With 2,600+ GitHub stars, MetaMCP solves the MCP server sprawl problem by aggregating any number of upstream servers into a single authenticated endpoint that any MCP client connects to once. Group servers into namespaces — development tools in one, data sources in another — then publish each namespace as its own SSE, Streamable HTTP, or OpenAPI endpoint with API-key authentication in headers or query parameters, or full OAuth per the MCP Spec 2025-06-18 standard. The aggregation engine discovers tools, resources, and prompts from all active servers in parallel, prefixes tool names with server identifiers to prevent collisions, and applies configurable middleware including tool filtering to reduce context-window bloat and description overrides to improve LLM comprehension. The web management UI lets you configure MCP servers with stdio, SSE, or Streamable HTTP transports, toggle servers active or inactive per namespace, create and revoke API keys per endpoint, and inspect discovered tools with their schemas. Nested MetaMCP support enables hierarchical architectures where one MetaMCP instance consumes another, creating multi-level tool organization with automatic name resolution. Compatible with Claude Desktop, Claude Code, Cursor, Open WebUI, and any MCP-compatible client through a single connection URL. The Docker container packages the TypeScript backend with PostgreSQL for configuration persistence, exposing the management UI on port 12005 and MCP endpoints on configurable ports. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With nearly 3,000 GitHub stars and active development since 2014 through version 14.2.0, Yopass eliminates the universal bad habit of sharing passwords and API keys through Slack messages, email threads, and ticket systems by encrypting secrets entirely in the browser using OpenPGP before anything reaches the server. The Go backend stores only ciphertext — it never sees plaintext — while the React frontend handles all encryption and decryption client-side, generating one-time URLs that self-destruct after a single viewing or when the configured expiration of one hour, one day, or one week passes. File upload support streams encrypted files with configurable size limits, and optional custom password protection adds a second encryption layer beyond the URL-embedded key. The server supports Redis or Memcached as storage backends with automatic key expiration, deploying via Docker Compose in under five minutes or as Kubernetes manifests for production environments. Built-in TLS support works alongside reverse proxy configurations for Nginx, Caddy, and Traefik with automatic Let's Encrypt certificate provisioning. Prometheus metrics expose HTTP request counts, latency histograms, and secret lifecycle counters for Grafana dashboard integration and alerting. Read-only mode enables split-instance deployments separating secret creation from retrieval across different network zones. Multi-language support localizes the interface for international teams. The open-source core under Apache 2.0 provides full self-hosted functionality with no account management required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 5,100 GitHub stars and eight years of active development since 2016, Shlink has become the definitive self-hosted URL shortener for teams that need unlimited links, full visitor analytics, and complete data ownership without per-link pricing or monthly caps. The PHP backend built on the Mezzio framework with Doctrine ORM serves redirects through any number of custom domains on a single instance, generating unique short codes or accepting custom slugs including multi-segment paths and emoji characters. Every click is tracked with anonymized visitor data including geolocation by country, city, and coordinates, browser and operating system identification, referrer source, and device type classification, all stored in your choice of MySQL, MariaDB, PostgreSQL, Microsoft SQL Server, or SQLite. Dynamic redirect rules route visitors to different destinations based on geolocation, device type, or browser language, enabling targeted campaigns from a single short URL. The REST API exposes every operation with OpenAPI documentation and an interactive sandbox at api-spec.shlink.io, while the CLI provides equivalent functionality for scripting and automation. The official progressive web app at app.shlink.io manages multiple Shlink instances from a single interface with URL creation, tag management, and detailed visit charts. Real-time event integration supports both Mercure and RabbitMQ for webhook-style notifications on new visits. Third-party imports migrate existing short URLs from Bitly and YOURLS with visit history preserved. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

