asn-lookup

Go

Local IP↔AS lookups from the IPinfo Lite database (CLI + MCP) — downloads the free Lite DB once and answers IP→ASN/country and ASN→prefixes fully offline; a large AS's prefixes come back inline a page at a time

abuse-lookup

Go

Checks IP address reputation against the AbuseIPDB API (CLI + MCP) — abuse score, report history, usage type, and ISP, cached locally with a TTL; report pages come back inline, sized by the caller. The online sibling of asn-lookup

doh-lookup

Go

Collects a domain’s DNS records over DoH (CLI + MCP) — queries Cloudflare or Google out-of-band over HTTPS so investigative lookups stay distinguishable from ordinary DNS; forward profile plus PTR reverse, and every result states the resolver, endpoint and DNSSEC AD flag

icloud-relay-lookup

Go

Reports whether an IP is an Apple iCloud Private Relay egress IP (CLI + MCP) — offline longest-prefix match from a cached copy of Apple’s egress list, with its geo hints (country/region/city); ETag revalidation, no credentials. The Apple-side sibling of tor-exit-lookup

ir-timeline

Go

Incident response timeline recorder (single binary) — replaces the Excel IR timeline with a local browser UI: events carry text, images, tags and the delta since the previous one, drawn as a vertical timeline or a per-tag swimlane. One SQLite file per incident, images included

mac-lookup

Go

Resolves a MAC address or BSSID to its manufacturer (CLI + MCP) — offline longest-prefix match (36/28/24-bit) against a cached copy of the IEEE registries, classifying the address first: a randomized or locally administered MAC is reported as having no vendor to find, not as an unknown device

malware-lookup

Go

Checks a file hash against three public indexes at once (CLI + MCP) — CIRCL hashlookup, Team Cymru MHR (over DoH) and MalwareBazaar, layered into one four-way verdict: known_good, known_malware, unknown, or conflicting (known-good and flagged at the same time). VirusTotal’s API is never called

news-collector

Python

News collection agent for daily batch runs (Gemini + Google Search Grounding) — collects articles per topic from a TOML keyword config, deduplicates into SQLite, then tags, summarizes and translates each one, and delivers the digest to Slack or a local web dashboard

otx-lookup

Go

Attaches campaign context to an indicator from LevelBlue OTX’s community reports, or “pulses” (CLI + MCP) — adversary, malware family, ATT&CK techniques and targeted industries, each counted by how many independent reports named it. Reads only a third-party index, so no packet reaches the target

cve-lookup

Go

Context for a CVE from EchelonGraph’s CVE Pulse API (CLI + MCP) — CVSS, CISA KEV, EPSS, SSVC, exploit and patch signals, product matching, vendor advisories and the internet-exposure footprint. No key or account: a single dependency-free binary in place of the vendor’s npx-launched MCP server

gti-lookup

Go

Threat context from Google Threat Intelligence (CLI + MCP) — the collections an indicator belongs to, a sample’s sandbox behaviour, corpus-wide IOC search in GTI query syntax, the vulnerability catalogue, and read-only LiveHunt inspection. Standard-tier only, and the one lookup here that needs a commercial licence key

rdns-lookup

Go

Maps the relationships around an IP or domain in the ip.thc.org index (CLI + MCP) — the domains on an address or octet-boundary block, a domain’s subdomains, and the domains that CNAME to it. An aggregate index, not PTR — 1.1.1.1 yields 83,216 records against a PTR’s one

shodan-lookup

Go

What an IP exposes to the Internet, read from Shodan with your own key (CLI + MCP) — open ports, products, TLS certificates, inferred CVEs and when each was seen, and history as changes in a stated window. Only search spends query credits, above a floor you set

tor-exit-lookup

Go

Reports whether an IP is a Tor Exit node (CLI + MCP) — offline membership lookup from a cached copy of the Tor Project’s torbulkexitlist, enriched with exit-addresses metadata; no credentials. The offline sibling of asn-lookup and abuse-lookup

urlscan-lookup

Go

Investigates a suspicious URL via the urlscan.io API (CLI + MCP) — an active scan submits it to urlscan’s sandbox browser for behaviour, verdict, observed IPs/domains and a screenshot (private by default), alongside a passive search of the historical public-scan database that never touches the target

whois-lookup

Go

Looks up the registration data of a domain, IP, or AS number (CLI + MCP) — RDAP-first via the IANA bootstrap with a port 43 WHOIS fallback for RDAP-less ccTLDs (.jp), in-house IDN punycode, local TTL cache; no credentials. The registration-focused sibling of asn-lookup

