Adobe Acrobat and Smallpdf, answered by a self-hosted Java web application: Stirling PDF processes every file with its 60+ tools on your own server and deletes it after the task completes. Nothing is uploaded to a third party, which is the whole point for contracts, invoices, and medical records. The toolbox covers page operations (merge, split at page numbers or scanned dividers, rotate, reorder, crop, extract), conversion in both directions between PDF and Word, Excel, PowerPoint, images, HTML, and Markdown, OCR that turns scans into searchable PDFs via Tesseract/OCRmyPDF (including PDF/A archival conversion), and security tools for passwords, permissions, watermarks, signatures, and true UI-driven text redaction. A built-in viewer handles annotation, drawing, and text or image insertion, and V2 added stateful processing - upload once, chain multiple tools - plus undo/redo history. For automation, nearly every tool has a REST API endpoint, no-code pipelines combine operations into custom logic chains, and watched folders process files automatically. Enterprise deployments get SSO, user management, and audit logging; the interface ships in 40+ languages. With 84K+ GitHub stars it is the most popular PDF tool in self-hosting, replacing $20/month Acrobat subscriptions with flat infrastructure cost.

Achieving 98.4% Recall@5 on LongMemEval-S without a reranker, AKB is the agent-native knowledge infrastructure giving Claude Code, Cursor, Windsurf, and any MCP-aware agent persistent organizational memory — a drop-in replacement for Confluence or Notion where AI agents read and write directly rather than scraping human-formatted pages. Documents are stored as Markdown with YAML frontmatter in Git bare repositories (full version history, branching, diff), while PostgreSQL 16 serves as source of truth for chunk text, metadata, and BM25 vocabulary, with dense embeddings handled by a pluggable vector store (pgvector default, Qdrant optional, or managed Seahorse). Agents interact through 20+ MCP tools — akb_put, akb_search, akb_browse, akb_relations, akb_sql, akb_edit, akb_history — performing hybrid dense plus BM25 search fused via Reciprocal Rank Fusion in one call. The URI graph (depends_on, related_to, implements relations) lets agents traverse knowledge connections without external graph databases. Multi-tenant vault isolation is enforced at the PostgreSQL ACL level with per-user roles and SET LOCAL ROLE for SQL sandboxing. Event fanout streams structured events to Redis Streams for external consumers (synthesis bots, digest agents, audit trails), and a hash-chained append-only audit log integrates with enterprise SIEMs. Ships with agent plugins for Claude Code and Codex (session capture, wiki ingest, lifecycle hooks), Kubernetes kustomize manifests, and Open Knowledge Format export. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed (free under 100 seats, auto-converts to Apache 2.0 after four years).

TencentDB Agent Memory provides a team-level memory hub that transforms AI agent conversations, documents, and codebases into four governed, shareable memory assets: Chat Memory for conversation history, Skills extracted from completed tasks, LLM-Wiki built from document ingestion, and Code-Graph generated from codebase analysis. The four-tier semantic pyramid structures long-term memory from L0 raw conversation capture through L1 episodic extraction and L2 scenario aggregation to L3 persona synthesis, enabling hierarchical drill-down via node and result references instead of flat vector recall. The Node.js Gateway sidecar handles capture, extraction, storage, recall, and pipeline scheduling through RESTful HTTP v2 endpoints on port 8420, while the Memory Proxy intercepts Anthropic-format API calls to inject team memory context into Claude Code, CodeBuddy, and other coding agents transparently. Local SQLite with the sqlite-vec extension provides the default storage backend with hybrid BM25 keyword plus vector embedding plus reciprocal rank fusion retrieval requiring zero external API dependencies. Teams manage ownership, versions, status, visibility, usage counts, and agent bindings through the Memory Hub dashboard with role-based access control separating System Admin and team-level Admin and Member permissions. Official TypeScript and Python SDKs provide programmatic access for custom framework integration beyond the built-in OpenClaw plugin and Hermes Agent adapter. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Unify fragmented corporate knowledge across chat channels, documents, and cloud drives with PipesHub, an open-source workplace context platform providing permission-aware search and verifiable answers for teams and autonomous agents. Employees can query enterprise knowledge bases through a conversational interface that retrieves relevant information across Google Workspace, Microsoft 365, Slack, Confluence, Jira, and GitHub while strictly respecting individual user access permissions. Knowledge workers can verify every answer through clickable citation blocks that trace claims directly back to source documents, spreadsheet rows, or chat messages. Teams can assemble custom AI agents visually using a drag-and-drop builder, combining retrieval collections with interactive toolsets to automate multi-step operations like drafting customer responses or creating issue tickets. Autonomous agents connect via Model Context Protocol to inspect shared company knowledge and perform external actions across connected SaaS tools. Organizations can index scanned PDFs, slide decks, markdown pages, and spreadsheets with OCR and document parsing, maintaining synchronized records through automated schedules. Administrators can inspect synchronized records, monitor query history, and manage connector credentials across all integrated business applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache License 2.0 licensed.

