broadcasting, and post-incident retrospectives, so operational knowledge is not trapped in individuals' heads. The server is a single Go binary backed by PostgreSQL, with React clients, released monthly under MIT license and deployable fully air-gapped - which is why governments and defense organizations run it inside closed networks, and why the same control applies to any team with confidentiality requirements. The compiled Team Edition is free for unlimited users with no message history cutoff, so costs stay flat as the team grows.

Your own Heroku or Vercel on a dedicated server — Dokploy is the open-source PaaS that replaces cloud platform subscriptions with a single dashboard you control. Point it at a Git repository or a Docker image, and it builds and deploys the application using Dockerfiles, Nixpacks, or Heroku/Paketo buildpacks. Traefik handles reverse proxying, routing, load balancing, automatic Let's Encrypt SSL, and HTTP/3. Databases — MySQL, PostgreSQL, MongoDB, MariaDB, libsql, and Redis — provision from the UI with automated backups to any S3-compatible destination. Complex multi-service applications deploy through native Docker Compose support, and multi-node scaling uses Docker Swarm. The web dashboard covers environment variables, volumes, resource limits, real-time CPU/memory/network monitoring, and deployment logs, with a CLI and REST API for automation. Deploy notifications go to Slack, Discord, Telegram, or email. One-click templates install common open-source tools, and a single control plane can manage deployments across multiple remote servers. Because everything is standard Docker, there is no lock-in: Dockerfiles, Compose files, and data volumes work anywhere else Docker runs. The push-to-deploy workflow of a $20/seat cloud PaaS, running on a dedicated VPS with guaranteed CPU, RAM, SSD, and full root access — no per-app, per-environment, or per-seat fees regardless of how many applications you deploy. 26,000+ GitHub stars.

DeepSeek Harness gained over 60,000 GitHub stars within hours of its August 2026 launch, establishing itself as the first fully modular open-source agent runtime where literally every component is a swappable plugin. Built on the Cordis framework—a programming paradigm for spatiotemporal composability—dsh decomposes the entire agent stack into independently replaceable pieces: model adapters for DeepSeek, Anthropic, OpenAI, AWS Bedrock, Azure, and Google Gemini; tool registries covering bash execution, file system operations, web search, subagent delegation, and todo management; plus session stores, sandboxes, approval policies, orchestration loops, and the user interface itself. Four operating modes serve different workflows: Standard provides the full toolset, Code mode uses model-generated code to compose multi-round tool calls, Minimal strips down to a shell and editor for benchmarking, and Creator mode lets developers inspect the running runtime and test Cordis plugins in memory. The kernel handles plugin mounting, unmounting, and dependency resolution while typed events and services coordinate between components. Profiles and bundles allow the same codebase to produce entirely different products—a terminal coding agent, a browser-based workspace, a headless automation service, or an ACP/JSON-RPC endpoint—by swapping YAML configuration layers. Session history is stored as an append-only event stream for full trajectory replay, and project-level hooks on agent lifecycle events enable fine-grained behavioral customization. MCP client integration connects to external tool servers, while Agent Client Protocol enables programmatic orchestration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With 83,000+ GitHub stars and $18.8M in Series A funding, OpenHands delivers the leading open-source platform for AI coding agents that scored 68.4% on SWE-bench Verified with Claude Opus 4.6, outperforming Devin 2.0's publicly reported 45.8%. The Agent Canvas web UI organizes work into persistent conversations where agents edit files, run shell commands, browse the web, and execute multi-step development tasks inside isolated Docker sandbox containers. The observe-plan-act loop drives agent behavior: the Python controller manages LLM abstraction via LiteLLM routing to 100+ providers including OpenAI, Anthropic, Google, DeepSeek, Qwen, Llama, and local Ollama models. Built-in skills for code review, Docker management, PRD generation, repo-rules enforcement, release notes, and test running attach to conversations automatically via auto-discovery or trigger-based activation. The Automations system schedules recurring agent tasks with configurable templates for CI workflows, dependency updates, and documentation generation. MCP server integration enables agents to access external tools and data sources. The REST API powers an OpenAI-compatible endpoint for connecting agents to chat UIs, IDEs, and voice platforms. GitHub, GitLab, Slack, and Jira integrations enable pull request reviews, issue resolution, and team notifications. The SDK provides Python and REST APIs for embedding agents in custom tools with local or cloud execution, custom agent behaviors, and Kubernetes deployment. On RepoCloud, deploy OpenHands on a dedicated VPS with Docker socket access, persistent project storage, root SSH access, and complete control over your AI development infrastructure, all under the MIT license.

