asn-lookup

Go

Local IP↔AS lookups from the IPinfo Lite database (CLI + MCP) — downloads the free Lite DB once and answers IP→ASN/country and ASN→prefixes fully offline; a large AS's prefixes come back inline a page at a time

abuse-lookup

Go

Checks IP address reputation against the AbuseIPDB API (CLI + MCP) — abuse score, report history, usage type, and ISP, cached locally with a TTL; report pages come back inline, sized by the caller. The online sibling of asn-lookup

doh-lookup

Go

Collects a domain's DNS records over DoH (CLI + MCP) — queries Cloudflare/Google out-of-band over HTTPS so investigative lookups stay distinguishable from ordinary DNS; forward profile + PTR reverse, bulk input, states the resolver/endpoint and DNSSEC AD in every result; no credentials. The DNS-resolution sibling of asn-lookup and whois-lookup

icloud-relay-lookup

Go

Reports whether an IP is an Apple iCloud Private Relay egress IP (CLI + MCP) — offline longest-prefix match from a cached copy of Apple's egress list, with its geo hints (country/region/city); ETag revalidation, no credentials. The Apple-side sibling of tor-exit-lookup

ir-timeline

Go

IR timeline recorder — single-binary, browser-based tool for tracking events with text, images, and time deltas

mac-lookup

Go

Resolves a MAC address or BSSID to its manufacturer (CLI + MCP) — offline longest-prefix match (36/28/24-bit) against a cached copy of the IEEE registries, and classifies the address first: a randomized or otherwise locally administered address is reported as having no vendor to find, not as an unidentified device; conditional downloads, no credentials. The L2 sibling of asn-lookup

malware-lookup

Go

Answers whether a file hash is a publicly known legitimate file or known malware (CLI + MCP) — layers CIRCL hashlookup, Team Cymru MHR (over DoH) and MalwareBazaar into one lookup with a four-way verdict: known_good / known_malware / unknown / conflicting. The VirusTotal API is never called (its free tier forbids workflow integration); results carry a human-facing GUI link instead. The file-hash sibling of abuse-lookup and urlscan-lookup

news-collector

Python

News collection agent — collects, tags, summarizes, translates, and delivers curated news digests

otx-lookup

Go

Attaches campaign context to an indicator from the community reports (“pulses”) of the LevelBlue Open Threat Exchange (CLI + MCP) — adversary, malware family, ATT&CK techniques, targeted industries and countries, each counted by how many independent reports named it, then the pivot from a pulse to the other indicators it carries. Every sibling returns one attribute of one indicator; this answers whether the indicator belongs to a known campaign. Reads only a third-party index, so no packet reaches the target. The API key is optional — lookups and the pivot both work without one

gti-lookup

Go

Threat context from Google Threat Intelligence (CLI + MCP) — the community collections an indicator is associated with, sandbox behaviour of a sample served as an index of paged sections, corpus-wide IOC search in GTI query syntax, the vulnerability catalogue with pivots and ATT&CK trees, and read-only LiveHunt ruleset inspection. Ships exactly the GTI Standard feature set, and is the one member of the lookup family that requires a commercial licence key — every query is recorded against it. Reads only Google’s index, so no packet reaches the target; read-only by design

rdns-lookup

Go

Looks up the relationships around an IP or domain in the free 6-billion-record ip.thc.org index (CLI + MCP) — the domains on an address or octet-boundary block, a domain's subdomains, and the domains that CNAME to it. Reads only a third-party index, so no packet reaches the target. Not PTR but an aggregate index: 1.1.1.1 yields 83,216 records where a PTR yields one, and every result reports how much upstream holds against how much was retrieved; no credentials. The relationship-breadth sibling of doh-lookup

tor-exit-lookup

Go

Reports whether an IP is a Tor Exit node (CLI + MCP) — offline membership lookup from a cached copy of the Tor Project's torbulkexitlist, enriched with exit-addresses metadata; no credentials. The offline sibling of asn-lookup and abuse-lookup

urlscan-lookup

Go

Investigates a suspicious URL via the urlscan.io API (CLI + MCP) — an active scan submits the URL to urlscan's sandbox browser for its behaviour, verdict, observed IPs/domains, and screenshot (private by default; public must be requested explicitly), plus a passive search of the historical public-scan database; async job flow, TTL cache, free-plan API key. The URL-layer sibling that feeds the IP/domain-layer lookups

