A plain-English catalog of tools that work well with Hermes, plus technical resources worth learning. Each card gives you the point, the first move, and a copy/paste command when install makes sense.
446 visible resources. Filter by group or search by name, category, use case, command, or safety note.
Resource map
Everything interesting enough to earn a spot.
Commands target Linux/WSL unless the card says otherwise. Security tools are for labs, your own systems, or explicitly authorized work. “Open resource” buttons leave this site.
External link note: every Open resource button opens the original project/docs site in a new tab.
176 resources
Hermes + AI agents
Start here if you want tools that pair directly with Hermes, local AI, MCP, browser automation, or automation glue.
AI agent coreBeginner
Hermes Agent
The actual agent framework behind Hermie: CLI, desktop, messaging gateway, skills, memory, cron jobs, MCP, tools.
First move:Install Hermes, run the setup wizard, then add one useful integration instead of trying to configure everything at once.
Example use case:Ask Hermie to inspect a repo, run tests, summarize failures, patch the code, and push a verified fix instead of only describing one.
Local-first dashboard for understanding token usage and estimated cost across AI coding tools and agents.
First move:Run the read-only terminal dashboard and inspect one project before enabling any desktop or web surface.
Example use case:Find which coding agent sessions are burning the most tokens so you can switch routine work to cheaper models.
Safety note:It reads local AI session files; review what those files contain and avoid sharing exported reports if prompts include private code or secrets.
Copy/paste
npx codeburn
# Optional local web UI:
npx codeburn web
Runs local models on your machine. Useful for private/offline experiments and local AI tooling.
First move:Install it, run a small model, then connect tools later. Do not start with giant models.
Example use case:Run a small local model for private experiments, quick summaries, or testing prompts without sending every throwaway idea to a cloud API.
Copy/paste
curl -fsSL https://ollama.com/install.sh | sh
ollama run llama3.2
Local context layer for AI agents that controls what agents can read, compresses context, and tracks saved context receipts.
First move:Install the CLI in a throwaway agent workspace and test it against a small repo before connecting sensitive projects.
Example use case:Give a coding agent a narrower, auditable view of a large codebase so it spends fewer tokens reading irrelevant files.
Safety note:Context middleware can see code, prompts, shell output, and local files. Start on non-sensitive repos and review what it stores or forwards.
Open-source firewall/mediator for MCP and agent egress that looks for exfiltration, SSRF, prompt injection, and risky outbound actions.
First move:Install it in a local lab and route one toy MCP or HTTP workflow through it before using it around real secrets.
Example use case:Put a mediator between an experimental agent and outbound HTTP so attempted secret leaks or suspicious requests are logged and blocked.
Safety note:Agent firewalls sit near sensitive prompts, tool calls, and secrets. Treat logs as sensitive and test policies with fake data first.
Copy/paste
go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest
pipelock --help
Python framework for building MCP-connected agents with workflow patterns, structured logging, token accounting, and optional durable execution.
First move:Install it in a fresh Python project and run one local example before connecting cloud deployment or real MCP servers.
Example use case:Prototype a small research agent that reads from a sandbox filesystem MCP server, summarizes files, and logs token usage.
Safety note:Agent frameworks can route prompts, files, tool calls, and API keys through many components. Start with sandbox data and keep provider keys out of repos and logs.
Copy/paste
uv init ~/labs/mcp-agent-lab
cd ~/labs/mcp-agent-lab
uv add mcp-agent
uv run python -c "import mcp_agent; print('mcp-agent installed')"
OpenTelemetry conventions and instrumentation for tracing LLM calls, RAG pipelines, tool calls, and agent behavior.
First move:Read the supported-instrumentation list, then instrument one toy script before tracing a real agent.
Example use case:Trace a local RAG experiment so you can see retrieved documents, model calls, latency, and tool spans instead of guessing where it failed.
Safety note:LLM traces can include prompts, retrieved documents, user data, and tool outputs. Redact sensitive content before exporting traces to any shared backend.
Self-hostable platform for LLM traces, evals, prompt management, datasets, metrics, and playgrounds.
First move:Run the local Docker Compose quick start with throwaway data, then disable or review telemetry before any serious use.
Example use case:Track prompts, costs, latency, and eval scores for a small internal chatbot experiment from one dashboard.
Safety note:Langfuse stores prompts, generations, metadata, scores, and sometimes user data. Keep it private, rotate sample secrets, and review self-host telemetry settings.
Copy/paste
git clone --depth 1 https://github.com/langfuse/langfuse.git ~/labs/langfuse
cd ~/labs/langfuse
docker compose up -d
Self-hostable visual automation platform with app connectors, AI steps, and MCP-oriented agent workflows.
First move:Try the official Docker Compose install locally and build one harmless webhook-to-notification flow.
Example use case:Turn a GitHub issue, form submission, or webhook into a reviewed notification and optional AI summary without writing a custom service.
Safety note:Automation platforms handle OAuth tokens, webhooks, emails, and actions in other apps. Use test accounts first and never publish connector credentials.
Copy/paste
# Follow the official self-hosting guide rather than pasting secrets into examples:
# https://www.activepieces.com/docs/install/overview
Local execution-tree recorder for TypeScript AI agents, covering tool calls, LLM steps, retries, failures, timings, and share-safe reports.
First move:Initialize it in a throwaway TypeScript agent project and inspect one demo trace before instrumenting real workflows.
Example use case:Debug why a Node-based agent repeated a tool call or failed halfway through a task without uploading traces to a hosted dashboard.
Safety note:Agent traces can include prompts, tool outputs, filenames, logs, and user data. Keep traces local and run redaction/verify-safe before sharing artifacts.
Governance layer for AI agents that evaluates risky actions, routes human approvals, and records audit trails before agents touch real systems.
First move:Read the local/hosted quickstart and test one toy governed action before connecting shell, browser, cloud, or production tools.
Example use case:Put an approval gate in front of an experimental agent so deploys, file writes, or external actions require policy checks instead of blind execution.
Safety note:Governance tools sit in the path of prompts, actions, approvals, and logs. Test with fake data first and treat audit logs as sensitive.
Open-source security layer for AI agents with deny-by-default tool grants, human approvals, signed audit logs, and a local scanner for risky capabilities.
First move:Run the scanner on a disposable or small agent project before adding enforcement code or a server.
Example use case:Find whether an agent project can delete data, run shell commands, move money, or exfiltrate secrets, then add approval gates around the risky tools.
Safety note:Governance scanners read project code and can surface sensitive tool names, workflows, and secret-handling mistakes. Keep reports private and review generated fixes before applying them.
Copy/paste
npx @makerchecker/scan .
# Optional enforcement package after review:
npm i @makerchecker/embedded
Self-hosted gateway that lets AI agents read connected services while queuing writes for human approval.
First move:Run it locally, create a password, connect one low-risk test service, and keep write approvals enabled.
Example use case:Let an agent draft a GitHub, calendar, or social action while a human approves the final write from the AgentGate UI.
Safety note:AgentGate brokers access to personal and SaaS data. Use least-privilege service tokens, keep it behind LAN/VPN/auth, and never expose bearer tokens or approval queues publicly.
Copy/paste
npx agentgate
# Open http://localhost:3050 and create the first local admin password.
Open-source desktop and CLI agent for coding and workflow automation, now under the Linux Foundation Agentic AI Foundation.
First move:Install the CLI or desktop app, configure a throwaway provider key, and run it in a disposable repo before granting access to important projects.
Example use case:Compare how another local coding agent plans, edits, and tests a small bugfix next to Hermes, Claude Code, or Codex workflows.
Safety note:Coding agents can read files, run commands, and spend API credits. Use sandbox repos, least-privilege credentials, and review every diff before committing.
Copy/paste
# Official CLI installer from the project release docs:
# curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash
# Then check:
goose --help
Local-first CLI and GitHub Action for reviewing AI-generated agent capability changes before they land in a repo.
First move:Install it in a disposable repo and run a local boundary check before wiring it into CI.
Example use case:Review a pull request that adds or changes MCP tools, OpenAPI actions, or SDK capabilities so risky tool surfaces are flagged before merge.
Safety note:Shipgate reads repo files and reports on agent/tool surfaces. Run it on repos you may inspect and treat reports as potentially sensitive project metadata.
Local memory service for AI agents with persistent recall, semantic search, trajectory learning, and consolidation workflows.
First move:Run it against toy notes and fake agent data before connecting real projects, chats, or provider-backed agents.
Example use case:Give a lab agent memory of prior debugging attempts so it can recall what failed yesterday without rereading every log.
Safety note:Agent memory can store prompts, files, decisions, credentials accidentally pasted into chats, and private project context. Use fake data first and inspect storage before long-term use.
Copy/paste
git clone --depth 1 https://github.com/GuyMannDude/mnemo-cortex.git ~/labs/mnemo-cortex
cd ~/labs/mnemo-cortex
python3 -m venv .venv
. .venv/bin/activate
pip install -e .
mnemo-cortex status
Declarative language and runtime for typed, composable AI procedures where each step and output is explicit.
First move:Install it in a fresh Python environment and run a local toy workflow before adding cloud model providers.
Example use case:Define a repeatable document-processing or research workflow where parsing, model calls, structured outputs, and validation are written down instead of hidden in glue code.
Safety note:AI workflow engines can route prompts, documents, outputs, provider keys, and telemetry. Use test data, review telemetry settings, and never commit API keys.
Copy/paste
uv init ~/labs/pipelex-lab
cd ~/labs/pipelex-lab
uv add pipelex
uv run pipelex --help
Local-first dashboard and CLI that reads AI-agent telemetry to show where tokens are wasted, repeated, cached, or worth scripting.
First move:Run the read-only quickstart on a disposable or non-sensitive agent profile before enabling live capture.
Example use case:Find whether a coding agent is burning context on rereading the same files and decide what to cache, summarize, or turn into a script.
Safety note:Token analytics can read local agent transcripts, prompts, filenames, and tool output. Treat reports as sensitive and do not publish traces from real work.
CNCF-adjacent Python framework for stateful, observable agents built on Dapr workflows, pub/sub, actors, and telemetry.
First move:Install Dapr locally and run an official quickstart before connecting external tools, queues, or model providers.
Example use case:Prototype an agent workflow that can pause, resume, persist state, and emit telemetry instead of living only in one Python process.
Safety note:Agent workflows can call tools, store state, and use provider credentials. Keep quickstarts local, use fake data, and keep keys out of code and traces.
Copy/paste
uv init ~/labs/dapr-agents-lab
cd ~/labs/dapr-agents-lab
uv add dapr-agents
# Install and initialize the Dapr CLI before running examples.
TypeScript SDK for durable, observable async workflows that can suspend, resume, and preserve state for apps and AI agents.
First move:Read the docs and build one toy workflow locally before attaching it to deploys, billing, or production actions.
Example use case:Turn a flaky multi-step agent task into a workflow that survives pauses, retries, and long-running waits with visible state.
Safety note:Durable workflows can retry side effects such as emails, deploys, and API calls. Make test steps idempotent and use sandbox credentials first.
Copy/paste
# Start with the official docs and examples:
# https://workflow-sdk.dev
Local-first MCP server that turns PDFs into structured, cited document evidence for AI agents instead of unreliable text dumps.
First move:Try it on one non-sensitive PDF from a sandbox folder before connecting it to an everyday agent profile.
Example use case:Let an agent extract tables and cite page/bounding-box evidence from a datasheet, manual, or report you are allowed to process.
Safety note:PDFs can contain private contracts, invoices, names, metadata, and hidden text. Use local files you may process and avoid sharing extracted traces blindly.
Copy/paste
claude mcp add pdf-reader -- npx @sylphx/pdf-reader-mcp
Open scanner and self-hostable control plane for AI, MCP, and cloud posture evidence across repos and agent surfaces.
First move:Install the CLI and scan a disposable repo locally before connecting any cloud or control-plane features.
Example use case:Audit a toy MCP-enabled project to see risky tool surfaces, evidence, and posture findings before exposing an agent to real infrastructure.
Safety note:Scanners read project structure, MCP configs, cloud metadata, and credential references. Run on repos you may inspect and do not publish raw findings from private projects.
Open-source platform for tracing, evaluating, simulating, guarding, and improving LLM and agent applications.
First move:Use a toy agent and local/self-hosted quickstart before sending real prompts or customer data to any hosted account.
Example use case:Trace one small chatbot flow, run an evaluation, and compare failures across prompts before changing production behavior.
Safety note:LLM observability stores prompts, generations, metadata, and sometimes user data. Use fake data first and review telemetry/export settings.
Step-by-step learning repo showing how Langtrace, OpenTelemetry, Jaeger, and related FOSS tools make LLM apps visible.
First move:Read the stages, run Jaeger locally, and use throwaway API keys or mocked calls for the first pass.
Example use case:Compare a no-observability chatbot script with traced versions so latency, model calls, and failures become visible.
Safety note:The README uses placeholder API-key examples. Never commit .env files, and do not export real prompts or user data into shared tracing backends.
Local CLI and MCP server that builds function-level dependency graphs so AI agents can inspect callers, dependencies, dead exports, and architecture boundaries before editing code.
First move:Install it in a throwaway repo first, build the graph, and ask one impact question before wiring it into an agent.
Example use case:Before refactoring a helper, have Hermie ask codegraph which files call it and whether the change creates dead exports or boundary violations.
Safety note:codegraph is local-first, but it indexes source code structure. Only run it on repos you are allowed to inspect, and do not paste private graph output into public issues.
Copy/paste
npm install -g @optave/codegraph
cd your-project
codegraph build
codegraph --help
Official MCP server that lets agents work with Postman collections, OpenAPI specs, workspaces, environments, and API-testing workflows.
First move:Start in minimal mode against a disposable Postman workspace before granting access to real environments.
Example use case:Let an agent read a toy OpenAPI spec from Postman and generate a small client or collection update without touching production credentials.
Safety note:Postman environments can contain API keys, tokens, internal URLs, and production examples. Use OAuth/minimal scope when possible and never expose real environment secrets to an untrusted agent.
Local MCP server and CLI for structured FFmpeg video editing, media analysis, subtitles, effects, validation, and agent-friendly video workflows.
First move:Install it in a scratch folder, run the CLI help, then try a tiny local clip before connecting it to an agent.
Example use case:Ask Hermie to trim a demo recording, extract a short vertical clip, add subtitles, and validate the FFmpeg plan before writing output files.
Safety note:Video jobs can overwrite files, expose private recordings, or produce misleading edits. Work on copies, keep private media local, and review generated output before publishing.
Rust-powered code intelligence CLI that indexes projects for symbol search, semantic code search, call graphs, and optional MCP tools for coding agents.
First move:Install it in a disposable or small repo first, run the setup wizard, then index only code you are comfortable exposing to the configured embedding model.
Example use case:Ask where a function is called before changing it, then use the call graph to keep an AI coding agent from guessing through a large codebase.
Safety note:The setup wizard can use embedding providers and writes agent/MCP config files. Treat private source code as sensitive, review provider settings, and avoid indexing secrets or proprietary repos without approval.
Copy/paste
npm install -g codeseek
codeseek
codeseek init
codeseek status
Practical patterns and small CLIs for designing repeatable AI-agent loops instead of one-off prompts.
First move:Read the quickstart, then run the initializer in a toy repo to see the loop-readiness score before using it on real work.
Example use case:Design a daily triage loop with state, budget checks, worktrees, and a human gate so an agent can review issues without blindly changing production code.
Safety note:Agent loops can create changes repeatedly. Keep human approval on for writes, commits, tickets, deploys, and external actions until the loop is proven in a sandbox.
Windows-only MCP server and CLI that automates the real Microsoft Excel desktop app through COM for workbooks, formulas, Power Query, PivotTables, charts, screenshots, and macros.
First move:Try it on a copy of a harmless workbook, with Excel closed, before letting an agent touch real business files.
Example use case:Have an AI assistant create a pivot table, chart, and formatted report in Excel while preserving formulas and workbook structure.
Safety note:It controls live Excel and can run or edit macros. Work on copies, keep sensitive spreadsheets local, and do not grant agents access to payroll, finance, or customer workbooks without explicit review.
Copy/paste
# Windows + Excel required. Start with the latest release or VS Code extension:
# https://github.com/sbroenne/mcp-server-excel/releases/latest
Desktop workspace for running multiple coding agents side-by-side in isolated git worktrees, with terminals and mobile monitoring.
First move:Download the desktop app, try it on a disposable repo, and compare agent output before merging anything.
Example use case:Fan the same bug-fix prompt across Claude Code, Codex, and OpenCode in separate worktrees, then review the diffs and keep the safest patch.
Safety note:Parallel agents can make conflicting edits quickly. Use disposable branches/worktrees, keep secrets out of prompts, review every diff, and do not auto-merge agent output.
Copy/paste
# Start with the official downloads and docs:
# https://onorca.dev/download
# https://www.onorca.dev/docs/model/worktrees
Lightweight Go gateway that exposes OpenAI-compatible and Anthropic-compatible APIs across many local and cloud model providers.
First move:Run it locally without request-body logging first, then add one provider through an env file rather than shell history.
Example use case:Put one local endpoint in front of Ollama and one cloud model so agent tools can switch providers without rewriting client code.
Safety note:AI gateways handle prompts, responses, headers, and API keys. Disable body/header logging unless you need it, protect the env file, and keep the dashboard off the public internet.
Copy/paste
docker pull enterpilot/gomodel
# Put provider keys in a private .env file, then run:
docker run --rm -p 8080:8080 --env-file .env enterpilot/gomodel
Local MCP gateway that lets multiple AI clients share MCP servers while using lazy tool discovery to reduce context overhead.
First move:Install it with no external MCP servers first, then add one low-risk read-only server and confirm the approval/quarantine behavior.
Example use case:Connect Claude, Codex, and a desktop AI client to one shared local MCP gateway instead of repeating the same MCP config in every app.
Safety note:MCP servers can expose files, browsers, shells, SaaS accounts, and secrets. Add servers one at a time, prefer read-only tools first, keep human approvals enabled for destructive calls, and review any server that asks for credentials.
Copy/paste
# Download the installer for your OS from the latest release:
# https://github.com/tsouth89/toolport/releases/latest
Open-source data catalog for documenting tables, topics, queues, APIs, lineage, owners, and business context, with AI-facing metadata access.
First move:Try the demo or catalog a tiny non-sensitive sample dataset before connecting production databases.
Example use case:Build a small internal map of database tables and Kafka topics so an AI assistant can answer data-discovery questions from approved metadata instead of guessing.
Safety note:Data catalogs can expose schema names, lineage, owners, and business context. Start with non-sensitive metadata, restrict MCP/API access, and do not feed production credentials into a test instance.
Copy/paste
# Start with the deployment guide rather than production credentials:
# https://marmotdata.io/docs/Deploy
Local analyzer for seeing what Claude Code and Codex send to model APIs and which prompt/tool/schema pieces drive token cost.
First move:Read the threat model and run it only on a disposable project before capturing real agent sessions.
Example use case:Find that an agent session is expensive because a large MCP tool schema or repeated file dump is being sent every turn.
Safety note:This inspects local AI API traffic, so captured data may include prompts, tool outputs, filenames, code, and secrets accidentally shown to an agent. Keep captures local, delete test data, and never share traces blindly.
Copy/paste
# Safest start: inspect the repo and docs before installing capture tooling
git clone --depth 1 https://github.com/tigerless-labs/cost-xray.git ~/tools/cost-xray
cd ~/tools/cost-xray
less README.md
Offline-by-default provenance layer that links AI-written code changes to the prompts, context, and decisions that produced them.
First move:Try it in a small repo and inspect what metadata it records before attaching it to sensitive work.
Example use case:Review a pull request and answer “which prompt caused this change, what files did the agent read, and is the decision trail complete?”
Safety note:Provenance records can reveal prompts, repository paths, file names, and decision context. Keep the data store private and avoid recording confidential customer code or secrets until retention rules are clear.
Local AI orchestration layer that pools existing inference servers behind one OpenAI-compatible endpoint.
First move:Read the quickstart and connect one already-working local model server before trying multi-machine routing.
Example use case:Let Hermes, Open WebUI, or a custom app call one endpoint while Grid routes requests to Ollama on a laptop or vLLM on a GPU box.
Safety note:A local model gateway can expose prompts, responses, model names, and internal network endpoints. Bind to localhost first, do not publish it to the internet, and protect any upstream API keys.
CLI that lets AI coding agents inspect and operate real iOS, Android, TV, web, and desktop app UIs with structured snapshots and evidence capture.
First move:Read the platform setup docs, then try it against a local simulator or test app before pointing it at anything personal.
Example use case:Have an agent verify a React Native change by opening the app in an emulator, tapping through the edited flow, and saving a screenshot when the assertion passes or fails.
Safety note:Device automation can capture screenshots, logs, traces, audio levels, and sometimes network evidence. Use test devices/accounts first and do not expose private app data in agent transcripts.
Copy/paste
npm view agent-device version
npx agent-device --help
Auditable workspace manager for AI coding agents, with sandboxed git worktrees, multi-agent runs, compressed logs, policies, and review trails.
First move:Try it in a disposable repository and inspect exactly what prompts, commands, logs, and reviews are recorded before using it on real work.
Example use case:Run Claude and Codex on the same small bug in isolated worktrees, compare their patches, and keep an audit trail of what each agent did.
Safety note:Agent orchestration can run commands, spend model credits, and record private code or prompts. Use sandbox repos first, keep provider keys out of logs, and review every diff before merging.
Context-engineering and instruction-management toolkit for sharing architecture notes, standards, workflows, and guardrails across AI coding agents.
First move:Install the CLI in a toy repo and publish one small instruction set before pointing multiple agents at it.
Example use case:Keep Hermes, Codex, Claude Code, Cursor, and Copilot aligned on the same repo-specific architecture rules instead of pasting instructions into every chat.
Safety note:Shared instructions can include private architecture, internal URLs, and security rules. Keep sensitive instruction packs private and review what an MCP server exposes to agents.
GraphQL-backed MCP server that lets agents inspect and, with confirmation, manage Unraid systems, Docker, VMs, arrays, parity, plugins, and live telemetry.
First move:Connect it only to a lab Unraid server or read-only API role first, then confirm which destructive operations require explicit approval.
Example use case:Ask an agent for a plain-English health summary of an Unraid homelab from system info, Docker state, array status, and notifications.
Safety note:This MCP surface touches NAS infrastructure and can expose API keys, storage status, Docker state, VM details, and destructive operations. Use least-privilege credentials and never publish config files.
Local-first work recorder that captures screens, audio, and activity so agents can search work history and turn real workflows into memory or automations.
First move:Read the privacy notes, install the desktop app on a non-sensitive machine, and exclude apps/windows before recording real work.
Example use case:Build a searchable local record of a debugging session so an agent can later reconstruct the commands, pages, and context that led to a fix.
Safety note:This can capture screens, audio, app names, hostnames, prompts, and personal data. Disable cloud/sync features you do not need, review exclusions, and never record private calls, passwords, or customer data casually.
Copy/paste
# Start with the official desktop download and onboarding:
# https://screenpi.pe/onboarding
Open-source proxy for MCP, A2A, LLM, and tool traffic that adds routing, policy, observability, and governance around agent connections.
First move:Run the quickstart locally with one toy MCP server before placing it between agents and any real tools or model providers.
Example use case:Put a policy and telemetry layer in front of an experimental agent so tool calls and agent-to-agent traffic are visible instead of opaque.
Safety note:Agent gateways sit near prompts, tool calls, headers, and provider credentials. Treat config and logs as sensitive, bind local tests to trusted interfaces, and use fake secrets first.
Copy/paste
# Start with the official quickstart and release docs:
# https://github.com/agentgateway/agentgateway
Python SDK for building stateful Gemini/Antigravity agents without hand-rolling the full agent loop.
First move:Install it in a fresh virtual environment and run a hello-world example with a throwaway key loaded from a private shell, not a committed file.
Example use case:Prototype a small Gemini-backed agent that answers from a sandbox folder while you inspect how state, streaming, and tool integration behave.
Safety note:Examples require provider credentials and may send prompts, files, and tool output to Gemini or Vertex AI. Keep API keys out of repos, logs, screenshots, and shell history.
Community registry service for Model Context Protocol servers, with API docs and publishing guidance for discoverable MCP tooling.
First move:Browse the registry docs first, then inspect one read-only server entry before installing anything from the ecosystem.
Example use case:Find a maintained filesystem, GitHub, or docs MCP server and compare its permissions before wiring it into Hermes or another AI client.
Safety note:A registry is discovery, not trust. MCP servers can expose files, browsers, shells, SaaS accounts, and secrets, so vet each server and start with read-only tools.
Copy/paste
# No install required. Start with the live API/docs:
# https://registry.modelcontextprotocol.io/docs
Open-source platform for running MCP servers in isolated containers with optional identity, policy, and observability controls.