Archestra delivers the enterprise AI infrastructure layer that organizations need when managing multiple LLM providers, MCP servers, and AI agents across teams becomes unmanageable. The LLM gateway routes requests across Anthropic, OpenAI, Azure, Bedrock, and DeepSeek with virtual API keys, per-team cost limits, and dynamic model routing — giving every developer one token for Claude Code, Cursor, or Codex while finance tracks spend per department. The MCP gateway authenticates tool calls with OAuth 2.1 and On-Behalf-Of tokens so each tool executes as the calling user, not a shared service account, eliminating credential sprawl. The private MCP registry lets teams publish custom tool servers with approval flows promoting servers from dev through staging to production, each environment maintaining its own credentials and network egress policies. The Kubernetes operator manages MCP server lifecycle — deploying containers, scaling, health-checking, and routing gateway traffic to local servers automatically. The agent runtime supports scheduled triggers, email and webhook invocations, sub-agent delegation, reusable skills, and sandboxed code execution with a K8s-native filesystem. Deterministic guardrails including Dual-LLM verification and Lethal Trifecta protections prevent dangerous tool calls before execution. Built-in OpenTelemetry traces and Prometheus metrics provide full observability without additional tooling. Docker deployment exposes the Admin UI on port 3000 and API on port 9000 with a single command. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Point Openship at a GitHub repo, local folder, or prebuilt artifact and it detects your stack, builds a Docker container, provisions databases, configures domains with automatic Let's Encrypt TLS, and routes traffic through an OpenResty edge layer on ports 80 and 443. Already past 10,000 stars since launching in March 2026, it turns any Linux VPS into a managed application host. Language support covers Node.js, Python, Go, Rust, PHP, Ruby, Java, .NET, Docker, and monorepo projects with push-to-deploy CI/CD, pull request preview environments on unique subdomains, staging/production flows, and one-click rollbacks. Integrated backend services include managed Postgres, MySQL, MongoDB, Redis, persistent volumes, WebSocket proxying, object storage, and worker processes, all provisioned from the dashboard without compose files. A built-in SMTP server handles transactional email with automatic DKIM, SPF, and DMARC configuration, eliminating external email services. The edge layer serves HTTP/3 with Brotli compression, configurable cache rules, and instant purging. Real-time monitoring streams build logs, container metrics, visitor geography, and per-status-code analytics at 1.4 microsecond overhead with zero database writes. Scheduled backups cover databases and volumes with one-click restore and export. Three interfaces (web dashboard, desktop app for macOS/Windows/Linux, and the openship CLI) drive the same API, plus a Model Context Protocol endpoint for AI integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

The open-source PaaS with 55,000+ GitHub stars and the largest one-click service catalog in its class — Coolify gives you the Vercel push-to-deploy workflow on a dedicated server you control. Connect a GitHub, GitLab, Bitbucket, or Gitea repository and every push builds and deploys automatically via Nixpacks, a Dockerfile, or Docker Compose, with Traefik or Caddy reverse proxying, automatic Let's Encrypt certificates, and per-branch preview deployments with their own URLs. Databases — PostgreSQL, MySQL, MariaDB, MongoDB, Redis — provision in a few clicks, and a catalog of 280+ one-click service templates covers WordPress, n8n, Grafana, MinIO, Plausible, Ollama, and more. One dashboard manages the entire server, with Docker Swarm available for clustering multiple nodes. Backups go to any S3-compatible storage with one-click restore, and a full API supports CI/CD integration. All configuration lives on your own server, so resources keep running even if you stop using Coolify — no vendor lock-in by design. Running on a dedicated VPS with guaranteed CPU, RAM, and SSD, full root access via SSH and browser console. Apache 2.0 licensed.