whois-lookup

Go

Looks up the registration data of a domain, IP, or AS number (CLI + MCP) — RDAP-first via the IANA bootstrap with a port 43 WHOIS fallback for RDAP-less ccTLDs (.jp), in-house IDN punycode, local TTL cache; no credentials. The registration-focused sibling of asn-lookup and abuse-lookup

mail-analyzer

Go

Suspicious email analyzer — rule-based indicators + Gemini LLM content analysis for .eml/.msg files

mail-analyzer-gui

Swift

Native macOS desktop GUI — drag & drop email analysis, Apple Mail multi-message supported

mail-analyzer-local

Go

Local LLM version — email analysis via OpenAI-compatible API (LM Studio, Ollama)

ask-gemini-mcp

Go

MCP server exposing ask_gemini(prompt) — forwards to Vertex AI Gemini for second-opinion consultations from AI coding agents

ask-llm-mcp

Go

MCP server exposing ask_llm(prompt) — forwards to an OpenAI-compatible endpoint (local LM Studio) for second-opinion consultations from AI coding agents

chrome-pilot-mcp

Go

Browser automation as an MCP server with no supply chain to trust — a single binary with zero external modules speaking CDP directly, driving your installed Chrome, with startup-only host allow/block lists no tool can widen

data-toolbox-mcp

Go

DuckDB analytics + containerized Python as an MCP server — workspace-scoped, Podman sandbox, stdio-only, BYO-LLM

mcp-bridge

Go

Bridges stdio MCP clients to Streamable HTTP MCP servers that require a pre-registered OAuth client — Slack, GitHub Apps, Entra ID and other providers without dynamic client registration, which a client’s own OAuth cannot reach. PKCE, an https loopback callback, zero dependencies

pcap-analyzer-mcp

Go

pcap/pcapng analysis as an MCP server — digest-pinned tshark in a network-less Podman container, capture mounted read-only and never copied, wire content returned framed as untrusted

bigquery-mcp

Go

Protection-first BigQuery MCP server — every query is dry-run first and refused unless BigQuery itself classifies it as a single SELECT inside the dataset allowlist and the byte budget; runs as a named job under maximumBytesBilled, returns column-keyed rows with explicit caps and truncation accounting, and reports failures as {code, message, retryable, details}. Application Default Credentials, no SDK, one instance per billing project

splunk-mcp

Go

Splunk search as a local MCP server — asynchronous job pattern over the REST API guarantees exact result counts (never oneshot/preview), large result sets delivered as JSONL files without truncation, destructive-SPL guard, one instance per Splunk host

gem-scribe

Go

Cloud speech-to-text on Vertex AI's dedicated transcription model — the model returns speaker turns and word-level timings as structured response parts, so no language model authors the transcript's JSON and nothing has to repair one that came back malformed. Separates up to 8 speakers where its local counterpart voice-scribe stops at 4; pick by priority, cost favours voice-scribe and accuracy favours this. CLI and MCP server in one binary, output compatible with voice-scribe

voice-scribe

Go

Local speech-to-text for macOS — whisper.cpp on Metal statically linked, so no API key, no ffmpeg, and no audio leaving the machine. A curated model catalog defaults to large-v3-turbo, measured on-machine to beat the Japanese-specialised alternative even on Japanese; voice-activity gating suppresses hallucinations over silence; speaker diarization via sherpa-onnx labels who is speaking. CLI and MCP server in one binary, output compatible with gem-scribe

voice-studio-mcp

Go

Local multi-speaker Japanese speech synthesis for AI agents as an MCP server — narrated audio (radio drama, audiobook, podcast, briefing), Japanese only. AivisSpeech Engine backend, script JSONL batch synthesis with content-hash cache, pronunciation dictionaries, ffmpeg mastering, voice-model license review, bundled multi-actor-narration skill

video-studio-mcp

Go

Presentation-video compositor as an MCP server — page images + per-page audio → one narrated MP4, a pure ffmpeg compositor paired with voice-studio-mcp. Per-page chapters, opt-in captions (burned-in overlay via bundled M PLUS 1p and/or a toggleable mov_text closed-caption track), per-call canvas override (16:9/9:16/1:1), async rendering

