Enterprise security stacks assume an enterprise budget; Wildbox assumes a server you already own. It runs your whole security operation as a set of cooperating services behind a single HTTPS gateway: threat intelligence collectors pull indicators from seven public feeds on a schedule, starting with abuse.ch's Feodo Tracker, and every indicator is searchable in one place. Fifty-two security tools sit behind one API, covering DNS, TLS, email security, headers, and port analysis. The cloud posture service runs 22 configuration checks against your live AWS accounts and keeps each scan's report, while the vulnerability service inventories your assets, prioritizes findings by risk, and tracks them through remediation with SLA checks and alert rules. When something needs doing, YAML playbooks execute response workflows as background jobs, and the agents service writes Claude-generated threat-enrichment reports for suspicious indicators when you give it an API key. An osquery-based sensor streams endpoint telemetry from your hosts into the platform, kept separate per team. Users, teams, roles, and scoped API keys live in the identity service, and the backends accept nothing that did not arrive through the gateway, so your security data never leaves hardware you control. Optional Compose profiles add n8n automation and Prometheus monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

KrakenD processes over 18,000 requests per second on a single instance while consuming under 50MB of RAM at 1,000 concurrent connections, operating as a stateless API gateway that requires no database whatsoever. The Community Edition has earned over 2,600 GitHub stars by outperforming database-dependent alternatives like Kong and Tyk in independent benchmarks. Written entirely in Go, it uses declarative JSON or YAML configuration files that integrate directly into GitOps workflows for version-controlled infrastructure management. The gateway aggregates responses from multiple backend services into a single API call, transforms request and response payloads with field filtering, grouping, and mapping, and applies zero-trust security policies including JWT validation, OAuth 2.0, CORS, HSTS, clickjacking protection, and XSS prevention. Traffic management features include multi-layer rate limiting at both the router and proxy levels, circuit breakers for backend fault isolation, spike arrest policies, and concurrent call support that requests the same data from multiple backends in parallel for improved response times. Telemetry integrates with OpenTelemetry, Prometheus, Grafana dashboards, Datadog, Zipkin, and Jaeger for distributed tracing and metrics collection. The gateway extends through Go plugins, Lua scripting, Martian modifiers, and Google CEL expressions for custom request processing logic. AI workload routing supports OpenAI, Anthropic, Gemini, and other model endpoints with built-in fallback, retries, and load balancing. Deploy via Docker with the devopsfaith/krakend image as a single binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Your internal services deserve certificates your browsers actually trust, without a spreadsheet tracking when each one expires. mkcertWeb wraps the mkcert tool in a web interface where you generate certificates for any mix of hostnames, wildcards, and IP addresses, then download them as PEM, CRT, or PKCS#12 bundles for servers and client authentication. The certificate list groups everything by state, needs attention, healthy, read-only, or archived, showing days remaining, subject alternative names, and SHA-256 fingerprints at a glance. You can upload existing certificate and key files for viewing, attach a free-text note to each certificate, and archive or restore entries without ever overwriting a certificate of the same name. The root CA page offers downloads and install instructions for macOS, Linux, and Windows, and can generate a fresh CA for a new deployment. Devices enroll through the built-in SCEP server using one-time challenge passwords and templates, with an optional enterprise CA signing manual enrollments. A scheduled monitor checks expiry daily and sends alerts through SMTP email, ntfy, or an HTTP webhook, with test buttons for every channel. Settings save from the browser with secret masking, sign-in supports passwords or OpenID Connect single sign-on, and light and dark themes work down to phone width. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Hunting for the hole is only half the job, because a scanner alert nobody believes wastes more time than the bug itself. Add a domain, CIDR, or bug-bounty scope and Reconner builds the map first: passive and active subdomain enumeration, live HTTP probing and fingerprinting, JavaScript analysis that digs endpoints, secrets, and API keys out of bundles, plus parameter and hidden-param discovery. Then it attacks what it mapped with a context-aware engine covering reflected, stored, and DOM XSS, SQL, NoSQL, SSRF, IDOR, LFI, SSTI, XXE, injection, and open redirects, and every candidate has to survive differential, out-of-band, or control-based proof, re-verified before it is ever reported. Blind issues are not dropped either: OAST callbacks catch out-of-band SSRF, RCE, SQLi, and SSTI that never respond inline. Networks get the same treatment, with port scanning, service detection, network-CVE checks, and IP-camera auditing. Findings land in a live dashboard streamed over WebSocket, with an attack-path view, coverage ledger, monitoring diffs, and HTML, Markdown, and PDF reports, while Telegram can alert you and even start, stop, or resume scans remotely. Run it only against assets you own or are authorized to test; behind a VPN and TLS it becomes your private proving ground. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Usulnet packs container management, Trivy security scanning, Nginx reverse proxy, scheduled backups, WireGuard VPN, firewall rules, and multi-node orchestration into a single 70MB Go binary with zero external runtime dependencies. Every module ships in one download with no paid tiers, no telemetry, and no edition gating. Container lifecycle management covers creation, start, stop, restart, pause, kill, and removal with bulk operations, real-time resource statistics, filesystem browsing, and settings editing. Trivy integration scans images and running containers for CVEs with severity scoring, generates SBOMs, and validates CIS benchmarks. The multi-node architecture supports standalone, master, or agent modes where agents connect over NATS JetStream with mTLS encryption, enabling remote Docker host management from a central dashboard. Reverse proxy configuration handles Nginx with automatic Let's Encrypt certificates, TCP/UDP stream proxying, access lists, and dead host detection. Backup operations capture container volumes and Compose stacks on configurable schedules with retention policies and full restore capabilities. A built-in application catalog provides 60+ one-click templates for common services. JWT license validation uses an RSA-4096 public key embedded in the binary, requiring no call-home and working entirely offline. For teams tired of maintaining separate tools for each infrastructure concern, Usulnet collapses the entire stack into a single point of management with Docker Compose deployment alongside PostgreSQL, Redis, and NATS.

