With nearly 30,000 GitHub stars and deployment across organizations including Criteo, Pandora, and Barclays, HashiCorp Consul is the industry-standard platform for service discovery, service mesh, and distributed configuration across dynamic multi-cloud and multi-datacenter infrastructure. Services register themselves and become discoverable via a built-in DNS interface on port 8600 or an HTTP API on port 8500, with health checks ensuring only healthy instances receive traffic through automatic catalog deregistration and service-level circuit breaking. The service mesh capabilities use Envoy sidecar proxies with Transparent Proxy mode to establish automatic mTLS encryption for all service-to-service communication, while identity-based intentions define fine-grained authorization rules controlling which services can communicate. The integrated API Gateway manages north-south traffic into the mesh with configurable routing rules, TLS termination, and header-based matching policies. Consul's distributed key-value store provides hierarchical configuration storage accessible via CLI, HTTP API, and the built-in web UI, with blocking queries enabling watch-based configuration updates without polling. Multi-datacenter federation connects Consul clusters across regions through WAN gossip and RPC forwarding, enabling cross-datacenter service discovery and failover with configurable prepared queries. The Raft consensus protocol provides strong consistency for the service catalog and KV store, with anti-entropy mechanisms ensuring agent state converges with the server catalog. Consul integrates natively with Kubernetes via Helm charts with automatic sidecar injection, Nomad for workload orchestration, Vault for secrets management, and Terraform for infrastructure provisioning. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BUSL 1.1 licensed.

Backed by nearly 30,000 GitHub stars and powering millions of meetings through meet.jit.si, Jitsi Meet is the open-source video conferencing platform that runs entirely in the browser with no plugins or downloads required. The WebRTC-based architecture delivers HD audio and video through the Jitsi Videobridge selective forwarding unit, while Prosody handles XMPP signaling and Jicofo manages conference focus and orechestration. End-to-end encryption uses AES-GCM 128-bit keys exchanged via the Olm protocol, protecting audio, video, and screen sharing through the Insertable Streams API in Chromium-based browsers. Moderators can split participants into breakout rooms with individual password protection, enable lobby waiting rooms for admission control, set meeting passwords, and track speaker statistics with per-participant talk time metrics. Virtual backgrounds leverage TensorFlow.js body segmentation with WebGPU and WebGL acceleration, automatically adapting quality through device tier detection. Server-side recording and YouTube live streaming run through Jibri, while Jigasi provides a SIP gateway for PSTN dial-in and speech-to-text transcription. The platform includes in-meeting chat with private conversations, polls, raise-hand functionality, emoji reactions, and tile and speaker view layouts. Mobile applications for iOS and Android complement the web client, and both web and native SDKs enable embedding video conferences into custom applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

An 8MB Go binary that boots in under one second, uses less than 10MB of RAM, yet delivers full AI agent capabilities across 16+ chat platforms simultaneously. PicoClaw connects to Telegram, Discord, Matrix, IRC, Slack, WeCom, DingTalk, WeChat, LINE, and QQ while supporting LLM providers spanning OpenAI, Anthropic, Gemini, DeepSeek, AWS Bedrock, Azure, and local models via Ollama. Native Model Context Protocol support enables standardized tool integration, and the built-in smart routing engine directs simple queries to lightweight models to reduce API costs while sending complex tasks to capable models. Tool capabilities include secure shell execution, filesystem access, web search, cron scheduling for recurring tasks, and sub-agent spawning with status tracking. Gateway mode transforms PicoClaw into a full AI backend with REST API endpoints accessible from any client. The Skills system loads hierarchical behavior definitions from SKILL.md files, enabling customizable agent personalities and workflows. Compiles for x86_64, ARM64, ARMv7, RISC-V, MIPS, and LoongArch, making it deployable on hardware as cheap as a $10 Sipeed LicheeRV Nano. Achieved nearly 30,000 stars within six months of its February 2026 release. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