llm-cli

Go

CLI client for local LLMs (LM Studio, Ollama) — streaming, batch, multi-image VLM, structured output

lite-rag

Go

RAG CLI for Markdown docs using DuckDB — index and query local knowledge bases

lite-switch

Go

Natural language classifier for shell pipelines — routes stdin text to a matching tag via LLM

gem-cli

Go

Gemini CLI client — multimodal prompts, streaming, grounding, structured output via Vertex AI

gem-rag

Python

Gemini-powered RAG CLI for Markdown documents — Vertex AI embeddings and DuckDB

gem-search

Go

Agentic web search via Vertex AI Gemini — Google Search Grounding, Markdown/JSON output, pipe-friendly

gem-query

Go

Natural language data analysis CLI — interactive SQL generation for DuckDB/SQLite via Vertex AI Gemini

gem-summary

Go

Single-call text summarisation via Vertex AI Gemini — auto chunk + parallel + merge for over-context inputs, prompt-injection defended

nlk

Go

LLM utility toolkit — guard, jsonfix, strip, backoff, validate. Zero external dependencies

nlk-py

Python

Python edition of nlk — same 5 modules, same API design. Zero external dependencies

data-analyzer

Go

Large-scale JSON/JSONL data analysis — sliding window + progressive summarization with local LLMs

image-forge

Go

Local diffusion image-generation engine + model CLI for macOS (Apple Silicon) — SDXL/anime & general models via stable-diffusion.cpp, per-model gotchas hidden behind profiles, txt2img/img2img/inpaint/ControlNet/LoRA, GGUF quantization, multi-component (FLUX/SD3.5/Z-Image), resident serve, and an image-forge mcp server mode

image-forge-gui

Swift

macOS app for image-forge — a native SwiftUI front-end over the resident serve engine, with a Composer → Generate → Gallery flow

gem-image

Go

Image generation and editing CLI — Vertex AI Gemini (Nano Banana 2), pipe-friendly

shell-agent-v2

Go/React

macOS chat & agent desktop app — interactive data analysis with session-scoped DuckDB, hybrid Local/Vertex backend, per-session container sandbox, MCP support, unified MITL approval

agent-board

Go

Machine-local shared knowledge board for concurrent AI agent sessions — append-only records posted as claims and delivered as per-turn deltas through Claude Code / gem-agent hooks, path claims that refuse another session's edits, and a write-side evaluation ladder (credential and PII floors, entropy quarantine) instead of a human gate

gem-agent

Go

Interactive CLI agent runtime on Vertex AI Gemini — sandboxed file/shell tools, MCP, skills, two-tier auto-approve (interactive and headless -p), session resume, context compaction (macOS)

instant-translate

Swift

macOS menu-bar translator — on-device Translation framework (no LLM, no network), auto language routing with a configurable secondary language (ambiguity resolves toward your own languages), source pin + manual target, a rebindable global hotkey with clipboard seeding, and launch at login; a status line always reports what it is doing (waiting on your input method, model download, translating) and failures name their cause and the fix

cclaude

Bash

Containerized Claude Code — run Claude Code in an isolated container with project isolation

active-lens

Go

Content-free Mac activity tracker — records only WHEN you work, never WHAT you do; classifies each moment operating / present / away with no permissions, and derives work sessions that are never cut at midnight (timeline for the work log, now for the session in progress)

active-lens-gui

Swift

macOS work-log menu-bar app — a native SwiftUI front-end over active-lens showing the session you are in, with a calendar-style work timeline (day columns, hover for start / end / duration) and a per-day work log

claude-usage-lens

Go

Token usage & cost analysis for Claude Code / Cowork — parses local session logs into a durable SQLite store, reports by day/session/project/model with near-real-time watch, period analysis, verify against Cowork audit ground truth, configurable per-model pricing, reprice to apply rate changes to stored history, and real-quota calibration deriving the effective weekly cap from official /usage readings (no private API)