Netra watches your network from the side, plugged into a switch mirror port, and turns everything it sees into a live picture of your traffic without ever sitting in the forwarding path. A single binary loads its eBPF collectors in the kernel, so aggregation happens before packets reach user space and multi-gigabit mirror feeds stay observable instead of dropping samples. The dashboard opens on totals, protocol share, and traffic trends, then lets you drill into flows by address, port, domain, or service, check which countries your traffic talks to on a world map, and read the internal topology as a live graph. Domains surface passively from TLS handshakes, public addresses are enriched with country and organization data, and heuristic detectors flag scanning, flooding, and single-host surges, pushing alerts to your team chat with an optional AI-written explanation. You can ask the built-in assistant questions about real recorded history, connect external MCP servers so it can call your own tools while it answers, and stream flows onward to Kafka for other consumers. History rolls into compressed columnar files on a schedule and stays queryable for a month by default. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

QuickDrop functions as an ephemeral, self-hosted file distribution node and pastebin that eliminates account requirements for rapid data transfers. Users can drag individual files, paste plain text code snippets, or drop entire folder structures while preserving complete directory hierarchies through automated client manifests. Resumable chunked transfers split multi-gigabyte payloads into resilient blocks, ensuring dependable uploads over unstable network connections. Senders can protect sensitive documents with optional AES encryption at rest, individual passphrase requirements, and automatic metadata stripping that removes GPS coordinates and camera EXIF markers. Granular share token policies restrict access by enforce maximum download quotas, burn-after-reading limits, or strict calendar expiration timestamps. In-browser viewers generate instant previews for code syntax, Markdown documentation, PDF reports, audio tracks, and high-resolution images without downloading files locally. Built-in QR code generators allow mobile devices to retrieve shared payloads instantly across local wireless networks. System operators can govern storage lifecycles through an administrative control panel with configurable retention windows, automated background garbage collection, and custom storage caps. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