The first open-source substrate for enterprise knowledge engineering that learns passively and governs itself. The Rust-built backend paired with PostgreSQL and pgvector delivers a bitemporal knowledge graph where every fact carries two timelines: when it held in the real world and when the system came to believe it — enabling full audit trail replay of how understanding evolved. Document ingestion handles PDF, DOCX, PPTX, XLSX, CSV, Markdown, HTML, and plain text with legacy encoding detection, while scheduled syncing pulls from web pages, RSS feeds, GitHub, Jira, Notion, WebDAV, and S3-compatible buckets. Search fuses Tantivy full-text indexing with pgvector semantic vectors using Reciprocal Rank Fusion, streaming answers with inline citations that link directly to source passages. The built-in agent harness drives agentic RAG through conversation — searching documents, walking the knowledge graph at any historical date, and querying mounted databases via Ontology2SQL which achieves state-of-the-art results on BIRD Mini-Dev benchmarks. Five ontology packs ship inside the binary (schema.org, W3C Org, PROV-O, FOAF, IOF Core) with forward-chaining reasoning for transitivity, symmetry, inverses, and relation hierarchy. Entity resolution operates in three stages: exact name matching, embedding similarity, then model-based judgment with every merge reversible. Any OpenAI-compatible endpoint works including DeepSeek, Qwen, Ollama, and vLLM for fully air-gapped deployment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Keep is an open-source AIOps and alert management platform built with Python FastAPI and Next.js. It provides a single pane of glass for monitoring alerts from 110+ integrations, alert deduplication, correlation, enrichment, and filtering, YAML-based workflow automation similar to GitHub Actions, AI-powered correlation and summarization, and customizable dashboards for incident management. With 12,100+ GitHub stars, Y Combinator backing, and an Elastic partnership, Keep is the open-source AIOps platform that centralizes alert management across your entire monitoring stack into a single customizable dashboard. Alert deduplication identifies duplicate notifications across providers, correlation groups related alerts into incidents based on rules or AI-powered semantic analysis using pluggable LLM backends supporting OpenAI, Anthropic, and local models via Ollama, and enrichment adds context from external sources like CMDBs and databases. Workflow automation follows a GitHub Actions paradigm with declarative YAML files defining triggers, conditions, and actions that can query MySQL, update Jira tickets, send Slack messages, execute Python scripts, or call REST APIs. Authentication supports no-auth, database, Auth0, Keycloak, OAuth2 Proxy, Okta, and OneLogin. The Common Expression Language enables advanced alert querying, slicing, and rule-based grouping to reduce noise. On RepoCloud, deploy Keep on a dedicated VPS with Docker Compose, root SSH access, and complete control over your alert infrastructure, all under the MIT license.

