Anubis is a self-hosted web firewall that stands in front of your website and makes suspicious visitors complete a lightweight challenge before their requests are allowed through. Place it between your load balancer or TLS terminator and the application it protects, with one instance guarding each service. Requests that look like scraper bots are weighed and challenged, which raises the cost of mass crawling so automated harvesting stops being free. Requests that pass are forwarded straight to your target service over TCP or a Unix domain socket, so legitimate visitors reach the real site. You define the bot policy: allowlist known good bots and crawlers you want to keep, challenge the ones you are unsure about, and turn away the rest. Challenge difficulty and weight thresholds tune how hard visitors must work, letting you balance protection against friction for real readers. The server listens on port 8923 by default and exposes Prometheus metrics on port 9090, so request and challenge rates show up in your existing monitoring. Deployment is a single Docker image or native package with minimal resource needs, and configuration arrives through environment variables plus the policy file. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

CLIProxyAPI turns AI coding subscriptions you already hold into one standard API endpoint that any OpenAI, Gemini, or Claude compatible client can call. Connect Codex, Claude Code, Grok Build, and Gemini accounts through simple OAuth sign in flows, then point your editor, agent, or script at a single base URL instead of juggling separate tools. Add several accounts per provider and the proxy spreads requests across them with round robin load balancing, so a busy team can pool capacity instead of pressing against one account's limits. Streaming, non streaming, and WebSocket responses are supported where the provider allows them, which keeps interactive coding sessions responsive. Function calling and tool use pass through, so agents can still run commands, edit files, and call external tools through the unified endpoint. Multimodal requests combine text and images, covering screenshot driven debugging and visual questions. Gemini API keys, AI Studio accounts, and hosted Gemini access sit alongside subscription accounts, and OpenAI compatible upstreams such as OpenRouter can be added in configuration. A management API exposes control endpoints for companion dashboards, while a reusable Go SDK lets developers embed the proxy inside their own services. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

OpenVoiceUI is the voice-first front end for a self-hosted AI agent that lives entirely on your own hardware; you talk, it answers out loud, and it builds live pages on screen while the conversation runs. Hold a hands-free conversation with wake word, push-to-talk, and the ability to interrupt, or switch to text when the room is quiet. Speech recognition runs in the browser for free or through Deepgram, Groq Whisper, or your own Whisper server, while nine speech providers from local Supertonic to ElevenLabs give the agent its voice, cloned voices included. As it talks, the agent opens live canvas pages, dashboards, galleries, reports, and tools, and files them on an OS-style desktop you can reopen from the start menu. Ask for music and it generates songs with a built-in player and playlists; ask for images and it creates those too, alongside an audio clip maker and a soundboard. Profiles swap the agent's persona, voice, and model provider, animated faces react while it speaks, and sub-agents and workspace files stay visible in the admin dashboard. The agent itself runs in the OpenClaw gateway with your choice of model provider, so your keys, conversations, and files never leave your server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Infinite OS packs a complete hosting environment into a single Docker container, and you decide what it hosts after it starts. From the dashboard you add the runtimes, databases, domains, and applications that a normal image would have forced you to choose at build time. Open the Marketplace and WordPress, n8n, or dozens of other applications install in a few clicks, dependencies and services included, with a hostname and route created automatically. PHP, Node.js, Bun, Python, Ruby, and Java runtimes install on demand beside databases and workers, so one project runs its whole stack inside one environment. Public domains get free TLS certificates automatically, and changing the primary domain once updates the web server, PHP, and database records to match. The built-in web terminal needs no SSH setup, and a coding agent such as OpenCode can work there with the project files, runtimes, and databases within reach. A file manager, cron scheduler, PHP version switching, and per-route rate, bandwidth, and connection limits cover the daily work of running sites from the browser. Team accounts give each person their own login, and nearly every dashboard action has a matching CLI command and REST API call for scripting. Each project gets its own container with its own filesystem and services, so unrelated sites stay isolated while several lightweight environments share one machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EPL 2.0 licensed.

Alook gives the coding agent on your machine a seat in the team chat, with its own handle, inbox, and room memberships, so colleagues can ask it for work the same way they would message a person. You create servers, channels, and direct messages where people and agents are both first-class members, and an agent keeps one persistent identity across every room it joins. Claude Code, Codex, Cursor, OpenCode, Pi, Grok, and Antigravity connect through a small daemon, so the agent keeps running on your own hardware while the room stays reachable from anywhere. Because the agent holds memory across rooms, it can pick up a thread in one channel, report progress in another, and move tasks forward without you relaying messages by hand. Inviting a teammate takes a link; they join the room and talk with your agent directly instead of waiting for you to copy answers back and forth. The same room follows you from desktop to phone, so a question asked at your desk is still there, with the agent's reply, when you check it later. Self-hosting runs the web app, realtime WebSocket service, email worker, and wake-up queue on your own server with a local database, started with a single npx command. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