mail-analyzer

Go

Suspicious email analyzer combining rule-based indicators and a Gemini LLM — parses .eml and .msg into structured JSON with SHA-256 hashes, SPF/DKIM/DMARC results, sender integrity checks (From vs Return-Path, display-name spoofing, Reply-To divergence), URL and attachment risk. Offline mode skips the LLM entirely

mail-analyzer-gui

Swift

Native macOS desktop app for analyzing suspicious emails — drop .eml or .msg from Finder or straight out of Apple Mail (multiple at once) and get the judgment, its confidence and its reasons up front, with indicators expandable per row. Works against either mail-analyzer or mail-analyzer-local

mail-analyzer-local

Go

Local-LLM edition of mail-analyzer — the same rule-based indicators and LLM judgment, but against an OpenAI-compatible endpoint (LM Studio, Ollama) so nothing leaves the machine and no GCP or Vertex AI is needed. Same JSON schema; disable the model’s thinking mode, which measurably improves accuracy

ask-gemini-mcp

Go

MCP server exposing a single tool, ask_gemini(prompt), which forwards the prompt to Vertex AI Gemini and returns the reply — a second-opinion channel for coding agents, and the only route to Gemini in MCP clients with no shell to run the gem-* CLIs

ask-llm-mcp

Go

MCP server exposing a single tool, ask_llm(prompt), which forwards the prompt to any OpenAI-compatible chat-completions endpoint — aimed at a local LM Studio server, so a second opinion costs nothing and no data leaves the machine. One config file per model to offer several backends

chrome-pilot-mcp

Go

Browser automation as an MCP server with no supply chain to trust — a single binary with no third-party modules speaking CDP directly, driving your installed Chrome, with startup-only host allow/block lists no tool can widen

data-toolbox-mcp

Go

DuckDB analysis and containerized Python as a single-binary MCP server — loads tabular files into a per-workspace DuckDB and runs SQL or throwaway Python against them inside a Podman sandbox, with results capped and the omission counted. Workspaces persist across sessions; the client brings its own LLM

mcp-bridge

Go

Bridges stdio MCP clients to Streamable HTTP MCP servers that require a pre-registered OAuth client — Slack, GitHub Apps, Entra ID and other providers without dynamic client registration, which a client’s own OAuth cannot reach. PKCE, an https loopback callback, zero dependencies

pcap-analyzer-mcp

Go

pcap/pcapng analysis as an MCP server — a digest-pinned tshark runs in a network-less Podman container with the capture mounted read-only, so an agent narrows a GB-scale capture step by step under explicit bounds instead of drowning in tshark -V. Wire content is framed as untrusted

bigquery-mcp

Go

Protection-first BigQuery MCP server — every query is dry-run and refused unless BigQuery itself classifies it as a single SELECT inside the dataset allowlist and the byte budget, then runs as a named job under maximumBytesBilled. Rows come back column-keyed with explicit caps; failures carry a retry hint

splunk-mcp

Go

Splunk search as a local MCP server — asynchronous job pattern over the REST API guarantees exact result counts (never oneshot/preview), large result sets delivered as JSONL files without truncation, destructive-SPL guard, one instance per Splunk host

brave-search

Go

The Brave Search API as a CLI and local MCP server — ranked web results, page text pre-extracted to a token budget for grounding a model, and cited answers from one search or a multi-step research run. Every result prints its cost; nothing is cached (Brave ToS)

web-fetch

Go

One URL’s readable text as a CLI and local MCP server — main content as markdown, plain text or the raw body. Built for agent runtimes that can search but cannot read a user-given URL: no cookies, nothing stored on disk, and an SSRF guard in the dialer

gem-scribe

Go

Cloud speech-to-text on Vertex AI’s dedicated transcription model (CLI + MCP) — speaker turns and word-level timings come back as structured response parts, so no language model authors the transcript’s JSON. Separates up to 8 speakers where the local voice-scribe stops at 4, and shares its output envelope

voice-scribe

Go

Local speech-to-text for macOS (CLI + MCP) — whisper.cpp statically linked against Metal, so no API key, no ffmpeg, and no audio leaving the machine. Defaults to large-v3-turbo, measured on-machine to beat the Japanese-specialised alternative even on Japanese; VAD gating suppresses hallucinations over silence

voice-studio-mcp

Go

Local multi-speaker Japanese speech synthesis for AI agents as an MCP server — narrated audio for radio drama, audiobook, podcast or briefing, Japanese only. AivisSpeech Engine backend, script JSONL batch synthesis with a content-hash cache, pronunciation dictionaries, ffmpeg mastering, bundled multi-actor-narration skill