Every line an indentable bullet, every bullet a first-class block that can be referenced, embedded, and queried anywhere: Logseq is a privacy-first, local-first knowledge platform built around the block outliner. The daily journal is the system's beating heart - each day opens a fresh date-stamped page where tasks, meeting notes, and fleeting ideas land as blocks without filing decisions, then connect later through [[wikilinks]] with automatic bidirectional backlinks and ((block references)) that transclude any bullet into any page. Everything persists as plain Markdown or Org-mode files on disk - git-friendly, greppable, and owned forever, with sync via iCloud, Dropbox, Syncthing, Git, or an optional end-to-end encrypted service. Built-in tooling goes beyond notes: TODO/DOING task states with scheduling, native PDF annotation with area highlights, spaced-repetition flashcards, whiteboards for visual thinking, Zotero integration for researchers, and Datalog-powered queries that build dynamic views across the entire graph. A marketplace of hundreds of community plugins and themes adds AI chat, Ollama local-model integration, and custom workflows. Written in Clojure/ClojureScript, AGPL-3.0 licensed with 320+ contributors, and completely free - the local-first Roam for people who refuse subscriptions and lock-in.

Decisions that scatter across email threads and chat scrollback get one home in Loomio, where a group discusses a question, votes, and publishes what it decided. Every decision starts as a thread with context, comments, @mentions, reactions, tags, and attachments, and tasks inside it carry assignees and emailed due-date reminders. Proposals ask for a defined response plus an optional written reason, using sense check, advice, consent, or consensus templates. Polls handle simple choices, scores, dot voting, ranked choice, meeting-time availability, and multi-winner STV elections. Coordinators set a participation quorum, require a vote share, weight votes, limit voting to appointed delegates, or hide results until close with anonymous voting. Groups nest subgroups, pick Open, Closed, or Secret visibility, and admit members freely, by request, or by invitation. People reply to discussion emails and catch up through a daily digest, and webhook integrations post invitations and outcomes to Slack, Discord, Microsoft Teams, Matrix, and Mattermost. Published outcomes stay searchable, and groups export CSV, HTML, or JSON and print threads to PDF. Comments translate on request, the interface is available in 24 languages, and a user API, server API, and webhooks connect other tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Kortix Suna is an AI management system where autonomous agents run on isolated Linux sandbox computers, producing finished deliverables that humans review through a change request workflow before anything merges. With 20,000+ stars, it positions itself against Claude Cowork and ChatGPT Work by storing every agent persona, skill, memory artifact, and connector in a git repository: versioned, diffable, and shared across an organization. Each session launches a dedicated sandbox with full terminal access, Playwright-controlled Chromium, writable filesystem, and internet connectivity. Over 3,000 app connectors are available through MCP, OpenAPI, GraphQL, and raw HTTP, with credentials brokered server-side so tokens never enter the sandbox. Skills (reusable markdown-plus-script packages encoding company workflows) load automatically into every session, compounding institutional knowledge over time. Bring-your-own-key model routing through LiteLLM connects to OpenAI, Anthropic, Google, Mistral, or local models without vendor lock-in. The deployment runs as a single Docker Compose stack bundling the Next.js frontend, FastAPI backend, Supabase, Redis, and Caddy with automatic TLS certificates. Enterprise features include SAML/OIDC SSO, SCIM provisioning, RBAC, and audit logging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Elastic License 2.0.

With over 110,000 GitHub stars and one of the fastest-growing open-source communities in the self-hosted space, Immich delivers a Google Photos-grade experience entirely on your own hardware. The platform handles automatic background backup from Android and iOS devices, deduplication, and support for RAW formats, LivePhotos, and MotionPhotos. Its machine learning pipeline runs facial recognition and clustering locally on your server, enabling you to group photos by person without sending a single image to the cloud. CLIP-based semantic search lets you find images by describing their content in natural language, while metadata-driven search covers EXIF data, dates, and locations. The web interface built with SvelteKit provides a responsive timeline view, albums, shared albums with configurable permissions, public sharing links with optional passwords and expiry dates, partner sharing for family libraries, and a global map plotting photos by GPS coordinates. Administrative features include multi-user support with per-user storage quotas, OAuth integration, API key management, and a user-defined storage structure for organizing files on disk. The architecture uses PostgreSQL for metadata, Redis with BullMQ for background job queues handling thumbnail generation, video transcoding, and smart search indexing, and exposes over 400 REST API endpoints documented via OpenAPI with auto-generated SDKs for web, mobile, and CLI clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