One server replaces the phone system, the meeting link, and the fax line: AiPBX turns a Linux machine into a business phone system with extensions, video meetings, chat, and call queues. Every employee gets one extension that rings a desk phone, the browser softphone, and the mobile app, while ring groups, multi-level IVRs, and time conditions route callers without anyone editing dialplan files. Queues staff your support line with dynamic agent sign-in, hold music, and position announcements, and a live wallboard lets supervisors watch waiting callers and agent states, then listen, whisper, or barge into a call. Meetings run in the browser: schedule conferences with PINs, send guests a magic link into a WebRTC room with screen sharing, and let streams forward without transcoding. Chat lives in the same portal: photos, files, presence, read receipts, and fax is composed in a rich-text editor or uploaded as PDF and delivered over T.38. Desk phones provision themselves: a discovery daemon spots new Yealink, Fanvil, Grandstream, Snom, and Cisco handsets and writes their configuration files. An AI assistant plans dialplan changes in plain language with dry-run preview and one-click undo, cloud voices from Google, Polly, Azure, ElevenLabs, or OpenAI read announcements aloud, and GDPR, KVKK, HIPAA, and PCI-DSS presets govern recording consent and retention purges. A 100-plus-endpoint REST API with scoped keys and HMAC-signed webhooks makes everything scriptable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Statewave is the memory runtime that compiles what your AI agents experience into typed, provenance-tagged memories, so the same subject asked the same question receives the same context every time. Recording is append-only: your application writes events as episodes (chat, ticket, commit), and a compiler distills them into structured memories with confidence scores, each traceable to its source episodes. When an agent needs context, Statewave assembles a ranked bundle inside the token budget you set; the same request at the same moment returns identical bytes, so retrieval sampling noise never leaks into an answer. Every bundle leaves an HMAC-signed receipt that a replay endpoint can re-evaluate under the same rules. Memories carry sensitivity labels for personal data, financial details, and secrets, and YAML policies deny or redact them per tenant. One instance serves many products: tenants are isolated by header, pinned to a region for residency with cross-region requests refused, and erasable by subject on request. The default compiler runs fully local on regex heuristics with no API key, or point extraction at any of 100+ LiteLLM providers. Reach it over REST from any language, through typed Python and TypeScript SDKs, LangChain, CrewAI, and AutoGen integrations, or the built-in MCP server that lets Copilot, Claude, and Cursor share one memory. Support agents recognize returning customers across sessions, and coding agents keep project decisions between conversations. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

One net worth figure should not require five logins. Picsou Finance pulls every account you own into a single self-hosted dashboard and reports how the total got there, month by month. More than 2,000 European banks connect through Enable Banking's PSD2 consent flow and US institutions through SimpleFIN, so balances and transactions refresh without manual CSV imports. Read-only sidecars reach the accounts PSD2 cannot touch: BoursoBank securities accounts, Trade Republic positions, Bourse Direct portfolios, and Amundi employee savings plans land in the same ledger as daily banking. Binance and Meria exchange sync plus on-chain Bitcoin, Ethereum, and Solana addresses put crypto exposure next to your savings instead of in a separate tracker. Monthly snapshots rebuild the net worth history account by account, separating capital you invested from growth the portfolio produced. French property is valued automatically each month from public transaction data, with each co-owner's share and the mortgage netted into the equity figure. Savings goals carry deadlines and progress bars, an ETF opens to its top holdings with country and sector breakdowns, accounts share with family members under NONE, ALL, or MANUAL rules, sign-in is guarded by TOTP two-factor authentication, and everything exports as a GDPR ZIP. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 + Commons Clause licensed.

xprem is a self-hosted update server for Expo applications that speaks the official Expo Updates protocol, so any app built with expo-updates can fetch its bundles from your infrastructure instead of a hosted service. Publishing works from the eoas CLI, from CI, or from the dashboard, and devices receive the corrected bundle on their next check with no app store review in between. Channels such as production and staging map to branches, which means each build flavor receives exactly the code meant for it. A rollout can serve an update to a slice of the fleet first and widen as confidence grows, and a bad release rolls back instantly instead of stranding users. One channel can even serve two branches at once, splitting devices deterministically for A/B tests. Every manifest is signed with a private key you own, and the matching certificate embedded in the app makes expo-updates refuse anything that fails verification, so a compromised bucket cannot push code into your product. The bundles themselves live in your S3, Google Cloud Storage, Azure Blob, Cloudflare R2, MinIO, or local storage and download through your CDN, while a single server hosts as many applications as you ship. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