video-studio-mcp

Go

Presentation-video compositor as an MCP server — page images plus per-page audio become one narrated MP4, each page shown for exactly the length of its audio. A pure ffmpeg compositor paired with voice-studio-mcp: per-page chapters, opt-in burned-in or closed-caption subtitles, 16:9/9:16/1:1, async rendering

pathguard

Go

Go library that judges whether a path may be touched — system locations, credential stores, agent configuration and a server’s own directories are compared by file identity as well as by folded name, so no case variant, link or firmlink walks past them, even before they exist

llm-cli

Go

CLI client for local LLMs over OpenAI-compatible endpoints (LM Studio, Ollama) — streaming prompts, line-by-line JSONL batch runs, multi-image input for VLMs, and JSON-schema structured output that falls back to prompt-injected formatting when the server rejects response_format. Built on nlk; successor to lite-llm

lite-rag

Go

Retrieval-augmented question answering over a Markdown directory, entirely local — chunks and embeds into DuckDB, then answers with a local LLM over an OpenAI-compatible API, from the CLI or an embedded web UI. Japanese/English mixed documents chunk on Japanese sentence boundaries; re-indexing only touches files whose hash changed

lite-switch

Go

Natural-language classifier for shell pipelines — reads free-form text on stdin and writes the single best-matching tag to stdout, so an LLM decision slots into a pipe like any other filter. Options live in a version-controlled YAML file, and stdin is isolated in a nonce-tagged wrapper

gem-cli

Go

Gemini client CLI on Vertex AI — multimodal prompts (image, PDF, audio, video), streaming, interactive chat with session persistence, context caching, Google Search Grounding with citations, native structured output, and a prompt-injection guard. The Gemini-native counterpart to llm-cli’s OpenAI-compatible route

gem-rag

Python

Gemini-powered RAG CLI for Markdown documents — heading-aware chunking with JP/EN sentence boundary detection, Vertex AI text embeddings stored in DuckDB, and answers built from vector search plus adjacent-chunk expansion. The Vertex AI counterpart to the fully local lite-rag; Python, runs anywhere uv does

gem-search

Go

Agentic web search CLI on Vertex AI Gemini — given a question in natural language, it searches via Google Search Grounding, reads the results and writes a Markdown or JSON report with citations. Pipe-friendly; brave-search is the raw search call, this is the report

gem-query

Go

Natural-language data analysis CLI for DuckDB and SQLite on Vertex AI Gemini — asks in plain language, generates SQL, validates it with a dry run before executing, and shows the result. Works as an interactive DB shell or a pipe-friendly one-shot command

gem-summary

Go

Single-purpose text summarisation CLI on Vertex AI Gemini — one LLM call for a .md/.txt file or stdin, relying on Gemini’s ~1M-token window instead of a sliding-window summariser. Inputs past that window fall back to chunk, summarise in parallel, then merge, so nothing is silently refused

nlk

Go

Go toolkit for the code that surrounds an LLM call, not the call itself — guard wraps user text in a nonce-tagged XML envelope against prompt injection, jsonfix repairs what a model actually emits, strip removes thinking tags, backoff and validate cover the rest. Zero external dependencies

nlk-py

Python

Python edition of nlk — the same five modules (guard, jsonfix, strip, backoff, validate) with the same API design, for the code around an LLM call rather than the call itself. Zero external dependencies, so it drops into any project without pulling a tree behind it

data-analyzer

Go

Large-scale JSON/JSONL analysis with a local LLM — a sliding window with overlap summarises progressively across 100k+ records instead of map-reducing them, so boundary context survives. Every finding cites the source records and is verified against the originals; checkpointed resume, Markdown or HTML report

image-forge

Go

Local diffusion image-generation engine and model CLI for macOS (Apple Silicon) — runs SDXL, anime and general models through stable-diffusion.cpp with each model’s gotchas (CLIP-skip, VAE, resolution, v-pred) hidden behind profiles. txt2img/img2img/inpaint/ControlNet/LoRA, GGUF quantization, resident serve, and an mcp server mode

image-forge-gui

Swift

macOS app for exploratory local image generation — a native SwiftUI front-end driving image-forge’s resident serve engine: a model picker with a Safe-only filter, stacked LoRAs with weight sliders, img2img with an inpaint mask painted on the init image, and a gallery with live progress

gem-image

Go

Image generation and editing CLI on Vertex AI Gemini’s native image models — generates from a text prompt or edits an existing image from the command line, built for batch work driven by shell scripts and pipes. The cloud counterpart to the fully local image-forge