OpenMetadata builds a unified knowledge graph connecting schemas, tables, columns, dashboards, pipelines, ML models, and data products into one searchable catalog accessible at port 8585. The ingestion framework ships 130+ connectors covering Snowflake, BigQuery, Redshift, Databricks, PostgreSQL, MySQL, Kafka, Airflow, dbt, Tableau, Looker, Power BI, Metabase, and Superset, automatically extracting metadata on configurable schedules. Column-level lineage traces data flow across transformations, joins, and aggregations, while built-in data quality testing executes profiling and validation rules as data contracts with automated alerting on failures. Governance features include role-based access control, PII auto-detection, glossary term propagation, and domain-based ownership assignment. The native MCP server and AI SDK expose semantic search, lineage queries, and governance metadata as tools any LLM agent can call, enabling AI systems to discover and reason about enterprise data with full trust context. The architecture requires only PostgreSQL or MySQL plus Elasticsearch, no Kafka, no graph database, and deploys via a single Docker Compose file. Created by the founders of Apache Hadoop, Apache Atlas, and Uber's Databook, the platform has earned over 14,700 GitHub stars and adoption by 3,000+ organizations. Apache 2.0 licensed.

MeterSphere is the open-source continuous testing platform that brings test management, API testing, and AI-powered automation into a single self-hosted environment. The Spring Boot Java backend handles test execution with the JMeter engine while the Vue.js frontend delivers a responsive interface for managing test cases, plans, defects, and reports across projects. The built-in AI assistant leverages large language models to auto-generate functional test cases and API interface definitions, reducing manual test creation effort. Test management covers the complete lifecycle from writing and reviewing cases in list or mind-map views, through test plan creation with single plans and plan groups, to defect tracking with customizable templates and workflow rules. API testing combines Postman-like ease of use with JMeter-level flexibility, supporting interface debugging with server-side and local execution, API definition with visual request and response editors, interface mocking with configurable headers and body parameters, scenario automation with visual orchestration, and detailed test reports with automatic generation. The system-organization-project hierarchy supports up to 30 users in the community edition with role-based access control, file management, and configurable notification channels. MySQL stores application data, Kafka handles message queuing, MinIO provides S3-compatible object storage, and Redis manages caching. The plugin marketplace extends testing capabilities and enables DevOps pipeline integration. On RepoCloud, deploy MeterSphere on a dedicated VPS with Docker, root SSH access, and complete control over your testing infrastructure, all under the GPLv3 license.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

Trusted by Cal.com, WhiteBIT, and Documenso and backed by 8,800+ GitHub stars, OpenStatus delivers the open-source status page and uptime monitoring platform that replaces Atlassian Statuspage, Better Stack, and Instatus with a single self-hosted deployment. The monitoring engine runs Go-based probes across 28 global regions on three cloud providers checking HTTP, TCP, and DNS endpoints in parallel with configurable intervals and multi-region consensus to eliminate false-positive alerts. Status pages ship with custom domain support, password and email-domain access controls, maintenance windows, grouped monitor components, and subscriber notifications via email and RSS. Incident management provides structured status reports with investigating, identified, monitoring, and resolved timeline phases that publish automatically to affected status pages. The monitoring-as-code workflow supports YAML configuration synced through the CLI, a GitHub Actions integration for CI/CD pipelines, and a Terraform provider for infrastructure-as-code deployments. The typed ConnectRPC JSON-over-HTTP API exposes a published OpenAPI specification with a Node SDK for programmatic access, while an MCP server connects AI assistants like Claude, ChatGPT, and Cursor directly to workspace data. The tech stack combines Next.js with shadcn/ui for the dashboard, Hono for the API server, Drizzle ORM over Turso for application data, and Tinybird for analytics. Private monitoring locations deploy as a single 8.5MB Docker image behind firewalls to check internal services. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Doca puts rich text, Markdown, spreadsheets, slides, and an infinite canvas under one login and one permission model, giving individuals and small teams a self-hosted workspace for writing together. Every format supports real-time co-editing with presence, comments, saved history, and manual snapshots, and rich text and Markdown documents can be restored to an earlier version. Documents live in knowledge libraries with tree navigation, invitations, inherited permissions, share links, and trash, while personal files and shared folders sit on local disk or S3-compatible storage. Knowledge books go further: they subscribe to sources, run an editable workflow, keep source evidence, and route results through human review. A personal AI assistant, powered by whichever model you configure, searches authorized documents, reads PDF and Office attachments, edits images, and prepares browser drafts. MCP services let external AI clients such as Codex use those tools under your permissions. Sign in with a password, OIDC, Google, GitHub, WeChat, or QQ, review registrations before they go live, and send webhooks to other systems. A plugin SDK and marketplace add business modules, and a browser extension clips pages into documents. The interface ships in Chinese and English. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your medical history, fragmented across a dozen patient portals, in one place on your server: MediKeep (formerly Personal Medical Records Keeper) is a self-hosted health record system. Built with a React frontend and FastAPI backend over PostgreSQL, it organizes 14 categories of medical data - medications with dosages and schedules, conditions, procedures, allergies, immunizations, symptoms, injuries, doctor visits and encounters, treatments, lab results, and even medical equipment with service dates and supplier info. Treatment management is genuinely sophisticated: an advanced mode links treatments to their medications with per-medication overrides for prescriber, pharmacy, and effective dates, and reverse lookup shows which treatments use a given medication. A dashboard summarizes records and recent activity, file uploads attach documents to records, and tagging works across categories. When a new specialist asks for your history, the report builder assembles custom reports by category and exports to PDF, JSON, or CSV - a curated, portable summary instead of a folder of photocopies. Authentication supports Google and GitHub SSO with OIDC providers like Keycloak and Authelia expected to work, and the built-in backup system protects the archive. Health data is exactly what should never live in someone else's cloud.