When a buyer asks ChatGPT which company to call, your brand is either inside the answer or invisible: Canonry tracks those mentions and citations across ChatGPT, Claude, Gemini, Meta Muse, and Perplexity, then joins them with the search, ads, and traffic data that explains them. You see mention share against named competitors, the exact answers and sources behind every result, and where rivals get cited while you do not. Server-side traffic analysis reads your own logs to show which pages GPTBot, ClaudeBot, and other AI crawlers visit, which pages AI assistants open for users, and who clicks through. Site Health crawls score every page for AI readiness and map the internal links between them, with each finding listing the pages it affects. Keyword volume, difficulty, rankings, and search gaps come from DataForSEO, while the content engine points at the pages to write or improve next and can draft them to WordPress for review. Your connected agent works the same evidence through the REST API, CLI, or MCP: find competitor citations, prepare a fix, publish and submit URLs to Google and Bing, then rerun checks and report what changed. Schedules rerun everything on a clock with alerts to Discord or Slack, and Aero, the built-in analyst, reads the evidence and explains what moved. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Ask a hard question and get back a cited report instead of a chat answer: Deep Research Web UI plans its own searches, reads the pages it finds, checks claims against the sources, and shows its work as it goes. The research unfolds as a live tree in your browser, each branch a search direction with streaming responses, so you watch a broad question narrow into answerable parts. When snippets are not enough, it fetches full source pages and extracts verbatim evidence, sharing one token and request budget across the run. Every claim cites its source inline, and clicking a citation opens an evidence panel with the source, retrieval time, and the excerpt behind the finding. Findings can be followed up: name what to verify and the agent searches again, updating only the passages that cite that finding while the original report stays untouched in your history. You bring the models, from OpenAI-compatible endpoints, DeepSeek, and OpenRouter to a local Ollama or LiteLLM proxy, paired with Tavily, Firecrawl, Google PSE, You.com, or Serply for the searching. Finished reports export as Markdown or PDF, search separates your question from time and source filters and retries once with a revised query when evidence is thin, and Server Mode keeps the team's API keys in environment variables behind an optional access password instead of in every visitor's browser. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Most proxies ask the operating system nicely for a socket; paqet skips the conversation, building its own TCP packets byte by byte to tunnel traffic between your machine and your server. The server end listens on a port you choose and speaks only in raw packets it crafts and captures itself through pcap, before the kernel's connection tracking ever sees them. On your machine, the client presents an ordinary SOCKS5 proxy on localhost plus optional port forwards, so browsers and command-line tools connect exactly as they would to any proxy. Between the two ends, KCP with smux multiplexing turns a stream of self-contained packets into fast, reliable, encrypted sessions, with AES or lighter modes selected per deployment. TCP flag cycling varies how packets present themselves on the wire, giving operators control over the traffic pattern the tunnel produces. Built-in utilities generate the shared secret, ping the server with a single test packet, and dump live traffic decoded, so a silent tunnel gets diagnosed in minutes rather than by packet-capture archaeology. One YAML file per side declares the role, network interface, gateway MAC, and keys, and the same binary runs both ends. It suits security research, hostile networks, and anyone whose ordinary proxies keep getting reset. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

A node beside each AI agent gives your fleet a private network where agents publish tools and models, discover what other nodes offer, and call those services under policy you control. Nothing is reachable by default, because a node exposes no service until its configuration says so, and no node may call a service your mesh policy has not granted. Identity comes from your own identity provider, since a node enrolls with an OpenID Connect or bootstrap token and receives a short-lived credential bound to its own key that peers can verify offline. Nodes connect directly when they can and relay through well-known routers when NAT or firewalls say no, so the same mesh stretches across laptops, containers, clusters, and phones. The node beside your agent exposes the mesh as a local MCP server and an OpenAI-compatible endpoint, so model requests route to whichever node serves that model. The control plane verifies who is joining, issues the credentials, and holds the grants, which are evaluated on service names rather than network addresses. For small deployments, a single binary bundles the control plane, a router, and a web console, so a private mesh for your agents runs on one modest host. A shared developer testnet lets you rehearse the whole enrollment and calling flow in minutes before standing up infrastructure of your own. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