CPA Manager Plus is a self-hosted observability dashboard and management panel that tracks every AI request flowing through your CLI Proxy API gateway, breaking down failures, costs, and account health across providers like OpenAI, Anthropic, xAI, and Codex in one interface. When a request fails, drill into the persistent history to see status codes, affected models, latency, and redacted failure evidence without exposing raw response bodies. The cost analytics engine breaks down token consumption and estimated spend by model, provider, account, API key, project, channel, and time range while tracking input, output, reasoning, cache, and service-tier pricing semantics separately. Model prices sync automatically from models.dev with LiteLLM and OpenRouter fallbacks, and you can add local overrides for aliases or internal models. For teams running Codex or xAI accounts, the health inspector reads quota windows, reset evidence, credential state, and workspace status on a configurable schedule, routing credential failures into an action queue for review rather than letting them silently degrade throughput. Deploy the Lightweight Panel to replace your existing CPA management UI without adding another service, or run Full Mode as a single Docker container that adds the Manager Server with persistent SQLite storage for request history, historical analytics, and automated account inspections. Export or import request history as JSONL for external analysis, and back up the SQLite files alongside your encrypted management keys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Comp AI turns the months-long slog of SOC 2, ISO 27001, HIPAA, and GDPR certification into a largely automated process by connecting to your existing infrastructure and continuously collecting the evidence auditors actually ask for. Point it at your AWS account, Google Cloud project, GitHub organization, or any of 580+ supported integrations, and autonomous agents pull configuration snapshots, access logs, encryption status, and policy compliance data on a recurring schedule so your compliance posture reflects reality rather than last quarter's manual export. The AI policy engine analyzes your tech stack, team structure, and risk tolerance to generate organization-specific policies for information security, access control, incident response, data retention, and vendor management; no two companies get the same boilerplate. An open-source device agent runs on employee machines checking disk encryption, firewall status, screen lock settings, password length, and antivirus presence around the clock, flagging failures the moment they occur instead of surfacing them during an audit. Built-in penetration testing agents scan your codebase and API endpoints for vulnerabilities like SQL injection and output audit-ready reports. The vendor risk management module scores third-party services and surfaces compliance gaps before they become findings. A public trust center lets prospects verify your compliance status directly, eliminating security questionnaire bottlenecks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

'Can Maria edit this document?' is a simple question with a hard implementation, and SpiceDB is the open-source, Zanzibar-inspired database built to answer it and millions like it correctly. You model your product once in its schema language, defining object types like documents and organizations, relations like owner and member, and computed permissions built from unions, intersections, exclusions, and arrows through other objects. Your application then writes relationships as users join groups, create folders, and share files, and SpiceDB evaluates checks against that live graph in milliseconds. Check a single permission before rendering a button, check hundreds at once to filter a dashboard, look up every resource a user can open for search prefiltering, or list every subject who can access a file for an admin screen. Per-request consistency options, anchored by revision tokens, protect you from the classic race where a revoked user briefly keeps access, and caveats add conditional rules based on context like IP address or time. Relationships persist in PostgreSQL for simple deployments or CockroachDB and Spanner when you need multi-region scale, and the same schema files validate in CI with the command-line tool before they ever reach production. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Warpgate is a clientless bastion host and privileged access management gateway that lets engineering teams secure, assign, and audit access to internal SSH servers, databases, Kubernetes clusters, web applications, and remote desktops from a single portal without installing VPN clients. Connect directly from standard tools like OpenSSH, VS Code Remote, psql, mysql, kubectl, or native RDP clients using formatted credentials, or launch browser-based SSH terminals, RDP desktops, and VNC sessions straight from the web interface. Administrators map users and roles to specific internal targets with granular 1:1 permissions, enforcing multi-factor authentication via TOTP and Single Sign-On through OpenID Connect providers like Google Workspace, Microsoft Entra ID, and Okta with automatic group-to-role provisioning. Every interactive terminal command, database query, HTTP request, and remote desktop session is captured in real time so security auditors can watch active connections live or replay historical recordings on demand from the web dashboard. Built-in brute-force defense automatically blocks suspicious IP addresses and locks compromised accounts, while temporary access tickets, just-in-time session approvals, encrypted credential storage, and S3-compatible recording archival support enterprise compliance workflows across multi-node clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With 3,900 GitHub stars, 140 contributors, and 380 releases since its 2022 launch, Grafana OnCall delivers developer-friendly incident response that routes alerts from any monitoring system to the right engineer at the right time through the right channel. The platform accepts alerts via unique API URLs from Alertmanager, Grafana Alerting, Zabbix, Datadog, Pagerduty-compatible sources, Jira, inbound email, and generic HTTP webhooks, then applies routing templates to direct each alert to the appropriate escalation chain. Escalation chains define notification sequences — notify the primary on-call via Slack, wait 5 minutes, escalate to SMS and phone, wait 10 minutes, page the secondary on-call and notify the engineering manager — continuing until acknowledgment or resolution. On-call schedules support multi-layer rotations with overrides, shift swaps, and timezone-aware handoffs rendered directly inside Grafana dashboards. ChatOps integration publishes alert groups to Slack channels and Telegram groups with interactive buttons for acknowledge, resolve, and silence actions. Template engines based on Jinja2 control alert grouping, appearance rendering, and behavioral automation. The REST API enables programmatic management of integrations, schedules, and escalation policies. Deploy via Docker Compose with PostgreSQL, Redis, and Celery workers alongside your existing Grafana instance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GNU AGPL v3 licensed.