Pretix powers thousands of events and millions of ticket sales through a fully brandable ticket shop with interactive seating plans, 30+ payment providers, and a mobile check-in app for venue entry management. With over 2,400 GitHub stars, it delivers what organizations need when they demand full control over attendee data and revenue rather than surrendering margins to Eventbrite or Ticket Tailor. Built with Python and Django on PostgreSQL with Redis and Celery, the ticket shop adapts to your colors, logo, and domain with responsive design. The graphical seating plan editor handles everything from small cinemas to large stadiums, letting buyers choose seats mapped to pricing categories. Payment providers connect through plugins including Stripe, PayPal, Mollie for iDEAL and Bancontact, SEPA direct debit, and bank transfer with automatic CSV import for payment matching. The voucher engine generates bulk discount codes with usage limits, quota reservations, and automated email distribution. Waiting lists automatically offer released tickets to the next registrant with expiration deadlines. A built-in mini-CMS hosts event descriptions, terms of service, and static pages directly in the ticket shop. Customer accounts enable repeat buyers to check out faster across events. The pretixSCAN mobile app performs QR code check-in on Android and iOS with offline capability. Embeddable JavaScript widgets integrate the shop into any website. Plugin architecture extends functionality with output formats, analytics, and Apple Wallet passes. Deploy via Docker with the pretix/standalone image alongside PostgreSQL and Redis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your apps keep using the OpenAI SDK while Antirion, a self-hosted AI gateway, decides which provider answers, what each team may spend, and what gets logged. Clients speak the OpenAI, Anthropic, Gemini, or Bedrock APIs, and Antirion translates between them, so a Claude deployment can answer an OpenAI-style call, streams included. Add providers such as Amazon Bedrock, Vertex AI, Mistral, Groq, DeepSeek, or a vLLM server, then publish them as named Models. Routing rules send traffic by team or project with fallback chains, weighted splits, least-cost or least-latency targets, retries, hedging, and circuit breakers. Budgets and rate limits in dollars or tokens apply per organization, team, project, and key, with projections and alerts before money runs out. Guardrails check for personal data, secrets, keywords, and regex matches, then block, redact, flag, or divert. Exact and semantic caching answers repeated prompts without calling a provider. The request log records every attempt, route, token count, cost, and guardrail verdict, with Prometheus metrics and OTLP traces. An MCP gateway and A2A proxy put tools and agents behind the same keys. Sign in with OIDC, SAML, or GitHub, provision users with SCIM, and review every change in the audit log. Changes you choose can require a change request or a second person's approval, and the Playground sends requests from the console. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.