For teams that need ISO 27001, NIS2, and GDPR evidence without handing compliance data to a SaaS vendor, ISMS Builder is a self-hosted information security management system for policies, risks, assets, audits, and incidents. Compliance managers move policies from draft through review to approved and archived, and recipients confirm each one through a token link that needs no login. Security officers close gaps in a Statement of Applicability that cross-maps BSI IT-Grundschutz, NIS2, EUCS, the EU AI Act, and the Cyber Resilience Act, with ISO 27001 controls imported from their own licensed copy. Risk owners keep treatment plans, turn Greenbone and OpenVAS reports into risk drafts, and score assets for confidentiality, integrity, availability, and authenticity. Data protection officers run records of processing, processor agreements, impact assessments, data subject requests, a 72-hour timer, and a deletion log with email alerts. The CISO inbox collects incidents, including reports from a public form that needs no login, beside a 30-item NIS2 Article 21 checklist and Article 23 deadline alerts. Auditors work from a findings register, a compliance matrix, and an exportable audit log of every create, update, delete, and login. Administrators enforce TOTP two-factor sign-in, choose among German, English, French, and Dutch, run semantic search locally through Ollama, and publish approved policies to Nextcloud or ownCloud as PDFs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your front desk phone rings at midnight and nobody sane is awake; QuickVoice answers it with an AI agent you configured, on servers you own, with call recordings you control. Build agents in the web console: write the prompt, pick speech-to-text, language model, and voice, set the first message, then link a real phone number from Twilio or Telnyx through LiveKit SIP trunks. Inbound callers get a receptionist that answers questions from your uploaded knowledge base, PDFs and web pages chunked and embedded for live retrieval, while outbound mode fires single quick calls or batch campaigns for reminders and follow-ups. Agents can invoke allowlisted MCP tools mid-call, so checking an order status or booking a slot happens inside the conversation instead of after it. Every call lands in the log with transcript, recording, and metadata, searchable from the analytics dashboard, and privacy controls redact personal data by default, can suppress recordings entirely, and sweep old transcripts on a retention schedule. Multi-language voices, per-agent runtime overrides for campaigns, organization accounts with API keys and audit logs, and Stripe billing hooks round out a platform built for teams who would rather inspect their voice stack than rent a black box. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

When cybersecurity instructors and competition organizers host Capture The Flag tournaments, GZCTF orchestrates isolated per-team challenge containers, dynamic anti-cheat flags, and live exponential scoreboards from a single web platform. Event administrators can configure four distinct challenge modes covering static attachments, team-specific dynamic attachments, shared static containers, and isolated dynamic containers where unique flags are injected into each team's environment at launch. A customizable exponential scoring engine adjusts point values automatically as more teams solve a problem while awarding first, second, and third blood bonuses to top contenders. Built-in flag-sharing detection monitors every submission in real time, flagging suspicious cross-team flag reuse alongside live event streams and container logs. Participants can group into divisions, track their ranking trajectory on interactive score timelines, and upload post-game writeups directly into the portal for organizer review and batch archiving. Built-in network proxying forwards challenge traffic over WebSocket tunnels with optional packet capture so referees can audit exploit payloads during active matches. Multi-language localization, customizable branding, invitation gates, and email domain restrictions adapt the portal to university courses, corporate security drills, or international tournaments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

DashBeam sends files and folders of any size straight from one device to another, end to end encrypted, with no cloud account, no size limits, and nothing parked on a third party server in between. Drop in a file and share it through a short code, a link, or a QR scan; whoever receives it needs no account and can collect it in a plain browser tab with nothing installed. On the same network, nearby machines appear on their own, so pairing two devices and sending between them takes a couple of clicks instead of a cable or a memory stick. Pair a device once and it stays reachable by its identity, so your machines can exchange files from anywhere without swapping fresh tickets every time. Interrupted transfers resume where they stopped, and hopping from Wi-Fi to cellular mid-send does not drop the connection. One share can fan out to several receivers at once, and devices you mark as trusted can accept files automatically, which suits pushing builds, media libraries, or backups around a small fleet. You can preview what is arriving before downloading it, and a local history records every completed transfer. The repository also ships Docker Compose stacks for your own relay and discovery server, so even the encrypted fallback path can run entirely on machines you own. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