First move:Install it locally and run one low-risk read-only MCP server before connecting shells, browsers, cloud accounts, or internal services.
Example use case:Give a small team one managed place to run MCP servers instead of every developer hand-editing unreviewed MCP configs on their laptop.
Safety note:ToolHive reduces some MCP risk but does not make unsafe servers safe. Review container images, permissions, auth, logs, and network access before adding sensitive tools.
Copy/paste
# Start with the official installation guide and run one toy server first:
# https://docs.stacklok.com/toolhive
Self-hosted developer control center for running coding agents and automations across local, remote, and cloud backends.
First move:Run it on a disposable repository first and inspect what commands, files, logs, and provider credentials it touches.
Example use case:Give an agent a contained bug-fix task in a test repo, watch the terminal and diff, then decide whether the patch is safe to keep.
Safety note:Coding agents can run commands, spend API credits, change files, and leak prompts or code into logs. Use sandbox repos, least-privilege keys, and manual review before merge.
Copy/paste
# Start with the official quickstart and a disposable repo:
# https://docs.openhands.dev/
Framework and runtime for building, serving, and managing agent platforms with an AgentOS UI.
First move:Create one toy agent in a fresh virtual environment with a throwaway provider key loaded from a private shell.
Example use case:Prototype a small support or data-lookup agent locally, then inspect how memory, tools, evaluations, and UI management fit together.
Safety note:Agent runtimes can store prompts, tool outputs, memory, credentials, and usage data. Keep demos local, use fake data, and do not commit provider keys or agent state.
Open-source terminal AI coding agent that can read, edit, and operate inside software projects.
First move:Install it in a scratch repository and ask for a harmless README edit before granting it access to valuable code.
Example use case:Use a terminal-native coding agent to draft a small refactor, then review the exact git diff before committing anything.
Safety note:Coding agents can modify files, execute commands, and send code or prompts to model providers. Keep secrets out of repos and review every diff before committing.
Official visual test and debugging tool for Model Context Protocol servers.
First move:Run it against a toy or read-only MCP server first and confirm exactly which tools the server exposes.
Example use case:Before adding a new MCP server to Hermes, open it in the Inspector and test one harmless tool call while watching the request/response details.
Safety note:The Inspector connects to MCP servers that may expose files, shells, browsers, SaaS accounts, or secrets. Bind locally, test read-only servers first, and do not paste real tokens into screenshots or bug reports.
Small proxy that exposes MCP tools through an OpenAPI-compatible HTTP server for agent clients that speak REST/OpenAPI.
First move:Wrap one harmless local MCP server with an API key and keep it bound to localhost while you inspect the generated docs.
Example use case:Expose a read-only documentation MCP server to an OpenAPI-capable agent without writing custom protocol glue.
Safety note:Putting MCP behind HTTP expands the blast radius if you bind to a network interface or use weak auth. Start on localhost, use a throwaway demo key, and never proxy destructive tools until policy is reviewed.
Package-manager style tool for declaring AI agent rules, skills, MCP servers, plugins, and sub-agents once and exporting them to many coding-agent clients.
First move:Create a tiny capabilities.yaml in a scratch repo and inspect every generated agent config before using it on a real project.
Example use case:Keep the same code-review rule, safe tool list, and MCP config synchronized across Cursor, Claude Code, Codex, Windsurf, and other agent clients.
Safety note:Agent config managers can grant tools and rules across many clients at once. Review generated files, pin versions, and do not let shared configs include secrets or broad write permissions by default.
Copy/paste
# Start with the official docs and a scratch repository:
# https://github.com/infragate/capa
Local-first memory layer for AI coding agents with hooks, MCP support, hybrid search, and an on-device SQLite vault.
First move:Install it in a disposable notes folder and run the doctor command before indexing real project notes or transcripts.
Example use case:Let Hermes or another coding agent remember decisions from a small scratch project so the next session can pick up context without rereading every file.
Safety note:Agent memory can store prompts, notes, transcripts, filenames, project decisions, and private context. Start with disposable notes and do not index secrets, credentials, or confidential exports.
Copy/paste
bun install -g clawmem
mkdir -p ~/labs/clawmem-notes
clawmem bootstrap ~/labs/clawmem-notes --name lab-notes
clawmem doctor
Self-hosted financial data stack and MCP server for SEC filings, statements, insider trades, institutional holdings, macro data, and market indicators.
First move:Clone it locally, copy the example environment file, set only the required SEC contact email, and let the Docker stack populate public sample data.
Example use case:Ask an MCP-capable agent to compare public SEC filing facts for two companies without manually scraping EDGAR pages in a browser.
Safety note:Financial data workflows can mix public filings with API keys, contact emails, watchlists, and investment research. Keep .env private, respect SEC fair-access rules, and treat outputs as research aids, not financial advice.
Copy/paste
git clone https://github.com/daniel3303/Equibles.git ~/labs/Equibles
cd ~/labs/Equibles
cp .env.example .env
# Edit .env and set SEC_CONTACT_EMAIL before running:
docker compose up
Fast open-source web scraping, crawling, search, and markdown extraction API with MCP support for AI agents.
First move:Try it against your own site or a small public docs page first, then inspect the generated markdown before connecting an agent.
Example use case:Give an agent a local crawler API that turns a documentation page into clean markdown for a RAG or research pipeline.
Safety note:Crawlers can overload sites, collect personal data, and violate access rules if pointed blindly at the internet. Use low rates, obey site policies, and start with owned or clearly public documentation pages.
Copy/paste
# Start with the official quickstart and crawl only sites you are allowed to access:
# https://docs.fastcrw.com/quickstart/
Local Rust MCP runtime for repository reads, search, file discovery, batch replacement, and explicit apply-reviewed edits for AI coding agents.
First move:Install it in a disposable repo and use the control terminal to review proposed changes before enabling it in everyday agent sessions.
Example use case:Give Codex or another MCP-capable coding agent stable file/search tools so it gathers code context without hand-assembling fragile shell commands.
Safety note:FastCtx can read code, run Bash, and prepare edits. Use sandbox repos first, review the control-terminal apply step, and never expose secrets through agent context.
Local-first guard layer that scans AI-agent tools, packages, skills, secret access, prompt injection, and risky runtime actions.
First move:Install the CLI locally, run init, and protect one disposable agent workspace before connecting real projects or team policies.
Example use case:Add a review layer around an experimental agent so suspicious tool calls or package/plugin behavior pause for inspection instead of running silently.
Safety note:Agent guards sit near prompts, tools, policies, logs, and secret-access decisions. Test with fake data first and treat security receipts as sensitive.
Deterministic orchestrator for running CLI coding agents in isolated git worktrees with replay journals, merge gates, and optional audit receipts.
First move:Install it in a disposable git repo, run the demo or one tiny goal, and inspect the generated state before giving it real work.
Example use case:Fan out a refactor across separate worktrees, require lint/type/test gates, then review the recap instead of trusting a single long-running agent session.
Safety note:Bernstein launches coding agents that can edit files and run commands. Use budget limits, sandbox repos, manual review, and private audit logs until your gates are proven.
Local MCP server that indexes a repository into a tree-sitter knowledge graph for faster symbol, route, and call-chain queries by coding agents.
First move:Try it on a small disposable repo first, inspect what it writes to your agent configuration, then index only code you are allowed to process locally.
Example use case:Before changing a handler, ask an MCP-connected agent for related routes, callers, and class/function relationships without reading hundreds of files.
Safety note:It reads source code and can update MCP/client config. Keep proprietary repos and secrets out of test indexes, verify release checksums, and review generated config changes.
Copy/paste
# Download the signed release for your OS, then audit before installing:
# https://github.com/DeusData/codebase-memory-mcp/releases
OpenTelemetry-native local CLI and dashboard for watching LangChain, OpenLLMetry, and agent traces in real time.
First move:Install the CLI in a toy project, start the local dashboard, and send one development trace before wiring in real applications.
Example use case:Debug an agent that loops or calls tools in the wrong order by inspecting span trees, token counts, and raw trace events locally.
Safety note:Traces can contain prompts, tool arguments, URLs, file paths, and model outputs. Keep the dashboard local and add trace databases to .gitignore.
Local-first dashboard for AI coding-tool token usage, estimated costs, widgets, and session trends without sending prompts to a hosted account.
First move:Run it once locally, inspect which tools it detected, and avoid exporting reports until you understand what session metadata is included.
Example use case:Compare which agent or model burned tokens during a week of coding so routine cleanup can move to cheaper local or small models.
Safety note:It reads local AI-tool logs and usage files. Those files may reveal project names, models, costs, and prompt metadata; keep the dashboard and exports private.
Open-source platform and SDKs for tracing, evaluating, and monitoring LLM applications and agents.
First move:Instrument a toy agent or development app first, then inspect one trace and one eval before sending production traffic.
Example use case:Track whether a RAG assistant is returning grounded answers, which prompts cost the most, and which tool calls fail during a test run.
Safety note:LLM traces can include prompts, retrieved documents, user text, tool arguments, and secrets accidentally pasted into chats. Redact and self-host or restrict access for sensitive work.
Copy/paste
pipx install langwatch
# Or for JavaScript projects:
npm install langwatch
Public-alpha framework for building AI SRE agents that investigate incidents using the monitoring and operations tools you already run.
First move:Read the docs and try it in a sandbox with mock alerts before granting access to real production observability or remediation tools.
Example use case:Prototype an incident assistant that gathers logs, traces, dashboards, and runbook context for a noisy service alert without letting it make changes automatically.
Safety note:SRE agents may see sensitive infrastructure metadata and can become dangerous if connected to write-capable tools. Keep first runs read-only, sandboxed, and manually reviewed.
Copy/paste
git clone --depth 1 https://github.com/Tracer-Cloud/opensre.git ~/labs/opensre
cd ~/labs/opensre
# Follow the project quickstart for a sandbox environment.
Runtime security hooks for AI coding agents that can observe or block risky shell commands, prompt-injection patterns, secret leaks, and unsafe package choices.
First move:Install it in observe mode on a disposable toy repo, then review the local dashboard before allowing any blocking policy to affect real work.
Example use case:Watch a Claude Code or Codex session and catch accidental secret exposure or destructive terminal commands before they become habit.
Safety note:Agent logs can include prompts, shell commands, filenames, tool arguments, and secrets. Start with non-sensitive repos and review what Prismor stores before using it broadly.
Experimental local memory layer for AI agents with a single-binary design and MCP-native integration.
First move:Read the pre-1.0 warning, install it only for a disposable agent workspace, and use dry-run checks before any uninstall or hook changes.
Example use case:Give a local coding agent a small persistent memory of project conventions without connecting a hosted memory service.
Safety note:Agent memory can preserve prompts, paths, snippets, and private project facts. Use non-sensitive data first and do not sync or publish memory stores casually.
Copy/paste
# Download a release for your OS, then inspect help first:
icm --help
icm install --dry-run
Local semantic code search and call-graph lookup for AI coding agents, so they can find relevant code by meaning instead of dumping whole files into context.
First move:Install it in one disposable or non-sensitive repo, pull a local embedding model, and run a single semantic search before wiring it into an agent.
Example use case:Ask “where is login throttling handled?” and give the coding agent only the matching functions and callers instead of feeding it the entire backend.
Safety note:GrepAI indexes local source code. Keep indexes and embedding caches private, and do not point it at repos containing secrets until you understand where its cache lives.
Rust-based local code intelligence server and CLI that exposes symbol search, call graphs, dependency tracking, and impact analysis to MCP-compatible agents.
First move:Start with the CLI in a small local repo; index one source directory and inspect results before running the persistent MCP server.
Example use case:Before changing a shared function, ask Codanna which callers and dependent symbols could be affected, then pass that focused impact map to Hermie.
Safety note:Codanna reads and indexes your repository locally. Treat generated indexes like source-derived artifacts and avoid exposing its HTTP/S server outside trusted machines.
Local-first web search, fetch, crawl, extraction, cache, REST, and MCP engine for agents that need browser-backed research without a hosted search API.
First move:Run the keyless local setup with downloads deferred, then check health before connecting it to any daily-use agent.
Example use case:Let a local agent fetch and extract a public documentation page, return clean markdown with metadata, and surface a clear blocked-by-challenge error when a site refuses automation.
Safety note:Web crawlers can hit rate limits, authenticated pages, and private URLs. Keep the server on loopback, use tokens before remote access, and do not crawl sites or accounts you are not allowed to automate.
macOS CLI and MCP server for permission-bound screen capture, UI inspection, and GUI automation with local or hosted vision models.
First move:Install it on a Mac, check permissions, and capture a harmless screenshot before granting Accessibility automation or connecting an agent.
Example use case:Give a coding agent a structured snapshot of a desktop app window so it can verify UI state or reproduce a click path under human review.
Safety note:Screen capture and Accessibility permissions expose private windows, messages, passwords shown on screen, and the ability to drive apps. Use least privilege and revoke permissions when experiments end.
TypeScript framework for dynamic multi-agent task DAGs with checkpoints, budgets, offline run viewing, evaluations, and optional OpenTelemetry export.
First move:Generate the no-key local demo first; prove the scheduler and run viewer work before adding real model providers or tools.
Example use case:Prototype a PR-review team where one agent plans, scoped reviewers inspect different files, and the run record shows task dependencies and token budgets.
Safety note:Multi-agent frameworks multiply side effects quickly. Keep tools default-deny, use sandbox credentials, and review persisted traces because they may contain prompts, tool calls, and code snippets.
Copy/paste
npm create oma-app@latest my-oma
# Choose the deterministic local demo when prompted.
Repo-local workflow layer for AI coding agents: durable specs, fresh-context workers, adversarial reviews, receipts, and multi-harness support.
First move:Install it in a disposable repository and run one small planning pass before letting it create branches, reviews, or pull requests.
Example use case:Turn a vague refactor request into reviewed task slices with evidence records so Hermes, Codex, or Claude Code does not drift through a giant diff.
Safety note:Agent workflow layers can launch subagents, create repo state, and record private specs or prompts. Use sandbox repos first and review every task receipt before merging.
Copy/paste
# Claude Code plugin path:
/plugin install flow-next
# Codex path after reviewing the installer script:
# ./scripts/install-codex.sh flow-next
Git-backed failure-memory library for AI coding agents, focused on redacted debugging lessons and MCP/CLI search.
First move:Install the core package and search one harmless failure message before capturing or submitting any real diagnostics.
Example use case:When CI fails with a confusing token, DCO, pip, or MCP error, ask an agent to search prior redacted recovery lessons instead of guessing.
Safety note:Failure reports can contain secrets, paths, repo names, tokens, and private logs. Redact aggressively and start with local search before any intake/capture workflow.
Entity-resolution toolkit for deduplicating and matching messy records across CSVs, Python, TypeScript, MCP, REST, and web/TUI workflows.
First move:Run the CLI on a tiny fake CSV first and inspect the output before touching customer, health, financial, or production datasets.
Example use case:Clean duplicate customer, vendor, or knowledge-graph entity names so an agent can reason over one stable record instead of five spellings of the same thing.
Safety note:Record linkage can process personal data and merge identities incorrectly. Use synthetic data first, review matches manually, and do not upload sensitive datasets to demos or public reports.
Agent Memory File System: a Git-like shared memory layer for agents with branches, diffs, rollback, MCP, and auditable outcomes.
First move:Install it in a toy Python environment and write one harmless fake service pattern before connecting any real agent or team workflow.
Example use case:Let two sandbox agents share a reviewed memory about how a demo checkout service retries requests, then inspect what changed before keeping it.
Safety note:Agent memory can preserve prompts, decisions, repo names, logs, business context, and personal data. Start with synthetic data and review retention, visibility, and sync settings before real use.
Local RAG MCP server for Claude Code that indexes documents and code with hybrid search, reranking, and no external API keys.
First move:Index a small folder of non-sensitive notes first, then run one search before pointing it at a full repo or document archive.
Example use case:Give a coding agent searchable local context from README files, design notes, and notebooks without uploading the collection to a hosted vector database.
Safety note:Local indexes can still contain private source code, documents, filenames, and embeddings derived from sensitive text. Keep the index private and start with disposable material.
Copy/paste
python3 -m pip install knowledge-rag
# Then follow the project docs to connect the MCP server to your local agent.
Local dashboard for watching AI coding-agent sessions, token/cost usage, tool calls, workspace changes, and approval holds.
First move:Open the fabricated live demo or run its seed-demo path before installing global hooks into a real Claude Code workspace.
Example use case:Watch a practice agent session and confirm which shell commands, diffs, token spikes, and approval pauses happened during a refactor attempt.
Safety note:Agent dashboards can capture prompts, files, commands, diffs, terminals, and secrets. Do not install hooks globally until you understand what is stored and who can access the UI.
Copy/paste
git clone --depth 1 https://github.com/SirAllap/agentglass.git ~/labs/agentglass
cd ~/labs/agentglass
python3 hooks/seed_demo.py
Open-source visual workspace for running and reviewing Codex, Claude Code, OpenCode, and other coding-agent sessions across files, tasks, and worktrees.
First move:Open the project README and try it on a disposable repo before letting multiple agents edit an important codebase.
Example use case:Run two agent experiments on separate worktrees, compare their visual diffs, and keep the useful patch while discarding the risky one.
Safety note:Coding-agent workspaces can expose source code, prompts, terminals, git state, and credentials. Use disposable repos first and review diffs before committing.
Copy/paste
# Download the signed/official release for your OS:
# https://github.com/nimbalyst/nimbalyst/releases
Google's code-first Python toolkit for building, evaluating, and deploying agent workflows with tasks, delegation, state, and human-in-the-loop steps.
First move:Install it in a fresh Python environment and run a tiny local sample before adding provider keys or real tools.
Example use case:Prototype a support triage agent that routes a toy ticket through deterministic workflow nodes before connecting it to real helpdesk data.
Safety note:Agent frameworks can call tools, store session state, and send prompts to model providers. Use sandbox data and keep API keys in private environment variables.
Open-source TypeScript platform for long-running AI workflows with queues, retries, observability, schedules, and human-in-the-loop checkpoints.
First move:Start with the local quickstart and one idempotent toy task before wiring it to production APIs or cloud jobs.
Example use case:Run a document-processing workflow that retries flaky model calls and pauses for human approval before sending an outbound notification.
Safety note:Durable workflows repeat side effects by design. Use sandbox credentials, idempotency keys, and explicit approvals before attaching real email, billing, deploy, or incident tools.
Copy/paste
npm create trigger@latest my-trigger-lab
cd my-trigger-lab
npm install
npm run dev
Fully local MCP memory/search tool that indexes past coding-agent sessions so future agents can reuse decisions without a hosted database or embeddings.
First move:Run a one-off query against local agent history, inspect what it finds, then decide whether to wire the MCP server into an agent.
Example use case:Ask why a repo chose one deployment path months ago and retrieve the old agent transcript instead of re-litigating the same decision.
Safety note:It indexes local agent transcripts, which can contain source code, prompts, paths, logs, credentials, and private decisions. Start read-only, keep indexes local, and redact before sharing outputs.
Python CLI that turns Pydantic AI runs stored in Logfire into a single interactive HTML diagram of model calls, tool calls, tokens, cost, and timing.
First move:Install the CLI, point it at a non-sensitive Logfire project, and render one local report before sending any trace data to other people.
Example use case:Debug a toy support agent by seeing which tool call failed, what each sub-agent did, and where token cost accumulated.
Safety note:Trace reports can expose prompts, reasoning, tool inputs, outputs, token counts, costs, and business data. Use read-only Logfire access and do not publish generated HTML from private runs.
CLI for building a local searchable library of agent skills, scripts, notes, workflows, memories, and project knowledge.
First move:Install the npm package, run the guided setup, then index one harmless notes or docs bundle before adding private project sources.
Example use case:Let an agent search a small team runbook library for the exact deploy workflow instead of pasting the whole runbook into every prompt.
Safety note:It can index sensitive local material, including prompts, env files, memories, and scripts. Start with non-secret docs and never publish exported indexes or bundles that may contain credentials.
Local codebase index and MCP server that lets AI coding tools search relevant files instead of repeatedly reading the whole repository.
First move:Try it on a small throwaway repository and inspect the generated index location before enabling editor or agent integrations.
Example use case:Ask a coding agent to find the API route and matching tests for a bug without spending thousands of tokens scanning generated files and lockfiles.
Safety note:A code index can expose private source and comments. Keep the index local, exclude generated/vendor/secret files, and do not connect broad MCP access to untrusted agents.
Copy/paste
uv tool install "code-context-engine[local]"
cd /path/to/your/repo
cce init
Local policy boundary for AI-agent actions that can allow, deny, escalate, and record signed receipts for tool and shell decisions.
First move:Read the execution security model, install in a non-production agent setup, and verify one deny receipt before routing important sessions through it.
Example use case:Put a safety gate between an overnight coding agent and risky shell/MCP actions so destructive commands are denied or escalated instead of silently executed.
Safety note:It is a guardrail, not a complete sandbox. Test policies locally, keep protected paths explicit, and do not treat receipts as proof that every possible side effect was contained.
Copy/paste
brew tap mindburn-labs/tap
brew install helm-ai-kernel
helm-ai-kernel --help
Local-first CLI, daemon, and MCP server for safe AI access to Logseq OG block graphs without raw Markdown scraping or silent overwrites.
First move:Run the status command against a copied test graph, then try read-only queries before allowing any write path.
Example use case:Let an agent search a Logseq knowledge graph for project decisions and write back a reviewed block instead of corrupting Markdown files directly.
Safety note:Notes can contain private plans, client data, credentials, and personal history. Use a test copy first and keep write access off until backups and conflict behavior are understood.
Rust tool that compresses noisy terminal output for coding agents while passing failures and structured data through more carefully.
First move:Install with Homebrew, wrap one noisy but non-critical command, and compare the reduced output with the original before trusting it in a workflow.
Example use case:Trim repetitive Docker build or test-run chatter so the agent sees the real failure line without burning context on progress bars.
Safety note:Output reducers can hide context if used blindly. Keep raw logs available, avoid wrapping security audits or one-off forensic commands, and verify failed commands are not compressed away.
Self-hosted OpenTelemetry-based observability platform for MCP servers and AI applications.
First move:Run the backend and frontend locally, create a test project, and instrument a toy MCP server before sending real agent traces.
Example use case:Watch which MCP tools an agent calls, how long they take, and where failures happen while debugging a custom server.
Safety note:Traces can include prompts, tool arguments, file paths, hostnames, and identifiers. Do not expose the dashboard publicly and avoid collecting secrets in tool inputs.
Copy/paste
git clone https://github.com/delta0-inc/heimdall.git ~/labs/heimdall
cd ~/labs/heimdall/backend
npm install
npm run dev
Open-source infrastructure for running parallel coding agents in isolated workspace sessions over one shared project base.
First move:Read the security model, try one local Docker-backed sandbox with a toy repository, and inspect the change set before publishing anything.
Example use case:Run two agents on competing fixes in separate writable workspaces, then review each patch without mutating the main checkout.
Safety note:The project explicitly says it is not a hardened microVM boundary. Use it for cooperating coding agents, not hostile tenants or untrusted code execution.
Copy/paste
curl -LO https://github.com/Ephemeral-AI-Lab/ephemeral-sandbox/releases/latest/download/ephemeral-sandbox-linux-amd64.tar.gz
tar -xzf ephemeral-sandbox-linux-amd64.tar.gz
cd ephemeral-sandbox-linux-amd64
./bin/ephemeral-sandbox --help
Browser automation SDK that mixes deterministic Playwright-style steps with AI extraction and action helpers.
First move:Create a tiny test app and run it against a harmless public page before pointing it at accounts, dashboards, or admin panels.
Example use case:Build a repeatable browser-agent script that opens a pull request page and extracts the title, author, and review status into structured JSON.
Safety note:Browser agents can click, submit forms, and read private pages. Start on disposable test sites, keep credentials in local env files, and review cached actions before replaying them.
Copy/paste
npx create-browser-app
# Then follow the generated project README before adding real credentials.
NVIDIA runtime layer for agent lifecycle events, tool/LLM middleware, observability export, and hook-backed execution controls.
First move:Install the CLI from a package manager, wrap one toy agent session, and inspect the generated lifecycle snapshot before touching real workflows.
Example use case:Add observable turn snapshots and policy hooks around Codex or Hermes experiments so tool calls can be logged, reviewed, or blocked by a local control layer.
Safety note:Relay can observe prompts, tool calls, file paths, and process activity. Use sandbox projects first and do not export traces containing secrets or private code to shared backends.
Local-first dashboard for agent sessions, token usage, tool traces, approvals, and runtime activity across several coding-agent tools.