shell-agent-v2

Go/React

macOS chat and agent desktop app built around interactive data analysis — each session owns its own DuckDB, and every analysis tool stays visible to the model each round so it can plan a multi-step workflow up front. Hybrid local/Vertex backend, per-session container sandbox, MCP, unified approval

gem-agent

Go

Interactive CLI agent runtime on Vertex AI Gemini — a deliberately minimal, auditable loop of read, edit, shell, MCP and approval, defended by sandbox-exec containment plus human-in-the-loop approval, with no analysis or GUI subsystems. Drop-in with existing projects: it reads their AGENTS.md, CLAUDE.md and .mcp.json as they are

lagent

Go

CLI agent runtime on a local LLM (LM Studio, mlx-serve, Ollama) for work that should stay off a cloud API — the same minimal, auditable loop as gem-agent, defended by sandbox-exec containment plus operator approval. Drop-in with existing projects: it reads their AGENTS.md, CLAUDE.md and .mcp.json unchanged

mermaid-render

Go

Go library that turns mermaid source into an image — flowcharts, ER and sequence diagrams on a white card, read as mermaid 12.0.0 reads them. Built so terminal agents can show diagrams in their transcripts; a diagram it cannot draw right is refused and shown as source

instant-translate

Swift

macOS menu-bar translator on the OS Translation framework — on-device, no LLM and no network. Auto language routing with a configurable secondary language, a source pin and manual target, a rebindable global hotkey seeded from the clipboard, and a status line that always says what it is doing

cclaude

Bash

Runs Claude Code inside an isolated container — only the current project directory is mounted, so it cannot reach anything outside the project, while ~/.claude persists on the host across sessions. Podman or Docker auto-detected, Go/Node/Python preinstalled, subscription or API-key auth

active-lens

Go

Content-free Mac activity tracker — records only WHEN you work, never WHAT you do; classifies each moment operating / present / away with no permissions, and derives work sessions that are never cut at midnight (timeline for the work log, now for the session in progress)

active-lens-gui

Swift

macOS work-log menu-bar app — a native SwiftUI front-end over active-lens showing the session you are in, with a calendar-style work timeline (day columns, hover for start / end / duration) and a per-day work log

claude-usage-lens

Go

Token usage and cost analysis for Claude Code / Cowork — parses local session logs into SQLite and reports by day, session, project or model, with near-real-time watch. Reprice applies rate changes to stored history, and the effective weekly cap comes from official /usage readings

claude-usage-lens-gui

Swift

macOS menu-bar app for Claude usage cost — a native SwiftUI front-end over claude-usage-lens: today’s cost in the menu bar, expanding into Swift Charts analysis (daily trend, per-model stacking, top projects). The weekly budget monitor calibrates to the real limit and projects overrun from the week’s pace

gem-usage-lens

Go

Token usage and cost analysis for gem-agent (Vertex AI Gemini) — parses the session transcripts’ accounting records into SQLite and prices them at Vertex AI list price: thinking as output, cached prompt as a share, grounding per request, regional multiplier. Calendar-month budget with a pace forecast

gem-usage-lens-gui

Swift

macOS menu-bar app for gem-agent usage cost — a native SwiftUI front-end over gem-usage-lens: today’s cost in the menu bar, expanding into Swift Charts analysis (daily trend, per-model stacking, call source, top projects). The calendar-month budget monitor shows use and remaining, and projects overrun from the month’s pace

load-spinner

Swift

macOS menu-bar CPU/GPU load indicator — a lit segment travels around a fixed circle or square at a speed proportional to load. Memory is a level rather than a rate, so it renders as a gauge that fills. A click opens live gauges with a 3-minute history

net-meter

Swift

macOS menu-bar meter for one network interface — upstream and downstream rate as numbers and a graph scrolling one bar a second, with a panel for history, addresses, peaks and totals. Follows the physical link even while a VPN is up. No permissions, nothing else. macOS 26+, darwin/arm64

status-lens

Swift

macOS menu-bar watcher for Statuspage-hosted status pages (Claude by default; GitHub or any Statuspage URL as profiles) — per-profile label plus shape symbol dual-encoded in color and shape, worst-of aggregation, a detail popover with components and active incidents, and notifications on degradation or recovery only

scli

Go

Terminal Slack client that acts as you, not a bot — read channels and DMs with threads expanded, post text or Block Kit JSON, upload files, list unread conversations and search the workspace, across multiple workspaces. OAuth 2.0 PKCE login, tokens in the OS keychain