When an agent breaks production at 3 a.m., "the model did it" is no incident report: Bernstein decides in advance what your AI agents may touch, then keeps receipts proving what they did. You write policy as code: which roles may do what, what needs human approval, and what must be recorded before a task counts as done. A deterministic scheduler with no model in the coordination loop turns each goal into parallel tasks, so replaying yesterday's plan reproduces yesterday's task graph exactly. Every coding task runs in its own git worktree behind merge gates; nothing lands on your main branch until tests, lint, and type checks pass. It drives the CLI agents you already use (Claude Code, Codex, Gemini CLI, Aider, Goose, dozens more), mixing cheap local models with heavy cloud ones in one run. Approvals can demand a hardware key touch, and role fences hold whatever an agent tries inside its task. The journal, lineage record, and optional tamper-evident audit chain capture every step, sealed into an Ed25519-signed receipt verifiable offline from the file alone. Non-code work gets the same treatment: an artifact contract names the deliverable (report, dataset, audit evidence pack), and the task completes on a signed receipt instead of a commit. You supervise from the browser dashboard or terminal UI, watching tasks, agents, approvals, and costs live. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Lotus is an open-source pricing and billing engine that lets SaaS teams meter usage, design plans, and experiment with pricing without rebuilding their billing stack every time the model changes. You define how customers are charged: per seat, per API call, per gigabyte, in tiers, with prepaid credits, or as a bespoke enterprise arrangement negotiated over email. Plans are versioned and deployed like releases, so changing a price never means editing the plan that half your customers already signed. Usage events stream in from your product and are aggregated against each customer's plan, turning raw events into billable quantities your finance team can audit line by line. Before a new model goes live, you backtest it against historical usage to see exactly who would have paid what, and forecast the revenue before a single invoice changes. Experiments compare pricing variants on real customers, so the packaging debate ends with numbers instead of opinions. The control panel sits on top of your existing quote-to-cash stack, pulling from your payment, CRM, and data systems rather than demanding a rip-and-replace migration. Engineers integrate through the API: send events, read balances, and let Lotus handle the proration math when plans change mid-cycle. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

An app store review takes days, but a broken checkout flow takes minutes to cost you users: Hot Updater lets React Native teams ship JavaScript fixes straight to installed apps from a server they control, no store submission required. Deploy a new bundle with the CLI, and devices pick it up on their next update check, whether they run iOS or Android. The web console shows what you have shipped, which app versions receive which bundle, and lets you roll back a bad release before the support tickets pile up. Bundle diffing keeps downloads small: unchanged files stay on the device, changed Hermes bundles travel as compact patches, and the server quietly drops any patch that is not smaller than the full file. Releases target specific semantic app versions, so a fix built for 2.3 users never lands on 3.0 devices. Storage and metadata live where you choose, from S3-compatible buckets and Cloudflare R2 with D1 to Supabase, Firebase, Azure, or your own PostgreSQL, swapped through adapters rather than rewrites. Insights record update events so you can watch adoption as a rollout spreads, API keys gate which apps may check in, and remote configuration tunes app behavior without another binary release. The server itself runs as a compact Node service in Docker on port 3000 next to PostgreSQL, with token-protected admin routes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Moving a 40 GB video from your laptop to three colleagues takes a shared link instead of a cloud upload when FileSync sends it from one device to many in real time, straight between browsers, from a server you host yourself. Open a room, share its link or QR code, and everyone inside can send, receive, and download everything as a zip. The files travel directly between browsers over encrypted connections while the server only introduces the devices to each other, so your documents never sit on someone else's disk. A verification key rides inside the link itself and is never sent to the server, proving the person who joined is the person you invited. Transfers stream to disk as they arrive, so file size is limited by storage rather than memory, and every file is checked with SHA-256 the moment it lands. Close a tab mid-transfer and the download resumes from the last saved byte instead of starting over. You can send whole folders, paste straight from your clipboard, and coordinate through the built-in room chat while the files move. When two devices cannot connect directly, the included relay carries the traffic automatically, and rooms can ask for a password before anyone joins. Recipients need no account and install nothing; they open the link in any modern browser and start receiving. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Numa is a DNS resolver you run yourself that gives every service on your network a real name, blocks ads and trackers before they load, and keeps your queries private with encrypted DNS. Register a frontend on port 5173 once, and https://frontend.numa opens in your browser with a valid certificate and WebSocket passthrough, no mkcert, no nginx, no editing hosts files. Path-based rules send app.numa/api to a backend on another port, so multi-service projects get one clean address instead of a spreadsheet of port numbers. Tracker and ad domains die at resolution time through the Hagezi Pro blocklist, refreshed daily, and every device that points its DNS at your instance inherits the filtering. Temporary overrides redirect any hostname for testing or debugging and revert on their own, and scripts can create them through the REST API. You choose how answers are found: forward to your existing DNS, resolve recursively from the root servers, or seal queries with Oblivious DNS over HTTPS so no single party sees both your address and your question. Phones and laptops connect over DNS-over-TLS on port 853, a QR-code flow points an iPhone at your resolver in minutes, and mDNS discovery lets one machine reach services registered on another. The dashboard on port 5380 manages services, overrides, and diagnostics, with token sign-in away from loopback. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.