First move:Install the Python package and open the local dashboard against one disposable agent runtime before enabling hooks or exports.
Example use case:Compare Claude Code, Codex, Goose, and Hermes sessions to see which task burned tokens, which tools were called, and where an approval gate would have helped.
Safety note:It reads local agent session files that may contain prompts, source snippets, tool arguments, and secrets. Keep it local, avoid screenshots of private traces, and review hook changes before enabling enforcement.
Free curriculum for learning Model Context Protocol fundamentals with cross-language examples, labs, and security-focused modules.
First move:Read the introduction and security modules first, then run the smallest local sample server instead of connecting enterprise accounts.
Example use case:Use the hands-on labs to understand how MCP servers, clients, tools, auth, and deployment fit together before writing a custom server for Hermes.
Safety note:Treat examples as labs. Use fake data and local credentials only; do not connect real Microsoft 365, Azure, database, or production services until you understand MCP permissions and auth boundaries.
Copy/paste
git clone https://github.com/microsoft/mcp-for-beginners.git ~/labs/mcp-for-beginners
cd ~/labs/mcp-for-beginners
# Start with 00-Introduction/README.md and 02-Security/README.md
Hosted MCP bridge that gives an AI assistant searchable documentation and code context for a specific GitHub repository.
First move:Try it with one public open-source repository and ask documentation questions before adding it to a regular coding workflow.
Example use case:Point an agent at a fast-moving library repo so it can answer API-usage questions from current docs instead of guessing from stale training data.
Safety note:Use public repos first. Do not route private repository contents or confidential docs through third-party MCP services unless your organization has approved the data path.
MCP server that lets an AI assistant query OpenTelemetry traces from Jaeger, Tempo, Traceloop, and similar backends.
First move:Run it against a local Jaeger demo first and ask only read-only trace questions before connecting real service telemetry.
Example use case:Ask an agent to find recent error traces, slow spans, or expensive LLM calls in a toy app without giving it shell access to production systems.
Safety note:Traces can contain prompts, URLs, headers, user IDs, and service names. Use local/sample telemetry first and do not expose trace backends or MCP endpoints publicly.
Python framework for building MCP servers from simple tool, prompt, and resource files with built-in auth and telemetry options.
First move:Scaffold a local throwaway project, inspect the generated example tool, and keep the server bound to localhost while learning.
Example use case:Turn a harmless internal lookup script into a small MCP server so Hermes can query it through a narrow, documented tool instead of raw shell commands.
Safety note:MCP servers can expose real capabilities. Start with read-only toy tools, avoid embedding API keys in generated files, and require auth before exposing anything beyond localhost.
Copy/paste
python3 -m venv .venv
. .venv/bin/activate
pip install golf-mcp
golf init hello-mcp
cd hello-mcp
golf build dev
golf run
IBM registry and gateway for federating MCP, A2A, REST, and gRPC services behind one governed endpoint.
First move:Run the 5-minute local setup with one fake or sample service, then inspect the admin UI and auth settings before adding real APIs.
Example use case:Put several lab MCP servers behind one gateway so an agent can discover tools through a controlled registry instead of separate ad-hoc configs.
Safety note:Gateways concentrate access to tools and APIs. Use sample services first, configure auth/rate limits, and never register production credentials or private APIs until policy is reviewed.
Copy/paste
uvx mcp-contextforge-gateway --help
# For full setup, follow the official 5-minute setup linked from the README.
Go framework for building streaming, observable, multi-agent AI systems with tools, memory, RAG, and MCP discovery.
First move:Run the smallest Ollama-backed sample locally and enable file tracing before adding cloud providers or external tools.
Example use case:Prototype a Go service that routes a support question through an analyzer agent and a responder agent while writing local trace files for review.
Safety note:Agent frameworks can call tools and store memory. Keep experiments in disposable repos, store provider keys in local env files, and review traces for private data.
Copy/paste
go install github.com/agenticgokit/agk@latest
agk --help
# Use Ollama or fake/sample providers before adding real API keys.
Go-native agent framework with graph workflows, memory, knowledge retrieval, evaluation, MCP, A2A, AG-UI, and OpenTelemetry observability.
First move:Read the Go docs and run a local example with a non-sensitive prompt before wiring databases, web search, or code-execution tools.
Example use case:Build a service-friendly research assistant where graph nodes classify a request, retrieve docs, call a narrow tool, and emit OpenTelemetry spans.
Safety note:Do not attach broad MCP, web-search, code-execution, or database tools until you have scoped permissions and reviewed trace logging for sensitive content.
Copy/paste
go get trpc.group/trpc-go/trpc-agent-go
# Then run one example from the official docs in a scratch module.
Local single-binary gateway for exposing selected service-package methods to agents through capsets, gRPC, Connect RPC, and MCP.
First move:Run the daemon on 127.0.0.1 and exercise the built-in calculator workflow before importing any real service package.
Example use case:Create a narrow capset that exposes only approved read-only methods from an internal helper service to an agent.
Safety note:Capsets are an access-control boundary. Keep the daemon local, import only trusted packages, and avoid exposing admin or data-plane ports without network controls.
Copy/paste
npx @chaitin-ai/octobus serve
# In another terminal: octobus status
MCP server that indexes code with tree-sitter so agents can retrieve exact symbols, outlines, and task-sized context instead of reading whole files.
First move:Install it with pipx or uv in a disposable repo, initialize one MCP client, and ask the agent to fetch a single known function by name.
Example use case:Let Hermes inspect a large TypeScript or Python repo by asking for the handler, class, or import blast radius it needs instead of dumping thousands of lines into context.
Safety note:It indexes local source code and edits MCP client config. Start on non-sensitive repos, review generated config/prompt-policy files, and do not share reports that include proprietary symbols or paths.
Microsoft framework for building Python and .NET agents, workflows, middleware, orchestration patterns, skills, observability, and human-in-the-loop systems.
First move:Install the Python package and run a toy local sample before connecting Azure, Foundry-hosted agents, or production data.
Example use case:Prototype a small approval-gated workflow where one agent drafts a response, another checks it, and OpenTelemetry traces show each step.
Safety note:Samples can use cloud credentials and hosted agents. Keep provider keys in environment variables, prefer toy prompts first, and review trace/log output before using private data.
Python framework for real-time voice, video, and multimodal AI agents built from composable pipeline processors and service integrations.
First move:Install the CLI with uv and scaffold the smallest quickstart before adding phone, video, paid model, or speech services.
Example use case:Build a local voice bot that listens over a WebRTC/WebSocket transport, transcribes speech, calls a small LLM, and speaks the answer back.
Safety note:Voice agents can capture audio, transcripts, faces, phone numbers, and provider keys. Use test accounts, disclose recording, and keep early demos local or private.
Local knowledge engine for notes, code, PDFs, Office docs, hybrid search, context capsules, a web UI, REST API, SDK, and MCP integration.
First move:Install it with Bun and index a disposable folder containing a few public markdown files before adding personal notes or work documents.
Example use case:Let a coding agent ask a local docs folder for exact cited snippets while the same index remains browsable in a web workspace.
Safety note:Local search indexes can contain private documents, source paths, emails, and transcripts. Use collection egress policies and do not expose the daemon or exports outside trusted machines.
TypeScript agent engineering platform with typed agents, tools, workflows, memory, RAG, guardrails, MCP support, evals, and observability hooks.
First move:Create a throwaway project, run the starter agent locally, and inspect the generated code before adding provider keys or hosted observability.
Example use case:Build a TypeScript support-agent prototype with one narrow tool, a workflow step, local memory, and traces you can inspect during development.
Safety note:Agent frameworks can call tools and log prompts. Use sandbox credentials, narrow Zod-typed tools, review telemetry destinations, and do not paste secrets into generated examples.
Copy/paste
npm create voltagent-app@latest
cd <your-project>
npm run dev
Python framework for building real-time voice, video, and multimodal AI agents on top of LiveKit WebRTC infrastructure.
First move:Install the library in a fresh virtualenv and run a docs example with synthetic audio before connecting real users, phones, or cameras.
Example use case:Prototype a private voice assistant that joins a LiveKit room, listens to a test microphone, calls one LLM provider, and speaks the response back.
Safety note:Voice and video agents can capture audio, transcripts, faces, phone numbers, room names, and provider credentials. Use test rooms, disclose recording, and keep keys in environment variables.
Low-level framework for long-running, stateful, durable AI agents and workflows with memory, interrupts, and human review points.
First move:Install the Python package and build the smallest two-node graph before adding persistence, tools, or external services.
Example use case:Make Hermes prototype an approval-gated research flow where one node gathers context, another drafts output, and a human interrupt approves side effects.
Safety note:Durable agents can repeat side effects after retries. Start with toy state, disable destructive tools, and inspect persistence/logging before using private prompts or production credentials.
Evaluation SDK for agent outputs, tool trajectories, multimodal responses, simulated conversations, and OpenTelemetry traces.
First move:Install it in a scratch project and score a tiny hand-written agent trace before evaluating real customer or production interactions.
Example use case:Check whether an agent calls tools in the intended order, refuses unsafe requests, and recovers from a simulated user correction before you ship it.
Safety note:Eval traces can contain prompts, tool outputs, file names, screenshots, and user data. Use synthetic cases first and redact logs before sharing reports.
TypeScript SDK and CLI that gives one interface for many LLM providers, streaming, MCP tools, voice, memory, file processors, and analytics.
First move:Install the package in a disposable Node project and route one harmless prompt through a single provider before enabling MCP or Redis-backed state.
Example use case:Let Hermes test the same summarization workflow against two model providers without rewriting the application code each time.
Safety note:Provider routers may log prompts, headers, tool calls, file contents, and API usage. Keep keys in environment variables, review analytics settings, and connect only trusted MCP servers.
Python agent framework from the Pydantic team that uses typed tools, structured outputs, dependency injection, and eval-friendly patterns.
First move:Create a fresh virtualenv and build one tiny typed agent before connecting real databases, tools, or customer data.
Example use case:Prototype a support triage agent whose output must match a Pydantic model so downstream code can validate it instead of parsing loose text.
Safety note:Typed agents still call external models and tools. Keep provider keys in environment variables, use toy prompts first, and avoid logging private inputs during experiments.
Lightweight Python framework for multi-agent workflows with handoffs, guardrails, tracing, and provider-agnostic model support.
First move:Install it in a scratch project and run a single no-tool agent before adding handoffs, hosted tools, or side effects.
Example use case:Build a small research workflow where one agent drafts an answer, another checks sources, and tracing shows what each step did.
Safety note:Agent traces and tool outputs can contain prompts, file names, URLs, and secrets. Use synthetic data first and review tracing retention before production use.
Python utility from Microsoft for converting PDFs, Office files, images, audio metadata, ZIPs, and web content into Markdown for LLM-friendly reading.
First move:Install it in a throwaway Python environment and convert one non-sensitive local document before using it inside an agent workflow.
Example use case:Turn a project PDF, PowerPoint, or Word handout into Markdown so Hermie can summarize it, extract action items, or build a clean study note.
Safety note:MarkItDown reads files with your current process permissions and can fetch remote URLs. Convert only documents you are allowed to process, and do not feed private or malicious files into an agent without review.
Python framework for building and testing Model Context Protocol servers and clients with less boilerplate.
First move:Create one local read-only tool first, inspect the generated server behavior, and only then add tools with file or network side effects.
Example use case:Wrap a safe internal notes search or local status command as an MCP server so Hermie can call it through a clear tool boundary.
Safety note:MCP servers expose capabilities to agents. Keep first servers read-only, avoid broad filesystem access, and never hard-code tokens or secrets in tool definitions.
Hugging Face library for compact Python agents, including code-oriented agents and tool-calling workflows.
First move:Run a tiny local or sandboxed example with no external tools before giving an agent filesystem, browser, or API access.
Example use case:Prototype a research assistant that calls a search tool, writes a short answer, and leaves an inspectable Python trace of its steps.
Safety note:Code-capable agents can execute actions you did not intend if tools are too broad. Use toy prompts, sandboxed directories, and explicit approval before connecting real credentials or services.
Unified virtual filesystem layer for AI agents that helps expose local and remote resources through one structured interface.
First move:Read the docs and mount only a disposable test folder before connecting real project directories or remote services.
Example use case:Give an agent a clean, bounded view of a docs folder and generated artifacts instead of handing it your whole home directory.
Safety note:Virtual filesystems are access-control boundaries only if configured carefully. Start with least-privilege mounts and avoid exposing home directories, SSH keys, browser profiles, or credential stores.
Copy/paste
git clone https://github.com/strukto-ai/mirage.git ~/tools/mirage
cd ~/tools/mirage
# Follow the official docs for the current package/SDK setup.
Reverse proxy and management layer for routing Model Context Protocol servers with session awareness, lifecycle controls, telemetry, and Kubernetes deployment patterns.
First move:Run the local deployment from the README with one harmless demo MCP server before putting real tools, SaaS APIs, or cluster services behind it.
Example use case:Put a few read-only lab MCP servers behind one gateway so Hermes can discover tools through a governed endpoint instead of scattered per-client configs.
Safety note:MCP gateways concentrate tool access. Keep first adapters read-only, require auth before shared use, review telemetry for prompts/tool output, and do not register production secrets while learning.
Copy/paste
git clone https://github.com/microsoft/mcp-gateway.git ~/labs/mcp-gateway
cd ~/labs/mcp-gateway
# Follow the README local deployment with a demo adapter first.
Official Microsoft Learn MCP endpoint that lets MCP-capable agents query current Microsoft documentation and code samples.
First move:Add the HTTP endpoint to one compatible client and ask a documentation-only question before connecting it to project work.
Example use case:Ask an agent for the current Azure CLI steps for a lab deployment and have it cite Microsoft Learn instead of guessing from stale model memory.
Safety note:This is a read-only documentation source, but agent answers can still be wrong. Verify commands before running them and do not paste private tenant IDs, resource names, or secrets into public examples.
Copy/paste
# Add this HTTP MCP endpoint in a compatible client:
# https://learn.microsoft.com/api/mcp
MCP server that gives coding agents controlled access to Chrome DevTools for page inspection, console logs, screenshots, network requests, and performance traces.
First move:Run it against a disposable local site with usage statistics disabled, then inspect which browser data the agent can see.
Example use case:Let Hermes debug a broken local UI by reading console errors, checking failed network requests, and capturing a performance trace without manual DevTools clicking.
Safety note:It exposes browser pages, cookies, form data, screenshots, DevTools state, and sometimes performance trace URLs to an MCP client. Use a clean browser profile, avoid sensitive sessions, and disable telemetry for private labs.
Unified MCP runtime that aggregates many MCP servers and gives agent clients progressive inspect-and-run workflows instead of dumping every tool schema up front.
First move:Install it in a scratch environment, add one harmless documentation server, and verify instructions, inspect, and run before migrating real MCP configs.
Example use case:Give Codex, Claude, Cursor, or Hermes one local MCP gateway while keeping tool discovery narrower and easier to audit per project.
Safety note:MCP aggregators concentrate tool access. Start with read-only servers, bind locally, review presets and filters, and never aggregate shell, browser, or SaaS tools until authorization and logging are clear.
Local persistent memory for CLI agents, using graph-based recall and LLM-supervised save/search workflows across coding sessions.
First move:Install the binary, verify the version, then enable it in one disposable agent project before relying on it for real project memory.
Example use case:Keep project decisions, recurring pitfalls, and handoff notes available across long Hermes or Claude Code sessions without stuffing everything into one prompt.
Safety note:Agent memory can store private code, prompts, paths, decisions, and mistakes. Start on non-sensitive projects and review what is saved before syncing or sharing any memory store.
Copy/paste
go install github.com/mnemon-dev/mnemon@latest
mnemon --version
Jellyfin plugin that generates subtitles and lyrics locally with Whisper-compatible transcription workers.
First move:Install it on a test Jellyfin server or small media library first, then generate subtitles for one non-sensitive file.
Example use case:Create subtitles for a locally hosted lecture, home video, or personal media file without sending the audio to a third-party transcription service.
Safety note:Transcription output can expose private speech, filenames, and media-library details. Keep processing local, review generated text, and avoid publishing subtitles from private recordings.
Copy/paste
# Download the current Jellyfin plugin release:
# https://github.com/GeiserX/whisper-subs/releases
USB-C deployment workflow for shipping AI apps to Jetson, Raspberry Pi, and Linux edge devices without needing SSH, a monitor, or device-side internet.
First move:Read the docs, install the CLI only on a lab machine, and test discovery with spare hardware before flashing or deploying anything important.
Example use case:Deploy a small vision or robotics demo to a Jetson from a laptop and stream logs back over USB-C while iterating at a bench.
Safety note:Device flashing and deployment can overwrite storage or change robot/edge-device behavior. Use spare hardware, disconnect actuators, and keep secrets out of build descriptors.
Copy/paste
# Review the docs first, then install the CLI if appropriate:
# https://docs.wendy.dev/latest
Self-hosted, git-backed control plane for agent skills, tools, context, permissions, and identity across MCP-capable agents.
First move:Try the public demo or read the architecture docs before connecting a real company repository or internal tool.
Example use case:Give a team one reviewed source of truth for approved agent skills and documentation instead of copying prompts and MCP configs between laptops.
Safety note:This sits between agents and company knowledge/tools. Keep deployments private, use least-privilege roles, review skill changes, and never put secrets directly in shared context.
Copy/paste
# Start with the demo/docs before deploying your own control plane:
# https://github.com/Bevel-Software/Hexis
Local desktop workspace for installing, configuring, launching, and backing up AI coding agents and their MCP/provider settings.
First move:Download a release on a non-critical machine and let it detect existing agents before applying any configuration changes.
Example use case:Bootstrap Codex, Claude Code, OpenCode, Kilo CLI, and Hermes-style MCP settings on a fresh laptop without hand-editing every config file.
Safety note:Agent managers can rewrite local configs and discover MCP servers. Make backups, exclude API keys from exports, and review every provider/profile change before applying it.
Copy/paste
# Download the latest release for your OS:
# https://github.com/MaimoryLab/BootAgent/releases/latest
Self-hosted homelab knowledge broker that routes plain-language queries across Kiwix, RSS, weather, SearXNG, Uptime Kuma, Home Assistant, REST, and MCP.
First move:Run it privately with one harmless backend, such as offline Kiwix or a test RSS feed, before connecting home-state or monitoring systems.
Example use case:Ask one local endpoint whether a homelab service is down, what the latest RSS item says, or what an offline wiki says without switching between tools.
Safety note:Homelab brokers can expose reading habits, Home Assistant state, service names, and search queries. Keep it on a trusted LAN and add backends one at a time.
Copy/paste
# Review the Docker install and source setup in the README first:
# https://github.com/immortalbob/Mnemolis
Self-hosted framework for adding agent-readable plugins, structured output, audit, sessions, and human approval around existing business APIs.
First move:Read the docs and run it against a toy API first; do not point it at production systems until permissions and approval gates are understood.
Example use case:Let an internal agent generate reports from an owned operations API while forcing write operations through human approval instead of direct autonomous execution.
Safety note:An agent bridge can reach sensitive APIs and databases. Use read-only plugins first, require approvals for writes, log access, and keep service credentials in private secret stores.
Copy/paste
# Start from the documentation index and local examples:
# https://github.com/Foamtor/AgentBridge/tree/main/docs
.NET toolkit and CLI for evaluating AI agents: tool-call assertions, stochastic tests, memory benchmarks, traces, and defensive red-team checks.
First move:Install the preview CLI in a throwaway .NET project and run the doctor/list commands before evaluating a real agent.
Example use case:Add a regression test that proves a booking agent searches before it books, calls the expected tools in order, and meets a minimum success rate across repeated runs.
Safety note:The project labels itself preview software. Do not use it as the only gate for production or safety-critical agents, and keep benchmark inputs free of private data.
Open-source Python framework for building explicit RAG, search, and agent pipelines with modular retrieval, routing, memory, and generation components.
First move:Install it in a fresh virtual environment and complete the quick-start RAG tutorial with public sample documents first.
Example use case:Build a support-docs assistant where Hermie can inspect each retrieval, reranking, prompt, and model step instead of debugging a black-box chatbot.
Safety note:RAG pipelines can leak source documents through prompts and logs. Start with public data, keep API keys in environment variables, and review telemetry settings.
Snapshot-testing CLI for AI agents that records tool calls, parameters, order, and outputs so behavior drift shows up in review or CI.
First move:Run the bundled demo first, then snapshot one disposable toy agent before testing a real workflow.
Example use case:Catch a prompt or model change that makes a support agent skip the search tool, call tools in the wrong order, or silently degrade output quality.
Safety note:Snapshots can contain prompts, tool parameters, filenames, and outputs. Start with non-sensitive agent runs and review baselines before committing them.
Tiny bridge that exposes stdio MCP servers over SSE, WebSocket, or streamable HTTP for local testing and client compatibility work.
First move:Bind it to localhost with one harmless read-only MCP server before using remote URLs, CORS, bearer tokens, or write-capable tools.
Example use case:Test whether a browser or remote MCP client can talk to a local git/documentation MCP server that normally only speaks stdio.
Safety note:Do not expose MCP bridges publicly by default. MCP servers may access files, shells, browsers, SaaS accounts, or secrets; avoid permissive CORS and protect any remote transport.
Google-maintained CLI and agent-skill bundle for building, evaluating, deploying, and governing agents on Google Cloud agent platforms.
First move:Read the docs and run setup only in a disposable project or sandbox Google Cloud environment, not against production resources.
Example use case:Let a coding agent scaffold a small Google ADK agent, add an evaluation, and prepare a deploy path while keeping cloud setup steps explicit.
Safety note:Cloud agent tooling can create projects, services, policies, deployments, logs, and costs. Use least-privilege cloud accounts, sandbox projects, and environment variables for credentials.
Copy/paste
uvx google-agents-cli setup
# Or install just the agent skills:
# npx skills add google/agents-cli
Self-hosted security gateway for LLM API traffic with prompt-injection checks, PII/secret redaction, response sanitization, and audit logs.
First move:Run it only on localhost with a disposable upstream model endpoint, then inspect exactly what requests, logs, and redactions it produces.
Example use case:Put a lab coding agent behind one gateway so you can see when prompts contain secrets, risky tool requests, or suspicious injected instructions.
Safety note:It sits in front of model traffic and may log prompts, responses, tokens, and internal URLs. Keep it private, use trusted upstreams, rotate credentials, and do not expose the admin UI publicly.
Copy/paste
git clone https://github.com/ax128/AegisGate.git ~/tools/aegisgate
cd ~/tools/aegisgate
# Review docker-compose.yml and .env examples before starting locally.
docker compose up -d --build
AI video-editing plugin and local MCP server that turns natural-language editing requests into montage workflows for Cassette.
First move:Try the browser demo or a small throwaway folder of non-sensitive clips before installing it into a coding-agent profile.
Example use case:Ask a local agent to assemble vacation clips into a short beat-synced vlog, then review the generated edit before sharing anything.
Safety note:Video projects can contain faces, voices, locations, and copyrighted media. Use clips you have rights to, check where uploads go, and avoid private footage until you understand the service account path.
Copy/paste
# Codex plugin path from the project README:
codex plugin marketplace add https://github.com/Cassette-Editor/oh-my-cassette.git
codex plugin add oh-my-cassette@cassette-editor
Fast Rust CLI for giving agents a controllable browser: open pages, inspect accessibility snapshots, click, fill, read text, and capture screenshots.
First move:Install it, download the testing browser, then automate only a harmless public page before using any logged-in profile.
Example use case:Let an agent smoke-test a local web app by opening the page, checking button labels, clicking a form, and saving a screenshot for review.
Safety note:Browser automation can act as you on logged-in sites. Start with disposable pages, avoid real accounts while learning, and review actions before submitting forms or purchases.
Git-native CLI that records AI-agent sessions, prompts, tool calls, files touched, and checkpoints alongside commits.
First move:Enable it in a private disposable repo and inspect where checkpoints are stored before using it on work or public code.
Example use case:Recover from a bad coding-agent run by jumping back to the checkpoint before the agent rewrote the wrong subsystem.
Safety note:Session transcripts may include private code, prompts, filenames, tool output, and secrets. Keep checkpoint branches private and do not push unreviewed transcripts to public repos.
Copy/paste
brew tap entireio/tap
brew trust entireio/tap
brew install --cask entire
cd your-project && entire enable
entire status
Single-binary toolkit for agents to inspect, render, create, and edit Word, Excel, and PowerPoint files without Microsoft Office installed.
First move:Download the official release for your OS and try read-only rendering on a throwaway document before letting an agent edit real files.
Example use case:Have Hermie render a generated PowerPoint to images, inspect layout problems, fix the slide, and save a clean deck.
Safety note:Office files can contain private text, metadata, tracked changes, and embedded media. Work on copies first and review generated documents before sending them.