A complete WhatsApp Business Platform covering messaging, chatbot automation, and voice calling with IVR — a combination most self-hosted projects never attempt. The Fastglue/fasthttp backend processes WhatsApp Cloud API webhooks through PostgreSQL and Redis into a real-time WebSocket layer powering instant chat updates across a Vue 3 frontend built with shadcn-vue and TailwindCSS. Chatbot automation supports keyword triggers, multi-step conversation flows with branching logic, AI-powered responses from OpenAI, Anthropic, or Google models, knowledge base integration via vector stores, and seamless handoff to human agents when the bot gets stuck. The visual IVR builder uses a drag-and-drop node canvas where you wire greeting prompts, DTMF menu capture, HTTP callbacks to external APIs mid-call, business-hours routing by IANA timezone, agent team transfers with hold music, and reusable sub-flows. Every call recording streams encrypted to your S3-compatible bucket with retention you control. Multi-tenant architecture isolates organizations with separate data, roles, and API keys while a unified inbox presents both chat and call conversations to agents in a single dashboard. Meta-approved template management, bulk campaign messaging, analytics tracking, and a full REST API round out the platform. Deploy via Docker Compose with Postgres and Redis included. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

Subtitles are the one chore Sonarr and Radarr leave behind - Bazarr finishes the *arr media stack by automating them. It connects to both via their APIs and mirrors their libraries - it doesn't scan disk itself, it manages exactly what your *arr apps index. For every monitored episode and movie it checks existing internal and external subtitles against your language profiles, then hunts missing ones across dozens of providers - OpenSubtitles.com, Podnapisi, Addic7ed, Subscene, and many regional sources - covering 184 subtitle languages including forced/foreign-dialogue tracks. Matching is smarter than filename guessing: releases are compared by release group and source, some providers support exact file-hash matching, and every downloaded subtitle gets a percentage score. Set a minimum score per Sonarr/Radarr connection and Bazarr rejects weak matches; enable upgrades and it replaces previously downloaded subtitles when better ones surface. Out-of-sync files get fixed too - automatic subtitle synchronization realigns timing after download, triggered only below a configurable score threshold so good subs aren't touched. Per-show and per-movie language configuration, download history, manual on-demand search, and adaptive searching that throttles provider API calls round it out, all behind a clean Sonarr-style web UI written in Python. If your library serves multilingual viewers, this removes the last manual step.

Before a change lands in the main branch, Review Board gives your team a self-hosted code review server where reviewers read the diff, open issues on specific lines, and sign off with a Ship It. Post a review request from the web or with RBTools, either before you commit or after, and every update becomes a new revision that stays in the history. Interdiffs show exactly what changed between revisions, and moved-code detection keeps rearranged blocks from drowning out real edits. Comments can open issues that reviewers later mark fixed or dropped. Images and Markdown files can be reviewed alongside code, with split, onion-skin, color, and side-by-side diffs for pictures. A dashboard with customizable columns separates incoming from outgoing requests by review group. Connect Git, Mercurial, Subversion, or Perforce repositories, including ones hosted on GitHub or GitLab, and review them all on one server. Slack and Discord notifications, Jenkins builds, and Review Bot linters report back inside the review. Private repositories and hidden or invite-only review groups restrict who sees what, with sign-in through Active Directory, LDAP, or SAML 2.0. A REST API, WebHooks, and Python extensions cover custom workflows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