claude-usage-lens-gui

Swift

macOS menu-bar app for Claude usage cost — a native SwiftUI front-end over claude-usage-lens showing today's cost in the menu bar, expanding into Swift Charts analysis (daily trend, per-model stacking, top projects), with a weekly budget monitor calibratable to the real limit from official /usage readings, showing use/remaining in both amount and percent and projecting from the week's pace whether the budget will be overrun

gem-usage-lens

Go

Token usage & cost analysis for gem-agent (Vertex AI Gemini) — parses the session transcripts' accounting records into a durable SQLite store, prices them at the Vertex AI list price (thinking as output, cached prompt as a share, grounding per request, regional multiplier) and reports by day/session/project/model/call source with watch, reprice, verify of the accounting checksum, and a calendar-month budget with a pace forecast

gem-usage-lens-gui

Swift

macOS menu-bar app for gem-agent usage cost — a native SwiftUI front-end over gem-usage-lens showing today's cost (price/tokens) in the menu bar, expanding into Swift Charts analysis (daily trend, per-model stacking, by call source, top projects), with a calendar-month budget monitor showing use/remaining in both amount and percent and projecting from the month's pace whether the budget will be overrun

load-spinner

Swift

macOS menu-bar CPU/GPU load indicator — a lit segment travels around a fixed circle or square at a speed proportional to load, plus an optional memory gauge that fills with usage; max / CPU / GPU / both modes (per-source shape & color) and a click panel that flips between live gauges with a 3-minute Swift Charts history and its settings, with a button through to Activity Monitor

status-lens

Swift

macOS menu-bar watcher for Statuspage-hosted status pages (Claude by default; GitHub or any Statuspage URL as profiles) — per-profile label + shape symbol dual-encoded in color and shape, worst-of aggregation mode, detail popover with components and active incidents, notifications on degradation/recovery crossings only

scli

Go

Terminal Slack client — channels, messages, DMs, search

swrite

Go

Bot-oriented Slack poster — text, Block Kit, attachments, and files from shell pipelines

scat

Go

General-purpose content poster — send text, files, and Block Kit messages to Slack

stail

Go

Read-only Slack CLI — stream channel messages in real time or export history to JSON

md-to-slack

Go

Markdown to Slack Block Kit JSON filter — pipe into scat to post formatted messages

slack-mcp-extender

Go

Transparent proxy for the official Slack MCP — adds file upload/download extension tools under your own identity

slack-router

Go

Slash Command daemon — routes commands to local shell scripts via Socket Mode

splunk-cli

Go

CLI client for the Splunk REST API — run searches, poll jobs, fetch results

confl-cli

Python

Confluence Cloud CLI — list, search, read, export

json-filter

Go

Extract, validate, prettify, and repair JSON from arbitrary text streams

json-to-table

Go

Format JSON arrays into text, Markdown, HTML, CSV, PNG, or Slack Block Kit tables

json-to-sqlite

Go

Load JSON data into SQLite with automatic schema inference

jstats

Go

SPL-style stats aggregations — count, avg, p95, stdev, values, and more

jviz

Go

Visualize JSON arrays as interactive charts in the browser — bar, line, pie, table

lookup

Go

Enrich JSON/JSONL streams by matching fields against CSV/JSON data sources

grid-edit

Swift

Native macOS CSV/TSV editor (AppKit, NSDocument + NSTableView) — csv-editor's successor: encoding auto-detect (UTF-8/BOM/Shift_JIS/CP932), delimiter auto-detect, IME-safe editing, rectangular selection, TSV clipboard with paste confirmation, find & replace, sort

csv-to-json

Go

Convert CSV data to a JSON array

eml-to-jsonl

Go

Parse .eml files and output structured JSONL — headers, body, attachments

msg-to-jsonl

Go

Parse Outlook .msg files and output structured JSONL

pptx-to-markdown

Python

Convert .pptx presentations to structured Markdown for LLM analysis

rex

Go

Extract fields from text using named regex capture groups — outputs JSON

sdate

Go

Calculate timestamps using Splunk-like relative time modifiers

sensor-lens

Go

Collect SwitchBot temperature, humidity and CO2 into a local SQLite history — quota-aware polling, CSV backfill

sensor-lens-gui

Swift

macOS menu-bar readout of your SwitchBot sensors — six-hour sparklines and CO2 alerts

markdown-viewer

Go

Single-binary local Markdown viewer — renders GFM, Mermaid, and syntax-highlighted code