FastGPT lets you build production AI agents and knowledge base chatbots through a visual drag-and-drop workflow editor, connecting any LLM provider to your documents with retrieval-augmented generation that cites sources and reduces hallucination. The workflow canvas chains LLM calls, conditional branching, HTTP requests, code sandbox execution, and plugin nodes into complex conversation flows and agent skill pipelines without writing backend code. The knowledge base engine ingests documents in ten formats (TXT, Markdown, HTML, PDF, DOCX, PPTX, CSV, XLSX, URL scraping, and CSV batch import) then applies automatic chunking, hybrid vector retrieval with semantic reranking, and QA-pair splitting to deliver accurate, citation-backed answers. FastGPT connects to virtually any LLM provider through its AI Proxy aggregation layer: OpenAI GPT-4o, Anthropic Claude, Google Gemini, DeepSeek, Qwen, ERNIE Bot, and models hosted via Ollama all work through a unified OpenAI-compatible API. Bidirectional MCP support enables agents to call external tools and expose their own capabilities to other systems. Completed applications can be shared via login-free links, embedded as iframe widgets, or integrated with WeCom, Lark, DingTalk, and WeChat Official Accounts through the published REST API. Application operation logs, conversation annotation, and per-model usage analytics provide full lifecycle governance for compliance-sensitive deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. FastGPT Open Source License (Apache 2.0 based) licensed.

Sim Studio lets teams build, deploy, and monitor AI agent workflows by dragging blocks onto a visual canvas and wiring them into executable pipelines, backed by over 1,000 integrations. The React Flow editor represents each step as a node: LLM calls, tool invocations, conditional branches, and data transformations form directed acyclic graphs that run as complete agent pipelines. Every major LLM provider works natively, including OpenAI, Anthropic, Google Gemini, Groq, and Cerebras, plus local models through Ollama and vLLM. Integrations span Gmail, Slack, Microsoft Teams, Telegram, WhatsApp, Notion, Google Workspace, Airtable, GitHub, Jira, Linear, Perplexity, Firecrawl, PostgreSQL, Supabase, Pinecone, and Qdrant. Built-in tables provide a database layer, a file store offers shared team storage, and knowledge bases powered by PostgreSQL with pgvector enable retrieval-augmented generation. Finished workflows deploy as REST API endpoints, scheduled jobs, or Slack bots, with block-by-block execution traces for full observability. Real-time collaborative editing via Socket.io supports simultaneous multi-user construction. Alternatively, describe agent behavior in natural language and Sim assembles the workflow automatically. Built on Next.js App Router, Bun runtime, Drizzle ORM, and Tailwind CSS. 29,400+ GitHub stars and 100,000+ builders. Apache-2.0 licensed.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

Previously known as Hoarder and now holding 28,000+ GitHub stars, Karakeep is the most popular open-source bookmark-everything application — combining AI-powered automatic tagging with full-text search, page archival, and cross-platform access for digital content hoarders who refuse to let valuable links disappear. The Next.js frontend with tRPC communication delivers a responsive interface for saving links, notes, images, and PDFs, while Puppeteer crawls bookmarked pages to fetch titles, descriptions, and images automatically. LLM-based auto-tagging supports OpenAI, Anthropic, or local models via Ollama for privacy-first deployments that never send data to external services. Meilisearch powers full-text and semantic search across all stored content including OCR-extracted text from images. A rule-based automation engine triggers custom actions based on bookmark properties — automatically sorting, tagging, or archiving content matching defined conditions. Full page archival via Monolith preserves complete page snapshots against link rot, while yt-dlp integration archives videos from YouTube and other platforms. RSS feed ingestion automatically captures new articles from subscribed sources. Collaborative lists enable teams to build shared bookmark collections, with per-list permissions and real-time sync. Native iOS and Android apps, Chrome and Firefox extensions, and browser bookmark sync via Floccus ensure capture from any device. Importers migrate data from Chrome, Pocket, Linkwarden, Omnivore, and Tab Session Manager. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Hoarder (now Karakeep) is a bookmark manager that actually fights link rot: every page you save gets archived at capture time using Monolith, so the content survives even when the original URL dies. Beyond archival, an AI layer powered by OpenAI or local Ollama models auto-tags everything by analyzing page content. Prefer full privacy? Ollama keeps all inference on your server with zero external API calls. Full-text search through Meilisearch indexes the actual scraped content of every bookmark, not just titles and tags, so you find articles by what they say rather than labels you half-remember. Save links with automatic metadata extraction, plain text notes, uploaded images, and PDF documents, all organized into shareable lists with collaborative access. Browser extensions for Chrome and Firefox make saving a one-click operation from any page. Migrating is painless with importers for Chrome, Pocket, Linkwarden, Omnivore, and Tab Session Manager. LLM summarization condenses saved pages into brief overviews for quick scanning. The AI layer is entirely optional: Hoarder works perfectly as a manual bookmark manager, with intelligence adding convenience rather than imposing a requirement. SSO integration and responsive dark mode round out the package.