Dockhand is a Docker management platforms, offering a modern alternative to Portainer with free OIDC SSO and vulnerability scanning that competitors gate behind paid tiers. Real-time container management provides start, stop, restart, and remove operations with live resource monitoring across CPU, memory, and network usage on a dashboard with real-time metrics. The visual Docker Compose editor enables stack creation and modification with syntax highlighting, while Git integration deploys stacks directly from repositories with webhooks and auto-sync for GitOps workflows. Vulnerability scanning powered by Grype and Trivy analyzes container images against CVE databases, with configurable auto-update scheduling that can trigger updates based on vulnerability severity criteria. The Hawser Go agent enables management of remote Docker hosts in Standard mode for LAN environments or Edge mode using outbound WebSocket connections for hosts behind NAT, firewalls, or dynamic IPs without exposing inbound ports. Interactive terminal sessions provide shell access into running containers, while the file browser enables uploading, downloading, and editing files directly within containers. Image management includes registry browsing, pull operations, and layer inspection alongside network and volume administration. The security-focused architecture builds its own OS layer from scratch using Wolfi packages via apko with every package explicitly declared. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed, converting to Apache 2.0 in 2029.

Stop hoping your AI coding assistant remembers to plan before it codes, test after it implements, and review before it ships. Archon wraps Claude Code, OpenAI Codex, and other AI agents inside structured YAML workflows that enforce the same development process every single time. Define your pipeline as a directed acyclic graph of nodes (AI tasks, shell scripts, approval gates, loops) and Archon handles the orchestration: resolving dependencies, running independent nodes in parallel, passing artifacts between steps, and isolating every run in its own git worktree so five bug fixes can proceed simultaneously without conflicts. Ship with 17 pre-built workflows covering everything from "idea to merged PR" to automated conflict resolution, or author your own by committing YAML files to your repository's .archon/workflows/ directory. The web dashboard, launched with archon serve, provides a conversation interface with real-time streaming, a visual drag-and-drop workflow builder for creating DAG pipelines, step-by-step progress monitoring for every run, and a unified sidebar aggregating conversations from CLI, Slack, Telegram, and GitHub into one view. An NLP router parses natural language requests and automatically selects the right workflow. Structured JSON output schemas let you enforce typed responses from AI nodes, with validation and auto-repair for providers that lack native schema support. Every workflow file is version-controlled, portable, and reviewable in pull requests, so your entire team runs identical processes from day one. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Keep is an open-source AIOps and alert management platform built with Python FastAPI and Next.js. It provides a single pane of glass for monitoring alerts from 110+ integrations, alert deduplication, correlation, enrichment, and filtering, YAML-based workflow automation similar to GitHub Actions, AI-powered correlation and summarization, and customizable dashboards for incident management. With 12,100+ GitHub stars, Y Combinator backing, and an Elastic partnership, Keep is the open-source AIOps platform that centralizes alert management across your entire monitoring stack into a single customizable dashboard. Alert deduplication identifies duplicate notifications across providers, correlation groups related alerts into incidents based on rules or AI-powered semantic analysis using pluggable LLM backends supporting OpenAI, Anthropic, and local models via Ollama, and enrichment adds context from external sources like CMDBs and databases. Workflow automation follows a GitHub Actions paradigm with declarative YAML files defining triggers, conditions, and actions that can query MySQL, update Jira tickets, send Slack messages, execute Python scripts, or call REST APIs. Authentication supports no-auth, database, Auth0, Keycloak, OAuth2 Proxy, Okta, and OneLogin. The Common Expression Language enables advanced alert querying, slicing, and rule-based grouping to reduce noise. On RepoCloud, deploy Keep on a dedicated VPS with Docker Compose, root SSH access, and complete control over your alert infrastructure, all under the MIT license.