DevTrack turns your GitHub activity into a living dashboard of commit streaks, pull-request analytics, and goals that quietly update themselves. Sign in with GitHub and your last year appears as a contribution heatmap you can filter by repository and language, next to the streak you are protecting and the freeze you are saving for a holiday. Pull requests get the honest treatment: merge rate, average review time, and open-versus-closed breakdowns that show whether reviews or authors are the bottleneck. Weekly and monthly goals fill themselves in from live activity, while the consistency score and activity rings tell you whether your rhythm is steady or heroic but rare. When you want the story told back to you, an AI mentor who knows your history offers guidance, a résumé generator builds an ATS-friendly CV from merged pull requests for the role you name, and a weekly summary explains your own graphs in plain words. Opt into the public leaderboard to rank your streak, commits, and PRs against other developers, or keep everything private and share only the profile page and embeddable badges you choose. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Running a school means juggling lesson plans, timetables, attendance, behaviour notes, and grades all at once; Gibbon gives teachers, students, parents, and administrators one shared web system for that daily work. Teachers build lessons from reusable Smart Blocks, assemble them into units with learning outcomes, set and collect homework online, and grade the results in a colour-coded markbook that stays linked to every class. The timetabling engine builds schedules from reusable day structures, ties them to real calendar dates, handles exceptions, books rooms and facilities, and shows every student and teacher exactly where they should be. Attendance can be taken by form group, class, or individual student, with future absences recorded ahead of time and reports ready for emergencies or truancy follow-up. Behaviour records log the good alongside the bad using your school's own descriptors and severity levels, notify form tutors when something needs attention, and surface patterns across a student's history. Each student's profile pulls timetable, attendance, behaviour, library, and assessment information into one page, while activities sign-ups, a school-wide resource library, and departmental scope-and-sequence views keep the wider community connected. Because every module can be switched on or off per role and extended with community modules, the same platform fits a small primary school and a large secondary school in 26 languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Plunk consolidates transactional emails, marketing campaigns, and drip automation into one platform riding AWS SES at roughly one-tenth of a cent per message, with zero per-contact charges regardless of list size. The Turborepo monorepo architecture separates the Express.js API server (handling REST requests with Prisma ORM against PostgreSQL) from a dedicated BullMQ worker process that consumes email, campaign, and workflow jobs independently for fault isolation and horizontal scaling. Transactional emails support HTML bodies, template variable substitution via React Email components, attachments, and custom headers with dedicated SMTP relay on ports 465 and 587 for integration with existing frameworks. The campaign system sends newsletters and product updates to full contact lists or dynamically segmented audiences based on contact properties and behavioral events, with scheduling, A/B testing, and performance tracking for opens, clicks, and bounces. The workflow automation builder creates event-triggered sequences with delays, conditional branches, and webhook steps for lifecycle campaigns like onboarding drip sequences and re-engagement flows. Contact management stores unlimited contacts with custom data fields, CSV import, full activity history, and dynamic segmentation. Custom domain verification with DKIM and SPF ensures deliverability, while inbound email processing handles incoming messages with custom routing rules. Docker Compose deployment runs five containers including PostgreSQL, Redis, MinIO for S3-compatible storage, and ntfy for notifications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

What Jellyfin is for video, Komga is for comics, manga, BDs, magazines, and eBooks: point it at folders of CBZ, CBR, CBT, PDF, and EPUB files and it becomes a proper library with cover art, embedded metadata import, and per-user reading progress. The responsive web reader handles multiple reading modes - left-to-right for western comics, right-to-left for manga, webtoon scrolling - while collections and read lists organize crossovers and story arcs, with ComicRack .cbl read list import for existing curation. Its openness is the real differentiator: OPDS v1.2 and v2.0 feeds serve virtually every reader app (Panels, Moon+ Reader, Mihon/Tachiyomi, KyBook), with OpenSearch and page-streaming extensions so mobile apps fetch pages on demand instead of whole archives. E-ink support is built in, not bolted on - Kobo devices sync directly against Komga instead of Kobo's servers, with two-way read progress, on-the-fly KEPUB conversion via Kepubify, and optional proxying so official Kobo purchases still work; KOReader sync covers everything else. Multi-user management brings per-library access control, age restrictions, and label restrictions for family setups. Housekeeping tools detect duplicate files and duplicate pages, and a REST API feeds a healthy ecosystem of community scripts. Runs from a single Docker container with embedded SQLite.