Copy/paste
# Download from GitHub Releases, then run:
officecli --help
officecli render sample.pptx --out sample-render
MCP server that exposes language-server features such as go-to-definition, references, rename, and diagnostics to MCP-capable agents.
First move:Install it with Go, add one language server such as gopls or pyright, and point it at a small local repo.
Example use case:Let an agent answer “where is this function used?” from real LSP references instead of brittle text search.
Safety note:The server indexes source code and may expose paths, symbols, diagnostics, and rename tools to an agent. Start read-only and scope the workspace narrowly.
Copy/paste
go install github.com/isaacphi/mcp-language-server@latest
# Then configure your MCP client with a read-only test workspace first.
Local Rust-backed code graph and validation gate that checks changed files before an AI coding edit lands.
First move:Run it read-only on a TypeScript or Rust repo and inspect the reported hotspots before making it part of an agent workflow.
Example use case:Have a coding agent run Opcore after edits so dead exports, risky fan-in hotspots, and missing validation surface before commit time.
Safety note:Treat it like a pre-commit reviewer, not an autopilot. Review any suggested edits and keep destructive commands outside the validation gate.
Copy/paste
npx opcore --help
# Then follow the repo quickstart for your project type.
Cross-platform CLI and MCP server that turns a repository into filtered, token-budgeted context for LLMs.
First move:Build or install it, run it on a small public repo, and confirm ignored files and size limits before using it on private code.
Example use case:Generate a focused context bundle for “explain the auth flow” without dumping node_modules, binaries, or generated files into an LLM prompt.
Safety note:Code context can leak proprietary source or secrets. Respect .gitignore, review output before sharing, and keep MCP access scoped to the intended repository.
Copy/paste
git clone https://github.com/DavidVeksler/CodeContext.git
cd CodeContext
dotnet build
LLM-assisted conventional commit generator that can draft commit messages, changelog entries, and logical commit splits from git diffs.
First move:Use --dry-run on a non-sensitive repo first; do not enable history rewrite until you understand the backup and review path.
Example use case:Turn a staged bug fix into a clean conventional commit message while preserving the human review step before committing.
Safety note:It reads git diffs and may send them to the model provider you configure. Do not run it on secret-bearing changes, and avoid rewrite mode on shared branches.
Outcome-based persistent memory MCP server for coding assistants, with profiles, local storage, and explicit sidecar scoring setup.
First move:Create a throwaway profile for one test project, inspect where data is stored, then decide what conversations or docs are safe to ingest.
Example use case:Let an agent remember which debugging approaches actually worked in a repo so future sessions avoid repeating failed fixes.
Safety note:Agent memory can preserve private prompts, file paths, and project facts. Use separate profiles, avoid ingesting secrets, and delete test memory stores when done.
Local-first flight recorder for AI coding agents that records tool calls, approvals, denials, detections, and optional SIEM forwarding.
First move:Try the local demo/dashboard on a lab machine and inspect the JSONL event trail before forwarding anything to a SIEM.
Example use case:Reconstruct what an agent did after a risky session: which files it read, which commands ran, and whether suspicious action sequences fired alerts.
Safety note:This creates sensitive audit logs about local files, commands, and agent behavior. Store them privately and scrub before sharing examples.
Local SQLite memory for project shell history, git patches, docs, and optional assistant transcripts so agents can retrieve what already happened.
First move:Run init and sync in a disposable repo, then query one past failure before enabling optional transcript ingestion.
Example use case:Ask “what command failed when we tried the Windows build?” and retrieve the shell attempts plus related commits without relying on scrollback.
Safety note:Shell history and transcripts can contain credentials, paths, and private project details. Keep the database local and leave transcript ingestion off until reviewed.
Vendor-neutral OpenTelemetry skills that teach compatible coding agents how to instrument apps, collectors, semantic conventions, and OTTL redaction.
First move:Install one skill into a disposable agent profile and ask it to instrument a toy service before touching production telemetry.
Example use case:Have an AI coding agent add correct HTTP spans and semantic attributes to a small app, then review the diff and emitted traces.
Safety note:Agent skills can change code and telemetry pipelines. Test on toy apps, review generated diffs, and avoid sending real user data or secrets into traces.
Local semantic runtime that models enterprise entities, datasets, topology, telemetry links, and agent-readable graph context through CLI, REST, Web UI, and MCP.
First move:Run the demo workspace locally with memory-backed storage, then inspect the Web UI before connecting any real schemas or telemetry.
Example use case:Let an agent explore a disposable service-topology model and answer which services, datasets, and runbooks relate to an incident.
Safety note:Semantic catalogs can expose schemas, service topology, business objects, logs, metrics, runbooks, and credentials. Start with sample workspaces and read-only data only.
Copy/paste
git clone --depth 1 https://github.com/alibaba/UnifiedModel.git ~/labs/umodel
cd ~/labs/umodel
make check-env
make quickstart
MCP server that lets an AI agent search and read local ZIM knowledge archives such as Wikipedia, Stack Exchange, or offline documentation.
First move:Install the server in a disposable MCP client and test it against one public ZIM file before adding private archives.
Example use case:Give a local agent offline access to a downloaded Python or Wikipedia ZIM archive while traveling or working without internet.
Safety note:ZIM archives can contain private or copyrighted material. Use archives you are allowed to store, keep private collections local, and only connect trusted MCP clients.
Copy/paste
uvx openzim-mcp --help
# Then point your MCP client at the stdio command from the project README.
MCP server for searching arXiv, downloading papers, reading bibliographic metadata, and helping agents work with research papers.
First move:Run the server with uvx and search for one harmless paper topic before wiring it into a larger research workflow.
Example use case:Ask an agent to find recent papers on sparse autoencoders, save the PDFs locally, and summarize methods into a literature note.
Safety note:Respect arXiv rate limits and paper licenses. Do not point automated summarizers at private PDFs or unpublished drafts unless you control the files.
DOCX-to-Markdown bridge and MCP server that lets AI edit Word documents while preserving formatting and producing Track Changes.
First move:Copy one non-sensitive DOCX into a test folder and round-trip it through Adeu before touching real contracts or client documents.
Example use case:Have an agent propose redlined edits to a policy draft, then review the generated Track Changes in Word instead of accepting raw Markdown.
Safety note:Word documents often contain confidential text, comments, and metadata. Test on copies, keep originals backed up, and never upload sensitive documents to unknown agents.
Small Bun-native job queue with SQLite persistence, dead-letter queues, cron scheduling, and an optional standalone server.
First move:Build one local queue with a toy job and a SQLite data path before using it for real notifications or automation.
Example use case:Queue background AI-agent tasks such as document summaries, retry failed jobs, and inspect failures without deploying Redis first.
Safety note:Queues can repeat side effects. Make jobs idempotent, protect any HTTP management port, and avoid putting secrets directly into job payloads.
Copy/paste
bun add bunqueue
# Standalone local server:
bunx bunqueue start --data-path ./data/bunq.db
HTML-like workflow language for reviewable automations with triggers, steps, retries, policies, JavaScript blocks, and human approvals.
First move:Install the CLI and run a tiny local workflow that prints status before connecting external APIs or scheduled triggers.
Example use case:Keep an agent-assisted deployment checklist as a version-controlled workflow file that requires human approval before the release step.
Safety note:WOML workflows can execute JavaScript and call external systems. Review workflow files like code, start with local dry runs, and keep tokens in environment variables.
Local project-memory and token-accounting layer that shares context across Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and related tools.
First move:Run OpenWolf in one throwaway repository and inspect the `.wolf/` files before enabling hooks in important projects.
Example use case:Carry project conventions and correction notes from a Codex session into Claude Code while tracking which sessions reread huge files.
Safety note:Project memory can store code snippets, prompts, paths, and command output. Keep `.wolf/` private unless you intentionally curate it for a public repo.
Local-first macOS status surface for AI coding quotas, CI, deploy health, and optional phone/watch/ESP32 desk displays.
First move:Run the Python host locally and inspect its JSON feed before enabling mobile or ESP32 clients.
Example use case:Watch Claude, Codex, GitHub Actions, and deploy status from one menu-bar indicator while a long agent run is in progress.
Safety note:The host reads local CLIs, auth state, and project status. Keep the feed bound to localhost or a private VPN and do not expose quota or repo status publicly.
Terminal workspace for running multiple coding-agent tasks in parallel with isolated git worktrees and persistent sessions.
First move:Try it with npx in a disposable repository and create one tiny task before letting several agents edit real code.
Example use case:Run one agent on a failing test, another on documentation, and a shell tab for verification while each task stays in its own worktree.
Safety note:Rove can start agent CLIs that edit files and run commands. Use trusted agent profiles, inspect each worktree diff, and do not land unattended changes without tests.
Copy/paste
npx @sma1lboy/rove
# Safer than piping the installer while evaluating it.
File-backed project memory convention, CLI, MCP server, and agent skills for tickets, issues, handovers, lessons, and roadmap state.
First move:Initialize it in a throwaway repo and read the generated `.story/` files before adding hooks to an important project.
Example use case:Keep yesterday's agent decisions, unresolved issues, and next-ticket handover in git so a new coding session does not restart from zero.
Safety note:The `.story/` directory can contain project plans, bug details, and private handovers. Review what gets committed and keep snapshots or sensitive notes out of public repos.
Copy/paste
npm install -g @storybloq/storybloq@latest
cd your-repo
storybloq init --name "your-repo"
Read-only local dashboard for observing AI agent runtime activity, sessions, token use, stalls, and cost signals across supported tools.
First move:Install it in a test environment, open the local dashboard, and confirm exactly which agent session files it can read.
Example use case:Spot a stalled or expensive agent session and compare token usage across local agent runs before choosing a cheaper model or smaller task split.
Safety note:It reads local agent metadata and may expose prompt, file path, or project context in a dashboard. Keep it local and do not share screenshots from private workspaces.
Git worktree manager built for parallel AI-agent coding sessions, branch-scoped state, hooks, and cleaner multi-task workflows.
First move:Install the CLI, enable shell integration, then create one disposable worktree from a clean repo before running multiple agents.
Example use case:Give one agent a bugfix branch and another a docs branch while keeping their file edits, terminal sessions, and diffs isolated until review.
Safety note:Worktrees make parallel edits easier, not automatically correct. Inspect each branch diff, run tests, and avoid merging unattended agent changes.
Open Swiss case-law and legislation corpus with web search, read-only MCP access, REST APIs, citation graph data, and downloadable Parquet files.
First move:Try the public web search or run one read-only REST query before connecting it to an MCP client.
Example use case:Ask a legal-research agent to find Swiss decisions for a narrow doctrine, then verify the returned citations against official head-notes instead of trusting generated citations.
Safety note:This is legal research data, not legal advice. Verify citations and jurisdictional context before relying on results in real legal work.
Local AI server for running chat, coding, speech, and image models through OpenAI-, Anthropic-, and Ollama-compatible APIs on your own hardware.
First move:Read the install docs for your platform, install from official releases, and test with one small model before wiring in agent tools.
Example use case:Run a private local model endpoint for throwaway coding experiments or offline demos while keeping prompts on your own machine.
Safety note:Local models still see whatever prompts and files you send them. Keep private data local, review connected apps, and do not expose the API port to your LAN or internet by accident.
Copy/paste
# Pick the official installer for your OS:
# https://github.com/lemonade-sdk/lemonade/releases/latest
Docker CLI plugin and gateway for running MCP servers in isolated containers and sharing one controlled tool endpoint across clients.
First move:Install or update Docker Desktop, then list the available MCP commands before attaching any server that needs credentials.
Example use case:Test a filesystem, GitHub, or database MCP server in a containerized sandbox before wiring it into Hermes, VS Code, or another agent client.
Safety note:MCP servers can expose files, SaaS accounts, databases, and secrets. Start with read-only tools, use Docker Desktop secret handling, and review permissions before connecting real accounts.
Command-line interface for Google Workspace APIs with structured output, dynamic commands, and agent-oriented workflows.
First move:Install the CLI and inspect the help output before starting OAuth setup or granting Workspace scopes.
Example use case:Let an agent list calendar events, search Drive metadata, or export a Sheet as JSON during a controlled automation run.
Safety note:Workspace OAuth scopes can expose email, files, calendars, and admin data. Use the minimum scopes needed, keep token caches private, and do not paste credentials into public examples.
Microsoft sample lab collection for learning AI gateway patterns with Azure API Management, model routing, safety controls, observability, and MCP scenarios.
First move:Browse the lab catalog and run only a small local or disposable Azure subscription lab before deploying any infrastructure.
Example use case:Prototype rate limits, quotas, semantic caching, or model-routing policies for a team AI gateway before writing production templates.
Safety note:Azure labs may create billable resources and handle provider keys. Use sandbox subscriptions, tear resources down after testing, and keep tokens in private environment or secret stores.
Copy/paste
git clone https://github.com/Azure-Samples/AI-Gateway.git ~/labs/azure-ai-gateway
cd ~/labs/azure-ai-gateway
Small self-hosted Markdown note app with APIs, useful for quick capture, lab notes, and agent-readable personal knowledge bases.
First move:Start a local container, create a few non-sensitive notes, and understand visibility settings before importing private notebooks.
Example use case:Keep homelab commands, troubleshooting notes, and small project logs in one local web app that an agent can later query through controlled APIs.
Safety note:Notes can contain secrets, personal data, and internal URLs. Configure accounts and backups before exposing Memos beyond localhost or a trusted VPN.
Copy/paste
docker run -d --name memos -p 5230:5230 -v ~/.memos:/var/opt/memos neosmemo/memos:stable
Open-source workbench for inspecting, chatting with, and evaluating MCP servers, MCP apps, tools, prompts, resources, OAuth flows, and JSON-RPC traffic.
First move:Open the hosted app or run the local inspector against one harmless demo server before connecting private files or accounts.
Example use case:Debug why the same MCP server behaves differently in Claude, Cursor, ChatGPT, and a local agent client before shipping the integration.
Safety note:MCP servers can expose files, SaaS data, credentials, or write tools. Start with read-only/demo servers, keep localhost bindings local, and avoid putting API keys into hosted sessions.
Repo-local living wiki and deterministic code graph that helps AI coding agents keep project knowledge grounded and current.
First move:Run setup in a disposable or well-backed-up repo first, then inspect the generated Markdown wiki before letting agents rely on it.
Example use case:Give a coding agent compact, task-specific context about architecture and conventions without rereading the whole repository every session.
Safety note:mex reads repository structure and may create or update local documentation. Review generated files, opt out of telemetry if needed, and never commit private notes or secrets accidentally.
Local-first dashboard that turns coding-agent session logs into work receipts: files changed, checks run, decisions, time, tokens, and estimated cost.
First move:Install the CLI, onboard one machine, and inspect the terminal dashboard before sharing any reports or screenshots.
Example use case:Audit what Claude Code, Codex, OpenCode, or Hermes actually did during a task and separate reported work from machine-verified checks.
Safety note:It reads local agent session files that may contain prompts, paths, diffs, and private project context. Keep dashboards local and treat exports as sensitive.
Runtime guardrail layer that reviews AI coding-agent tool calls, MCP actions, shell egress, and risky operations before they execute.
First move:Install in a test workspace, run the doctor/demo flow, and choose a conservative mode before protecting real agent sessions.
Example use case:Put a policy gate in front of a filesystem MCP server so routine reads pass while destructive or suspicious tool calls are blocked for review.
Safety note:Guardrails reduce risk but are not a substitute for review. Test policies locally, understand telemetry choices, and do not assume every dangerous command can be detected perfectly.
Copy/paste
pip install doberman-core
doberman setup
doberman doctor
Official Python SDK for building Model Context Protocol servers and clients with typed tools, resources, prompts, transports, and a developer CLI.
First move:Create a tiny local server with one harmless read-only tool before connecting it to Hermes or another agent client.
Example use case:Build a private MCP server that lets an agent search a local notes folder or query a toy SQLite database through a narrow, audited interface.
Safety note:MCP tools can expose files, databases, SaaS accounts, and shell access. Start with read-only tools, keep secrets in environment variables, and review every capability before connecting a powerful model.
Official TypeScript SDK for building MCP servers and clients in Node, Deno, and browser-adjacent JavaScript projects.
First move:Install the server package in a throwaway project and expose one safe demo tool before adding real integrations.
Example use case:Prototype an MCP server that gives an agent controlled access to a project issue list or read-only build metadata from a TypeScript service.
Safety note:Treat each MCP method as an agent-facing permission boundary. Avoid broad filesystem or network tools until you have logging, scoping, and review in place.
Compiler-based UI framework for adding fast interactive components without turning a static site into a bloated app.
First move:Use it as Astro islands first: add one interactive component, prove it works, then decide whether SvelteKit is worth a full migration.
Example use case:Power askhermie.dev resource search, command palettes, copy buttons, filters, and dashboard widgets while Astro keeps static SEO pages simple.
Safety note:Install from the official Astro/Svelte packages, review generated changes, and avoid pasting private tokens into demo components.
Tiny static-site generator that turns a folder of Markdown files into a simple blog with very little setup.
First move:Try it in an empty folder with one Markdown file and serve the generated site locally.
Example use case:Publish a small project log, lab notebook, or plain Markdown blog without learning a full JavaScript framework.
Safety note:Static output is low risk, but review generated pages before publishing if your Markdown notes contain private names, paths, hostnames, or screenshots.
Copy/paste
cargo install marmite
mkdir -p ~/labs/marmite-blog/input
printf "# First post
Hello from Marmite.
" > ~/labs/marmite-blog/input/first.md
cd ~/labs/marmite-blog
marmite --serve
Static-site generator for Deno that supports Markdown, YAML, TypeScript, JSX, Vento, Nunjucks, and asset processors.
First move:Install Deno, create one test page, and build locally before choosing themes or plugins.
Example use case:Publish a small lab notebook or project page without creating a Node.js dependency tree.
Safety note:Static sites are low risk, but published Markdown can leak names, paths, hostnames, screenshots, and private notes. Review output before deploy.
Copy/paste
mkdir -p ~/labs/lume-site
cd ~/labs/lume-site
printf "---
title: Hello Lume
---
# Hello Lume
" > index.md
deno run -A https://deno.land/x/lume/cli.ts
Self-hostable web analytics with cookie-less tracking, conversion reports, AI-crawler visibility, and optional read-only MCP access.
First move:Read the self-hosting guide and test it against a throwaway site before adding production domains or Search Console imports.
Example use case:Track visits, goals, Web Vitals, and AI crawler traffic for a small static site without deploying a heavy analytics stack.
Safety note:Analytics tools collect visitor behavior, referrers, locations, and sometimes search/import data. Use privacy-friendly settings and never publish JWT secrets or API clients.
Copy/paste
docker pull pascalebeier/hitkeep:latest
# Then follow the official self-hosting guide for secrets and public URL.
Young but practical static-site generator focused on fast personal sites and blogs with a small toolchain.
First move:Read the getting-started docs and build one tiny personal-site folder before migrating existing content.
Example use case:Publish a minimal project journal or lab blog without adopting a heavier web framework.
Safety note:Static sites are low risk, but drafts can leak names, hostnames, screenshots, paths, or internal notes. Review generated output before publishing.
Copy/paste
# Start with the official getting-started docs:
# https://zine-ssg.io
Modern Markdown documentation-site generator from the Material for MkDocs team, with search, themes, and multilingual docs support.
First move:Create a throwaway docs site and write one install page before choosing themes or publishing.
Example use case:Turn a project README plus a few how-to notes into a polished static documentation site.
Safety note:Docs often leak internal URLs, screenshots, example credentials, and private architecture details. Scrub examples and generated pages before deploy.
Tiny Lua/C static-site generator with Markdown processing, templates, syntax highlighting, link checking, and zero runtime dependencies.
First move:Download a release or compile from source, then build the tutorial blog before writing plugins.
Example use case:Generate a small lab notebook or project site when you want one small binary instead of a Node or Python toolchain.
Safety note:The project is experimental and may break workflows. Static output is low risk, but review generated pages for private notes, paths, and screenshots.
Copy/paste
git clone --recursive https://github.com/jaredkrinke/luasmith.git ~/labs/luasmith
cd ~/labs/luasmith
make
Content-driven static-site generator that turns Markdown, YAML frontmatter, Twig templates, themes, assets, taxonomies, RSS, redirects, robots.txt, and sitemaps into a static site.
First move:Install the PHAR in a toy folder and build the quick-start blog before migrating real content.
Example use case:Publish a simple project journal or docs site when you already have PHP available and want a static output with no database.
Safety note:Static-site generators can publish drafts, screenshots, private URLs, and environment-derived config. Review the generated output before deploying.
WordPress plugin that exports a WordPress site as static HTML, CSS, and JavaScript for deployment to static hosting.
First move:Test it on a staging clone of a WordPress site, export a ZIP, and inspect the generated files locally before touching production.
Example use case:Convert a small WordPress brochure site or blog into static files for Cloudflare Pages while leaving the editable WordPress instance private.
Safety note:Static exports can leak draft pages, private media, admin URLs, form endpoints, analytics IDs, and old uploads. Use a staging clone and review the ZIP before publishing.
Markdown-first static-site generator for publishing notes, wikis, and digital gardens with backlinks and graph-style navigation.
First move:Create a toy garden with a few public notes before pointing it at a real private vault.
Example use case:Publish a small public knowledge base from Markdown notes while keeping private Obsidian notes out of the repo.
Safety note:Note vaults often contain private names, drafts, links, and screenshots. Use a separate public folder or explicit export workflow, then inspect the built site before publishing.
Markdown-based typesetting system for turning one source project into papers, books, presentations, websites, and knowledge bases.
First move:Compile one sample document locally before using custom functions or publishing outputs.
Example use case:Maintain a project report as Markdown and generate both a printable PDF-style document and a web version from the same source.
Safety note:Generated documents can leak drafts, local paths, embedded files, or private citations. Review exports before sharing, especially when using includes or custom functions.
Copy/paste
# Install from the latest release or package instructions:
# https://github.com/iamgio/quarkdown/releases/latest
# Then follow: https://quarkdown.com/docs
Self-hostable visual CMS and static-site builder that keeps sites synchronized as both database content and editable project files.
First move:Run the Docker quickstart locally and create a throwaway site before trusting it with client content.
Example use case:Let a human client edit content visually while an AI coding agent edits the same site as structured files under version control.
Safety note:CMS instances hold unpublished content, user accounts, media, and site config. Set real auth before exposure, back up the volume, and review generated static output before deploying.
Copy/paste
docker run -d -p 8080:8080 -v primo-data:/app/pb_data ghcr.io/primocms/primo:latest
Simple JavaScript static-site generator for Markdown, HTML, Liquid, Nunjucks, WebC, and other templates.
First move:Create a tiny local site and learn the input/output folder model before adding plugins.
Example use case:Build a lightweight project blog, lab notebook, or documentation microsite without running a database or full app framework.
Safety note:Static-site publishing is usually safe, but templates and plugins can run local code at build time. Use trusted plugins and review content for secrets before publishing.
Documentation generator for .NET API reference, Markdown docs, REST API docs, and technical documentation sites.
First move:Install the .NET tool and generate the default sample site locally before pointing it at a real codebase.
Example use case:Publish API reference and conceptual docs for a .NET library so users can browse types, examples, and guides in one static site.
Safety note:API docs can expose internal namespaces, comments, endpoints, or TODOs. Build locally and review output before making generated docs public.
Lightweight Crystal static-site generator with Markdown frontmatter, Jinja2-style templates, parallel builds, incremental caching, and live reload.
First move:Install Crystal, build the tutorial site locally, and check the output folder before migrating existing posts.
Example use case:Generate a fast project journal or lab notebook from Markdown when you want a small non-JavaScript static-site stack.
Safety note:Static-site builds can publish drafts, hostnames, screenshots, or private notes. Review generated output and third-party themes before deploying.
Copy/paste
# Install Crystal first, then follow the current Hwaro install docs:
# https://hwaro.hahwul.com/start/installation/
hwaro --help
Static-site generator built on Quarkus for Markdown, Asciidoc, templates, data files, blogs, and Java-adjacent documentation sites.
First move:Follow the Roq getting-started docs in a throwaway project and build one tiny page before adding Quarkus extensions.
Example use case:Publish a Java/Quarkus project blog or docs site while keeping content and typed data close to the application codebase.
Safety note:Static builds can publish drafts, internal config, diagrams, and generated data files. Review the output directory before deployment and keep build-time secrets out of content.
Copy/paste
# Start with the official docs:
# https://iamroq.dev/docs/
Open-source framework for building interactive API documentation and developer portals from OpenAPI, Markdown, and MDX.
First move:Generate a new docs project with a toy OpenAPI file before pointing it at an internal or production API schema.
Example use case:Turn a small REST API schema into a polished docs site with an interactive playground for local testing.