PRISM consolidates passive reconnaissance, credential leak detection, and network asset mapping into a unified operational dashboard to replace fragmented command-line security tools. Analysts can launch simultaneous multi-source investigations against domains, internet protocol addresses, email mailboxes, phone numbers, and online handles to uncover domain registrations, open network ports, cryptographic certificates, and historical web archives. The platform interrogates threat feeds and leak repositories to expose credential leaks, dark web mirrors, and email routing anomalies with automated SMTP mailbox verification. Cross-platform identity engines crawl thousands of social networks and public registries to correlate aliases, discover leaked commit identities, and trace digital footprints across the web. Discovered assets render into interactive entity relationship graphs alongside geographic internet protocol maps to help investigators visualize infrastructure clusters and ownership links. An automated operational security calculator evaluates exposure vulnerabilities across identity, web, and infrastructure vectors, producing an aggregated risk score with granular hardening recommendations. Scheduled watchlists continually monitor target infrastructure, dispatching webhook notifications to chat channels whenever new subdomains, ports, or credential leaks appear. Investigators can export comprehensive audit dossiers as self-contained HTML files, styled PDF documents, or structured spreadsheets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Upload a file, get a unique download link and a separate delete link - Jirafeau has done exactly this one thing since 2008. It is plain PHP with no database, no mail server, no JavaScript framework, and no external dependencies - files and metadata live on the filesystem, which is why it runs on nearly anything and why it has outlasted most of its imitators. Uploads use the HTML5 file API, so PHP's post_max_size ceiling does not constrain file size, with live progress showing speed, percentage, and time remaining. Every upload takes options: expiration from one minute to a year to unlimited, self-destruct after first download, and password protection with configurable policy - passwords can be optional, required, or server-generated with complexity rules. Server-side encryption (modern builds use XChaCha20-Poly1305) stores files encrypted at rest with the decrypt key embedded only in the download URL, never on the server, so a compromised host cannot read the contents. Unencrypted deployments get file-level deduplication - identical files stored once with multiple links. Upload access can be gated by password lists or IP allowlists, a small admin panel manages stored files, and a CLI cleanup script handles expired files via cron. Recipients can preview supported files in-browser.

A node beside each AI agent gives your fleet a private network where agents publish tools and models, discover what other nodes offer, and call those services under policy you control. Nothing is reachable by default, because a node exposes no service until its configuration says so, and no node may call a service your mesh policy has not granted. Identity comes from your own identity provider, since a node enrolls with an OpenID Connect or bootstrap token and receives a short-lived credential bound to its own key that peers can verify offline. Nodes connect directly when they can and relay through well-known routers when NAT or firewalls say no, so the same mesh stretches across laptops, containers, clusters, and phones. The node beside your agent exposes the mesh as a local MCP server and an OpenAI-compatible endpoint, so model requests route to whichever node serves that model. The control plane verifies who is joining, issues the credentials, and holds the grants, which are evaluated on service names rather than network addresses. For small deployments, a single binary bundles the control plane, a router, and a web console, so a private mesh for your agents runs on one modest host. A shared developer testnet lets you rehearse the whole enrollment and calling flow in minutes before standing up infrastructure of your own. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

When an agent breaks production at 3 a.m., "the model did it" is no incident report: Bernstein decides in advance what your AI agents may touch, then keeps receipts proving what they did. You write policy as code: which roles may do what, what needs human approval, and what must be recorded before a task counts as done. A deterministic scheduler with no model in the coordination loop turns each goal into parallel tasks, so replaying yesterday's plan reproduces yesterday's task graph exactly. Every coding task runs in its own git worktree behind merge gates; nothing lands on your main branch until tests, lint, and type checks pass. It drives the CLI agents you already use (Claude Code, Codex, Gemini CLI, Aider, Goose, dozens more), mixing cheap local models with heavy cloud ones in one run. Approvals can demand a hardware key touch, and role fences hold whatever an agent tries inside its task. The journal, lineage record, and optional tamper-evident audit chain capture every step, sealed into an Ed25519-signed receipt verifiable offline from the file alone. Non-code work gets the same treatment: an artifact contract names the deliverable (report, dataset, audit evidence pack), and the task completes on a signed receipt instead of a commit. You supervise from the browser dashboard or terminal UI, watching tasks, agents, approvals, and costs live. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Qeli is a self-hosted VPN built for networks where ordinary VPN protocols get recognized and blocked, disguising its traffic as ordinary web traffic while keeping the classic full-tunnel experience. Where WireGuard, OpenVPN, and IKEv2 carry fingerprints that deep packet inspection has learned to spot, Qeli answers with five wire modes: plain, TLS mimicry, ChaCha20 obfuscation behind WebSocket fronting, REALITY, and a flagship mode that carries the private stream inside a genuine HTTP/2 request within a real TLS 1.3 exchange. A probe without a valid token never learns the difference, because the server bridges it to the configured public target site. The handshake is hybrid post-quantum, X25519 plus ML-KEM-768, with a ChaCha20-Poly1305 data plane, and the tunnel itself behaves like the VPNs people already know: full-tunnel or split routing, OS-level DNS, and per-app include or exclude rules on Windows, macOS, and Android. A one-command installer on a clean Debian or Ubuntu server asks for a profile and a port, writes the NAT configuration, creates the first users, and prints ready-to-paste connection links. The web panel then issues qeli:// links and QR codes per person behind an Argon2id login, so onboarding a phone is a camera scan instead of a config file. Clients cover Linux, Windows, macOS, Android, and Keenetic and OpenWrt routers, and published lab benchmarks average around 1220 Mbit/s across all twelve profiles. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