VoidAccess is a self-hosted dark web OSINT platform that takes a single investigation question and returns a sourced report, a searchable relationship graph, and indicators you can load straight into your defenses. One query fans out in parallel to more than a dozen Tor search engines, code hosts, paste sites, security feeds, and curated onion seeds, then follows newly discovered onion links while mandatory safety gates drop prohibited queries, URLs, and content. A thirteen-step pipeline refines the question, collects across English, Russian, and Chinese sources, filters signal from duplicates and dead ends, enriches what survives, and extracts the entities that matter. It recognizes threat actors, ransomware groups, malware families, IP addresses, domains, onion addresses, file hashes, cryptocurrency wallets across seven chains, exposed credentials with secrets masked, messaging handles, CVEs, and MITRE ATT&CK techniques. Everything lands in an interactive graph with communities and infrastructure clusters, so you can start from one wallet or handle and walk the neighborhood it belongs to, cross-referenced against earlier investigations. Scheduled monitors watch for changes and send Telegram or email alerts when your targets move. Finished work exports as STIX 2.1, MISP events, Sigma and YARA rules, CSV, JSON, and bundled IOC packages, with multi-user access for a team. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Lurker keeps you present in every IRC channel you care about, holding your connections open around the clock and recording everything said so a retro, searchable web client can hand it all back whenever you return. Invite your friends and each person gets their own set of networks under one roof, while admins decide which networks members may join and which channels newcomers are pointed at. Nothing said while you were away is lost: the full history is searchable by nick, channel or network, and clicking a result jumps straight to that moment, whether it happened an hour or a year ago. The everyday annoyances are handled too, with drafts that follow you between devices, a highlight and ignore system that cuts noise, bookmarks and private notes on users, reactions, replies, and image uploads that are optimized, stripped of metadata and stored on your own disk or S3. If you prefer your old client, the built-in bouncer speaks the soju and ZNC dialects with SASL, network discovery, on-demand scrollback and read markers that stay in sync everywhere, and DCC file transfers with an XDCC queue still work. Optional companion containers generate inline link previews in isolation and keep your IRC connections alive across restarts of the main service. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

With 17,000 GitHub stars, 460+ contributors, and deployments across telecommunications, automotive, and financial services running on over 10,000 CPU cores at the largest known installations, Apache APISIX delivers a fully dynamic API gateway achieving 140,000 QPS on eight cores with sub-millisecond latency through NGINX's event-driven architecture and LuaJIT-compiled plugin execution. The 100+ open-source plugins cover authentication (JWT, OAuth 2.0, OIDC, Keycloak, LDAP), observability (Prometheus, Datadog, SkyWalking, OpenTelemetry), traffic management (rate limiting, circuit breaking, canary releases, traffic splitting), and security (CORS, IP restriction, CSRF protection) — all hot-reloadable without process restarts via etcd-based real-time configuration synchronization. Multi-protocol support handles HTTP, gRPC, MQTT, TCP, UDP, and WebSocket traffic for both north-south API access and east-west service mesh communication. AI gateway capabilities proxy requests to 20+ LLM providers with semantic caching, token-aware rate limiting, provider failover routing, and content moderation. Custom plugins extend the gateway in Lua, Go, Java, Python, or WebAssembly. Radixtree route matching handles 100,000+ routes without performance degradation. Functions as a Kubernetes ingress controller with native service discovery for Consul, Nacos, and Eureka. Deploy via Docker or Helm charts with horizontal scaling through etcd cluster coordination. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

