Enterprise security stacks assume an enterprise budget; Wildbox assumes a server you already own. It runs your whole security operation as a set of cooperating services behind a single HTTPS gateway: threat intelligence collectors pull indicators from seven public feeds on a schedule, starting with abuse.ch's Feodo Tracker, and every indicator is searchable in one place. Fifty-two security tools sit behind one API, covering DNS, TLS, email security, headers, and port analysis. The cloud posture service runs 22 configuration checks against your live AWS accounts and keeps each scan's report, while the vulnerability service inventories your assets, prioritizes findings by risk, and tracks them through remediation with SLA checks and alert rules. When something needs doing, YAML playbooks execute response workflows as background jobs, and the agents service writes Claude-generated threat-enrichment reports for suspicious indicators when you give it an API key. An osquery-based sensor streams endpoint telemetry from your hosts into the platform, kept separate per team. Users, teams, roles, and scoped API keys live in the identity service, and the backends accept nothing that did not arrive through the gateway, so your security data never leaves hardware you control. Optional Compose profiles add n8n automation and Prometheus monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Usulnet packs container management, Trivy security scanning, Nginx reverse proxy, scheduled backups, WireGuard VPN, firewall rules, and multi-node orchestration into a single 70MB Go binary with zero external runtime dependencies. Every module ships in one download with no paid tiers, no telemetry, and no edition gating. Container lifecycle management covers creation, start, stop, restart, pause, kill, and removal with bulk operations, real-time resource statistics, filesystem browsing, and settings editing. Trivy integration scans images and running containers for CVEs with severity scoring, generates SBOMs, and validates CIS benchmarks. The multi-node architecture supports standalone, master, or agent modes where agents connect over NATS JetStream with mTLS encryption, enabling remote Docker host management from a central dashboard. Reverse proxy configuration handles Nginx with automatic Let's Encrypt certificates, TCP/UDP stream proxying, access lists, and dead host detection. Backup operations capture container volumes and Compose stacks on configurable schedules with retention policies and full restore capabilities. A built-in application catalog provides 60+ one-click templates for common services. JWT license validation uses an RSA-4096 public key embedded in the binary, requiring no call-home and working entirely offline. For teams tired of maintaining separate tools for each infrastructure concern, Usulnet collapses the entire stack into a single point of management with Docker Compose deployment alongside PostgreSQL, Redis, and NATS.

Papyra gives you a calm, private home for notes that stays as easy as sticky notes while quietly linking everything together like a wiki. Cards pin, colour, and drag into place on your desk, and opening one drops you into an editor where slash commands insert headings, checklists, tables, or maps without leaving the keyboard. Type two brackets to link another note, and backlinks gather the other direction automatically, following the note even if you rename it. Notes save themselves, and every earlier version is kept, so you can scrub back through history and restore the draft you actually wanted. Sharing a note lets several people type in it together with visible cursors, comments in threads, and mentions that bring the right person in. Private notes lock behind a PIN or your fingerprint and sit encrypted on disk, while a daily journal page collects the day with a mood and a calendar to browse the year. Search covers notes, to-dos, and attachments with highlighted matches, and image text and audio transcripts can join the index. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Your team chat can be one executable on your own server: Campfire Rust runs rooms, direct messages, attachments, and search as a single binary that replaces the whole Ruby, Puma, Redis, Resque, and Thruster stack. Create rooms with access controls for projects, departments, or a private board discussion, and keep direct messages beside them for quick questions. File attachments arrive with previews, mentions pull the right person into a thread, and search finds the decision someone made months ago. Web Push notifications reach browsers and phones, so a quiet room still finds its people when it matters. Chatbots connect through a simple HTTP API for sending and receiving messages and attachments, which makes Campfire a home for build alerts, deploy notices, and support pings. Existing Campfire installs upgrade in place because the Rust binary reads the same SQLite database, storage layout, and signed cookies, with no data migration and no mass sign-out. Automatic TLS with Let's Encrypt certificates, HTTP/2, and Action Cable-compatible WebSockets are built in, and the whole system works on air-gapped networks that never touch the internet. Run it as your primary chat, as a backup for the day a hosted service goes down, or as a walled garden for executives and events. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Spreadsheets and sticky notes stop scaling the day your network grows past a rack or two, so JT-IPAM keeps every address, subnet, and device in one searchable system of record. Track subnets and individual IPs with their hostnames, MAC addresses, and owners, then reconcile what you documented against what scan agents actually find through ICMP, ARP, reverse DNS, and SNMP collection from routers and switches. Connect the DNS servers you already run, from PowerDNS and BIND 9 to Windows DNS and Technitium, and flag records that have no matching address in IPAM. Pull devices and virtual machines in from LibreNMS, Zabbix, Proxmox VE, ESXi, Hyper-V, and OpenStack so monitoring and address records stop drifting apart. Draw floor plans and rack elevations, trace a cable across multiple hops, and open an SSH terminal, SFTP browser, or RDP desktop to a device straight from its address page. Route new address requests through configurable multi-stage approval workflows, distribute certificates to web servers and firewalls from central encrypted storage, and keep a full audit trail of every change and console session. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Excaliself turns the Excalidraw canvas into your team's own whiteboard server, where every sketch, diagram, and flowchart lives in your database instead of a vendor's cloud. The home screen works like a file cabinet for drawings: nest them in folders, star the keepers, drag files between spaces, and find anything again by title or by the text inside the drawing. Share a link and teammates edit together in real time with live cursors and follow mode; links can stay members-only or open to guests who have no account at all. A shared Team space sits next to everyone's private space, and one team library holds the shapes and icons the whole group reuses. AI clients can join with a personal access token: Claude Code or Claude Desktop can search your drawings, read what a diagram says, and create new ones from shapes or a Mermaid flowchart. Accounts are invite-only, single sign-on covers Google, Microsoft, and any OIDC provider, and admins manage members, roles, and password resets from Settings. Deleted drawings rest in a trash folder for thirty days before they are purged, and everything auto-saves as you draw. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Analytics teams, and increasingly the AI agents working beside them, get one shared definition of the business from Malloy Publisher instead of a pile of SQL queries that each compute revenue slightly differently. You model what your data means once: the sources, the joins, the measures, and who may see what. Agents then compose queries against that model over MCP, so there is no wrong join, no invented column, and no fan-out that double-counts while looking plausible, and the same question returns the same numbers tomorrow. Applications and BI tools reach the same model over REST, and unattended agents use the same governed path instead of scraping raw tables. Reports declared in Malloy read top to bottom or lay out as tile grids you can build by dragging, no-build HTML data apps ship inside the package, and the built-in Console lets anyone browse environments, packages, models, and results without writing code. Access rules decide who may query and which rows they see, discovery curation decides what is even visible, and a single annotation materializes an expensive source or pre-aggregates it on a schedule. Local files work through built-in DuckDB, while BigQuery, Snowflake, Postgres, Databricks, and others connect when the data already lives there. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

WhatsApp is where your customers already are, and Waxum is the self-hosted gateway that lets your own software talk to them there without renting a per-message platform. One REST API fronts two providers at once: multi-device sessions paired by QR code or pairing code, and Meta's official Cloud API, sharing the same message routes and webhook events. Send text, media, locations, contact cards, polls, reactions, and broadcast lists, schedule messages for later, or run paced bulk blasts with deduplication, retries, and a dead-letter queue when a send fails. Voice and video calls ring, play audio, speak text in hundreds of voices, record the peer side, and stream media over WebSocket, while groups, contacts, blocking, privacy settings, and presence are all manageable per session. Signed webhooks with event filters and circuit breakers push receipts and replies into your app, and a failed delivery can be replayed from the queue instead of lost. The built-in ops console shows your whole session fleet, and each session opens a playground covering dozens of endpoints, so you can test a send from the browser before writing code. Sessions export and import between instances as zip files, and Prometheus metrics with health probes keep the fleet observable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Somewhere in your house, a presenter is introducing the next record, and that presenter is a language model running on your own server. Deadair builds you a real radio station rather than another playlist: it picks records from your Navidrome, Jellyfin, Emby, or Plex library, or from Spotify, YouTube Music, Pandora, and Apple Music, writes what the host says between songs, speaks it in that host's own voice, and broadcasts the result as one shared live stream over Icecast, with no skip button and the same show for every listener. From the console you steer it in plain sentences: tell it "rap like Snoop Dogg" and the next hours programme themselves to that brief, or ask why the record on air was chosen and get an answer. The forward lineup runs several hours deep, visible and editable, and nothing reaches air until its audio is already on the machine, so the stream never stutters waiting on a download. Words and voice are separate choices, swapped live in Settings: break-writing can run on a hosted model while a local Kokoro or Chatterbox voice reads it, and a station with no model at all still talks. Twenty-seven bundled plugins cover music sources, metadata, news, weather, and speech, and third-party plugins install from the console. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

