abuse-lookup

Go

Checks IP address reputation against the AbuseIPDB API (CLI + MCP) — abuse score, report history, usage type, and ISP, cached locally with a TTL; large report pages are file-mediated to an agent workspace. The online sibling of asn-lookup

ai-ir

Python

AI-powered incident response — analyzes Slack IR exports to generate summaries, activity reports, and reusable tactics

ai-ir2

Python

Next-gen IR analysis — one-stop Gemini pipeline producing Markdown, self-contained HTML, and knowledge documents

cti-graph

Python

Local-first attack graph analysis — STIX 2.1 ingestion, PIR-driven weighting, choke-point detection, FastAPI API

cti-primer

Python

Local-first CTI PIR generation — turns business context into Priority Intelligence Requirements via local LLMs or dictionary-only mode

doh-lookup

Go

Collects a domain's DNS records over DoH (CLI + MCP) — queries Cloudflare/Google out-of-band over HTTPS so investigative lookups stay distinguishable from ordinary DNS; forward profile + PTR reverse, bulk input, states the resolver/endpoint and DNSSEC AD in every result; no credentials. The DNS-resolution sibling of asn-lookup and whois-lookup

icloud-relay-lookup

Go

Reports whether an IP is an Apple iCloud Private Relay egress IP (CLI + MCP) — offline longest-prefix match from a cached copy of Apple's egress list, with its geo hints (country/region/city); ETag revalidation, no credentials. The Apple-side sibling of tor-exit-lookup

ioc-collector

Python

Research security incidents from URLs or CVE IDs — extracts IoCs into Markdown and STIX 2.1 bundles

ir-hub

Go

IR lifecycle hub — resident Slack ChatOps bot that opens a channel per case, tracks the response, and ingests messages for postmortems and knowledge reuse

ir-timeline

Go

IR timeline recorder — single-binary, browser-based tool for tracking events with text, images, and time deltas

ir-tracker

Python

Live IR tracker — continuous ingestion, segmented analysis, and timeline visualization via Gemini

mac-lookup

Go

Resolves a MAC address or BSSID to its manufacturer (CLI + MCP) — offline longest-prefix match (36/28/24-bit) against a cached copy of the IEEE registries, and classifies the address first: a randomized or otherwise locally administered address is reported as having no vendor to find, not as an unidentified device; conditional downloads, no credentials. The L2 sibling of asn-lookup

mail-triage

Python

GCS-based email triage — classifies eml/msg files with Gemini LLM and posts results to Slack

news-collector

Python

News collection agent — collects, tags, summarizes, translates, and delivers curated news digests

product-research

Python

Research products and services — outputs ToS, privacy, and data security analysis as structured reports

tor-exit-lookup

Go

Reports whether an IP is a Tor Exit node (CLI + MCP) — offline membership lookup from a cached copy of the Tor Project's torbulkexitlist, enriched with exit-addresses metadata; no credentials. The offline sibling of asn-lookup and abuse-lookup

urlscan-lookup

Go

Investigates a suspicious URL via the urlscan.io API (CLI + MCP) — an active scan submits the URL to urlscan's sandbox browser for its behaviour, verdict, observed IPs/domains, and screenshot (private by default; public must be requested explicitly), plus a passive search of the historical public-scan database; async job flow, TTL cache, free-plan API key. The URL-layer sibling that feeds the IP/domain-layer lookups

whois-lookup

Go

Looks up the registration data of a domain, IP, or AS number (CLI + MCP) — RDAP-first via the IANA bootstrap with a port 43 WHOIS fallback for RDAP-less ccTLDs (.jp), in-house IDN punycode, local TTL cache; no credentials. The registration-focused sibling of asn-lookup and abuse-lookup

mail-analyzer

Go

Suspicious email analyzer — rule-based indicators + Gemini LLM content analysis for .eml/.msg files

mail-analyzer-gui

Rust

macOS desktop GUI — drag & drop email analysis via Tauri

mail-analyzer-local

Go

Local LLM version — email analysis via OpenAI-compatible API (LM Studio, Ollama)

ask-gemini-mcp

Go

MCP server exposing ask_gemini(prompt) — forwards to Vertex AI Gemini for second-opinion consultations from AI coding agents

ask-llm-mcp

Go

MCP server exposing ask_llm(prompt) — forwards to an OpenAI-compatible endpoint (local LM Studio) for second-opinion consultations from AI coding agents

data-toolbox-mcp

Go

DuckDB analytics + containerized Python as an MCP server — workspace-scoped, Podman sandbox, stdio-only, BYO-LLM

pcap-analyzer-mcp

Go

pcap/pcapng analysis as an MCP server — digest-pinned tshark in a network-less Podman container, capture mounted read-only and never copied, wire content returned framed as untrusted

voice-studio-mcp

Go

Local multi-speaker Japanese speech synthesis for AI agents as an MCP server — narrated audio (radio drama, audiobook, podcast, briefing), Japanese only. AivisSpeech Engine backend, script JSONL batch synthesis with content-hash cache, pronunciation dictionaries, ffmpeg mastering, voice-model license review, bundled multi-actor-narration skill