Safety note:API docs can leak internal endpoints, example tokens, schemas, auth flows, and unpublished routes. Review generated pages and scrub examples before publishing.
Documentation generator for user guides that can pull tested examples, API snippets, diagrams, charts, and presentation slides from the same Markdown source.
First move:Run the official hello-world example and publish only generated sample content before wiring it to real test outputs or internal docs.
Example use case:Turn a small API tutorial into docs and workshop slides while embedding command output from a toy test suite.
Safety note:Living docs can accidentally publish internal code snippets, screenshots, REST responses, CLI output, hostnames, and test data. Review generated pages before deploying.
Copy/paste
# Start with the official docs and hello-world flow:
# https://testingisdocumenting.org/znai/
Local Markdown knowledge graph that gives humans editor navigation and AI agents CLI/MCP-friendly context over the same plain files.
First move:Try it on a throwaway folder of Markdown notes before pointing it at a real Obsidian vault, work journal, or project docs.
Example use case:Let an agent query linked lab notes or design docs from local Markdown without uploading the whole vault to a hosted memory product.
Safety note:Markdown vaults can contain private names, links, project details, and copied secrets. Start with non-sensitive notes and review what agents can query.
Static-site generator for publishing a team technology radar with quadrants, rings, item history, tags, and search.
First move:Clone the reference repo and build a tiny private radar with fake entries before importing real team decisions.
Example use case:Publish an internal “adopt / trial / assess / hold” map for agent tools, homelab platforms, or engineering standards.
Safety note:Technology radars can reveal internal priorities, vendors, architecture, and security posture. Review entries before making a generated radar public.
Copy/paste
git clone https://github.com/AOEpeople/aoe_technology_radar.git ~/labs/aoe-technology-radar
cd ~/labs/aoe-technology-radar
npm install
npm run build
Lightweight static site generator for technical documentation written in MDX with Mermaid diagram support.
First move:Install the CLI, build a tiny docs folder, and preview it locally before connecting deployment.
Example use case:Publish a small project handbook with API notes, Mermaid architecture diagrams, and copy/paste setup snippets without running a backend.
Safety note:Static docs can leak internal hostnames, paths, screenshots, and example secrets. Review generated pages before publishing them.
Static site generator that turns Structurizr DSL / C4 architecture models into browsable documentation sites.
First move:Generate the included example workspace first, then try one small model for a non-sensitive project.
Example use case:Create a static architecture map for a homelab or service: systems, containers, ADRs, diagrams, and docs in one browsable site.
Safety note:Architecture models often expose internal system names, trust boundaries, and network paths. Keep generated sites private unless the model is intentionally public.
Copy/paste
docker run -it --rm ghcr.io/avisi-cloud/structurizr-site-generatr --help
Astro-powered documentation framework for fast, accessible docs sites with navigation, search, i18n, and content collections.
First move:Create the starter project and write one page of real docs before customizing themes or plugins.
Example use case:Turn a Hermes skill collection, lab guide, or project runbook into a polished static docs site that can deploy cheaply.
Safety note:Docs sites often leak internal URLs, screenshots, and config snippets. Review content for secrets and private infrastructure details before publishing.
Copy/paste
npm create astro@latest -- --template starlight
cd <project-name>
npm run dev
Python static documentation generator for Markdown and Jupyter notebooks with multi-doc, wiki, versioning, theme, and search support.
First move:Create a throwaway docs site, choose the minimal template, and serve it locally before importing real notebooks or internal notes.
Example use case:Turn firmware lab notes and a few Jupyter analysis notebooks into a local searchable documentation site for a workshop.
Safety note:Generated docs can publish notebook outputs, screenshots, internal links, hostnames, and copied secrets. Review the built HTML before deploying.
Fast Go implementation of much of Jekyll, useful for locally building or previewing simple Jekyll-style static sites without a full Ruby setup.
First move:Download a release or build from source, then run it against a throwaway Jekyll-style folder before trying a real migration.
Example use case:Preview an older Jekyll blog or GitHub Pages-style project quickly while deciding whether to keep Jekyll, migrate to Hugo/Astro, or simplify the site.
Safety note:Static-site generators can still publish private drafts, hostnames, and screenshots. Review the generated _site output before deploying it anywhere.
Copy/paste
go install github.com/osteele/gojekyll@latest
gojekyll help
Python tool that turns Gramps and GEDCOM genealogy data into interactive encyclopedia-style static family-history websites.
First move:Try the official demo and docs first, then build from a tiny sample tree before importing real family data.
Example use case:Generate a private family-history website from a curated GEDCOM export so relatives can browse people, places, sources, and timelines.
Safety note:Genealogy data contains living people, relationships, dates, places, and sensitive family details. Keep first builds private and remove living-person data before publishing.
CLI and Vite tooling for building static websites from Observable Notebooks using an open notebook file format.
First move:Read the technology-preview docs and build one public sample notebook before converting private analysis work.
Example use case:Publish a small data-exploration notebook as a static site for a project page without running a notebook server in production.
Safety note:Notebooks often contain outputs, paths, data samples, and copied credentials. Clear private cells and review the built site before publishing.
Copy/paste
npm install @observablehq/notebook-kit
# Then follow the official quickstart for your notebook files.
Polished Markdown documentation theme for MkDocs with search, navigation, tabs, admonitions, diagrams, and strong mobile layout.
First move:Create a tiny docs folder, run the local dev server, and write one page before changing theme options.
Example use case:Turn scattered homelab notes or project runbooks into a searchable internal documentation site that a teammate can actually browse.
Safety note:Docs often contain private hostnames, tokens, and operational details. Review generated pages before publishing and keep internal runbooks private by default.
Copy/paste
pipx install mkdocs-material
mkdocs new my-docs
cd my-docs
mkdocs serve
Text-based diagrams for flowcharts, sequence diagrams, state machines, entity relationships, Git graphs, and architecture sketches.
First move:Paste a small diagram into the live editor or a Markdown preview before installing any CLI tooling.
Example use case:Document how a webhook moves through an API, queue, worker, database, and notification service in a diagram that can live next to the code.
Safety note:Diagrams can reveal internal architecture and system names. Sanitize diagrams before sharing them publicly.
Everyday tools for Python, terminals, automation, homelabs, monitoring, and keeping machines understandable.
ObservabilityIntermediate
SigNoz
OpenTelemetry-native observability stack that brings traces, metrics, logs, dashboards, and alerts into one self-hostable place.
First move:Try the local Docker install on a non-production machine, then send one sample app trace before wiring in real services.
Example use case:Debug a slow API by correlating request traces, error logs, and latency graphs instead of guessing from raw log files.
Safety note:Run it on systems you control and lock down dashboards before exposing them; observability data can contain sensitive URLs, headers, and logs.
Copy/paste
git clone -b main https://github.com/SigNoz/signoz.git ~/tools/signoz
cd ~/tools/signoz/deploy/docker
docker compose up -d
Self-hosted dashboard for organizing homelab links, widgets, status checks, and shortcuts.
First move:Run the demo container locally and add two internal links before exposing anything beyond localhost.
Example use case:Build a single homepage for Home Assistant, Uptime Kuma, NAS admin, and documentation links on a private LAN.
Safety note:Do not publish admin dashboards to the internet without authentication, HTTPS, and access controls; dashboard links reveal internal services.
Copy/paste
docker run -d -p 8080:8080 --name dashy --restart=unless-stopped lissy93/dashy:latest
Self-hosted web UI for checking and optionally updating Docker containers across one or more hosts.
First move:Use check-only mode first, keep automatic updates disabled, and verify backups before allowing it to update containers.
Example use case:Get notified that homelab containers have newer images, then manually update low-risk services after reading release notes.
Safety note:Docker socket access is powerful. Use a strong local secret, avoid public exposure, and do not enable unattended updates for stateful services.
A fast self-hosted start page for homelab services, bookmarks, and service widgets configured with YAML.
First move:Create a tiny config directory and add two links before wiring service integrations.
Example use case:Build a private landing page for your NAS, router, Uptime Kuma, Grafana, Home Assistant, and lab docs.
Safety note:Dashboard widgets and Docker integrations can reveal internal hostnames and service metadata. Keep it private and avoid publishing lab details.
Programmable build/test/ship automation that runs workflows locally, in CI, or in the cloud using containers.
First move:Run a local example pipeline before connecting it to CI secrets or deployment targets.
Example use case:Give Hermie a repeatable containerized pipeline for linting, testing, and building a project without depending on host setup quirks.
Safety note:Dagger workflows can access source code, containers, networks, and secrets. Keep secrets out of examples and review modules before running them.
Copy/paste
# Pick an official install option for your OS:
# https://docs.dagger.io/install
dagger version
Open-source monitoring, alerting, incident management, and status-page platform for teams that want one self-hostable observability hub.
First move:Read the Docker Compose install guide and test it on a lab VM before pointing real alerts or production services at it.
Example use case:Create a private status page and monitor a few lab services so you can practice alert routing and incident updates without touching production.
Safety note:Monitoring systems collect service names, URLs, incidents, and sometimes secrets in logs. Keep lab installs private and scrub sensitive data before exposing status pages.
Copy/paste
# Official install options:
# https://oneuptime.com/docs
# Self-hosted quick start is documented at:
# https://github.com/OneUptime/oneuptime
Self-hosted DOCSIS/cable-modem evidence tracker for signal problems, packet loss, slowdowns, and ISP complaint timelines.
First move:Run it against your own modem/router only, then confirm the dashboard records signal and event history.
Example use case:Collect a week of modem signal and outage evidence before calling an ISP about evening packet loss.
Safety note:Only monitor networks and modems you own or administer. The dashboard can reveal ISP details, public IPs, modem events, and home-network timing patterns.
Copy/paste
git clone --depth 1 https://github.com/itsDNNS/docsight.git ~/labs/docsight
cd ~/labs/docsight
docker compose up -d
Unified monitoring dashboard for Proxmox, Docker, Kubernetes, alerts, and infrastructure health.
First move:Run the Docker container on a lab host, complete setup, and connect one non-production target first.
Example use case:Watch a Proxmox node and Docker host from one dashboard while learning which metrics matter during outages.
Safety note:Monitoring dashboards and agents expose infrastructure details and sometimes API tokens. Use authentication, private networks, and least-privilege integrations.
Self-hosted network discovery, Docker host scanning, visualization, and monitoring for homelabs and small infrastructure.
First move:Run it only on a lab network you administer and set explicit subnets instead of letting discovery roam.
Example use case:Map a home lab with Docker hosts, local devices, and service metadata so you can spot forgotten machines and exposed services.
Safety note:Network discovery and Docker socket access are sensitive. Scan only networks you own, protect the UI/API, and avoid broad or public ranges.
Vendor-neutral service for receiving, processing, and exporting telemetry data across traces, metrics, and logs.
First move:Run the contrib container with a tiny local config and send sample telemetry before touching production pipelines.
Example use case:Receive app traces locally, scrub or transform attributes, then export them to a chosen backend without changing every app.
Safety note:Collectors can forward sensitive headers, labels, logs, traces, and host metadata. Redact secrets and test routing locally before exporting anywhere.
Copy/paste
docker run --rm otel/opentelemetry-collector-contrib:latest --version
Graphical desktop app for building, running, and managing containers, pods, local Kubernetes, and Podman/Docker-compatible workflows.
First move:Install the desktop app, run one local container, then inspect images, logs, volumes, and Kubernetes features from the UI.
Example use case:Help a beginner see what containers, images, ports, and volumes exist before switching to CLI-heavy Podman or Docker workflows.
Safety note:Container UIs can start privileged containers, expose ports, and mount local files. Avoid running unknown images or mounting sensitive directories.
Copy/paste
# Download the package for your OS:
# https://podman-desktop.io/downloads
Terminal UI for Docker and Docker Compose that makes containers, logs, images, volumes, and compose services easier to inspect.
First move:Install it and open it against a disposable Docker Compose project before managing important services.
Example use case:Watch logs, restart a broken compose service, inspect ports, and clean up test containers without memorizing every Docker command.
Safety note:Docker management tools can stop services, delete containers, and expose secrets in logs or env views. Use lab stacks first and read before acting.
Copy/paste
go install github.com/jesseduffield/lazydocker@latest
lazydocker --version
UPS monitoring and shutdown orchestration for NUT, with policies for VMs, containers, remote hosts, notifications, Prometheus, MQTT, and a TUI.
First move:Install it on a lab host connected to a test UPS, validate the config, and simulate policy behavior before trusting shutdown automation.
Example use case:Coordinate clean shutdown of a homelab server, NAS, and a few containers when UPS battery runtime drops below a safe threshold.
Safety note:Shutdown orchestration can power off real machines and interrupt services. Test with non-critical hosts, document recovery, and keep notification tokens out of configs you publish.
Small self-hosted dashboard for homelab links, widgets, live Docker stats, service status, and SSE updates.
First move:Run it on a private lab host, add two internal services, and verify the config volume is writable.
Example use case:Create a single private page for your router, NAS, Docker services, monitoring, and lab notes without a large platform.
Safety note:Labby has no built-in auth in the documented quickstart. Keep it on a trusted LAN/VPN and do not expose service links or credentials publicly.
Self-hosted dashboard that watches container image updates across many registries and can send notifications or trigger actions.
First move:Use the documented Docker socket proxy setup in a lab before letting it monitor important hosts.
Example use case:Track which homelab containers have newer images available without granting a dashboard unrestricted Docker socket access.
Safety note:Container update tools can expose registry credentials and act on Docker infrastructure. Use a socket proxy, protect the UI, and avoid automatic updates until tested.
Copy/paste
# Start with the socket-proxy quickstart, not a raw Docker socket mount:
# https://github.com/CodesWhat/drydock#quick-start
Lightweight Flask and Socket.IO dashboard for Raspberry Pi 5 CPU, memory, temperature, fan, disk, network, and power metrics.
First move:Run it on a local Pi 5 and view the dashboard from your trusted LAN before changing service or startup settings.
Example use case:Watch thermals and PMIC power draw while testing a case, fan, SSD, or small homelab workload on a Pi 5.
Safety note:System dashboards expose live device health and network details. Keep the Flask app on a trusted LAN or bind it to localhost for experiments.
Self-hosted uptime and SSL monitoring with status pages, maintenance windows, notifications, Prometheus/OpenTelemetry export, and an MCP server.
First move:Deploy it on a lab host and monitor one harmless local service before adding public sites or notification channels.
Example use case:Track whether your homelab dashboard, personal website, and SSL certificates are healthy, then ask an agent for a plain-English incident summary.
Safety note:Monitoring configs and status pages can reveal internal service names, URLs, and alert contacts. Keep private monitors private and protect the admin UI.
Copy/paste
# Start with the maintained install guide:
# https://kuvasz-uptime.dev/setup/installation/
Terminal dashboard for Raspberry Pi health: CPU, RAM, disk, network, temperature, undervoltage, throttling, and diagnostic “Doctor” views.
First move:Run it locally on one Pi and watch thermals while changing only one variable, such as case lid, fan, or workload.
Example use case:Check whether a Pi case or fan setup is causing thermal throttling during a Docker build or sensor workload.
Safety note:Read-only monitoring is low risk, but the output reveals hardware state, IP/network details, and hostnames. Do not post screenshots from private labs without review.
Copy/paste
# Check the README for the current package/install path, then try:
# systempi --variation doctor --theme vaulttec
UPS monitoring and shutdown orchestration for Network UPS Tools, with multi-UPS policies, VM/container/remote shutdown, TUI, API, Prometheus, MQTT, and Grafana support.
First move:Read the deployment profiles and simulate with one non-critical lab machine before enabling any real shutdown action.
Example use case:Coordinate a graceful shutdown plan for a homelab UPS that powers a NAS, a Proxmox host, and Docker services.
Safety note:This tool can shut down hosts, VMs, containers, and remote systems. Test policies in dry-run/lab mode and protect SSH keys, API access, and dashboard ports.
Raspberry Pi monitoring application for Generac-compatible standby generators and other supported controllers over serial, Wi-Fi, wired, Modbus, MQTT, SNMP, email, and web views.
First move:Read the wiring and supported-controller docs twice, then test read-only monitoring before enabling integrations or notifications.
Example use case:Track generator status, faults, maintenance logs, battery voltage, and exercise history from a Pi on a trusted LAN.
Safety note:Generators are safety-critical equipment. Wrong wiring, controller commands, or exposed dashboards can cause damage or leak home infrastructure details. Work only on equipment you own and keep control interfaces private.
Copy/paste
git clone --depth 1 https://github.com/jgyates/genmon.git ~/labs/genmon
cd ~/labs/genmon
# Read the project wiki before running install scripts or connecting hardware.
Raspberry Pi Zero W and Pimoroni Enviro+ project for measuring particles, gases, temperature, humidity, air pressure, light, and approximate noise levels.
First move:Start with the Pimoroni Enviro+ setup, then run one display/logger mode indoors before adding MQTT or outdoor enclosures.
Example use case:Build a small air-quality station for a workshop or lab and send readings to Home Assistant or a local dashboard.
Safety note:Sensor readings are approximate unless calibrated, and locations/feeds can reveal home routines. Keep MQTT/API credentials private and protect outdoor electronics from weather and power faults.
Copy/paste
git clone --depth 1 https://github.com/roscoe81/enviro-monitor.git ~/labs/enviro-monitor
# Then follow the hardware-specific setup notes in the README.
Local-first bridge that turns Bluetooth speakers or headphones into Music Assistant players with a browser setup UI and Home Assistant deployment paths.
First move:Run the demo mode or Docker setup on a spare Linux host before pairing real speakers.
Example use case:Reuse ordinary Bluetooth speakers as room audio endpoints managed by Music Assistant and Home Assistant automations.
Safety note:Bluetooth pairing, local audio devices, and Home Assistant tokens are involved. Keep the web UI on your LAN, review diagnostics before sharing, and do not expose the bridge to the internet.
Copy/paste
git clone https://github.com/trudenboy/sendspin-bt-bridge.git
cd sendspin-bt-bridge
docker compose up -d
Open-source, cloud-free Homematic IP / HomeMatic CCU replacement that runs on CCU hardware, Raspberry Pi, x86/ARM machines, virtual appliances, containers, and Home Assistant.
First move:Read the installation wiki and test with a backup or spare device before migrating a working smart-home controller.
Example use case:Move a Homematic smart-home setup into a local, cloud-free controller that can run on Raspberry Pi or a VM while preserving CCU-style workflows.
Safety note:Smart-home hubs can control locks, heating, alarms, and automation routines. Back up first, test restores, and avoid internet-exposing the WebUI.
Copy/paste
# Start with the official install wiki and release images:
# https://github.com/OpenCCU/OpenCCU/wiki/Installation
# https://github.com/OpenCCU/OpenCCU/releases
Web UI and lightweight agents for waking, sleeping, or shutting down LAN hosts with Wake-on-LAN and authenticated shutdown requests.
First move:Use the browser-only demo first, then test one lab machine before controlling anything important.
Example use case:Let a homelab dashboard wake a NAS before backup time and shut down a spare workstation after a render job finishes.
Safety note:Remote shutdown is a denial-of-service footgun if exposed or misconfigured. Keep the coordinator on the LAN/VPN, use authentication, and never install agents on machines you do not own or administer.
Copy/paste
# Preview the safe demo before installing agents:
# https://9SMTM6.github.io/shuthost/
# Then read: https://github.com/9SMTM6/shuthost/tree/main/docs/examples
Small tool that keeps historical uptime, downtime, startup, and shutdown statistics across reboots.
First move:Install it on one Linux box or VM and run it after a few restarts to learn what it records.
Example use case:Check whether a flaky Raspberry Pi, mini-PC, or VPS is rebooting overnight and how long it stays down.
Safety note:It records host uptime history locally. The risk is low, but exported reports can reveal maintenance windows or outage patterns for private infrastructure.
CLI and TUI dashboard for UniFi Network controllers covering clients, devices, networks, events, and operational commands.
First move:Run the help command first, then create a least-privilege API key and use interactive config instead of pasting keys into shell history.
Example use case:List connected clients or inspect UniFi devices from a terminal while debugging a home lab network you administer.
Safety note:UniFi access can reveal client devices and run disruptive actions such as kicks, restarts, upgrades, or port cycles. Use read-only workflows first and keep API keys in protected config files.
Lightweight self-hosted Git service that runs on small servers, VMs, and Raspberry Pi-class hardware.
First move:Deploy it on a private lab host first and create one test repo before migrating anything important.
Example use case:Host private firmware, homelab, or documentation repositories on a LAN box when GitHub is not the right place for the code.
Safety note:Git servers can leak source code, keys accidentally committed to repos, webhooks, and user accounts. Keep it patched, require strong auth, back up repositories, and do not expose a lab instance publicly by default.
Copy/paste
# Easiest safe start: read the install guide and run a local test instance
# https://gogs.io/docs/installation
Searchable directory of thousands of open-source self-hostable apps with categories, alternatives, licenses, setup links, and version tracking.
First move:Search for one need you actually have, then compare two projects instead of installing a random stack.
Example use case:Find a lightweight pastebin, notes app, uptime page, or media organizer for a homelab and ask Hermie to turn the chosen project into a safe Docker test plan.
Safety note:Directory entries are starting points, not endorsements. Check each project’s maintenance, auth model, exposed ports, update path, and data privacy before deploying it on a real server.
Copy/paste
# No install required. Start by browsing:
# https://selfhost.directory
Distributed network and service monitoring platform for edge, constrained, or hard-to-reach infrastructure.
First move:Read the architecture and deployment docs before installing; start with a small lab segment rather than your whole network.
Example use case:Monitor a remote homelab site, field cabinet, or small office edge network where you need local checks plus alerts when connectivity or power gets flaky.
Safety note:Monitoring can reveal internal hostnames, topology, service health, and outage patterns. Deploy only on networks you own or administer and protect dashboards, alert channels, and collected metrics.
Copy/paste
git clone --depth 1 https://github.com/carverauto/serviceradar.git ~/tools/serviceradar
cd ~/tools/serviceradar
less README.md
One-container dashboard for homelab and local-AI rigs: GPU usage, model activity, power cost, Docker, disks, uptime, and host health.
First move:Use the documented read-only compose option on a lab host before enabling controls, self-update, SSH, Docker, or systemd access.
Example use case:Watch a GPU workstation, Raspberry Pi, and Docker host while running local models so you can see VRAM, power, containers, and bottlenecks on one page.
Safety note:The default project can use broad host access, Docker socket access, service controls, SSH keys, and self-update features. Keep it private and disable controls unless you need them.
Copy/paste
# Prefer the documented read-only compose path first:
# https://sikamikanikobg.github.io/homelab-monitor/install/
Self-hosted photovoltaic dashboard for solar production, consumption, battery usage, grid exchange, and savings calculations.
First move:Use the official configurator to generate a Docker setup for a lab or home server, then connect one supported inverter/data source carefully.
Example use case:Track a home solar setup on a Raspberry Pi so production, battery state, grid usage, and cost savings are visible without a vendor-only app.
Safety note:Energy dashboards can reveal home occupancy, power usage, inverter details, and network endpoints. Keep it on a trusted LAN and protect credentials for meters, inverters, and APIs.
Copy/paste
# Generate the Docker configuration here:
# https://configurator.solectrus.de/
Fast Python type checker and language server from Astral, the team behind uv and Ruff.
First move:Try it on one small Python project and read the diagnostics before turning it into a blocking CI gate.
Example use case:Catch a wrong return type or missing attribute in a small automation script before Hermie edits more of the codebase around that mistake.
Safety note:Low operational risk. It reads source code and reports type issues, so avoid uploading diagnostics or examples from private repositories without review.
Flow-based automation tool for wiring events, APIs, MQTT, IoT devices, dashboards, and small glue jobs.
First move:Run it locally, build one Inject-to-Debug flow, then add real devices or credentials only after you understand the editor.
Example use case:Create a homelab flow that watches an MQTT temperature topic and sends a local notification when a sensor crosses a threshold.
Safety note:Node-RED flows can store credentials and control real devices. Keep the editor off the public internet, back up flows, and test automations with harmless outputs before switching relays or appliances.
Self-hostable database change-management platform for reviewing, approving, and tracking schema changes.
First move:Start with the Docker demo and a throwaway database before connecting production credentials or real migration pipelines.
Example use case:Give a small team a review trail for PostgreSQL schema changes instead of emailing raw SQL migrations around.
Safety note:Database governance tools touch schemas, credentials, migration history, and sometimes production data. Use least-privilege accounts, backups, and a lab database until access controls are proven.
Fast single-binary time-series database and Prometheus-compatible metrics backend.
First move:Run the single-node Docker container and send it lab metrics before trying it as long-term Prometheus storage.
Example use case:Store homelab server metrics for longer than your default Prometheus retention while still graphing them from Grafana.