OctoBot provides a free and fully configurable cryptocurrency trading platform that runs on your own server. The bot automates investment strategies across 15+ exchanges including Binance, Coinbase, MEXC, Hyperliquid, Kucoin, OKX, and Bybit, supporting spot, futures, and perpetual markets. The AI trading system connects to any OpenAI-compatible API or local Ollama server, enabling strategies powered by ChatGPT, Llama, Mistral, or any custom model for market analysis and signal generation. TradingView integration accepts PineScript indicator signals and strategy alerts via webhooks, while built-in technical analysis covers RSI, Moving Averages, MACD, Bollinger Bands, and other standard indicators. The modular tentacle architecture allows community-developed plugins to extend strategy logic, evaluators, data sources, and exchange interfaces. The backtesting engine replays historical market data against any configured strategy, reporting profit and loss, drawdown, win rate, and trade-by-trade breakdown before committing real funds. Paper trading provides risk-free live simulation with the same execution logic as production. The web dashboard displays real-time portfolio value, open positions, trade history, and strategy performance with interactive charts. Telegram bot integration enables remote monitoring, notifications, and command execution from mobile devices. Docker deployment runs the full stack in a single container with persistent volume storage for configuration and trade data. On RepoCloud, deploy OctoBot on a dedicated VPS with root SSH access, persistent storage for your trading data and strategy configurations, and complete control over exchange API keys and AI model connections, all under the GPL-3.0 license.

With 1,450+ GitHub stars and a live demo on Vercel, this Bloomberg Terminal clone delivers a professional-grade financial dashboard without the $24,000 annual seat license. The Next.js 15 App Router with React 19 and TypeScript serves a single-page terminal interface optimized for constantly mutating financial data, with partial pre-rendering enabling sub-500ms initial loads even on data-heavy views. Upstash Redis caches AlphaVantage market data to minimize API calls while maintaining sub-second update latency through React Query polling with configurable refresh rates. OpenAI integration provides AI-powered market insights, sentiment analysis, and trend interpretation directly within the terminal interface. Multiple specialized views cover market data tables with bid/ask spreads, financial news aggregation with category filtering, market movers highlighting top gainers and losers, and volatility analysis with historical comparison charts. Jotai atoms manage local state for watchlists, layout preferences, and terminal sessions while React Query handles server-state synchronization with aggressive stale-while-revalidate caching. The shadcn/ui component library with Tailwind CSS delivers accessible, keyboard-navigable interface elements styled after Bloomberg's iconic dark terminal aesthetic. Security features include origin restriction, rate limiting via Redis, and Zod-based input validation on all API routes. Motion (formerly Framer Motion) animates transitions between views and data updates without layout shift. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Kill Bill handles the complete subscription billing lifecycle from plan definition through invoice generation to payment collection across any gateway, with 15 years of Fortune 500 production use and 5,600+ GitHub stars behind it. Plans, trials, add-ons, and pricing tiers live in a versioned XML catalog that propagates changes without code deploys. The multi-phase subscription engine manages trial periods, promotional discounts, evergreen billing, usage-based metering, and hybrid pricing models with automatic proration on plan upgrades and downgrades. Automated invoice generation calculates charges, applies credits and adjustments, and triggers payment collection through pluggable gateways including Stripe, Adyen, Braintree, PayPal, and CyberSource. The Java plugin framework extends every billing domain with custom logic for tax calculation via Avalara AvaTax or Vertex, fraud detection through Accertify or Feedzai, and ERP integration without modifying the core. The Kaui admin dashboard gives finance and operations teams account management, subscription controls, invoice views, payment configuration, billing timeline visualization, MRR tracking, advanced search, and full audit history with object-level change tracking. Multi-tenancy isolates billing data across thousands of brands with tenant-specific catalogs, payment configs, and RBAC policies. REST APIs expose every operation with webhook notifications for downstream integration. Deploys via Docker Compose on MySQL or PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Self-hosted and built around long reading, Omnivore saves articles, newsletters, and PDFs, renders web pages as clean text, remembers your place, and keeps every highlight searchable. Pages arrive from the web app's Add button or from Chrome and Firefox extensions that authenticate with an API key. Newsletters arrive through generated email addresses once an IMAP watcher or another mail bridge is set up. PDFs open in the same reader and accept highlights and notes just like articles. Labels, saved searches, and filters such as subscription:"Name" make a big library easy to slice. The RSS section follows your feeds, lets you add a story to the library or hide it, and can sort stories into topics when an OpenAI key is configured. Custom extractors scroll lazy-loaded pages, follow paginated articles, and strip pop-ups before saving. Rules trigger webhooks when pages are created or updated, which suits automatic labelling and other custom workflows. E-ink reading settings add double-tap page turns and volume-button scrolling, and Android and iOS apps sync the same library. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Originated as Alibaba Group's official internal AI code review assistant serving tens of thousands of developers and identifying millions of code defects over two years before open-sourcing in May 2026 — now at 21,000+ GitHub stars — Open Code Review is the production-hardened platform that proves enterprise-grade code review can be fully open-source under Apache 2.0. The hybrid architecture separates deterministic engineering pipelines (file selection, diff parsing, rule matching for NPE, thread-safety, XSS, and SQL injection across 10+ languages) from LLM-powered agent reasoning with tool-use capabilities including FileRead, CodeSearch, and cross-file context inspection, consuming approximately one-ninth the tokens of general-purpose coding agents while delivering line-level precise comments with severity and confidence scoring. The bundled web dashboard (port 4173) provides review management, findings triage, result browsing, and direct GitHub posting without external dependencies, while the session viewer (port 5483) renders full LLM request/response traces for debugging and auditing. Integration spans GitHub Actions, GitLab CI, GitFlic CI, and Gerrit with delegation mode enabling Claude Code, Cursor, and other AI agents to leverage OCR's engineering logic alongside their own LLM reasoning. Supports OpenAI, Anthropic, Google Gemini, DeepSeek via built-in providers plus Ollama and vLLM for air-gapped deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With 22,700 GitHub stars, 4,100+ forks, and proven scale powering dev.to — one of the largest developer communities serving millions of monthly users — Forem provides a complete community platform for building engaged audiences around shared interests, whether for developer documentation, customer communities, fan bases, or professional networks. The Rails backend with Preact frontend delivers article publishing with a rich Markdown editor, threaded discussions, user profiles with portfolio links, tag-based content organization, podcast hosting, classified listings for jobs and events, and social interactions including reactions, bookmarks, and following. AI-powered semantic search using PostgreSQL pgvector embeddings surfaces relevant content across articles and concepts, while scheduled automations enable community bots to create automated roundups, republish curated content, and trigger time-based moderation actions. Score-based content ranking replaces simple reaction counts with nuanced algorithms that resist gaming. The admin dashboard provides user management, content moderation, community settings, analytics, and organization controls. OAuth integration supports GitHub, Twitter, Apple, and configurable OIDC providers for frictionless sign-up. Dynamic open-graph image generation creates branded social cards automatically. Deploy with Kamal 2 to any cloud provider or bare metal server with PostgreSQL and Redis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