With over 27,000 GitHub stars and an ecosystem of 1,900+ plugins covering every major cloud provider, database, and SaaS platform, Kestra is the orchestration engine that brings Infrastructure as Code principles to workflow automation — defining complex multi-step pipelines in readable YAML that execute across any language, runtime, or infrastructure boundary. The built-in VS Code-style editor provides syntax highlighting, auto-completion, real-time validation, and an AI Copilot that generates workflow YAML from natural language descriptions. Tasks execute in Python, Node.js, Go, R, Shell, SQL, or any Docker container, with event-driven triggers listening for file arrivals on SFTP and cloud storage, messages from Kafka, Redis, Pulsar, AMQP, MQTT, NATS, AWS SQS, Google Pub/Sub, and Azure Event Hubs in real time. The topology view visualizes workflow DAGs with execution state, duration, and output artifacts for each task node. Namespaces organize workflows into isolated environments with configurable secrets, while subflows enable modular composition with inputs, outputs, and conditional branching. Retry policies, timeouts, error handlers, and automatic backfills for missed schedules ensure reliability across production workloads. Git integration pushes workflows directly to branches from the UI with CI/CD pipeline support for automated deployment. The REST API enables programmatic workflow management, execution triggering, and resource provisioning. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

The first container registry to reach CNCF graduated status with over 29,000 GitHub stars since VMware open-sourced it in 2016, Harbor transforms the basic Docker Distribution into a hardened enterprise registry with vulnerability scanning, supply chain signing, multi-datacenter replication, and project-level access control out of the box. Trivy scans every pushed image against the NVD, GitHub Advisory Database, and distribution-specific vulnerability feeds, with scan-on-push policies that block deployment of images exceeding configurable severity thresholds. Artifact signing through Cosign keyless signatures and Notation enforces content trust policies ensuring only cryptographically verified images reach production clusters. Policy-based replication synchronizes images and Helm charts between Harbor instances across multiple datacenters using repository, tag, and label filters with automatic retry and bandwidth throttling — enabling hybrid-cloud and disaster-recovery topologies. The RBAC model isolates projects with per-project quotas, robot accounts for CI/CD automation, webhook notifications, and audit logging that tracks every pull, push, delete, and configuration change. LDAP, Active Directory, and OIDC authentication integrate with existing identity providers, while the proxy cache transparently caches images from Docker Hub, Quay, and other upstream registries to reduce pull latency and rate-limit exposure. The RESTful API with embedded Swagger UI, tag retention policies, garbage collection scheduling, and immutable artifact rules complete the lifecycle management. Deploy via Docker Compose or Helm Chart on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 29,000 GitHub stars and deep integrations into LangChain, LlamaIndex, and CrewAI, Chroma has become the default vector database for developers building retrieval-augmented generation pipelines and AI agent memory systems. Its core API consists of just four functions — create, add, query, and delete — making it the fastest path from zero to semantic search, while the underlying Rust engine handles tokenization, embedding, HNSW indexing, and similarity scoring automatically. Chroma supports dense vector search via HNSW with configurable distance metrics including L2, cosine similarity, and inner product, sparse vector search using SPLADE, full-text BM25 keyword search, and regex matching, all combinable in hybrid queries through a single unified interface. Metadata filtering at query time uses MongoDB-style operators including $eq, $ne, $gt, $lt, $in, and logical combinators $and and $or, enabling precise result scoping without post-processing. The multimodal pipeline powered by OpenCLIP embeds text and images into a shared vector space, allowing cross-modal retrieval where text queries return relevant images and vice versa. Deployment options range from embedded mode via PersistentClient for notebooks and prototypes, to client-server mode with Docker for production, to Chroma Cloud for serverless scalability. Official Python and JavaScript SDKs provide identical APIs, and embedding function integrations support OpenAI, Cohere, Hugging Face, Google, Ollama, and custom models. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Every unit of income gets a job in Actual Budget - a local-first personal finance app built on envelope (zero-sum) budgeting, where you can only budget cash you actually have, which keeps the plan honest by construction. The data model is a SQLite file that lives on your device and works fully offline; the self-hosted Node.js sync server adds background multi-device synchronization using CRDT-based distributed-systems machinery, browser and mobile access as an installable web app, and automated backups. Optional end-to-end encryption makes the synced data unreadable even to the server hosting it. Transactions enter three ways: manual entry, file import (CSV, QIF, OFX, QFX, CAMT.053), or automatic bank syncing through GoCardless for EU/UK banks and SimpleFIN for US/Canada. Built-in YNAB4 and nYNAB importers migrate complete budget histories, and reports, schedules for recurring transactions, and rule-based transaction cleanup handle the day-to-day. A fully featured local API lets developers script custom importers and automation against their own data. 100% free, open source, and 26k stars strong.