video-studio-mcp

Go

Presentation-video compositor as an MCP server — page images + per-page audio → one narrated MP4, a pure ffmpeg compositor paired with voice-studio-mcp. Per-page chapters, opt-in captions (burned-in overlay via bundled M PLUS 1p and/or a toggleable mov_text closed-caption track), per-call canvas override (16:9/9:16/1:1), async rendering

mcp-guardian

Go

MCP governance proxy — transparent auditing, OAuth2 auto-discovery, and tool masking

llm-cli

Go

CLI client for local LLMs (LM Studio, Ollama) — streaming, batch, multi-image VLM, structured output

lite-llm Archived

Go

Superseded by llm-cli — CLI client for OpenAI-compatible LLM APIs

lite-rag

Go

RAG CLI for Markdown docs using DuckDB — index and query local knowledge bases

lite-switch

Go

Natural language classifier for shell pipelines — routes stdin text to a matching tag via LLM

gem-cli

Go

Gemini CLI client — multimodal prompts, streaming, grounding, structured output via Vertex AI

gem-rag

Python

Gemini-powered RAG CLI for Markdown documents — Vertex AI embeddings and DuckDB

gem-search

Go

Agentic web search via Vertex AI Gemini — Google Search Grounding, Markdown/JSON output, pipe-friendly

gem-query

Go

Natural language data analysis CLI — interactive SQL generation for DuckDB/SQLite via Vertex AI Gemini

gem-summary

Go

Single-call text summarisation via Vertex AI Gemini — auto chunk + parallel + merge for over-context inputs, prompt-injection defended

gem-transcribe

Python

Audio transcription CLI on Vertex AI Gemini — speaker name inference, multi-language output, structured JSON

nlk

Go

LLM utility toolkit — guard, jsonfix, strip, backoff, validate. Zero external dependencies

nlk-py

Python

Python edition of nlk — same 5 modules, same API design. Zero external dependencies

data-analyzer

Go

Large-scale JSON/JSONL data analysis — sliding window + progressive summarization with local LLMs

image-forge

Go

Local diffusion image-generation engine + model CLI for macOS (Apple Silicon) — SDXL/anime & general models via stable-diffusion.cpp, per-model gotchas hidden behind profiles, txt2img/img2img/inpaint/ControlNet/LoRA, GGUF quantization, multi-component (FLUX/SD3.5/Z-Image), resident serve, and an image-forge mcp server mode

image-forge-gui

Swift

macOS app for image-forge — a native SwiftUI front-end over the resident serve engine, with a Composer → Generate → Gallery flow

gem-image

Go

Image generation and editing CLI — Vertex AI Gemini 2.5 Flash, pipe-friendly

shell-agent-v2

Go/React

macOS chat & agent desktop app — interactive data analysis with session-scoped DuckDB, hybrid Local/Vertex backend, per-session container sandbox, MCP support, unified MITL approval

shell-agent Archived

Go/Swift

Superseded by shell-agent-v2 — macOS LLM chat & agent with MCP, shell Tool Calling + MITL, Hot/Warm/Cold memory, multimodal

data-agent Archived

Go/React

Superseded by shell-agent-v2 — data analysis desktop GUI with interactive chat, plan-driven SQL + sliding-window analysis, per-case DuckDB

quick-translate

Swift

macOS menu-bar translation tool — powered by local LLM, always-on-top overlay

instant-translate

Swift

macOS menu-bar translator — on-device Translation framework (no LLM, no network), auto language routing with a configurable secondary language + manual target, a rebindable global hotkey with clipboard seeding, and launch at login

cclaude

Bash

Containerized Claude Code — run Claude Code in an isolated container with project isolation

active-lens

Go

Content-free Mac activity tracker — records only WHEN you work, never WHAT you do; classifies each moment operating / present / away with no permissions, and derives work sessions that are never cut at midnight (timeline for the work log, now for the session in progress)

active-lens-gui

Swift

macOS work-log menu-bar app — a native SwiftUI front-end over active-lens showing the session you are in, with a calendar-style work timeline (day columns, hover for start / end / duration) and a per-day work log

claude-usage-lens

Go

Token usage & cost analysis for Claude Code / Cowork — parses local session logs into a durable SQLite store, reports by day/session/project/model with near-real-time watch, period analysis, verify against Cowork audit ground truth, configurable per-model pricing, and reprice to apply rate changes to already-stored history

claude-usage-lens-gui

Swift

macOS menu-bar app for Claude usage cost — a native SwiftUI front-end over claude-usage-lens showing today's cost in the menu bar, expanding into Swift Charts analysis (daily trend, per-model stacking, top projects)

load-spinner

Swift

macOS menu-bar CPU/GPU load indicator — a lit segment travels around a fixed circle or square at a speed proportional to load; max / CPU / GPU / both modes (per-source shape & color) and a click panel with live gauges plus a 3-minute Swift Charts history