Dolt is a SQL database that versions your tables the way Git versions files, so every row carries a history you can branch, diff, merge, and roll back. The command line mirrors Git command for command: dolt init, add, commit, checkout, log, and blame operate on tables instead of files, and merges happen cell by cell, with conflicting cells landing in dolt_conflicts tables you resolve by choosing ours or theirs. Run dolt sql-server and the same database answers on the MySQL wire protocol, so the mysql client, TablePlus, DataGrip, and your existing application drivers connect unchanged, while stored procedures like DOLT_CHECKOUT and DOLT_MERGE and system tables like dolt_diff and dolt_log put version control inside SQL itself. Teams push and pull databases through remotes on DoltHub, S3, GCS, or a filesystem, fork a database to test a risky migration, and cherry-pick the good commits back. AI agents get their own branches to write into, and a human reviews the row-level diff before anything merges to main. Data publishers ship corrections as commits subscribers can pull, and analysts query any historical snapshot with AS OF instead of restoring backups. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Securo is a privacy-first personal finance platform that keeps all your financial data in your own PostgreSQL instance while connecting to 2,500+ banks across three continents for automated transaction sync. The FastAPI backend with React/TypeScript frontend deploys via Docker Compose on ports 3000 and 8000, with Redis-backed Celery workers handling background synchronization. Bank connections span approximately 2,500 European PSD2 institutions through Enable Banking across 29 countries, US and international banks via SimpleFIN's open protocol, and Brazilian banks through Pluggy, all refreshing automatically every four hours. Multi-account management tracks checking, savings, credit cards, and investments with running balances. The auto-categorization rules engine applies pattern-matching across merchants and amounts. Goal tracking monitors savings targets with progress visualization, asset management handles stocks and custom instruments with configurable valuation growth rules, and reports generate Net Worth and Income vs Expenses charts with category sparklines. Optional AI Agents provide LLM chat with tool-use over your financial data through MCP, supporting OpenAI, Anthropic, Ollama, and compatible providers with per-agent RAG knowledge bases accessible via a global command palette. Multi-user support includes OIDC login, passkey authentication, TOTP two-factor, privacy mode, and multi-currency FX conversion via Open Exchange Rates. 1,500+ stars since March 2026. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