swrite

Go

Posts messages and files to Slack from the command line, for bot workflows and shell pipelines — text or Block Kit, file upload with a comment, and a --stream mode that batches stdin every 3 seconds. Profile-based config or pure environment variables for containers; auto-joins on not_in_channel

scat

Go

Service-facing Slack CLI using bot credentials — posts messages and files, streams stdin, manages channels and invitations, and exports threads as scli-compatible JSON with attachment downloads. Multiple workspace profiles and environment-only server mode support automation; user-authenticated workflows belong to scli

stail

Go

Read-only Slack tail — streams new channel messages in real time over Socket Mode like tail -f, shows the last N, or starts from an absolute timestamp, and exports full channel history to JSON in the export schema shared with scat and scli (a subset of their fields)

md-to-slack

Go

Converts Markdown on stdin to a Slack Block Kit JSON payload on stdout — GFM tables become aligned code blocks, H1/H2 become header blocks, H3-H6 bold sections, standalone images become image blocks, and raw HTML is dropped because Slack cannot render it. Pairs with scli for posting

slack-mcp-extender

Go

Per-workspace MCP proxy that transparently forwards Claude’s official Slack MCP while injecting the one capability it lacks: moving real files between Slack and local disk. Every official tool passes through unmodified, and the three added tools live in an explicit ext_ namespace that cannot collide

slack-router

Go

Daemon that receives Slack slash commands over Socket Mode and dispatches them asynchronously to local shell scripts by a YAML routing table — a ChatOps hub for admin, deploy and LLM workflows. Command metadata arrives on stdin, not argv, so credentials never surface in ps

splunk-cli

Go

Pipe-friendly CLI client for the Splunk REST API — run an SPL search synchronously, or start it and poll status and results for long jobs. JSON output composes with jq and json-to-table, and Ctrl+C on a running search offers to cancel it or send it to the background

confl-cli

Python

CLI for Atlassian Confluence Cloud built on the UNIX split — stdout is data, stderr is logs, so it composes with jq and grep. Lists and exports whole space page trees, full-text search over CQL, reads a page or page tree as text/HTML/JSON/storage format, and downloads attachments safely

json-filter

Go

Command-line filter that extracts, validates, prettifies and repairs JSON inside arbitrary text — pulls the object out of LLM prose, an API response or a log line, then fixes 20+ real-world defects (code fences, single quotes, trailing commas, unquoted keys, comments). --bypass keeps a pipeline alive

json-to-table

Go

Formats a JSON array of objects into a readable table — reads stdin, writes plain text with borders, GitHub-flavoured Markdown, CSV, self-contained HTML, or a PNG image with Japanese font support for pasting into a report or chat. Column selection and ordering; the companion to splunk-cli

json-to-sqlite

Go

Ingests JSON and turns it into an SQLite database — infers the table schema from the objects themselves, maps JSON types to TEXT/REAL/INTEGER (falling back to TEXT when types conflict), and evolves an existing table by adding columns when new fields appear. Reads from files or stdin

jstats

Go

SPL-style stats for JSON — reads a JSON array or JSONL on stdin and computes aggregations grouped by one or more fields, with count, sum, min/max, avg, median, stdev, variance, range, percentiles, distinct count, first/last, mode, and values/list collectors. The aggregation stage between json-filter and jviz

jviz

Go

Visualizes JSON in the browser — pipe a JSON array and it opens a local page with interactive bar, line, pie or table views and X/Y column pickers. The chart updates live when the data changes, so it sits naturally at the end of a jstats pipeline

lookup

Go

Enriches a JSON stream by joining fields from an external table — reads a JSON array or JSON Lines on stdin, matches against a CSV or JSON lookup file, and writes the enriched objects out. Matching is exact (case-sensitive or not), glob wildcard, regex, or CIDR

grid-edit

Swift

Native macOS CSV/TSV editor (AppKit, NSDocument + NSTableView) — csv-editor’s successor, and a real AppKit grid, so scrolling, IME input and focus behave like macOS rather than a web page. Encoding and delimiter auto-detect (UTF-8/BOM/Shift_JIS/CP932), rectangular selection, TSV clipboard with paste confirmation, find and replace, sort

csv-to-json

Go

Converts CSV to a JSON array — reads a file or stdin and writes the array to stdout, one object per row keyed by the header. A single dependency-free binary for macOS, Linux and Windows, and the usual entry point to the json-filter / jstats / jviz pipeline