Safety note:Metrics often reveal hostnames, internal URLs, service names, and traffic patterns. Keep lab instances private and review labels before exposing dashboards or snapshots.
Copy/paste
docker run --rm -p 8428:8428 victoriametrics/victoria-metrics:latest
Open-source orchestration platform for scheduled, event-driven, data, infrastructure, and AI workflows.
First move:Run the local quickstart and build one hello-world flow before connecting cloud accounts, databases, or production scripts.
Example use case:Schedule a nightly homelab maintenance flow that checks backups, records disk usage, and posts a summary to a private channel.
Safety note:Workflow orchestrators can run commands, move data, and trigger external services. Avoid mounting Docker sockets or credentials in shared environments until permissions and audit logs are clear.
Copy/paste
docker run --pull=always --rm -it -p 8080:8080 --user=root -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp kestra/kestra:latest server local
Self-hosted fan and temperature management dashboard for desktops, servers, homelab hosts, and IPMI/BMC-controlled machines.
First move:Run it on one non-critical machine, tune a conservative fan curve, and observe temperatures before managing a fleet.
Example use case:Reduce homelab server noise while keeping CPU and drive temperatures visible during builds, backups, or summer heat.
Safety note:Fan control can overheat hardware if misconfigured. Use safe fallback curves, monitor temperatures, and do not expose the dashboard or BMC credentials publicly.
Copy/paste
mkdir -p ~/labs/pankha && cd ~/labs/pankha
wget -O compose.yml https://github.com/Anexgohan/pankha/releases/latest/download/compose.yml
wget -O .env https://github.com/Anexgohan/pankha/releases/latest/download/example.env
# Edit .env first; then run:
docker compose pull && docker compose up -d
CLI/TUI that explains why a process, port, container, or file is running by tracing the chain that started it.
First move:Use the browser sandbox first, then install from your OS package manager and investigate one harmless local process.
Example use case:Find whether a mysterious localhost port came from systemd, Docker, PM2, a shell script, or an inherited parent process before killing it.
Safety note:Process trees, command lines, ports, and environment-adjacent metadata can expose sensitive paths or service names. Do not share raw output from private systems.
eBPF-based Kubernetes networking, security, and observability stack for clusters that need deep traffic visibility and policy control.
First move:Use a disposable local Kubernetes cluster and the official quickstart; do not replace networking in an important cluster as a first experiment.
Example use case:Learn how network policy, service connectivity, and packet visibility work by deploying Cilium and Hubble in a local k3d or kind lab.
Safety note:Cluster networking changes can break workloads. Use labs first, back up manifests, and get explicit authorization before touching shared or production clusters.
Copy/paste
helm repo add cilium https://helm.cilium.io/
helm repo update
# Then follow the official install guide for your cluster type.
Single-container monitoring dashboard for keeping an eye on services, endpoints, and small self-hosted stacks.
First move:Run the container on a private machine and add one harmless local HTTP check before pointing it at real infrastructure.
Example use case:Monitor a homelab homepage, NAS web UI, and a small API from one dashboard without setting up a full observability stack.
Safety note:Keep monitoring dashboards on a trusted LAN or behind VPN/auth. Targets, status pages, incident notes, and internal hostnames can reveal sensitive infrastructure.
Copy/paste
docker run --rm -p 8080:8080 ghcr.io/kolapsis/maintenant:latest
Development-stage zero-code OpenTelemetry instrumentation powered by eBPF for collecting telemetry from Linux user-space applications.
First move:Read the support matrix and run only a pinned release in a disposable Linux lab before evaluating it for real services.
Example use case:Observe a lab service without changing its code and compare generated spans/metrics against conventional OpenTelemetry instrumentation.
Safety note:eBPF instrumentation needs elevated host visibility and can expose process, network, and telemetry metadata. Use lab machines, pinned versions, and private collectors first.
Copy/paste
# Follow signed-release or container docs, pin a version, and verify artifacts first:
# https://opentelemetry.io/docs/zero-code/obi/setup/docker/
Prometheus exporter that uses eBPF to gather node, container, TCP, latency, and service-relationship metrics for Coroot or compatible monitoring stacks.
First move:Read the Coroot docs and test on a disposable Linux host before installing eBPF collectors on an important server.
Example use case:Map which containers connect to each other in a homelab stack and spot connection errors without adding tracing code to every service.
Safety note:eBPF node agents need elevated host visibility and may expose process, network, container, cloud metadata, and service topology. Keep metrics private and use owned systems only.
Copy/paste
# Start with the official install docs and pin a version for your platform:
# https://docs.coroot.com/
Self-hosted National Weather Service alert dashboard that combines weather.gov polling, optional NWWS-OI, optional NOAA radio decoding, maps, history, and notifications.
First move:Run the Docker Compose path with only the public weather.gov API first; add radio or NWWS sources later only if you understand the hardware and account setup.
Example use case:Keep a LAN dashboard for local weather alerts during a homelab power/internet resilience drill while still using official alert channels.
Safety note:This is unofficial and must never be your only life-safety alert source. Keep a battery weather radio and phone emergency alerts enabled; protect any notification URLs or NWWS credentials.
Copy/paste
git clone https://github.com/robwolff3/NWS-Alert-Dashboard.git ~/labs/nws-alert-dashboard
cd ~/labs/nws-alert-dashboard
cp .env.example .env
# Edit LOCATION and contact/user-agent fields, then:
docker compose up -d --build
Read-only dashboard for monitoring multiple Proxmox VE and Proxmox Backup Server sites: node health, VM/container status, temperatures, backup freshness, and alerts.
First move:Use the Docker Compose path on a private LAN and create least-privilege Proxmox audit tokens; avoid the remote-shell LXC installer until you have reviewed it.
Example use case:Watch several Proxmox nodes and backup stores from one page without granting a dashboard permission to start, stop, migrate, or delete workloads.
Safety note:Even read-only monitoring uses Proxmox tokens and optional SSH access. Keep it LAN/VPN-only, use PVEAuditor-style privileges, and do not paste tokens into tickets, screenshots, or repos.
Copy/paste
git clone https://github.com/freewaretools/proxview.git ~/labs/proxview
cd ~/labs/proxview
cp .env.example .env
docker compose up -d --build
Self-hosted landing page that discovers services from Docker, Kubernetes, Tailscale, Headscale, static config, or JSON APIs.
First move:Start with a static config or read-only Docker socket source on a private LAN, then add one service source at a time.
Example use case:Generate a searchable homepage of homelab services with health and metadata instead of hand-maintaining dashboard cards.
Safety note:Discovery sources can reveal internal service names, URLs, tags, and cluster metadata. Keep it LAN/VPN-only and prefer read-only socket proxies for Docker or Kubernetes sources.
Self-hosted homelab dashboard with built-in auth, app links, optional reverse-proxy gateway, Docker discovery, and health checks.
First move:Run it on localhost, complete the setup-token onboarding, and add one manual app link before enabling Docker discovery or gateway features.
Example use case:Create a private landing page for NAS, media, monitoring, and Home Assistant links with role-based access instead of exposing raw service URLs.
Safety note:Keep it on a trusted LAN/VPN and set authentication before adding admin links. Docker discovery, container controls, and gateway proxying are powerful; enable them deliberately and avoid exposing internal services publicly.
Self-hosted homelab dashboard that is configured through a UI and includes built-in authentication, including SSO support.
First move:Try it on a private LAN or local VM and add only two low-risk service links before importing the rest of your homelab.
Example use case:Make a private start page for Proxmox, Home Assistant, docs, Grafana, and uptime checks without handing every household user admin bookmarks.
Safety note:Dashboards reveal internal services and sometimes tokens in URLs. Keep it behind authentication, avoid public exposure, and do not paste admin secrets into link descriptions.
Copy/paste
# Review the current compose file first:
# https://github.com/andreasmolnardev/dashwise/blob/main/docker-compose.yaml
Small single-binary time-series database and dashboard for Raspberry Pi, edge devices, and local metrics experiments.
First move:Run it on localhost and POST a fake room-temperature metric before wiring real sensors or devices.
Example use case:Track CPU temperature, humidity, power draw, or garden-sensor readings on a Pi without deploying a full observability stack.
Safety note:Metrics can disclose room occupancy, device names, locations, and uptime patterns. Keep edge dashboards on a trusted LAN and avoid exposing raw sensor feeds publicly.
Copy/paste
# Download the latest release for your platform, then run it locally.
# Example API shape:
curl -X POST "http://localhost:8428/api/v1/import"
Open-source observability platform that combines logs, metrics, traces, errors, and session replay on top of ClickHouse and OpenTelemetry.
First move:Run the all-in-one container locally and send sample telemetry before pointing browsers, servers, or production services at it.
Example use case:Debug a slow web app by linking a browser session replay to frontend errors, backend traces, and container logs in one timeline.
Safety note:Observability and session replay may include URLs, headers, user actions, screenshots, and PII. Redact aggressively and keep dashboards private until auth and retention are configured.
Copy/paste
docker run --rm -p 8080:8080 -p 4317:4317 -p 4318:4318 docker.hyperdx.io/hyperdx/hyperdx-all-in-one
MCP server that exposes the Zabbix API to AI clients for monitoring queries, reports, topology context, and operational troubleshooting.
First move:Create a read-only Zabbix API user, run the server locally, and ask one harmless inventory question before exposing more tools.
Example use case:Let Hermes summarize which monitored hosts are down, which triggers changed recently, and what context should go into a handoff note.
Safety note:Monitoring APIs reveal hostnames, topology, alerts, internal URLs, and sometimes credentials in item values. Use least-privilege Zabbix users and keep the MCP server off the public internet.
Copy/paste
git clone https://github.com/initMAX/zabbix-mcp-server.git ~/labs/zabbix-mcp-server
cd ~/labs/zabbix-mcp-server
cp .env.example .env
# Edit .env with a read-only lab Zabbix user before docker compose up -d
Developer-friendly status page and alerting service for checking HTTP, TCP, DNS, ICMP, and custom service health.
First move:Run the container locally with one harmless HTTP endpoint, then add alerts only after the checks are accurate.
Example use case:Watch a homelab dashboard, NAS login page, and local API health endpoint from one private status page.
Safety note:Status pages disclose service names, URLs, failure windows, and sometimes internal topology. Keep private checks private and avoid putting credentials directly in endpoint URLs.
Copy/paste
docker run --rm -p 8080:8080 --name gatus ghcr.io/twin/gatus:stable
Prometheus exporter that exposes Linux and Unix machine metrics such as CPU, memory, disk, network, and filesystem stats.
First move:Run it on localhost and view the metrics endpoint before adding Prometheus, Grafana, alerts, or remote scraping.
Example use case:Track a Raspberry Pi, NAS, or small homelab server so you can see disk pressure, CPU spikes, and network changes over time.
Safety note:Metrics reveal hostnames, mount points, network interfaces, and capacity details. Keep exporters on private networks or behind authentication and firewall rules.
Copy/paste
docker run --rm -p 9100:9100 --name node-exporter quay.io/prometheus/node-exporter:latest
curl http://localhost:9100/metrics | head
Fast Unix linker that can shorten edit-build-test loops for large C, C++, and Rust projects.
First move:Install it on one development machine and try it on a non-critical local build before changing project-wide linker settings.
Example use case:Speed up repeated debug builds in a systems project where final linking dominates local compile time.
Safety note:Changing linkers can change build behavior. Test on a clean branch, keep the default linker available, and do not ship release artifacts until your normal test suite passes.
TypeScript-first structured event logging library for turning messy app logs into wider, queryable events and typed errors.
First move:Add it to a small TypeScript service and emit one event with request context before replacing an existing logging stack.
Example use case:Instrument a Node API so Hermie can inspect clean JSON events for latency, user-visible errors, and correlation IDs instead of free-form console output.
Safety note:Structured logs can capture user data, headers, request bodies, and internal IDs. Start with synthetic traffic and redact sensitive fields before shipping logs anywhere.
Copy/paste
npm install evlog
# Then follow the README quickstart for your runtime.
Self-hosted Docker dashboard that tracks pinned image versions, release notes, service health, resource usage, alerts, and topology maps.
First move:Review the compose file and run it in a lab host first; use update visibility before enabling container-management actions.
Example use case:See which homelab containers have real version upgrades available, read the linked changelog, and plan manual updates instead of blindly pulling latest.
Safety note:Container dashboards often need Docker access, which can be host-powerful. Keep it on a trusted LAN/VPN, avoid public exposure, and prefer read-only monitoring while learning.
Copy/paste
git clone https://github.com/dougmaitelli/DockDash.git ~/labs/dockdash
cd ~/labs/dockdash
# Review docker-compose.yml before starting it.
Small command-line tool for emitting OpenTelemetry spans from shell scripts, cron jobs, CI steps, and other places where adding a library is awkward.
First move:Install it and send one local no-op span to a disposable collector before instrumenting real automation.
Example use case:Wrap a backup script or firmware build with spans so Hermes can later see which step failed and how long each phase took.
Safety note:Traces can reveal command names, paths, hostnames, timings, and error messages. Point early spans at a local collector and avoid recording secrets in attributes.
Copy/paste
go install github.com/equinix-labs/otel-cli@latest
otel-cli span --name hermie.test true
Self-hosted infrastructure inventory for racks, devices, ports, cables, IPAM, VLANs, Wi-Fi, monitoring, reports, and topology diagrams.
First move:Run the Docker image on a private lab machine and manually add a few devices before enabling discovery or SNMP monitoring.
Example use case:Document a small homelab rack with switch ports, patch cables, IP reservations, VLANs, and device health checks so troubleshooting does not depend on memory.
Safety note:Inventory tools reveal internal IPs, hostnames, VLANs, cable maps, SNMP targets, and alert destinations. Keep it behind LAN/VPN auth and use discovery only on networks you own.
Copy/paste
sudo mkdir -p /opt/rackpad
cd /opt/rackpad
sudo curl -fsSLo compose.yml https://raw.githubusercontent.com/Kobii-git/Rackpad/main/docker-compose.release.yml
# Create .env from the install guide, then run: sudo docker compose up -d
Docker-to-Tailscale bridge that exposes selected containers as Tailscale Services using labels instead of public host ports.
First move:Read the quickstart and test one static nginx container inside a private tailnet before touching real services or enabling Funnel.
Example use case:Expose a homelab documentation container to your own devices over Tailscale HTTPS without opening a public router port.
Safety note:DockTail uses Docker access and Tailscale service credentials. Keep OAuth secrets in private env/secret files, avoid Tailscale Funnel until reviewed, and expose only services you intend to share.
Copy/paste
# Review the official compose examples before adding credentials:
# https://github.com/marvinvr/docktail
Lightweight self-hosted dashboard for service links, status checks, system stats, Docker status, and simple homelab widgets.
First move:Run it without public exposure and add two harmless links before mounting the Docker socket or adding service credentials.
Example use case:Build a private start page that shows your NAS, Home Assistant, Pi-hole, and a few container health checks from one browser tab.
Safety note:Dashboards can leak internal URLs, widget tokens, Docker state, and terminal access. Keep it private, enable auth, and mount the Docker socket only if you understand the host-level risk.
Copy/paste
docker run -d --name atom -p 3000:3000 -v atom_data:/app/data --restart unless-stopped sudheerbhuvana25/atom-homepage:latest
Homelab DNS automation that watches Docker, Kubernetes, Proxmox, and Incus workloads and creates matching records across self-hosted and cloud DNS providers.
First move:Read the getting-started guide, pull the container, and test against one private lab domain/provider before automating real service names.
Example use case:Automatically create internal DNS names for Traefik-backed Docker services and Proxmox VMs so homelab URLs stay consistent as workloads move.
Safety note:DNS automation can publish internal hostnames, overwrite records, and require provider API credentials. Use least-privilege tokens, private zones first, and review planned records before enabling delete/create automation.
Copy/paste
docker pull maxamill/dnsweaver:latest
# Then configure one private DNS provider from the getting-started docs.
Local-first playback hub that turns a Linux box connected to a TV into a target for web links, Jellyfin/Emby browsing, Home Assistant, and phone controls.
First move:Read the install docs and run it on a lab Linux box before connecting real media libraries or Home Assistant automations.
Example use case:Send a video link from your phone to a living-room Linux mini PC and control playback locally without depending on a cloud account.
Safety note:Playback hubs can reveal media library names, URLs, and local device controls. Keep it on a trusted LAN, review IPTV/link sources, and protect any remote-control surface.
Copy/paste
# Start with the install guide in the repo docs:
# https://github.com/mcgeezy/relaytv/blob/main/docs/INSTALL.md
Local-first GUI and terminal dashboard for viewing and managing systemd services on Raspberry Pi, Debian, and Ubuntu machines.
First move:Try the CLI on a spare Pi or lab VM first, and only manage one harmless test service until you trust the sudo behavior.
Example use case:Restart a stuck homelab service, inspect its logs, and confirm CPU/RAM/disk health from one local dashboard instead of memorizing systemctl commands.
Safety note:Service control can stop networking, storage, or security services. Use it only on systems you own, keep sudo prompts enabled, and avoid production servers.
Terminal dashboard for turning a Raspberry Pi plus USB storage into a small Samba NAS with guided storage setup and recovery controls.
First move:Read the states model, run the installer on a fresh test Pi, and use a blank USB drive before touching any disk with important data.
Example use case:Build a weekend file-share lab where a Pi serves one USB SSD to Windows, macOS, Linux, Android, and iOS clients over your private LAN.
Safety note:Storage and Samba changes can destroy data or expose private files. Test with disposable media, keep backups, and do not expose SMB shares to the internet.
Copy/paste
git clone https://github.com/WastelandSYS/nasberrypi.git ~/tools/nasberrypi
cd ~/tools/nasberrypi
chmod +x install.sh uninstall.sh
sudo ./install.sh
sudo nasberry doctor
Self-hosted event timeline that correlates Docker, config-file, systemd, uptime, and update events so homelab outages are easier to explain.
First move:Start with the documentation and a single-node lab stack; watch only non-sensitive paths until you know exactly what events are stored.
Example use case:After a container update breaks a service, check one chronological incident timeline to see the update, config change, restart, and outage together.
Safety note:It records infrastructure events and may read Docker metadata or watched file paths. Keep the UI private, rotate real tokens, and avoid monitoring secret files.
Copy/paste
# Follow the single-node quickstart and replace all example secrets locally:
# https://docs.blackboxd.dev/docs/deployment/single-node
Terminal dashboard for Raspberry Pi health: CPU, RAM, swap, disks, network, throttling, undervoltage, temperature, and alert history.
First move:Install it on a spare Pi or lab image and run snapshot mode before leaving the live dashboard open.
Example use case:Diagnose why a Pi project is unstable by checking heat, undervoltage, frequency capping, disk pressure, and recent alert events from one terminal.
Safety note:Run it on Raspberry Pi or Linux systems you own. The installer uses sudo, and exported reports may reveal hostnames, device models, storage paths, and network interfaces.
eBPF-driven Kubernetes diagnostic tool for tracing pod network behavior and exporting bounded troubleshooting reports.
First move:Install it in a disposable cluster or staging namespace first and run a short `--diagnose` capture against one known pod.
Example use case:Debug why a pod cannot reach a database by capturing DNS, connection, and network events from the pod perspective instead of guessing from logs.
Safety note:Podtrace may create a privileged helper pod and collect sensitive network metadata. Use only on clusters you administer, review your kube-context, and avoid publishing exported reports.
Official NATS monitoring tool that exports server, account, stream, and consumer metrics for Prometheus and Grafana.
First move:Point it at a local or lab NATS server using a least-privilege system account before adding production endpoints.
Example use case:Watch JetStream consumer lag and NATS server health from Grafana so a homelab event bus failure is visible before apps start timing out.
Safety note:NATS credentials and metrics reveal service topology. Keep `.creds` files out of git, bind dashboards privately, and use read-only monitoring accounts where possible.
Copy/paste
git clone https://github.com/nats-io/nats-surveyor.git ~/tools/nats-surveyor
cd ~/tools/nats-surveyor/docker-compose
NATS_SURVEYOR_SERVERS=nats://host.docker.internal:4222 docker compose up --pull always
Arduino/ESP32 library for receiving and decoding many Bresser weather-station sensor packets with CC1101, SX1276/RFM95W, SX1262, or LR1121 radios.
First move:Use a spare ESP32 plus a supported radio module to decode your own outdoor sensor before integrating the data into Home Assistant or MQTT.
Example use case:Build a local weather dashboard that reads temperature, humidity, wind, rain, battery, and leak-sensor packets without depending on a cloud bridge.
Safety note:Receive only your own sensors or signals you are legally allowed to monitor. Follow local radio rules and do not treat unauthenticated sensor packets as safety-critical truth.
Copy/paste
# Arduino IDE: install "BresserWeatherSensorReceiver" from Library Manager.
# PlatformIO: add matthias-bs/BresserWeatherSensorReceiver to lib_deps.
Open-source router stack for owned networks with per-device Wi-Fi passwords, policy-based routing, DNS blocking, WireGuard, and device segmentation.
First move:Read the hardware and install docs, then test it on a spare access point or lab router before touching your main internet gateway.
Example use case:Give every IoT device a separate Wi-Fi password and policy so a smart plug cannot talk to your laptop or NAS by default.
Safety note:Router changes can lock you out or break internet access. Keep a rollback path, back up the current network config, and never experiment first on a production or shared network.
Copy/paste
# Start with the project docs and a spare router/Pi target:
# https://github.com/spr-networks/super
Self-hosted Jellyfin dashboard for live streams, playback history, library statistics, Jellyseerr requests, and optional push notifications.
First move:Run the SQLite Docker Compose setup on a private LAN and connect one Jellyfin server with a purpose-made API token.
Example use case:See who is streaming from a family Jellyfin server, whether playback is transcoding, and which libraries are actually being watched.
Safety note:Jellyfin API tokens, watch history, usernames, libraries, and notification tokens are private. Keep Jellydash behind LAN/VPN/auth and never publish .env files.
Copy/paste
mkdir -p ~/labs/jellydash && cd ~/labs/jellydash
curl -L -o docker-compose.yml https://raw.githubusercontent.com/themartz90/jellydash/main/docker-compose.sqlite.yml
curl -L -o .env https://raw.githubusercontent.com/themartz90/jellydash/main/.env.example
# Edit .env locally: JELLYFIN_URL, JELLYFIN_API_TOKEN, and a strong admin password.
docker compose up -d
YAML-configured dashboard for homelab services with a backend that can fetch service data without exposing API keys to the browser.
First move:Read the docs and build a tiny dashboard with two manual links before wiring service integrations or secrets.
Example use case:Create one private start page for a NAS, Jellyfin, Home Assistant, monitoring, and lab docs while keeping service tokens server-side.
Safety note:Dashboards reveal internal service names, URLs, and integration status. Store API keys only in backend config, change defaults, and keep the UI private.
Copy/paste
# Start with the project docs and example YAML before adding secrets:
# https://kellojo.github.io/Modular-Homelab-Dashboard/Modular%20Homelab%20Dashboard.html
Self-hosted DNS, DHCP, and IP address management control plane backed by real BIND9, PowerDNS, and Kea service containers.
First move:Read the beta docs and run it in an isolated lab network before letting it manage your home LAN DNS or DHCP.
Example use case:Map a homelab IP plan, reserve device addresses, and manage internal DNS names from one private dashboard.
Safety note:DDI systems can break network access if misconfigured. Do not replace your router DHCP/DNS until backups, rollback, and an out-of-band admin path are ready.
Copy/paste
# Start with the project docs and lab-only quickstart:
# https://github.com/spatiumddi/spatiumddi
Native macOS menu-bar app for monitoring Pi-hole status and making quick targeted allowlist or blocking-control changes.
First move:Download the DMG from GitHub Releases and connect it to a local Pi-hole instance before enabling browser-tab automation.
Example use case:See Pi-hole health from the menu bar and allowlist the domain that broke one page without disabling blocking for the whole network.
Safety note:Pi-hole controls affect DNS for real devices. Store credentials in Keychain, avoid global disable as a habit, and grant browser automation permission only if you need tab unblocking.
Copy/paste
# Download the current DMG from:
# https://github.com/pedrovieira/Holeberry/releases
Static analyzer for OpenTelemetry Collector YAML that checks pipeline, receiver, processor, exporter, security, and performance mistakes.
First move:Run the Docker image against one local collector config and read every failure before wiring it into CI.
Example use case:Catch a missing memory limiter, unsafe exporter setting, or misplaced batch processor before a telemetry gateway falls over in production.
Safety note:Collector configs may contain endpoints or headers. Remove secrets before sharing lint output and prefer environment variables over hardcoded API keys.