OmniSight ends the homelab ritual of a dozen admin panels open in a dozen tabs, each with its own login and its own idea of what healthy looks like. It folds all of them into one page that answers the only question you actually have: is everything fine? Watch Proxmox nodes with their VMs, containers, backup status, and Ceph health next to VMware hosts and datastores, Linux and Windows servers, and Kubernetes pods with live log viewing. Add Docker hosts and see container status, ports, resource use, and image updates, check OPNsense firewalls, TrueNAS and QNAP storage, and PostgreSQL, MySQL, and MongoDB databases without leaving the dashboard. A small push agent installs with one copied command and self-registers within seconds, needing no inbound firewall rules, so machines behind NAT report in on their own. Follow relationships on the topology map, restart a service from the detail view, export a full backup, and publish a read-only public status page for anyone who asks how things are running. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

The social preview cards shown when links hit Twitter, LinkedIn, Slack, or Discord, generated on the fly: Oxigen is a small Go service for dynamic Open Graph images, no designer required per page. Instead of exporting static images per page, you compose a card once and drive it with parameters: title, author, website, logo, background image, and background dimming all arrive as URL query arguments, so your og:image meta tag simply points at the Oxigen endpoint with the page's own values substituted in. Every blog post, product page, and doc gets a branded, correctly sized preview generated on the fly. A built-in web UI covers interactive composition - tweak the text and imagery, watch the preview update, copy the resulting URL - while the same rendering path serves programmatic API use from static site generators, CMS templates, or build pipelines. Rendering is pure Go using the gg 2D graphics library, freetype fonts, and the imaging package, built on the kyoto framework by that project's author. Deployment is one stateless container on port 80 with no database and no external dependencies, so instances scale and restart freely.

Aizen is a coding agent that actually lives on your server: one small binary you can message from your phone, which fixes code, runs the tests, and reports back before you are anywhere near a keyboard. Leave it running on the box and drive it from Telegram or Discord, approving risky edits with a tap while it works behind NAT with no inbound port to expose. In the terminal it is a single chat and agent loop with a live heads-up display of model, tokens, and context, reading files in parallel, editing symbolically through the language server, and running your shell under an approval layer with a hard floor that refuses catastrophic commands even on auto-approve. It does not get to claim done early: a verify gate runs your typecheck and test suite and sends it back to fix what it broke, git-backed checkpoints let you rewind a bad turn, and seven capability-scoped sub-agents can fan out across finding, planning, building, reviewing, testing, research, and recall when a job wants a team. Point it at any OpenAI-compatible endpoint, from hosted models to your own local server, extend it with MCP servers and slash-command macros, and let the sandbox keep every child process away from your API keys with the network denied by default. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Platypus gives a whole team always-on AI agents that reason, call tools, and keep working on your own servers while everyone is offline. Build an agent once by choosing a provider and model, writing its instructions, and capping its tool-calling loop, then reuse that preset across chats and scheduled runs. Agents load reusable Skills on demand and delegate specialist work to sub-agents that appear to the parent as tools. Connect local and remote data through Model Context Protocol servers, or expose an agent to outside agents and chat platforms through A2A endpoints with a token per client. Triggers run agents on a cron schedule, as one-off jobs, or when workspace events such as a card moving on a board occur, and every run records its result. Kanban boards give agents work they can move and update themselves, while notifications and HMAC-signed webhooks push board and workspace events into your own systems with filtering and retries. Facts and preferences are extracted from conversations in the background and injected into future chats, so returning users are remembered. Sandbox backends give agents shell and filesystem access inside an isolated per-workspace environment instead of the host. Organizations and workspaces keep each team's agents and data separate, and blueprints package shared agents, skills, MCP servers, and providers so a new workspace starts pre-equipped. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