eml-to-jsonl

Go

EML parser for shell pipelines — reads .eml from stdin, files or a directory and writes one JSON object per message: headers (from/to/cc/subject/date/message-id/received), bodies with text/plain first, and attachment metadata without the binary. Everything decoded to UTF-8, ISO-2022-JP and Shift_JIS included

msg-to-jsonl

Go

Outlook MSG parser for shell pipelines — reads .msg and writes the same JSONL schema as eml-to-jsonl, so both compose in one pipeline. Handles Unicode and codepage MAPI properties, prefers SMTP addresses and discards X.400/Exchange internals, splits To/CC/BCC from recipient records. Pure local parser, no network

pptx-to-markdown

Python

Converts .pptx presentations to structured Markdown as a preprocessing step for LLM analysis — slide text and bullet hierarchy become Markdown, tables become Markdown tables, chart data is extracted as a table, images are embedded as base64 data URIs, and speaker notes get their own section per slide

rex

Go

Extracts fields from unstructured text with regular expressions and emits JSON — like Splunk’s rex, it applies several patterns to each line and merges the named captures into one object. With --field it works on JSON input instead, applying the regex to one field and merging it back

sdate

Go

Generates a timestamp from a Splunk-style relative time and snap expression — -1d@d means yesterday snapped to midnight, and units run from seconds to years with weeks starting Monday. Prints in a Go time layout or as epoch, in a timezone you choose

sensor-lens

Go

Collects temperature, humidity and CO2 from SwitchBot sensors into a local SQLite history — authenticates against the SwitchBot Open API v1.1, polls on a schedule within the daily quota, and backfills from CSV. Strictly read-only: it never sends a command, so it cannot switch, open or lock anything

sensor-lens-gui

Swift

macOS menu-bar readout of your SwitchBot sensors — a front end over the bundled sensor-lens CLI, which holds the credentials and owns the database; while the app runs it also does the collecting. Up to three device-by-metric readings in the menu bar, six-hour sparklines and CO2 alerts

markdown-viewer

Go

Single-binary local Markdown viewer and file browser — a two-pane UI with a persistent file tree beside the rendered page, GitHub-like styling, Mermaid diagrams and syntax highlighting, with every asset embedded so there is nothing to install. Directory-traversal protection and HTML sanitization are on by default

task-clock

Go

Resident macOS scheduler that does not trust launchd’s timing engine — evaluates cron itself (launchd only keeps it resident) and records every fire as scheduled-vs-actual with overrun accounting. Watermark triggers, overlap policies, persistent per-task pause, a localhost HTTP trigger API, and a stop that never kills running tasks

task-clock-gui

Swift

Menu-bar front end for task-clock — quiet by default, speaking only on overrun or an unreachable daemon. Pilot lamp plus a power switch for the run state (stopping never kills running tasks), per-task on/off switches with per-second countdowns, a scheduled-vs-actual run history, and a resizable panel

timeout

C

Runs a command with a time limit on macOS, which ships no timeout — POSIX.1-2024 behaviour with the GNU coreutils options, so scripts written for Linux run unchanged. Stops descendants too, forwards every signal it receives, and ends with the command’s own signal

webhook-relay

Go

Authenticated webhook receiver that writes payloads to GCS — an internet-facing ingestion gateway on Cloud Run with VPC isolation and egress only to Google APIs, scale-to-zero billing, constant-time API-key comparison, per-IP token-bucket rate limiting, a request size cap and a file-extension whitelist against path traversal

nvme-lens

Swift

macOS menu-bar monitor for NVMe SSD temperature and endurance — reads SMART through IOKit directly (no smartmontools, no root, no daemon) and judges on the hottest Temperature Sensor, not the composite value that understates the hotspot by 17–21 °C. Internal and Thunderbolt/USB4 NVMe only

menubar-spacer

Swift

Changes the spacing between macOS menu bar icons and puts it back exactly as it was — four presets drawn in the window at widths measured on macOS 27, so they can be compared before anything is written. Requests no permissions; macOS’s own icons keep their spacing

share-mounter

Swift

macOS menu-bar app that auto-mounts SMB shares at login — mounts via NetFS with no Finder window, appearing in the sidebar as network volumes; multiple shares, per-share auto-mount, Keychain credentials, re-mount on wake/network recovery

url-shelf

Swift

macOS menu-bar shelf of URL notes kept as plain .webloc files — the folder tree is the classification, so Finder stays the editor and the records outlive the app. Per-entry private-window opening with folder-inherited defaults, disabled rather than downgraded when no private browser is set