task-clock

Go

Resident macOS scheduler that does not trust launchd's timing engine — evaluates cron itself (launchd kept for KeepAlive residency only) and records every fire as scheduled-vs-actual with overrun accounting; watermark trigger (fire N after the last success), overlap policies, persistent per-task pause, notification hooks, per-run output capture, and a localhost HTTP trigger API

task-clock-gui

Swift

Menu-bar front end for task-clock — quiet by default, speaking only on overrun or an unreachable daemon; pilot-lamp daemon control with a power switch, per-task on/off switches with per-second countdowns, a scheduled-vs-actual run-history view, and notifications for overrun, failure and daemon-down

webhook-relay

Go

Authenticated webhook receiver — writes payloads to GCS via Cloud Run with VPC isolation

share-mounter

Swift

macOS menu-bar app that auto-mounts SMB shares at login — mounts via NetFS with no Finder window, appearing in the sidebar as network volumes; multiple shares, per-share auto-mount, Keychain credentials, re-mount on wake/network recovery

url-shelf

Swift

macOS menu-bar shelf of URL notes kept as plain .webloc files — the folder tree is the classification, so Finder stays the editor and the records outlive the app; per-entry private-window opening with folder-inherited defaults, disabled rather than downgraded when no private browser is set, and no network access

zip-porter

Swift

Windows-safe ZIP creation and extraction for macOS — drag-and-drop GUI with an embedded CLI; junk files excluded, NFC UTF-8 names with a CP932 legacy mode, AES-256/ZipCrypto passwords, CP932 auto-detection on extract; several archives selected in Finder extract as one job with one progress bar, one prompt and one result; and hardened extraction: zip-slip guard, decompression-bomb limits, permissions masked by your umask so an archive cannot drop world-writable files, and quarantine propagation to every extracted item — folders included, so Gatekeeper still evaluates an app that arrives inside a ZIP

m5-vehicle-logger

C++

Vehicle driving data logger for M5Stack Basic v2.7 — GPS + IMU sensing with Wi-Fi transmission

m5-clock

C++

NTP-synchronized digital clock for M5Stack Core2 — night mode, RTC backup, SD card config

m5-data-receiver

Bash/CFn

Serverless AWS backend for m5-vehicle-logger — API Gateway + Lambda + S3 with deploy/destroy scripts

compliance-review

Skill

Two-phase regulation-compliance review — compiles your regulation documents into a versioned domain-expert set (full clause text, no RAG, deterministic coverage check), then reviews applications with parallel independent experts behind drift and nonce-isolation gates; successor to the virtual-reviewer PoC

incident-research

Skill

Security incident deep-dive research — collects and reads news and primary sources on one public incident into a timeline-centric, source-tiered JSON report plus a STIX 2.1 bundle of extracted IoCs; companion to service-research, successor to the ioc-collector CLI

incident-review

Skill

Own-incident retrospective analysis — turns your IR communication record into a validated report and reusable tactic knowledge behind a defang/nonce-isolation gate; successor to ai-ir/ai-ir2

mcp-tactics

Skill

MCP server selection tactics — decision tables from input artifact to route, cross-server chains, and an escalation doctrine

meeting-notes

Skill

Meeting transcript to structured minutes — validated 3-layer JSON with verbatim quotes and decision rationale, compiled to Markdown/HTML

news-digest

Skill

Feed collection into an evaluated digest — scores novelty, significance and relevance behind a nonce-isolation gate, derives reading priority from a swappable profile's decision table, and tracks continuing stories so a rehash with no new facts is named as such; public engine with a private corpus repository, agent-runnable from first-time setup through scheduled operation

rfp

Skill

Interactive RFP facilitation — collects requirements through Q&A and generates structured RFP documents

service-research

Skill

Product/service risk research — reads ToS, privacy, and security primary sources into a validated JSON report with risk rating; successor to the product-research CLI

lagent

Go

Sandboxed coding-agent runtime on a local LLM (LM Studio / Ollama, OpenAI-compatible API) — gem-agent's design as a separate product line

llm-othello

Go

Browser-based Othello against a local LLM — server-side move generation via OpenAI-compatible API