GitNexus turns any codebase into an interactive knowledge graph that maps every dependency, call chain, functional cluster, and execution flow, giving AI coding assistants the deep structural awareness they need to stop breaking things. Drop a repository URL or ZIP file into the browser-based explorer and watch Tree-sitter parsers decompose your code into a navigable property graph you can zoom, click, and query. The MCP server integrates directly with Cursor, Claude Code, Codex, Antigravity, and other editors through 16 specialized tools covering architectural queries, impact analysis, safe multi-file renames, change detection, and cross-repo contract matching. Need to know the blast radius before touching a shared utility? The impact analyzer traces every caller, implementer, and downstream consumer in milliseconds. Teams reviewing pull requests get automated blast-radius annotations powered by the same graph. The registry architecture lets a single MCP server manage multiple indexed repositories simultaneously, so switching between projects requires zero re-indexing. For visual exploration, the web interface renders interactive community-clustered graphs where you can trace execution paths, browse file trees, and chat with an AI agent grounded in the graph's structural data rather than raw file snippets. Everything runs locally; your source code never leaves the machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. PolyForm Noncommercial 1.0.0 licensed.

Radar is an open-source Kubernetes management dashboard and Model Context Protocol server that gives engineering teams complete cluster visibility, automated issue diagnosis, and GitOps controls through a unified web interface. Operators explore live interactive cluster topology maps rendered with automated layout engines, grouping workloads by namespace or custom application labels to trace network communication pathways. The unified event timeline retains Kubernetes activity and state change diffs well beyond default one-hour limits, allowing site reliability engineers to diagnose historical CrashLoopBackOff states and investigate failed deployment rollouts. Teams manage Helm releases by inspecting deployed values, comparing manifest revisions side by side, and initiating rollbacks or upgrades with a single click. The built-in GitOps workspace correlates ArgoCD and Flux applications, surfacing synchronization health, field-level configuration drifts, and automated remediation suggestions. Developers inspect container image filesystems directly from pod detail panels without pulling images locally or establishing interactive terminal sessions, browsing permissions and downloading specific files. Native Model Context Protocol endpoints expose cluster telemetry and operational tools to artificial intelligence coding assistants, enabling external agents to diagnose failing pods and inspect access controls securely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Homeio turns a Linux box into a desktop you open in a browser tab, with draggable windows, a dock, a lock screen, and a command palette sitting on top of your Docker apps, files, and disks. The App Store installs Docker Compose stacks from the CasaOS catalog or your own store sources, and each app's ports, volumes, environment variables, and compose file stay editable before and after install. Containers you started elsewhere still appear with live CPU and memory stats, streaming logs with keyword filters, and one-click restarts. The file manager uploads with progress, previews images, audio, video, and PDFs, edits text in a built-in code editor, mounts USB drives and SMB shares, and shares folders over Samba. A real login shell lives in the Terminal window, with exec access into any container, so routine fixes never need a separate SSH client. Cron-style scheduled tasks restart apps, pull images, or run backups on a timer, and scheduled archives of the database, files, and compose stacks restore from the same interface. Tailscale puts the whole desktop on your private network, while Cloudflare Tunnel can publish a single app on a public hostname with its DNS record created for you. Live metrics stream to widgets and the status bar, and notifications flag crashed containers, filling disks, and failed tasks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.