Built as a direct rejection of the adtech model, Plausible is the best-known privacy-first web analytics tool - lightweight, cookie-free, and open-source. It sets no cookies and stores no personal data: unique visitors are counted via a hash of IP plus User-Agent that rotates every 24 hours and is never stored raw, so no consent banner is required and GDPR compliance is structural rather than contractual. The tracking script is under 1 KB - orders of magnitude lighter than GA - and the dashboard is a deliberate contrast to GA4's sprawl: one fast-loading page with visitors, sources, top pages, countries, devices, and UTM breakdowns, filterable by any dimension. Custom events and goals track signups and clicks, Google Search Console integration pulls in search queries, scheduled email reports keep stakeholders updated, and the Stats API (v2) plus CSV export feed data anywhere. This is the AGPL-licensed Community Edition, the same Elixir codebase that powers Plausible's cloud service, running as three containers: the web app, PostgreSQL for accounts, and ClickHouse for event storage - which means self-hosters get direct SQL access to raw analytics data the cloud version never exposes. Traffic data stays entirely on your server, with no visitor caps or per-pageview pricing.

Authelia is the leading open-source SSO and multi-factor authentication server for self-hosted infrastructure. The Go backend compiles to a single binary or Docker container image, serving a TypeScript React web portal that handles first-factor username and password login, second-factor authentication via TOTP, WebAuthn FIDO2 security keys, passwordless passkeys, and Duo mobile push notifications, and an OpenID Connect 1.0 and OAuth 2.0 identity provider with device code flow, JWE encrypted ID tokens, custom claims policies, and network-scoped authorization criteria. The forward authentication model integrates with Nginx auth_request, Traefik ForwardAuth, HAProxy, Caddy, Envoy, SWAG, and Skipper reverse proxies, injecting Remote-User, Remote-Groups, and Remote-Email headers into authorized requests. Granular access control rules match subject, groups, request URI, HTTP method, and network to enforce one-factor and two-factor policies per route. The user backend supports LDAP with attribute mapping, connection pooling, and bind mode, or YAML file-based authentication with Argon2id hashed passwords. Session state stores in Redis for high availability across clustered deployments, while persistent data lives in SQLite, MySQL and MariaDB, or PostgreSQL. Brute force protection locks accounts after configurable failed attempts, and email-based identity verification handles password resets and device registration. Dark, light, and OLED themes with i18n localization customize the portal appearance. On RepoCloud, deploy Authelia on a dedicated VPS with Docker, root SSH access, and complete control over your authentication infrastructure, all under the Apache-2.0 license.