With over 6,400 GitHub stars, 130 contributors, and 512 releases, Flagsmith is the open-source feature flag and remote configuration platform that gives development teams granular control over feature releases, remote configuration values, user segmentation, and A/B testing from a single self-hosted dashboard. Feature flags support boolean toggles and remote config values simultaneously — every flag carries both an enabled state and a configurable value, letting teams deploy functional and visual changes without code modifications or app store approvals. User segments target audiences by attributes, percentage rollouts, and custom rules, enabling beta testing, canary releases, and gradual feature rollouts with real-time toggle control. Multivariate flags split traffic across multiple variations with configurable percentage weights for A/B and multivariate testing with analytics integration. The flag evaluation engine runs server-side with local evaluation mode in SDKs for sub-millisecond performance without network calls, supporting 15+ languages including TypeScript, Python, Java, C#/.NET, Go, Ruby, PHP, Swift, Kotlin, Flutter, React, and Next.js. The REST API and webhooks enable integration with CI/CD pipelines, and pre-built connectors exist for Datadog, New Relic, Amplitude, Mixpanel, Segment, Heap, Rudderstack, and Slack. Built on Django with a React frontend, self-hosting deploys via Docker Compose with PostgreSQL, or via Helm charts and the OpenShift Operator for Kubernetes environments. Change history provides a complete audit trail of flag modifications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Managing Kubernetes shouldn't require every developer to become a Kubernetes expert — KubeSphere wraps cluster operations, CI/CD, service mesh, and observability into guided web workflows that operations teams configure once and developers consume without kubectl. The LuBan extensible architecture treats each capability as an independently installable extension plugging into a lightweight microkernel: enable DevOps without service mesh, add monitoring without the app store, compose exactly what your organization needs. Multi-cluster management provides a centralized control plane for provisioning and operating clusters across cloud providers, data centers, and edge locations with unified identity and resource quotas. The DevOps extension integrates Jenkins for graphical pipeline creation with S2I and B2I workflows, while Argo CD powers GitOps continuous deployment with real-time sync status. Istio-based service mesh provides traffic management, canary deployments, circuit breaking, and distributed tracing through the console without CLI knowledge. Prometheus monitoring with custom dashboards, Fluentd log collection with multi-tenant search, and alerting via Slack and email complete the observability stack. Multi-tenant workspace hierarchy enforces resource quotas and fine-grained RBAC roles across teams. A built-in Helm-based app store handles lifecycle management across clusters. KubeKey deploys production-grade clusters on bare metal or VMs with air-gapped support. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

CPA Manager Plus is a self-hosted observability dashboard and management panel that tracks every AI request flowing through your CLI Proxy API gateway, breaking down failures, costs, and account health across providers like OpenAI, Anthropic, xAI, and Codex in one interface. When a request fails, drill into the persistent history to see status codes, affected models, latency, and redacted failure evidence without exposing raw response bodies. The cost analytics engine breaks down token consumption and estimated spend by model, provider, account, API key, project, channel, and time range while tracking input, output, reasoning, cache, and service-tier pricing semantics separately. Model prices sync automatically from models.dev with LiteLLM and OpenRouter fallbacks, and you can add local overrides for aliases or internal models. For teams running Codex or xAI accounts, the health inspector reads quota windows, reset evidence, credential state, and workspace status on a configurable schedule, routing credential failures into an action queue for review rather than letting them silently degrade throughput. Deploy the Lightweight Panel to replace your existing CPA management UI without adding another service, or run Full Mode as a single Docker container that adds the Manager Server with persistent SQLite storage for request history, historical analytics, and automated account inspections. Export or import request history as JSONL for external analysis, and back up the SQLite files alongside your encrypted management keys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Tracking over 50,000 fleet vehicles across production deployments, Fleetbase delivers a modular logistics operating system where each module—Fleet-Ops, Storefront, Pallet, and Ledger—works independently yet shares a unified data layer that eliminates middleware between ordering, dispatch, warehousing, and accounting. The Fleet-Ops core handles real-time driver tracking through a SocketCluster-based WebSocket event bus, interactive map-based dispatch with both directed and ad-hoc driver assignment, configurable order workflows with custom rules, automation triggers, and activity flows, plus a Kanban-style order board for visual pipeline management. Service zones let dispatchers define geographic operating areas, while proof-of-delivery capture and route optimization close the last-mile loop. The Storefront module provides headless e-commerce with products, carts, and checkout that feed directly into dispatch queues, and the Ledger module records invoices and financial journal entries across all operations. The Navigator driver app—also AGPL-3.0 licensed and fully white-label—delivers turn-by-turn navigation, live order communication, and fault reporting to drivers in the field. The extension architecture pairs backend Laravel Composer packages with frontend Ember Engine modules, enabling third-party developers to build first-class platform extensions without forking. A RESTful API with full documentation, webhook delivery via Redis-backed queues, and push notification support through APNs and FCM round out the integration surface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Comp AI turns the months-long slog of SOC 2, ISO 27001, HIPAA, and GDPR certification into a largely automated process by connecting to your existing infrastructure and continuously collecting the evidence auditors actually ask for. Point it at your AWS account, Google Cloud project, GitHub organization, or any of 580+ supported integrations, and autonomous agents pull configuration snapshots, access logs, encryption status, and policy compliance data on a recurring schedule so your compliance posture reflects reality rather than last quarter's manual export. The AI policy engine analyzes your tech stack, team structure, and risk tolerance to generate organization-specific policies for information security, access control, incident response, data retention, and vendor management; no two companies get the same boilerplate. An open-source device agent runs on employee machines checking disk encryption, firewall status, screen lock settings, password length, and antivirus presence around the clock, flagging failures the moment they occur instead of surfacing them during an audit. Built-in penetration testing agents scan your codebase and API endpoints for vulnerabilities like SQL injection and output audit-ready reports. The vendor risk management module scores third-party services and surfaces compliance gaps before they become findings. A public trust center lets prospects verify your compliance status directly, eliminating security questionnaire bottlenecks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