NarraLume is a writing studio for long novels where the AI proposes and you dispose, so a book stays yours across tens of thousands of words. Everything lives around the story bible: your stated intent, outline, entities, confirmed facts, relationships, chronology, and foreshadowing, kept as the single source of truth that planning, drafting, and review all read from. You can write chapters by hand in the studio, save versions and comments, ask for a selection edit, or delegate a chapter, a run of chapters, or a whole quick-creation plan to a model; whatever comes back arrives as a candidate with diffs, never as silent edits to your manuscript or canon. Review findings come with evidence you can accept, reject, or mark as false positives, and when generated prose collides with a locked fact the task stops and waits for your ruling instead of improvising around it. The run center keeps every AI job's steps, model calls, and checkpoints recoverable, the long-form lab searches story memory and previews plot impact without touching the book, and delivery ends with quality checks, exports, snapshots, and full-library backups. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Capture a thought before it evaporates: Crumbs is a self-hosted, privacy-first alternative to Google Keep for notes you would rather keep on your own server. You write rich notes with Markdown, checklists, and image attachments, then give each one a personality from twelve color themes. Hashtags organize everything without folders, pinning keeps the important notes on top, and archive and trash clear the rest out of sight. Full-text search reaches across titles, content, and tags, so last month's idea is one query away. Every note keeps a version history you can browse and restore, which turns accidental deletions and bad edits into non-events. Notes can be shared with other users on your instance, with optional email notifications over SMTP for share alerts and account events. The installable PWA works offline through IndexedDB with last-write-wins CRDT sync, so a note captured on a plane reconciles when you land. Accounts are protected with Argon2 password hashing, and Google, GitHub, or any OIDC provider can handle sign-in instead. A built-in MCP server even lets AI assistants manage your notes on your behalf. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Give your team one console to build agents, ground them in real data, and reach them through email, Telegram, Slack, and WhatsApp: Huf is a self-hosted multi-agent AI platform running on servers you operate. Create agents visually, assign each one a provider and model, and watch runs, last activity, and status from a grid that shows every agent at a glance; the same console manages prompts, skills, flows, data tables, and knowledge sources. Connect agents to Gmail and email, Telegram, Slack, WhatsApp, and custom HTTP webhooks, and inbound messages trigger runs whose replies route back to the original channel automatically. Agents read, create, update, and delete any Frappe document, work ERPNext data, and call external systems through Model Context Protocol servers with managed OAuth credentials. Code-heavy tasks run in hardened execution profiles: a local Python environment, an isolated venv, direct SSH, a Frappe SSH connection, or a Docker container, each gated by role-based permissions for agents, tools, data tables, and MCP servers. Teams package prompt templates, tools, and MCP configurations into shareable skills and Huf Apps, run models from cloud providers, or keep everything local with Ollama, LM Studio, or any OpenAI-compatible endpoint. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Proval is a self-hosted AI code review agent that reads every pull request on your GitLab, Forgejo, or GitHub server and posts a consolidated, severity-grouped review with inline comments, using a model you run yourself. When a pull request gets a meaningful push, a planning agent groups changed files into review units and dispatches specialist sub-agents in parallel, each exploring the codebase so cross-file issues surface. A writing agent merges their findings into one review, with comments on the affected lines, including multi-line ranges. Reply to any Proval comment and it reads the thread context and answers, and it works on issues too, greeting new ones and answering follow-ups on every message or only when mentioned. Choose per repository whether reviews run on first push only, every push, or not at all, skipping drafts until they are marked ready. Every review, reply, and issue comment is logged with its token usage, so each model's cost shows in the dashboard instead of hiding in an API bill. Your code is never stored; review context goes only to the LLM endpoint you configure, whether that is a cloud API or a local Ollama or llama.cpp server on your own network. Connect GitLab or Forgejo with an access token and webhooks, or GitHub through a GitHub App; Gitea and Codeberg use the same Forgejo-compatible path. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your coding agents work in separate terminals and cannot ask each other anything; Imbo gives Claude Code, Codex, opencode, Cursor CLI, and six other agent tools one shared messaging network, so a session can send a question to another session and get an answer while both keep working. Messages land inside the receiving session mid-task, and a reply wakes an idle session so it can act on the answer. You add people by account ID, and their agents can message yours; group chats let several sessions from several people coordinate on one brief, with every reply reaching every member. Sessions can send files that land in the receiving machine's ~/.imbo/files folder, and an agent asks you first before sending your data out, deleting files, spending money, or touching production. From the web app or the iPhone app you can message your own sessions from anywhere, and a closed Claude Code session reopens in the background to pick the message up. The server is a single binary with a bundled PostgreSQL, HTTPS through Let's Encrypt, email code sign-in, and optional domain restrictions on who may register. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.