zip-porter

Swift

Windows-safe ZIP creation and extraction for macOS — a drag-and-drop GUI with an embedded CLI: junk files excluded, NFC UTF-8 names with a CP932 legacy mode, AES-256 or ZipCrypto passwords, CP932 auto-detection on extract. Hardened extraction too: zip-slip guard, decompression-bomb limits, umask-masked permissions, quarantine propagation

m5-vehicle-logger

C++

Vehicle driving-data logger on M5Stack Basic v2.7 — GNSS position at 1 Hz, IMU accelerometer/gyroscope/magnetometer at 10 Hz and barometric environment data at 1 Hz, buffered in memory and sent over Wi-Fi when a network is reachable. Built for vehicle-mounted use with no battery backup

m5-clock

C++

NTP-synchronized digital clock for M5Stack Core2 — date, weekday and time to the second, synced over Wi-Fi at startup and hourly, falling back to the onboard RTC when Wi-Fi is unavailable. Night mode dims automatically within configurable hours; settings come from a JSON file on the SD card

m5-data-receiver

Bash/CFn

Serverless AWS backend for m5-vehicle-logger — receives sensor data over HTTPS POST, validates the API key, and stores JSON in S3 under date-partitioned keys. Every resource lives in one CloudFormation template, so deploy, teardown and download need only the AWS CLI; no CDK, SAM or Terraform

m5-system-panel

Swift/C++

Turns an M5Stack BASIC into a desk panel for one Mac — CPU, GPU, memory and network sent by a menu-bar companion over Wi-Fi, encrypted with a key shared at setup; the buttons switch pages. macOS 26+, darwin/arm64

compliance-review

Skill

Two-phase regulation-compliance review — compiles your regulation documents into a versioned domain-expert set (full clause text, no RAG, deterministic coverage check), then reviews applications with parallel independent experts behind drift and nonce-isolation gates; successor to the virtual-reviewer PoC

incident-research

Skill

Security incident deep-dive research — collects and reads news and primary sources on one public incident into a timeline-centric, source-tiered JSON report plus a STIX 2.1 bundle of extracted IoCs; companion to service-research, successor to the ioc-collector CLI

incident-review

Skill

Claude Code Skill that reviews your own organization’s IR communication record — a Slack export, a plain-text log or a live channel — into a schema-validated JSON report with per-participant activity, role inference and a process-quality review. Every IoC is defanged before the agent reads a line

mcp-tactics

Skill

Claude Code Skill: the cross-cutting tactics book for nlink-jp’s MCP servers and proxies — SKILL.md is a router of decision tables with a four-tier escalation doctrine ranked by who can see that you asked, from no external observer up to contact from your own IP

meeting-notes

Skill

Claude Code Skill that structures a meeting transcript (TXT/VTT/SRT) into a validated three-layer JSON record — raw utterances, decisions with their rationale, summaries — then compiles Markdown or self-contained HTML minutes. Extracts small pieces, validates each and retries only what broke, verifying every quote against the transcript

news-digest

Skill

Claude Code Skill that collects your own feeds, decides what is worth reading, and compiles a digest of only that — significance and your own relationship to it are scored separately, continuing stories are tracked, and a topic that resurfaced with no new facts is named as stale

rfp

Skill

Claude Code Skill that facilitates the RFP planning stage for a new nlink-jp project — collects requirements through interactive Q&A, validates completeness against the organization’s CONVENTIONS.md Phase 1, and emits a structured RFP document covering problem statement, features, constraints and non-goals

service-research

Skill

Claude Code Skill that researches a product or service — overview, pricing, terms of service, privacy policy, data security and AI-agent behavior — into a schema-validated JSON report with a three-tier risk rating and a Markdown summary. The agent opens and reads the actual policy pages itself

weather-forecast

Skill

Claude Code Skill that answers weather-forecast questions for places in Japan from the Japan Meteorological Agency’s latest forecast — today to the day after tomorrow, the 7-day forecast and the written overview. A bundled script does all the reading; each answer cites the area, release time and source

llm-othello

Go

Browser-based Othello against a local LLM — you play Black, the model plays White, and every move decision happens server-side: the server builds a prompt from the board and the legal moves, parses the JSON reply and validates that the move is legal. Works with any OpenAI-compatible API

slack-monitor

Python

Real-time Slack channel activity summarizer on a local or cloud LLM — tails a channel through stail and produces periodic summaries of topics, sentiment, cumulative findings and the situation so far, in a live three-panel TUI or as Rich panels reading stail JSONL from stdin