ToolHive is an open-source MCP server management platform that lets you run, secure, and orchestrate Model Context Protocol servers in isolated containers, giving AI agents structured access to tools like GitHub, databases, and cloud services without exposing host credentials or network. Every server launches inside its own sandboxed container with a minimal permission file, network access filtering, and encrypted secrets management, preventing misbehaving connectors from reaching beyond their defined scope. The built-in registry provides a catalog of vetted servers you can install with one command, while custom images and package-manager references let you onboard proprietary connectors without writing Dockerfiles. Platform teams deploy the Kubernetes operator to declare MCP servers as cluster resources using Custom Resource Definitions, with automated lifecycle management and multi-namespace isolation. The Virtual MCP Server gateway aggregates multiple backends behind a single endpoint, centralizing OIDC authentication, tool filtering, and composite cross-server workflows so clients connect once instead of juggling separate URLs. An MCP Optimizer analyzes tool schemas via semantic search and surfaces only relevant tools per request, cutting token consumption by up to 85%. OpenTelemetry traces and Prometheus metrics deliver full visibility into tool execution, latency, and request audit trails across every managed server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

The de facto dashboard of observability: Grafana is the open-source frontend that turns the data stores you already run into interactive graphs. It does not store metrics itself; it connects to the data stores you already run and turns their contents into interactive dashboards. Supported sources number over 150 via plugins: Prometheus, Loki, Tempo, InfluxDB, Elasticsearch, MySQL, PostgreSQL, Microsoft SQL Server, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, and many more. Dashboards are built from a large library of panel types (time series, heatmaps, tables, gauges, logs) with template variables for reusable, parameterized views. Unified alerting evaluates rules against any connected data source, not just Prometheus, and routes notifications to Slack, PagerDuty, email, and other channels with grouping and silencing - unlike Prometheus Alertmanager, a single rule can combine a Loki log pattern, a PostgreSQL query result, and a CloudWatch metric. Dashboards serialize to JSON and data sources configure via provisioning files, so the entire observability setup can live in Git and deploy repeatably across environments. Explore mode adds ad-hoc querying outside dashboards, with split view for correlating a metric spike against the matching log lines, and access control spans organizations, teams, folder permissions, and OAuth, LDAP, and SAML integration. Written in Go and TypeScript, AGPL-licensed. Self-hosting gives you unlimited users, dashboards, and queries at flat hosting cost, without Grafana Cloud's usage-based pricing.