Configure each indexer once, not five times: Prowlarr is the indexer hub of the *arr stack, removing the most tedious duplication in a media automation setup. Instead of configuring the same torrent trackers and Usenet indexers separately in Sonarr, Radarr, Lidarr, Readarr, and Mylar3, you add each one once in Prowlarr and it syncs them to every connected app automatically, complete with category mappings; with Full Sync enabled, adding or removing an indexer propagates everywhere, and a tracker URL change is a one-place fix. Coverage is the deepest available: 500+ torrent trackers with definitions added constantly, 24 native Usenet indexers, generic Newznab and Torznab support for anything else, and custom Cardigann YML definitions with JSON and XML parsing for obscure sources. Built on the same .NET/React base as its siblings, it also earns a place as a search tool in its own right: unified manual search queries every indexer simultaneously at a category level, and you can push multiple releases straight to your download clients without touching Sonarr or Radarr. Health checks and status notifications flag failing indexers, per-indexer statistics track success rates and response times so you can cull unreliable sources, and per-indexer proxy support (SOCKS4/5, HTTP, FlareSolverr) handles trackers behind Cloudflare.

VitoDeploy replaces a pile of SSH sessions and shell scripts with one browser tab for provisioning servers and deploying websites, on a control panel you host yourself. Spin up a server on AWS, Akamai (Linode), DigitalOcean, Vultr, Hetzner, or Proxmox in a few clicks. Attach any Ubuntu machine you already own as a custom server. Add sites built with PHP, Laravel, or WordPress, or run Node.js and Bun apps behind a reverse proxy. Pull code from GitHub, GitLab, Gitea, or Bitbucket. Set environment variables and HTTP basic authentication. Issue Let's Encrypt, wildcard, or custom SSL certificates. Create MySQL, MariaDB, or PostgreSQL databases, manage their users, and send backups to Amazon S3, Wasabi, FTP, SFTP, Dropbox, or local disk. Manage firewall rules, cron jobs, Supervisor workers, Redis, and multiple PHP versions from the same screens. Watch CPU, memory, and disk use for each server, then open a live SSH shell without leaving the page. Agencies split clients into projects, invite teammates as Admins or Users, and send alerts to Slack, Discord, Telegram, or email. Workflows automate deployments, backups, and maintenance. Plugins, DNS record management, export and import of your setup, and a REST API round out the toolkit. The panel itself needs only 1 GB of RAM and 1 CPU core, then manages your other machines over SSH. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

PanWatch's three scheduled AI agents plan the trading day before the bell, watch the session, and review it after the close for your China A-share, Hong Kong, and U.S. holdings. Day one begins with the portfolio: several brokerage accounts, holdings and profit and loss, and search for stocks or listed ETFs by code or name. The pre-market agent folds overnight moves, news, and technical structure into that plan and skips exchange holidays. Through the session, the intraday monitor watches for unusual moves and technical signals. Price alerts combine price, percentage change, turnover, and volume ratio with AND/OR logic, cooldowns, and expiry times. Each rule picks its own channel from Telegram, WeCom, DingTalk, Feishu, Bark, or a webhook. Spot something odd? The brain icon next to a holding starts TradingAgents, where four analyst roles feed a bull and bear debate, a risk review, and a portfolio-manager decision, with the reasoning trail in the app and your notifications. The opportunities screen ranks AI-scored ideas with entry levels and targets, and paper trading simulates signal-based entries and exits and tracks equity and performance. At day's end, the daily report reviews the session and prepares the next trading day's plan. OpenAI-compatible providers or local Ollama models power the analysis, and the PWA installs on a phone in English or Simplified Chinese. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.