Autonomous red team execution without manual script coordination is what PentaGI delivers through a multi-agent penetration testing platform engineered for automated security assessments. Security engineers configure testing scopes, target IP ranges, domain lists, and rules of engagement through an interactive web console with real-time execution graphs. Autonomous agent personas break down high-level assessment goals into discrete tactical phases, orchestrating network port discovery, service banner fingerprinting, web application crawling, and CVE verification. Specialized agents query integrated Graphiti knowledge graphs and local vulnerability repositories to synthesize attack paths, validate exploitability, and confirm finding veracity before issuing alerts. Operators monitor live agent terminal streams, inspect sandboxed tool executions, and adjust active LLM provider routes across OpenAI, Anthropic, or local Ollama endpoints. The template editor allows red teams to compose reusable testing playbooks with customizable security prompt chains, safety constraints, and automated remediation reporting. Audit logs capture full command histories, raw tool outputs, and LLM reasoning steps to generate compliance-ready technical documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

TencentDB Agent Memory provides a team-level memory hub that transforms AI agent conversations, documents, and codebases into four governed, shareable memory assets: Chat Memory for conversation history, Skills extracted from completed tasks, LLM-Wiki built from document ingestion, and Code-Graph generated from codebase analysis. The four-tier semantic pyramid structures long-term memory from L0 raw conversation capture through L1 episodic extraction and L2 scenario aggregation to L3 persona synthesis, enabling hierarchical drill-down via node and result references instead of flat vector recall. The Node.js Gateway sidecar handles capture, extraction, storage, recall, and pipeline scheduling through RESTful HTTP v2 endpoints on port 8420, while the Memory Proxy intercepts Anthropic-format API calls to inject team memory context into Claude Code, CodeBuddy, and other coding agents transparently. Local SQLite with the sqlite-vec extension provides the default storage backend with hybrid BM25 keyword plus vector embedding plus reciprocal rank fusion retrieval requiring zero external API dependencies. Teams manage ownership, versions, status, visibility, usage counts, and agent bindings through the Memory Hub dashboard with role-based access control separating System Admin and team-level Admin and Member permissions. Official TypeScript and Python SDKs provide programmatic access for custom framework integration beyond the built-in OpenClaw plugin and Hermes Agent adapter. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Backed by Alibaba's AIDC team and carrying over 27,700 GitHub stars, Pixelle-Video turns a single text prompt into a publish-ready short video in approximately three minutes — handling scriptwriting, image generation, voice narration, music selection, subtitle overlay, and final MP4 export in one automated pipeline. The engine supports multiple LLM backends for script generation including GPT-4, Qwen, DeepSeek, and local Ollama deployments, while image and video creation routes through either self-hosted ComfyUI workflows, cloud-based RunningHub pipelines, or direct API connections to DashScope Wan, OpenAI, Seedream, Seedance, and Kling AI. Text-to-speech synthesis uses Edge-TTS, Index-TTS, and other mainstream engines with multi-language voice profiles. Five distinct pipelines cover Quick Create, Standard, Digital Human Avatar broadcasting, Image-to-Video transformation, and Motion Transfer from reference video. The Streamlit web UI on port 8501 provides a visual workflow builder with template selection across portrait (1080x1920), landscape (1920x1080), and square formats, while the FastAPI server on port 8000 exposes a REST API with endpoints for async video generation, task polling, content scripting, TTS and image generation, template listing, and health checks. History persistence tracks all completed generations. HTML-based visual templates support static, image-overlay, and AI-video styles with customizable prompt prefixes. The modular architecture lets operators swap any atomic capability — image model, video model, TTS engine, or VLM — by editing a workflow JSON file without touching Python code. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Team and product documentation on a fast Vue frontend with PostgreSQL storage: Wiki.js is a Node.js wiki engine. Its distinguishing trait is per-page editor choice: authors pick Markdown with live preview, a WYSIWYG visual builder for non-technical writers, or raw HTML, page by page. Native Git synchronization commits every page change to GitHub, GitLab, Bitbucket, Azure DevOps, or any Git remote - bi-directionally, so edits made in the repository flow back into the wiki - giving documentation version-controlled backup for free. Authentication coverage is among the broadest of any self-hosted wiki: local accounts with self-registration, social login via Google, GitHub, Discord, and Slack, and enterprise SSO through LDAP/Active Directory, SAML, CAS, Auth0, Okta, Azure AD, Keycloak, and generic OAuth2/OIDC, with optional MFA. Built-in full-text search runs on PostgreSQL with zero setup, and external engines like Algolia or Solr can substitute. Page history with visual version comparison, granular group-based permissions per path, nested navigation menus, 50+ integration modules, and full localization round it out. AGPLv3-licensed with a 28k-star community.