Copy/paste
docker run --rm -v "$(pwd):/work" ghcr.io/starkross/augur:latest /work/otel-collector-config.yaml
Web editor and visualizer for OpenTelemetry Collector pipelines with validation and shareable configuration diagrams.
First move:Paste a sanitized sample collector config into the editor and inspect the generated pipeline swimlanes.
Example use case:Explain how logs, metrics, and traces flow through receivers, processors, and exporters before changing a production collector.
Safety note:Do not paste production collector configs containing tokens, internal hostnames, or customer data into a hosted editor. Sanitize first or self-review locally.
Copy/paste
# Open the hosted editor with a sanitized config:
# https://www.otelbin.io/
Local OpenTelemetry viewer that receives traces, metrics, and logs and shows them in a desktop-friendly web UI.
First move:Run it locally and send one toy trace before pointing real applications at the OTLP ports.
Example use case:Debug a development service by collecting local traces on ports 4317/4318 and inspecting request timing at localhost instead of shipping telemetry to a cloud backend.
Safety note:Telemetry can include URLs, identifiers, errors, and log content. Keep the viewer on localhost and avoid sending production secrets into a casual lab instance.
Copy/paste
docker run --rm -p 8000:8000 -p 4317:4317 -p 4318:4318 ctrlspice/otel-desktop-viewer:latest
Tiny self-hosted directory page for the people who use your services, with multilingual labels, status hints, theming, and simple Docker deployment.
First move:Run the sample container locally with a read-only config folder and list two harmless internal services.
Example use case:Give family or teammates a clean private homepage for Jellyfin, Nextcloud, documentation, and service-status links without exposing admin dashboards.
Safety note:A start page can reveal internal service names and URLs. Keep it LAN-only or put real authentication in front before sharing beyond trusted users.
Self-hosted page-change monitor that watches websites and sends notifications when content changes.
First move:Run it locally and monitor one low-stakes public page before adding authenticated pages, browser automation, proxies, or AI summaries.
Example use case:Watch a project release page, vendor status page, or documentation page and notify yourself when the content changes.
Safety note:Only monitor pages you are allowed to access. Watch data, headers, screenshots, and notification payloads may contain private URLs or tokens; keep the dashboard private.
Copy/paste
docker run -d --name changedetection -p 5000:5000 -v changedetection-data:/datastore dgtlmoon/changedetection.io
Single-binary Kubernetes UI with topology, events, Helm, GitOps, traffic, audit views, and an MCP server for controlled cluster inspection.
First move:Run it against a local Kind/k3d cluster or read-only kubeconfig before pointing it at shared infrastructure.
Example use case:Understand why a deployment is unhealthy by viewing pods, events, image files, Helm values, and topology in one local UI.
Safety note:Kubeconfigs can grant destructive access and expose cluster inventory. Use least-privilege contexts, avoid public dashboards, and do not hand an MCP client broad cluster write access by default.
Copy/paste
# Prefer package-manager or release installs from the docs. Quickstart from upstream:
# curl -fsSL https://get.radarhq.io | sh && kubectl radar
Self-hostable network documentation system that scans owned infrastructure and keeps L2, L3, workload, and application diagrams up to date.
First move:Try the public demo or run it in a small lab VLAN before scanning a whole home or office network.
Example use case:Generate SVG or Mermaid network maps for a homelab so documentation reflects what is actually running instead of last month’s drawing.
Safety note:Only scan networks you own or are explicitly allowed to assess. Network maps reveal internal hosts and services, so keep the UI and exports private.
Copy/paste
curl -O https://raw.githubusercontent.com/scanopy/scanopy/refs/heads/main/docker-compose.yml
docker compose up -d
Container resource monitor from Google that exposes CPU, memory, filesystem, and network usage for running containers.
First move:Run it on a single lab Docker host and open the localhost UI before adding Prometheus scraping or dashboards.
Example use case:Find which container is eating RAM or disk I/O on a small homelab server without installing a full observability stack first.
Safety note:cAdvisor exposes host and container inventory. Bind it to localhost or a trusted network only, and avoid publishing raw metrics dashboards to the internet.
Web UI for inspecting Kafka and Redpanda topics, brokers, consumer groups, messages, schemas, and stream health.
First move:Connect it to a local Redpanda or Kafka lab before pointing it at a shared message bus.
Example use case:Debug why a worker stopped consuming by checking topic partitions, lag, schemas, and recent messages from one local browser UI.
Safety note:Message streams can contain customer data, secrets, and internal events. Use read-only credentials where possible and keep the console private.
Copy/paste
docker run -p 8080:8080 -e KAFKA_BROKERS=host.docker.internal:9092 docker.redpanda.com/redpandadata/console:latest
Static checker for Ansible playbooks, roles, and collections that catches common mistakes before automation touches real machines.
First move:Run it against one local playbook and read the rule messages before enabling automatic fixes.
Example use case:Catch unsafe package tasks, ambiguous file modes, and non-idempotent playbook patterns before a homelab update runs across every server.
Safety note:Linting is safe; applying playbooks is the risky step. Review fixes, test on disposable hosts, and do not store SSH keys or vault passwords in the repository.
Container image watcher that notifies you when tracked images have new tags or digest changes without updating them automatically.
First move:Run Diun against one low-risk lab container and send notifications to a private channel before monitoring a whole stack.
Example use case:Watch homelab service images and get a message when updates exist, then read release notes and update containers manually.
Safety note:Diun is safer than automatic updaters because it only alerts, but registry credentials and notification URLs can be sensitive. Keep config files private and start with read-only registry access.
Copy/paste
docker run --rm crazymax/diun:latest version
# Docs: https://crazymax.dev/diun/
Cross-platform task runner that stores common project commands in a readable Taskfile instead of a pile of shell history.
First move:Install the CLI, create one Taskfile entry for tests or local dev, and run it from a clean terminal.
Example use case:Give Hermie and humans the same `task test` and `task dev` commands so project automation is discoverable and repeatable.
Safety note:Task runs whatever commands are in the Taskfile. Review Taskfiles from other people before running them, especially if they download scripts or touch production systems.
Copy/paste
go install github.com/go-task/task/v3/cmd/task@latest
task --version
Terminal UI for browsing Docker containers, images, volumes, logs, and compose services without memorizing every Docker command.
First move:Run it on a local development Docker host and only browse/log-tail until you understand the keyboard shortcuts.
Example use case:Debug a broken compose stack by watching logs, restarting one service, and checking container state from one terminal screen.
Safety note:Lazydocker can stop, remove, restart, and exec into containers. Use it only on Docker hosts you administer, and be careful on shared or production systems.
Copy/paste
go install github.com/jesseduffield/lazydocker@latest
lazydocker --version
Nix-powered CLI for declaring project development tools in a devbox.json so every machine gets the same shell environment.
First move:Try it in a throwaway project with one harmless package, then inspect the generated devbox.json before committing it.
Example use case:Pin Node, Python, and a formatter for a repo so Hermie, CI, and contributors run the same versions without mutating the whole machine.
Safety note:Devbox manages project shells through Nix. Review devbox.json before entering an unfamiliar environment and do not commit private environment variables.
CLI that runs GitHub Actions workflows locally in Docker for faster feedback before pushing commits.
First move:Run `act -n` or a tiny workflow in a disposable repo before executing a real project workflow.
Example use case:Test a docs build workflow locally after editing CI YAML instead of burning several push/CI cycles to find syntax mistakes.
Safety note:act executes workflow steps from the repository and can pass environment variables into containers. Review workflows first, avoid untrusted repos, and do not mount secrets unless required.
Copy/paste
go install github.com/nektos/act@latest
act --version
act -n
Python CLI and library for sending notifications to many services through one common interface.
First move:Install the CLI and send a local or test-channel notification before wiring it into monitoring jobs.
Example use case:Let a backup script, uptime monitor, or Hermie cron job send one notification path without custom Slack, Discord, email, and Gotify code.
Safety note:Notification URLs often contain tokens or passwords. Keep Apprise config files out of public repos, use placeholders in docs, and rotate webhook tokens if they leak.
Scriptable load-testing tool for checking how APIs and web services behave under realistic traffic.
First move:Run one tiny local test against a service you own; do not point load tests at public sites or third-party APIs.
Example use case:Verify a homelab API still responds under 20 concurrent users before publishing it behind Cloudflare or a reverse proxy.
Safety note:Load testing can look like an attack and can break services. Only test systems you own or have explicit permission to test, and start with low request rates.
Copy/paste
docker run --rm grafana/k6 version
# Then write a small script and run: docker run --rm -i grafana/k6 run - <script.js
Firmware Analysis and Comparison Tool for unpacking firmware, identifying components, and summarizing security-relevant findings.
First move:Use the documented Vagrant path on a lab VM before attempting a local install on your main workstation.
Example use case:Compare two router firmware images to see changed components, embedded files, and likely security-relevant differences.
Safety note:Firmware images can contain proprietary code, secrets, keys, or personal data. Analyze only firmware you are allowed to inspect and do not publish extracted secrets.
Copy/paste
# Start with the maintained install docs:
# https://github.com/fkie-cad/FACT_core/blob/master/INSTALL.md
Firmware filesystem cartography tool for mapping relationships between executable files, imports, symbols, symlinks, and other firmware artifacts.
First move:Read the quick-start docs and run it on a known lab firmware image before trying vendor images or proprietary dumps.
Example use case:Visualize which binaries in an extracted firmware filesystem depend on BusyBox, shared libraries, or suspicious executable relationships.
Safety note:Firmware often contains proprietary code, credentials, certificates, or device identifiers. Analyze only firmware you may inspect and do not publish extracted secrets.
WinDirStat-style treemap viewer for MAP and ELF symbol files from embedded, firmware, and native builds.
First move:Download a release on Windows and open a known MAP file from a small firmware or native build.
Example use case:See which functions, objects, or libraries consume flash/RAM in an embedded build before guessing what to optimize.
Safety note:MAP files can reveal proprietary symbol names, file paths, product internals, and build structure. Do not publish screenshots or maps from private firmware.
Copy/paste
# Windows GUI: download the latest release zip or installer:
# https://github.com/Zepp-Hanzj/MemMapExplorer/releases
Research framework for extracting Android firmware, inventorying pre-installed apps, and running static analysis tools over APKs and firmware contents.
First move:Read the project docs and run it only on lab firmware images before analyzing vendor or personal phone dumps.
Example use case:Inventory preinstalled APKs in an Android firmware image and compare analysis results across a controlled research dataset.
Safety note:Android firmware and app dumps can include proprietary code, user data, identifiers, and secrets. Analyze only images you may inspect and do not publish extracted sensitive data.
Copy/paste
# Start with the official documentation:
# https://firmwaredroid.github.io/
Small Python toolkit for dissecting ESP32 firmware images and parsing NVS partitions from files or owned devices.
First move:Use a known sample firmware file first; only read from a board you own and can reflash if something goes wrong.
Example use case:Inspect an ESP32 project image to understand partition layout and NVS contents while learning embedded firmware structure.
Safety note:Firmware dumps can contain Wi-Fi credentials, tokens, calibration data, and device identifiers. Do not extract or share firmware from devices you do not own or have permission to analyze.
Windows desktop app that gives MAP and ELF memory layouts a WinDirStat-style treemap view for sections, objects, symbols, and DWARF source details.
First move:Open a non-sensitive embedded build artifact first and inspect which objects consume the most flash or RAM.
Example use case:Find why an ESP32 or firmware build suddenly grew by comparing large symbols and sections in the linker map.
Safety note:MAP and ELF files reveal source paths, symbol names, memory layout, and sometimes proprietary implementation details. Do not upload private build artifacts to public issue trackers.
Copy/paste
# Windows: download the latest release:
# https://github.com/Zepp-Hanzj/MemMapExplorer/releases
Web-based environment for coordinating firmware analysis with EMBA: scan, identify, track, and report on firmware images.
First move:Start with a lab VM and a public training firmware image; learn what EMBA reports before uploading anything proprietary.
Example use case:Keep firmware scan results, extracted artifacts, and reports organized while comparing multiple versions of an owned IoT device image.
Safety note:Firmware images can contain proprietary code, credentials, keys, certificates, serial numbers, and network config. Analyze only images you may handle and keep reports private.
Copy/paste
git clone --depth 1 https://github.com/e-m-b-a/embark.git ~/labs/embark
# Follow the project deployment docs inside a lab VM.
OWASP methodology that breaks firmware security assessment into staged, documented steps from information gathering through reporting.
First move:Read the table of stages and use it as a checklist for a legal lab device or intentionally vulnerable firmware sample.
Example use case:Plan a safe firmware-learning project: obtain firmware legally, extract it, identify filesystems, review configs, document findings, and stop before touching devices you do not own.
Safety note:Methodologies can guide intrusive testing if misapplied. Use it only for owned devices, authorized assessments, or intentionally vulnerable training images.
Copy/paste
# No install required. Read the methodology:
# https://github.com/scriptingxss/owasp-fstm
Parser for Intel Engine, Graphics, and related firmware images that reports versions, families, platforms, sizes, and health metadata.
First move:Run it against a known firmware image from hardware you own before experimenting with dumps from unknown sources.
Example use case:Check the Management Engine firmware family and version inside a BIOS update before planning a safe lab firmware review.
Safety note:Firmware images can contain proprietary code, serial numbers, keys, and device-specific data. Analyze only authorized images and do not publish extracted private contents.
Firmware memory-footprint analyzer and GitHub Action that reports flash/RAM usage from ELF files and linker scripts.
First move:Use the local CLI with a non-sensitive firmware ELF before adding cloud dashboards, PR comments, or API keys.
Example use case:Catch that an embedded build grew by 40 KB of flash after a library change and identify the largest new symbols before shipping firmware.
Safety note:ELF, MAP, and linker files reveal source paths, symbols, architecture, and product internals. Keep reports private unless the firmware project is intentionally public.
Hex editor for reverse engineers and firmware tinkerers with pattern language support, data visualization, and binary inspection tools.
First move:Download a release and open a disposable sample file before inspecting firmware or disk images you care about.
Example use case:Explore a small firmware blob, identify headers and offsets, and use patterns to document the structure without modifying the original file.
Safety note:Work on copies, not originals. Binary editors can corrupt files, and firmware/reversing work should stay limited to devices and samples you own or are authorized to inspect.
Copy/paste
# Download the current release for your OS:
# https://github.com/WerWolv/ImHex/releases
Firmware security analyzer that extracts, inventories, and reports on embedded Linux firmware images and SBOM-related findings.
First move:Run it only against a known public sample or firmware from hardware you own, then read the report before scanning more images.
Example use case:Inspect an old router firmware image for package versions, embedded filesystems, hard-coded paths, and risky components as a defensive learning lab.
Safety note:Firmware images can contain proprietary code, credentials, Wi-Fi keys, certificates, and device identifiers. Keep analysis in a lab, do not publish extracted secrets, and scan only authorized images.
Copy/paste
git clone https://github.com/e-m-b-a/emba.git ~/labs/emba
cd ~/labs/emba
# Read installer/README.md and run inside an isolated lab VM.
YAML-driven firmware builder for ESP32, ESP8266, BK72xx, and RP2040 devices, especially useful with Home Assistant.
First move:Install the dashboard, compile one known-good example, then flash only hardware you own.
Example use case:Turn an ESP32 into a Home Assistant temperature sensor, relay controller, or Bluetooth proxy.
Safety note:Flashing firmware can brick devices or create unsafe electrical behavior. Use low-voltage dev boards first; mains-powered devices are not beginner projects.
Copy/paste
pipx install esphome
esphome version
esphome dashboard ./esphome-configs
Open firmware for controlling addressable LED strips from ESP32/ESP8266 boards over Wi-Fi.
First move:Use the web installer with a supported board and a small LED strip before building anything permanent.
Example use case:Build a small addressable LED project with a browser UI before designing a bigger lighting setup.
Safety note:LED strips can pull serious current. Use a correctly sized power supply, fuse larger builds, and do not power long strips from a dev-board pin.
Alternative local-control firmware for many ESP8266 and ESP32 smart devices, with MQTT, rules, timers, and a web UI.
First move:Read the device-specific template and install docs before opening or flashing anything.
Example use case:Move a supported low-voltage ESP device toward local MQTT control instead of cloud-only control.
Safety note:Many target devices are mains-powered. Electrocution and fire are real failure modes. If you are not qualified, stick to dev boards and low-voltage devices.
Copy/paste
# Web installer and docs:
# https://tasmota.github.io/install/
# https://tasmota.github.io/docs/
CLI-centered embedded development environment for many boards, frameworks, libraries, builds, and uploads.
First move:Install the CLI and build a known example for a board you own before adding libraries.
Example use case:Create, build, and upload firmware for an ESP32 or Arduino-compatible board from a repeatable terminal workflow.
Safety note:Uploading firmware changes device behavior. Start with dev boards, verify board/port selections, and avoid mains-powered hardware as a beginner.
Live-reload workflow for Toit programs on ESP32 boards over Wi-Fi, cutting the edit-flash-test loop down to seconds.
First move:Install the jag CLI, flash one supported ESP32 dev board, and run a tiny Toit example before adding sensors.
Example use case:Iterate quickly on an ESP32 sensor prototype without reflashing over serial for every small code change.
Safety note:Jaguar flashes firmware and starts a device-side Wi-Fi/HTTP workflow. Use dev boards on trusted networks and avoid safety-critical hardware.
Copy/paste
go install github.com/toitlang/jaguar/cmd/jag@latest
jag --help
Browser-based emulator for Arduino, ESP32, Raspberry Pi Pico, Raspberry Pi, and other boards, with code editing and simulated components.
First move:Open the live demo or run the Docker image locally, then load one blink-style example before trying complex peripherals.
Example use case:Teach or prototype a microcontroller idea when you do not have the exact board or sensor on your desk yet.
Safety note:Simulation helps learning but does not prove electrical safety. Real hardware still needs correct voltage, current, wiring, and radio/regulatory checks.
Copy/paste
# Try the hosted demo first:
# https://velxio.dev
# Local Docker options are in the repo README.
Espressif’s JavaScript/WebSerial implementation of esptool for browser-based ESP32 and ESP8266 flashing workflows.
First move:Use the official demo or a local test page with a spare dev board before embedding flashing into your own project docs.
Example use case:Add a browser flasher to an ESP32 workshop page so learners can install known firmware without a Python toolchain first.
Safety note:Flashing firmware can erase devices or install the wrong image. Use known firmware, check board targets, and avoid customer or safety-critical devices.
MCP server for KiCad that exposes schematic, PCB, ERC/DRC, BOM, DFM, and manufacturing-review workflows to AI agents.
First move:Start with the bounded default read-only profile on a copy of a simple KiCad project before enabling write/build/release profiles.
Example use case:Ask an agent to review a small PCB for missing datasheets, DRC/ERC issues, or manufacturability problems while you keep KiCad project files under version control.
Safety note:PCB automation can modify designs and manufacturing outputs. Work on copies, keep human review before fabrication, and do not grant write/release profiles until the read-only review path is proven.
Raspberry Pi friendly offline knowledge server for Wikipedia, Khan Academy content, OpenStreetMap, books, local apps, and community learning materials.
First move:Read the hardware/install guide and build a small test library before syncing huge content packs.
Example use case:Create an offline classroom or workshop hotspot where phones and laptops can browse curated learning material without internet access.
Safety note:Offline libraries can still expose local uploads, names, documents, and network metadata. Curate content carefully and keep admin access private.
Copy/paste
# Start with the official install guide:
# https://wiki.iiab.io/go/FAQ#How_do_I_install_Internet-in-a-Box%3F
Lightweight library for decoding Bluetooth IoT sensor advertisements into readable JSON across ESP32, Arduino, Python, and server workflows.
First move:Browse the supported-device list, then test decoding on your own BLE sensors before integrating it into Home Assistant or MQTT flows.
Example use case:Decode temperature, humidity, plant, or presence sensor broadcasts from devices you own so automations can use structured values.
Safety note:BLE observations can reveal nearby devices, rooms, and habits. Decode only devices you own or are authorized to monitor and avoid publishing identifiers.
Copy/paste
git clone --depth 1 https://github.com/theengs/decoder.git ~/labs/theengs-decoder
cd ~/labs/theengs-decoder
pipx install platformio
pio --version
Open-source home automation system for Raspberry Pi, Linux, Windows, and macOS with support for Z-Wave, Zigbee, MQTT, Hue, sensors, and scripting.
First move:Run it on a lab Raspberry Pi or VM, add one harmless sensor or switch, and learn the dashboard before connecting critical devices.
Example use case:Build a small local dashboard for energy readings, temperature sensors, MQTT devices, or smart-home experiments without starting with a giant stack.
Safety note:Home automation can control locks, relays, heaters, and mains-powered devices. Start with read-only sensors and keep the UI off the public internet.
Cross-platform firmware hub and flashing app for LILYGO and other ESP devices, with serial monitor, firmware analyzer, dumper, and electronics calculators.
First move:Download a release, connect one spare ESP32 dev board, and inspect firmware metadata before flashing anything.
Example use case:Flash known firmware to a LILYGO board and use the serial monitor while learning ESP32 hardware workflows.
Safety note:Flashing and dumping firmware can erase devices or expose device data. Use boards you own, verify chip/firmware targets, and avoid safety-critical devices.
Copy/paste
# Download the app for your OS from releases:
# https://github.com/Xinyuan-LilyGO/LILYGO-Spark/releases
Open collection of modular 3D-printable rackmount parts for Raspberry Pi, SBCs, JetKVM, fans, and lab accessories.
First move:Browse the STL folders, read the hardware notes, and print one low-risk bracket before designing a whole rack.
Example use case:Organize a small Raspberry Pi or SBC homelab into a clean rack shelf with labeled modules and safer cable routing.
Safety note:3D-printed mounts still need correct screws, heat-set inserts, airflow, strain relief, and power safety. Do not trap heat or stress cables.
Browser-based WebSerial/WebUSB tool for flashing and managing supported TI, Silicon Labs, Espressif, Arduino, and Telink devices.
First move:Open the hosted UI from Chrome or Edge with one spare adapter/dev board before trying bridge or remote-serial modes.
Example use case:Flash known firmware to a supported Zigbee, ESP, or Arduino-style adapter without installing a full local flashing toolchain.
Safety note:Flashing can erase devices, back up sensitive NVRAM, or expose serial ports remotely. Use hardware you own, known firmware, and avoid remote bridge mode until you understand it.
Copy/paste
# Browser workflow:
# https://mt.xyzroe.cc/
# Docker bridge options are documented in the repo README.
Browser-based visual builder for ESPHome YAML: pick boards, add sensors/switches, map pins, preview YAML, and export a ready-to-flash config.
First move:Open the hosted demo and build a fake basic sensor node before importing a real ESPHome config.
Example use case:Design an ESP32 temperature-and-motion sensor visually, export the YAML, then have Hermie review pin conflicts and secrets before flashing.
Safety note:ESPHome configs can contain Wi-Fi names, passwords, API encryption keys, static IPs, MQTT details, and OTA settings. Keep secrets in secrets.yaml and review shared URLs before sending them to anyone.
Copy/paste
# Browser workflow; no install needed:
# https://mo3he.github.io/ESPForge/
Cross-platform Electron firmware hub and flash tool for LILYGO and other ESP devices, with firmware browsing, Web Serial flashing, dumping, analysis, partition editing, and electronics calculators.
First move:Download a release, connect one spare ESP board, and only flash known firmware for that exact device model.
Example use case:Explore a LILYGO board, identify the chip and partition table, flash official firmware, and keep notes about the exact firmware source.
Safety note:Flashing or dumping firmware can erase devices or expose Wi-Fi credentials, tokens, serial numbers, and calibration data. Use hardware you own and do not share dumps publicly.
Copy/paste
# Download the desktop app from releases:
# https://github.com/Xinyuan-LilyGO/LILYGO-Spark/releases
ESP32-based emulator and diagnostic tool for Apple Lisa ProFile and Widget hard drives, including hardware designs, firmware, diagnostics, and disk-image workflows.
First move:Read the hardware notes and compatibility caveats before ordering boards or connecting vintage machines.
Example use case:Emulate a ProFile drive for a Lisa restoration project or diagnose an owned ProFile/Widget drive without risking the only original disk.
Safety note:Vintage computers and storage hardware are fragile. Confirm voltage levels, wiring, orientation, and backups before connecting an ESP32 board to original equipment.
Visual drag-and-drop editor for ESPHome, OpenEpaperLink, and OpenDisplay dashboards, especially ESP32 smart displays and e-paper panels.
First move:Try the live demo or HACS integration, design one simple page, and copy the generated snippet into a test ESPHome device config.
Example use case:Build a small ESP32 e-paper dashboard that shows weather, room temperature, and a doorbell alert without hand-writing every display lambda.