One dashboard for every WordPress site you look after: that is WPMgr, a self-hosted control panel that replaces dozens of separate wp-admin tabs with a fleet view you own. Enroll a site by URL, paste a one-time code into its agent plugin, and the connection flips live on its own. From there the daily grind changes shape. Backups stream straight out of PHP with no mysqldump and no shell access, chunked and deduplicated, scheduled per site, and restorable as a whole site or just the database. Updates stop being a weekend ritual: preview the run dry, apply it across the fleet, and let the automatic snapshot and health check roll back a bad release before a client notices. Uptime probes split DNS, TLS, and time-to-first-byte, flag certificates about to expire, and open exactly one incident per outage instead of a storm of alerts. The Sites grid leads with a fresh screenshot of every homepage, so the dead site is visible before the client calls. Core files get diffed against official WordPress.org checksums, brute-force logins meet escalating lockouts, and an IP firewall fires before other plugins load. Page caching, Redis object cache, image optimization, and per-site email fill the remaining gaps, and every command between dashboard and agent is signed so nothing can be forged in transit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Anubis is a self-hosted web firewall that stands in front of your website and makes suspicious visitors complete a lightweight challenge before their requests are allowed through. Place it between your load balancer or TLS terminator and the application it protects, with one instance guarding each service. Requests that look like scraper bots are weighed and challenged, which raises the cost of mass crawling so automated harvesting stops being free. Requests that pass are forwarded straight to your target service over TCP or a Unix domain socket, so legitimate visitors reach the real site. You define the bot policy: allowlist known good bots and crawlers you want to keep, challenge the ones you are unsure about, and turn away the rest. Challenge difficulty and weight thresholds tune how hard visitors must work, letting you balance protection against friction for real readers. The server listens on port 8923 by default and exposes Prometheus metrics on port 9090, so request and challenge rates show up in your existing monitoring. Deployment is a single Docker image or native package with minimal resource needs, and configuration arrives through environment variables plus the policy file. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Hand-editing nginx configuration files to run a firewall is nobody's idea of a good afternoon, and Nginx-Love turns that chore into a dashboard. You manage domains, load balancing upstreams, and HTTPS backends through forms instead of config syntax, and the platform writes and reloads the underlying configuration for you. A ModSecurity firewall with the OWASP Core Rule Set inspects traffic to your sites, and you tune its rules from the interface rather than a text editor. Certificates arrive two ways: automated through Let's Encrypt, or uploaded manually when you bring your own. A Bot Manager fingerprints visitors with JA4 signals so you can welcome good crawlers, challenge suspicious automation, and block hostile bots by policy. Access lists filter by IP address, geography, and user agent, and multi-user roles let administrators, moderators, and viewers each see the controls appropriate to their job. Monitoring watches performance and attack patterns, sending alerts by email or Telegram when something needs attention. Configuration exports back up your setup, restores bring it back, and multi-node sync keeps a cluster of servers enforcing the same policy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Most proxies ask the operating system nicely for a socket; paqet skips the conversation, building its own TCP packets byte by byte to tunnel traffic between your machine and your server. The server end listens on a port you choose and speaks only in raw packets it crafts and captures itself through pcap, before the kernel's connection tracking ever sees them. On your machine, the client presents an ordinary SOCKS5 proxy on localhost plus optional port forwards, so browsers and command-line tools connect exactly as they would to any proxy. Between the two ends, KCP with smux multiplexing turns a stream of self-contained packets into fast, reliable, encrypted sessions, with AES or lighter modes selected per deployment. TCP flag cycling varies how packets present themselves on the wire, giving operators control over the traffic pattern the tunnel produces. Built-in utilities generate the shared secret, ping the server with a single test packet, and dump live traffic decoded, so a silent tunnel gets diagnosed in minutes rather than by packet-capture archaeology. One YAML file per side declares the role, network interface, gateway MAC, and keys, and the same binary runs both ends. It suits security research, hostile networks, and anyone whose ordinary proxies keep getting reset. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.