slack-monitor

Python

Real-time Slack channel summarizer — periodic LLM summaries with live TUI display

agent-skeleton Archived

Python

Autonomous agent skeleton — plan-approve-execute loop, per-tool approval, memory compression

agentic-web-search Frozen

Go

Frozen (search API ToS concerns) — agentic web search via local LLM + Brave Search API

ai-ir Archived

Python

AI-powered incident response — analyzes Slack IR exports into reports and reusable tactics; superseded by the incident-review skill

ai-ir2 Archived

Python

Next-gen IR analysis — one-stop Gemini pipeline for reports and knowledge documents; superseded by the incident-review skill

csv-editor Archived

Go/React

CSV/TSV editor GUI for macOS/Windows — UTF-8/Shift_JIS/CP932 auto-detect, virtual scroll for 100k+ rows, IME-safe edit, find/replace; superseded by grid-edit

cti-graph Archived

Python

Local-first attack graph analysis — STIX 2.1 ingestion, PIR-driven weighting, choke-point detection, FastAPI API

cti-primer Archived

Python

Local-first CTI PIR generation — turns business context into Priority Intelligence Requirements via local LLMs or dictionary-only mode

data-agent Archived

Go/React

Superseded by shell-agent-v2 — data analysis desktop GUI with interactive chat, plan-driven SQL + sliding-window analysis, per-case DuckDB

gem-transcribe Archived

Python

Audio transcription CLI on Vertex AI Gemini — speaker name inference, multi-language output, structured JSON. Superseded by gem-scribe

ioc-collector Archived

Python

Research security incidents from URLs or CVE IDs — extracts IoCs into Markdown and STIX 2.1 bundles; superseded by the incident-research skill (v0.2+)

ir-hub Archived

Go

IR lifecycle hub — resident Slack ChatOps bot that opens a channel per case, tracks the response, and ingests messages for postmortems and knowledge reuse

ir-tracker Archived

Python

Live IR tracker — continuous ingestion, segmented analysis, and timeline visualization via Gemini

lite-llm Archived

Go

Superseded by llm-cli — CLI client for OpenAI-compatible LLM APIs

log-analyzer Archived

Python

Large JSONL log analyzer — LLM-driven analysis with timestamp-based chunking for files exceeding context limits

magi-system Archived

Python

Three-persona AI discussion (MELCHIOR / BALTHASAR / CASPER) — multi-angle analysis seeking convergence

magi-system2 Archived

Python

Multi-persona AI discussion — dynamic persona generation, dual memory, adaptive facilitation

mail-triage Archived

Python

GCS-based email triage — classifies eml/msg files with Gemini LLM and posts results to Slack

mail-watcher Archived

Bash

Mail monitoring workflow — watches for eml/msg files, analyzes with LLM, posts Slack notifications

mcp-guardian Archived

Go

MCP governance proxy — transparent auditing, OAuth2 auto-discovery, and tool masking. The bridging half is superseded by mcp-bridge; the governance layer was never adopted in practice

mcp-skeleton Archived

Python

MCP server skeleton — raw JSON-RPC 2.0 over stdio/SSE with API key auth

meeting-note Archived

Python

Meeting minutes structuring — audio/transcript to structured JSON via Gemini; superseded by the meeting-notes skill

product-research Archived

Python

Research products and services — ToS, privacy, and data security analysis; superseded by the service-research skill

quick-translate Archived

Swift

macOS menu-bar translation tool — powered by local LLM, always-on-top overlay; superseded by instant-translate (macOS 26+)

sai Archived

Python

Context-aware Slack bot — RAG memory over channel history, natural language command execution via local LLM

shell-agent Archived

Go/Swift

Superseded by shell-agent-v2 — macOS LLM chat & agent with MCP, shell Tool Calling + MITL, Hot/Warm/Cold memory, multimodal

slack-personal-agent Archived

Go/React

Personal Slack knowledge agent — monitors multiple workspaces, channel-scoped RAG over DuckDB with strict 3-tier isolation, Hot/Warm/Cold memory, MITL draft responses

virtual-reviewer Archived

Python

AI-powered security review — LLM expert models with full regulation context, UNIX pipes; superseded by the compliance-review skill

workflow-builder Archived

LLM-powered workflow builder — generates shell scripts from natural language