scli

Go

Terminal Slack client — channels, messages, DMs, search

swrite

Go

Bot-oriented Slack poster — text, Block Kit, attachments, and files from shell pipelines

scat

Go

General-purpose content poster — send text, files, and Block Kit messages to Slack

stail

Go

Read-only Slack CLI — stream channel messages in real time or export history to JSON

md-to-slack

Go

Markdown to Slack Block Kit JSON filter — pipe into scat to post formatted messages

slack-mcp-extender

Go

Transparent proxy for the official Slack MCP — adds file upload/download extension tools under your own identity

slack-router

Go

Slash Command daemon — routes commands to local shell scripts via Socket Mode

splunk-cli

Go

CLI client for the Splunk REST API — run searches, poll jobs, fetch results

confl-cli

Python

Confluence Cloud CLI — list, search, read, export

asn-lookup

Go

Local IP↔AS lookups from the IPinfo Lite database (CLI + MCP) — downloads the free Lite DB once and answers IP→ASN/country and ASN→prefixes fully offline; large reverse-lookup results are file-mediated to an agent workspace

json-filter

Go

Extract, validate, prettify, and repair JSON from arbitrary text streams

json-to-table

Go

Format JSON arrays into text, Markdown, HTML, CSV, PNG, or Slack Block Kit tables

json-to-sqlite

Go

Load JSON data into SQLite with automatic schema inference

jstats

Go

SPL-style stats aggregations — count, avg, p95, stdev, values, and more

jviz

Go

Visualize JSON arrays as interactive charts in the browser — bar, line, pie, table

lookup

Go

Enrich JSON/JSONL streams by matching fields against CSV/JSON data sources

csv-editor

Go/React

CSV/TSV editor GUI for macOS/Windows — UTF-8/Shift_JIS/CP932 auto-detect, virtual scroll for 100k+ rows, IME-safe edit, find/replace

csv-to-json

Go

Convert CSV data to a JSON array

eml-to-jsonl

Go

Parse .eml files and output structured JSONL — headers, body, attachments

msg-to-jsonl

Go

Parse Outlook .msg files and output structured JSONL

pptx-to-markdown

Python

Convert .pptx presentations to structured Markdown for LLM analysis

rex

Go

Extract fields from text using named regex capture groups — outputs JSON

sdate

Go

Calculate timestamps using Splunk-like relative time modifiers

markdown-viewer

Go

Single-binary local Markdown viewer — renders GFM, Mermaid, and syntax-highlighted code

webhook-relay

Go

Authenticated webhook receiver — writes payloads to GCS via Cloud Run with VPC isolation

share-mounter

Swift

macOS menu-bar app that auto-mounts SMB shares at login — mounts via NetFS with no Finder window, appearing in the sidebar as network volumes; multiple shares, per-share auto-mount, Keychain credentials, re-mount on wake/network recovery

url-shelf

Swift

macOS menu-bar shelf of URL notes kept as plain .webloc files — the folder tree is the classification, so Finder stays the editor and the records outlive the app; per-entry private-window opening with folder-inherited defaults, disabled rather than downgraded when no private browser is set, and no network access

m5-vehicle-logger

C++

Vehicle driving data logger for M5Stack Basic v2.7 — GPS + IMU sensing with Wi-Fi transmission

m5-clock

C++

NTP-synchronized digital clock for M5Stack Core2 — night mode, RTC backup, SD card config

m5-data-receiver

Bash/CFn

Serverless AWS backend for m5-vehicle-logger — API Gateway + Lambda + S3 with deploy/destroy scripts

rfp

Skill

Interactive RFP facilitation — collects requirements through Q&A and generates structured RFP documents

agent-skeleton

Python

Autonomous agent skeleton — plan-approve-execute loop, per-tool approval, memory compression

agentic-web-search Frozen

Go

Frozen (search API ToS concerns) — agentic web search via local LLM + Brave Search API

magi-system2

Python

Multi-persona AI discussion — dynamic persona generation, dual memory, adaptive facilitation

mcp-skeleton

Python

MCP server skeleton — raw JSON-RPC 2.0 over stdio/SSE with API key auth

virtual-reviewer

Python

AI-powered security review — LLM expert models with full regulation context, UNIX pipes

meeting-note

Python

Meeting minutes structuring — audio/transcript to structured JSON via Gemini

workflow-builder

LLM-powered workflow builder — generates shell scripts from natural language

llm-othello

Go

Browser-based Othello against a local LLM — server-side move generation via OpenAI-compatible API

log-analyzer

Python

Large JSONL log analyzer — LLM-driven analysis with timestamp-based chunking for files exceeding context limits

magi-system

Python

Three-persona AI discussion (MELCHIOR / BALTHASAR / CASPER) — multi-angle analysis seeking convergence

mail-watcher

Bash

Mail monitoring workflow — watches for eml/msg files, analyzes with LLM, posts Slack notifications

sai

Python

Context-aware Slack bot — RAG memory over channel history, natural language command execution via local LLM

slack-monitor

Python

Real-time Slack channel summarizer — periodic LLM summaries with live TUI display