spice-client

Swift

Native SPICE client for QEMU and Ravada virtual desktops — opens .vv files and an HTTPS Ravada portal, confirming host, port, TLS and clipboard (off by default) natively before connecting. Text-only clipboard for the focused window, files sent to the guest by drop or menu; for Apple Silicon

agent-board Archived

Go

Machine-local shared knowledge board for concurrent AI agent sessions — worked as built but saw almost no use; no successor

agent-skeleton Archived

Python

Autonomous agent skeleton — a plan / approve / execute loop with per-tool approval and memory compression

agentic-web-search Frozen

Go

Frozen (search API ToS concerns) — agentic web search via local LLM + Brave Search API

ai-ir Archived

Python

AI-powered incident response — analyzes Slack IR exports into reports and reusable tactics; superseded by the incident-review skill

ai-ir2 Archived

Python

Next-gen IR analysis — one-stop Gemini pipeline for reports and knowledge documents; superseded by the incident-review skill

csv-editor Archived

Go/React

CSV/TSV editor GUI for macOS and Windows — encoding auto-detect, virtual scroll for 100k+ rows, IME-safe edit. Superseded by grid-edit

cti-graph Archived

Python

Local-first attack graph analysis — STIX 2.1 ingestion, PIR-driven weighting, choke-point detection, FastAPI API

cti-primer Archived

Python

Local-first CTI PIR generation — turns business context into Priority Intelligence Requirements via local LLMs or dictionary-only mode

data-agent Archived

Go/React

Data analysis desktop GUI — interactive chat, plan-driven SQL with sliding-window analysis, per-case DuckDB. Superseded by shell-agent-v2

gem-transcribe Archived

Python

Audio transcription CLI on Vertex AI Gemini — speaker name inference, multi-language output, structured JSON. Superseded by gem-scribe

ioc-collector Archived

Python

Researches a security incident from a URL or CVE ID, extracting IoCs into Markdown and STIX bundles. Superseded by incident-research

ir-hub Archived

Go

IR lifecycle hub — a Slack ChatOps bot that opens a channel per case and tracks the response for postmortems

ir-tracker Archived

Python

Live IR tracker — continuous ingestion of an ongoing case, segmented analysis, and timeline visualization via Gemini

lite-llm Archived

Go

CLI client for OpenAI-compatible LLM APIs — streaming and batch against a local or cloud endpoint. Superseded by llm-cli

log-analyzer Archived

Python

Large JSONL log analyzer — LLM-driven analysis with timestamp-based chunking for files exceeding context limits

magi-system Archived

Python

Three-persona AI discussion (MELCHIOR / BALTHASAR / CASPER) — a thought experiment in multi-angle analysis seeking convergence

magi-system2 Archived

Python

Multi-persona AI discussion — dynamic persona generation, dual memory, and adaptive facilitation; the second take on magi-system

mail-triage Archived

Python

GCS-based email triage — classifies eml/msg files with Gemini LLM and posts results to Slack

mail-watcher Archived

Bash

Mail monitoring workflow — watches a directory for eml/msg files, analyzes each with an LLM, and posts to Slack

mcp-guardian Archived

Go

MCP governance proxy — transparent auditing, OAuth2 auto-discovery, tool masking. Bridging superseded by mcp-bridge; the governance layer was never adopted

mcp-skeleton Archived

Python

MCP server skeleton — raw JSON-RPC 2.0 over stdio/SSE with API key auth, as an experimental starting point

meeting-note Archived

Python

Meeting minutes structuring — audio/transcript to structured JSON via Gemini; superseded by the meeting-notes skill

product-research Archived

Python

Research products and services — ToS, privacy, and data security analysis; superseded by the service-research skill

quick-translate Archived

Swift

macOS menu-bar translation tool — powered by local LLM, always-on-top overlay; superseded by instant-translate (macOS 26+)

sai Archived

Python

Context-aware Slack bot — RAG memory over channel history, with natural language command execution via a local LLM

shell-agent Archived

Go/Swift

macOS LLM chat and agent — MCP, shell tool calling with MITL, Hot/Warm/Cold memory, multimodal. Superseded by shell-agent-v2

slack-personal-agent Archived

Go/React

Personal Slack knowledge agent — monitors multiple workspaces with channel-scoped RAG over DuckDB under three-tier isolation, plus MITL draft replies

virtual-reviewer Archived

Python

AI-powered security review — LLM expert models with full regulation context, UNIX pipes; superseded by the compliance-review skill

workflow-builder Archived

Design

LLM-powered workflow builder — compiles a shell script from natural language, keeping the LLM at build time. Design stage only