Safety note:The web version may ask for a Home Assistant URL and long-lived token. Use least-privilege tokens, avoid pasting production secrets into random browsers, and test generated YAML before flashing devices.
Copy/paste
# Easiest first move: open the live demo
# https://koosoli.github.io/ESPHomeDesigner/
# Local dev option:
git clone https://github.com/koosoli/ESPHomeDesigner.git
cd ESPHomeDesigner
npm install
npm run dev
Arduino library that adds a serial command shell to ESP32 sketches for debugging pins, buses, variables, and hardware behavior while the sketch runs.
First move:Install it through Arduino Library Manager and test the example on a spare ESP32 board with nothing dangerous connected.
Example use case:Debug an I2C sensor or UART GPS module by creating interfaces and sending commands from the serial terminal instead of recompiling every tiny test.
Safety note:A live shell can toggle pins and talk to attached hardware. Use boards you own, disconnect relays/motors/high-current loads while learning, and do not expose serial access to untrusted users.
Copy/paste
# Arduino IDE: Library Manager → search "espshell" → Install
# Then include it in a test sketch and open Serial Monitor.
Self-hosted Next.js smart-display system for Raspberry Pi kiosk screens with drag-and-drop layouts, modules, profiles, plugins, and remote display control.
First move:Run it on a spare Pi or local lab machine with only public modules like clock, weather, and text before connecting calendars, photos, or home services.
Example use case:Build a kitchen or workshop dashboard that rotates weather, chores, timers, calendars, and local status panels on a private display.
Safety note:Smart displays can expose calendars, photos, location, routines, API tokens, and internal URLs. Keep the editor/UI private and review plugins before installing from a URL.
Copy/paste
git clone https://github.com/home-screens/home-screens.git ~/labs/home-screens
cd ~/labs/home-screens
npm install
npm run dev
Cross-platform BLE smart-scale bridge that reads body-composition data and exports it to Home Assistant MQTT, files, Garmin, Strava, InfluxDB, webhooks, and more.
First move:Start with local-file or MQTT output before connecting health accounts or webhook exporters.
Example use case:Put a Raspberry Pi Zero near a supported BLE scale and publish weight readings to Home Assistant without relying on the vendor phone app.
Safety note:Weight and body-composition readings are private health data. Keep exports local by default, protect Garmin/Strava tokens, and do not expose MQTT or webhook endpoints publicly.
Copy/paste
git clone https://github.com/KristianP26/ble-scale-sync.git
cd ble-scale-sync
npm install
npm run setup
Curated map of free tools for embedded, firmware, hardware, PCB design, debug probes, simulation, CI, IoT backends, RF, TinyML, power profiling, and learning.
First move:Bookmark it and pick one category you need now instead of installing everything.
Example use case:Find a free simulator, logic-analyzer UI, OTA hosting approach, or KiCad-adjacent tool while planning a small ESP32 or firmware project.
Safety note:It is a list, not a guarantee. Check each linked tool’s license, privacy model, and firmware-safety implications before using it on proprietary hardware or commercial work.
Custom Home Assistant integration for Raspberry Pi GPIO binary sensors, switches, and covers using modern gpiod-based GPIO access.
First move:Install through HACS, then start with a read-only binary sensor before wiring any relay or actuator.
Example use case:Expose a wired PIR sensor or reed switch on a Raspberry Pi to Home Assistant without writing your own GPIO polling service.
Safety note:GPIO mistakes can damage Pi pins or trigger real-world devices. Verify pin numbering, voltage levels, pull-ups, and relay behavior before connecting covers, doors, heaters, or other actuators.
Copy/paste
# Recommended path: install HACS, add rpi_gpio, then configure one binary_sensor first.
# Repo: https://github.com/thecode/ha-rpi_gpio
Self-hosted dashboard companion for composing browser dashboards, rendering them server-side, and pushing updates to e-ink panels over REST or MQTT.
First move:Run the server locally and render a static test panel before connecting Home Assistant, MQTT, or a real display.
Example use case:Build a low-power e-paper status panel for weather, room state, calendar hints, or homelab alerts on a Raspberry Pi or ESP32 display.
Safety note:Dashboard panels can expose home state, calendars, locations, MQTT topics, and local service names. Keep the server private and use test data before pairing real displays.
Copy/paste
# Start with the latest release and docs:
# https://github.com/dmellok/tesserae/releases/latest
# https://github.com/dmellok/tesserae
Modular open-source smart-mirror platform, commonly used on Raspberry Pi displays for dashboards, calendars, weather, and room information.
First move:Read the installation docs and start with only the default modules before adding community modules.
Example use case:Turn a spare Raspberry Pi and monitor into a hallway dashboard showing time, weather, transit, and Home Assistant status.
Safety note:Dashboard modules can expose calendars, locations, camera feeds, tokens, and home status. Use least-privilege integrations and keep the display/server on a trusted LAN.
Raspberry Pi e-paper dashboard for a few calm widgets such as clock, weather, public-calendar agenda, local tasks, and focus status.
First move:Run the project locally or browse the docs before buying display hardware.
Example use case:Build a no-glow desk display that updates a few times an hour with today’s weather and next public-calendar events.
Safety note:Calendar URLs, weather locations, task text, and dashboard screenshots can reveal private routines. Use public or test calendars first and keep the dashboard on a trusted LAN.
Copy/paste
git clone --depth 1 https://github.com/fberrez/quietdash.com.git ~/tools/quietdash
cd ~/tools/quietdash
docker compose up --build
Self-hosted Raspberry Pi digital picture frame with a browser admin UI, slideshow, weather, room temperature, motion awareness, and Home Assistant integration.
First move:Read the install docs and test with a small folder of non-sensitive photos before connecting family albums or Home Assistant.
Example use case:Turn a spare Raspberry Pi and display into a private LAN photo frame that also shows time, weather, and room temperature.
Safety note:Photos, room sensors, motion state, and Home Assistant tokens are sensitive. Keep the admin UI on the LAN, use copies of photos, and avoid exposing the frame publicly.
Copy/paste
# Start with the documented install path for your Pi/display:
# https://pictureframe.ekemate.hu
Small PlatformIO project that turns a Cheap Yellow Display ESP32 touchscreen into a self-running pixel aquarium and clock.
First move:Build it for an unmodified CYD board first, then change art or behavior after the stock firmware works.
Example use case:Practice PlatformIO, TFT display drawing, touch hardware basics, and ESP32 deployment with a harmless desk toy instead of a sensor that controls real equipment.
Safety note:Flashing firmware can overwrite whatever is on the board. Verify the exact ESP32 display model, keep backups of custom firmware, and do not connect unknown USB hardware to a trusted machine.
Copy/paste
git clone --depth 1 https://github.com/Lagerpun/esp32-cyd-aquarium.git ~/projects/esp32-cyd-aquarium
cd ~/projects/esp32-cyd-aquarium
# Open in VS Code with PlatformIO, then build/upload to an ESP32-2432S028R board.
Open ESP32, GPS, and LoRa group-safety mesh project for hikers, with simulator and 3D replay tooling.
First move:Start with the simulator and documentation before transmitting anything over LoRa hardware.
Example use case:Study how offline hiking devices can exchange position and emergency-state messages without cellular service, then replay a test hike in the viewer.
Safety note:Radio projects are regulated and GPS/location data is sensitive. Use legal frequencies and power levels for your region, test with consenting participants only, and do not publish live location traces.
Copy/paste
git clone --depth 1 https://github.com/luciobaiocchi/heard.git ~/projects/heard
cd ~/projects/heard
less README.md
Official Rust template generator for no_std applications targeting ESP32 and other Espressif chips.
First move:Install it, generate a hello-world-style project for a board you own, and build before connecting sensors or radios.
Example use case:Create a repeatable Rust starter project for an ESP32-C3 or ESP32-S3 lab board without copying template files by hand.
Safety note:Generated firmware eventually runs on physical boards. Confirm target chip, pins, voltages, and flashing commands before uploading to hardware.
Raspberry Pi e-paper dashboard software for calendars, weather, tasks, photos, and custom modules.
First move:Read the manual install docs and configure a small test display with sample/local data before adding calendars or home services.
Example use case:Build a low-power desk display that shows a calendar, weather, and one lab status note on an e-paper screen.
Safety note:Dashboard modules may use calendars, photos, tasks, locations, and API tokens. Keep config private and verify display wiring before powering hardware.
Copy/paste
# Start with the manual install guide:
# https://aceinnolab.github.io/Inkycal/installation/
Open-source graphics library for building embedded user interfaces on MCUs and MPUs, including ESP32 displays and many vendor boards.
First move:Start with the official simulator or a vendor-supported demo board instead of wiring a custom display on day one.
Example use case:Prototype an ESP32 touchscreen dashboard for sensor readings, buttons, and status graphics before committing to custom hardware.
Safety note:Display drivers touch real pins, voltages, backlights, and sometimes batteries. Confirm board support, wiring, and current limits before flashing hardware.
Copy/paste
git clone --depth 1 https://github.com/lvgl/lvgl.git ~/labs/lvgl
# Then follow the official integration docs for your board or simulator.
FreeRTOS-based Unix-like command-line environment for ESP32 and RP2350 microcontrollers with process management, shell features, TFT support, and networking demos.
First move:Read the supported-board notes and build it for a spare development board before enabling network features or attaching peripherals.
Example use case:Use an ESP32 as a tiny systems-learning lab to practice shell commands, task scheduling, display output, and embedded networking concepts.
Safety note:Firmware flashing can brick or misconfigure boards. Use hardware you own, disconnect actuators while testing, and keep Wi-Fi credentials out of committed config.
Copy/paste
git clone --depth 1 https://github.com/VuqarAhadli/MiniOS-ESP.git ~/labs/MiniOS-ESP
# Build/flash only after reading the repo board-specific instructions.
Open-source emulator and architectural-analysis toolkit for obsolete Nokia DCT3 phones that boots bring-your-own firmware in browser or native GUI modes.
First move:Build the emulator and use only a legitimately obtained firmware image from hardware you own or may study.
Example use case:Study how a classic Nokia 3310-era phone boots and interacts with its LCD, keypad matrix, DSP, and EEPROM without relying on physical hardware.
Safety note:The repo intentionally ships no firmware. Do not download or share copyrighted phone firmware, EEPROM dumps, identifiers, or proprietary blobs you are not allowed to use.
Copy/paste
git clone --depth 1 https://github.com/djr-747/nokia-dct3-emulator.git ~/labs/nokia-dct3-emulator
cd ~/labs/nokia-dct3-emulator
make all
Cross-platform dashboard that turns serial, BLE, MQTT, Modbus, CAN bus, and other hardware telemetry into live plots, gauges, maps, and logs.
First move:Download the official release, connect a spare Arduino/ESP32 or a serial simulator, and visualize one harmless sensor stream before touching field hardware.
Example use case:Watch temperature, battery voltage, GPS position, or motor-test telemetry from an ESP32 project without building a custom dashboard first.
Safety note:Only connect boards and buses you own or are authorized to inspect. Telemetry can expose locations, device IDs, or process data; keep logs private.
Copy/paste
# Download the official installer/AppImage for your OS:
# https://github.com/Serial-Studio/Serial-Studio/releases
Official-style mdBook source for learning Rust on Espressif chips, including setup paths and embedded Rust context for ESP32-class boards.
First move:Read the hosted book first, then run a local copy only if you want offline notes or to inspect examples while setting up the Rust toolchain.
Example use case:Use it as the starting checklist before trying a Rust LED blink or sensor project on an ESP32-C3 or ESP32-S3 development board.
Safety note:Use inexpensive boards you own, confirm the exact chip target before flashing, and disconnect relays, motors, or high-current loads while learning.
Hands-on ESP32 DevKit V1 book that teaches embedded Rust through LEDs, sensors, OLED output, buzzers, Wi-Fi control, and small maker projects.
First move:Start with the hosted book and a spare ESP32 DevKit V1; do the simplest LED chapter before attaching sensors or actuators.
Example use case:Build a Rust-based light sensor or ultrasonic-distance demo on a breadboard while learning how ESP32 peripherals map into real code.
Safety note:Breadboard mistakes can damage boards or components. Double-check wiring, voltage levels, and resistor values, and keep high-power devices disconnected while testing.
TinyGo package for ESP32-class Wi-Fi networking, sockets, MQTT, raw Ethernet frames, and Go net/http examples on microcontrollers.
First move:Build the documented hello example for a spare supported ESP32 board before adding Wi-Fi credentials or MQTT integrations.
Example use case:Serve a tiny HTTP endpoint from an ESP32-C3/S3 in Go while learning how embedded networking maps to real firmware constraints.
Safety note:Wi-Fi firmware examples often embed SSIDs and passwords at build time. Use lab credentials, verify board targets, and avoid committing secrets or flashing unknown boards.
Copy/paste
git clone --depth 1 https://github.com/tinygo-org/espradio.git ~/labs/espradio
cd ~/labs/espradio
tinygo flash -target xiao-esp32s3 -size short -monitor ./examples/hello
Self-hosted home display for tablets, monitors, TVs, or picture frames with family-board widgets, Home Assistant views, weather, and local live sync.
First move:Try it on a private home-network display with fake calendar/list content before adding Home Assistant, Immich, or real family data.
Example use case:Turn an old tablet or Raspberry Pi screen into a kitchen dashboard showing chores, weather, photos, and selected smart-home status without a cloud account.
Safety note:Home dashboards can expose calendars, photos, rooms, routines, Home Assistant state, and local hostnames. Keep it on LAN/VPN and avoid public exposure.
Copy/paste
git clone --depth 1 https://github.com/jeremiaa/magic-frame.git ~/labs/magic-frame
cd ~/labs/magic-frame
# Read the README/deploy docs before running the installer.
Open ESP32/RFID filament-spool reader project for updating 3D-printer filament settings with inexpensive NFC tags.
First move:Read the hardware list and use the browser flasher on a spare supported board before wiring it near a real printer.
Example use case:Build a small reader that recognizes tagged filament spools and updates a Bambu printer profile during a maker-lab experiment.
Safety note:Only use printers and boards you own. Printer IPs, serial numbers, LAN access codes, and Wi-Fi credentials are sensitive; keep them out of screenshots, repos, and shared configs.
Copy/paste
# Recommended path is the browser flasher in Chrome/Edge:
# https://openspool.io
Browser-flashable diagnostic firmware for ESP32 Cheap Yellow Display boards that identifies display, touch, SD card, LED, speaker, flash, and board configuration details.
First move:Open the hosted flasher in Chrome or Edge with one spare CYD board attached and run non-destructive screen/touch tests before changing settings.
Example use case:Figure out which display driver, color order, rotation, and touch behavior a cheap ESP32 display clone actually needs before starting an ESPHome or Arduino project.
Safety note:Only flash boards you own and can recover. Disconnect external loads, relays, speakers, batteries, and sensor wiring before testing unknown board variants.
Copy/paste
# Browser flash path, no local install:
# https://henryscat.github.io/
Experimental Raspberry Pi Pico firmware that turns a Pico into a USB serial bridge plus power/reset/boot-control sidecar for embedded Linux boards under test.
First move:Read the wiring and requirements carefully, build the firmware for a spare Pico, and test loopback serial before connecting power-control lines to any real device.
Example use case:Recover a Yocto or Mender test board in a hardware-in-the-loop lab by power-cycling it and forcing bootloader mode from the host machine.
Safety note:Power switching and boot straps can damage hardware if wired wrong. Treat it as an experimental lab tool, verify voltage/current limits, and never attach it to production or safety-critical devices.
Copy/paste
git clone https://github.com/TheYoctoJester/dutler.git ~/labs/dutler
cd ~/labs/dutler
git -C .. clone --branch 2.2.0 https://github.com/raspberrypi/pico-sdk.git
git -C ../pico-sdk submodule update --init
# Then follow the README build and wiring steps for your Pico model.
Raspberry Pi Pico W and Inky Frame project for showing calendar and to-do information on a low-power e-paper display.
First move:Build it with a spare Pico/Inky Frame and sample calendar data before connecting real Todoist or Google Calendar accounts.
Example use case:Make a desk display that shows today’s meetings and tasks without leaving a phone, browser tab, or always-on monitor in view.
Safety note:Calendar and task feeds are private data. Use least-privilege tokens, keep Wi-Fi credentials out of commits, and test firmware on hardware you own.
Copy/paste
git clone https://github.com/jaeheonshim/inky-dashboard.git ~/labs/inky-dashboard
cd ~/labs/inky-dashboard
git submodule update --init
Raspberry Pi project for driving a Waveshare 7.5-inch e-paper dashboard with time, weather, alerts, calendars, and custom data.
First move:Build the default weather-only display on a spare Pi and e-paper HAT before connecting Google, Outlook, CalDAV, or location-specific feeds.
Example use case:Put a quiet always-on wall display in a homelab showing the date, weather alert, and next calendar item without running a full tablet dashboard.
Safety note:Calendar tokens, CalDAV passwords, location, and weather API keys are sensitive. Keep config files off GitHub, use hardware you own, and note the README says there is no username/password support for the display service.
Official Raspberry Pi tool for writing OS images to SD cards and USB drives with beginner-friendly device and OS selection.
First move:Use it to write Raspberry Pi OS Lite to a spare SD card, then boot the Pi before changing advanced settings.
Example use case:Prepare a clean Pi for a homelab monitoring node, offline docs box, or sensor gateway without manually downloading and flashing images.
Safety note:Imaging overwrites the selected drive. Double-check the target device before writing and do not reuse cards that contain files you still need.
Living guide to writing Rust for bare-metal microcontrollers and embedded systems.
First move:Read the setup and hardware-free chapters first; do not buy boards until you know which target family the examples use.
Example use case:Learn the vocabulary behind no_std, peripherals, memory-mapped registers, and embedded-hal before attempting an ESP32 or Cortex-M Rust project.
Safety note:Embedded code can control physical devices. Start with simulator or LED-only examples, and keep motors, heaters, relays, and high-current loads disconnected during early experiments.
Local-first home automation platform for connecting sensors, lights, switches, dashboards, and automations on a Raspberry Pi or server.
First move:Install the official Home Assistant OS image on spare hardware and add one harmless device before building automations.
Example use case:Create a private dashboard that shows room sensors, turns on a light at sunset, and notifies you if a lab UPS or leak sensor changes state.
Safety note:Automations affect real devices. Keep it on a trusted LAN/VPN, use strong auth, and test with lights or sensors before controlling locks, heaters, pumps, or alarms.
Copy/paste
# Start with the official installation chooser:
# https://www.home-assistant.io/installation/
Open Raspberry Pi-based IP-KVM for remote keyboard, video, mouse, power, and recovery access to machines you administer.
First move:Read the official hardware guide and build it for one lab machine on a private network before trusting it for remote recovery.
Example use case:Recover a headless homelab server stuck in BIOS, reinstall an OS, or debug boot failures without keeping a monitor and keyboard attached.
Safety note:An IP-KVM is equivalent to physical console access. Use it only on machines you own or administer, change defaults, isolate it behind VPN/LAN access, and never expose it directly to the internet.
Copy/paste
# Follow the official hardware/software guide:
# https://docs.pikvm.org/
Linux/Raspberry Pi software for running an all-sky camera with capture, processing, web UI, and astronomy-focused workflows.
First move:Read the hardware and camera compatibility docs, then test indoors with a spare camera before installing anything outside.
Example use case:Build a small observatory camera that captures night-sky timelapses, meteor events, and weather context from your own property.
Safety note:Cameras can capture people, addresses, location clues, and private property. Aim responsibly, follow local rules, secure the web UI, and avoid publishing raw feeds unintentionally.
Copy/paste
git clone https://github.com/aaronwmorris/indi-allsky.git ~/labs/indi-allsky
cd ~/labs/indi-allsky
# Read docs/install.md before running setup scripts.
Rustup-style installer and manager for the Rust toolchains needed to build applications for Espressif chips.
First move:Install rustup first, then use espup to prepare a disposable ESP Rust workspace before flashing any board.
Example use case:Set up a repeatable Rust toolchain for an ESP32 sensor project without manually chasing Xtensa toolchain pieces.
Safety note:Toolchains can flash real hardware once paired with cargo-espflash. Use boards you own, double-check target chips and serial ports, and keep Wi-Fi credentials out of examples.
Copy/paste
cargo install espup
espup install
# Then follow the Rust on ESP Book for your target chip.
Bare-metal no_std hardware abstraction layer for Espressif chips, useful when ESP-IDF is heavier than the project needs.
First move:Read the Rust on ESP Book and build an example matching your exact chip before writing custom peripheral code.
Example use case:Prototype a small ESP32-C3 LED or sensor firmware in Rust with direct peripheral access and embedded-hal traits.
Safety note:Bare-metal embedded code can hang boards or drive pins incorrectly. Start with LED-only examples, disconnect high-current loads, and verify pin mappings before connecting hardware.
Copy/paste
# Start from the official examples for your release:
# https://github.com/esp-rs/esp-hal/tree/main/examples
Rust embedded-hal wrapper over ESP-IDF drivers for Espressif projects that want Rust while still using the vendor SDK.
First move:Use it through the official esp-idf-template or Rust on ESP examples before mixing in Wi-Fi, MQTT, or OTA updates.
Example use case:Write Rust code for an ESP32 device that uses familiar embedded-hal traits while relying on ESP-IDF underneath.
Safety note:ESP-IDF projects often include Wi-Fi credentials, certificates, and OTA settings. Keep those in ignored local config and flash only boards you own.
Copy/paste
# Read the crate docs and start from esp-idf-template:
# https://github.com/esp-rs/esp-idf-template
ESP32-S3 firmware for an all-in-one embedded debug tool with JTAG/SWD, logic analyzer, FPGA programming, signal generation, and a browser UI.
First move:Build for the documented ESP32JTAG or generic ESP32-S3 profile and use loopback/self-test captures before connecting a target board.
Example use case:Debug an owned microcontroller board by capturing GPIO timing and stepping firmware over SWD without buying a separate logic analyzer and probe for a first lab.
Safety note:Debug probes can halt, erase, program, reset, or electrically stress target hardware. Use only boards you own, verify voltage/pin maps, and avoid remote debug exposure.
Copy/paste
git clone --recursive https://github.com/EZ32Inc/esp32jtag_firmware.git ~/labs/esp32jtag_firmware
cd ~/labs/esp32jtag_firmware
# Source ESP-IDF v5.5.2+, choose the board profile, then run: idf.py build
Low-ceremony .NET library for controlling Raspberry Pi GPIO pins from C# projects.
First move:Add it to a tiny .NET console app and blink one low-current LED through a resistor before connecting sensors, relays, or motors.
Example use case:Prototype a C# Raspberry Pi app that turns an LED on/off or reads a simple input button before moving to more complex hardware.
Safety note:GPIO pins are easy to damage. Verify voltage, current limits, resistor values, and pin numbering before wiring anything; avoid mains-powered relays as a beginner.
Copy/paste
dotnet add package SimpleGPIO
# Then use the README examples with a supported Raspberry Pi board.
ESP32-S3 firmware that turns a USB HID UPS into a Wi-Fi Network UPS Tools server with a browser configuration UI.
First move:Use the browser flasher on a spare ESP32-S3 and a supported UPS, then verify readings locally before adding Home Assistant or NAS shutdown automation.
Example use case:Expose battery and line-power status from an Eaton or APC USB UPS to Home Assistant without dedicating a Raspberry Pi to NUT.
Safety note:UPS monitoring can trigger shutdown automations. Test with non-critical clients first, change default captive-portal credentials, and keep the NUT/web interfaces off the public internet.
Copy/paste
# Browser flasher and manual PlatformIO build are documented here:
# https://github.com/maverick1982/esp32-nut
FreeRTOS-based Unix-like command shell for ESP32 and RP2350 boards with a serial interface, filesystem, networking tools, alarms, themes, and demos.
First move:Build the documented PlatformIO project for a supported display board and try serial-only shell commands before enabling networking.
Example use case:Teach embedded operating-system ideas by running simple commands, files, and tasks on a cheap ESP32 board instead of starting with a full Linux SBC.
Safety note:Embedded shells and Wi-Fi code can expose boards or drive pins unexpectedly. Use lab hardware, verify board targets, and keep Wi-Fi credentials out of committed examples.
Copy/paste
git clone https://github.com/VuqarAhadli/MiniOS-ESP.git ~/labs/minios-esp
cd ~/labs/minios-esp
# Open with PlatformIO and build for your exact board target.
Open hardware and software platform for small Raspberry Pi-powered bioreactors used in biology education and controlled growth experiments.
First move:Read the documentation and start with a non-hazardous educational build; do not improvise wet-lab procedures from code alone.
Example use case:Run a classroom-safe growth-curve experiment where a Raspberry Pi logs optical density, temperature, and stirring over time.
Safety note:This is physical lab equipment, not a toy medical device. Use only legal, low-risk organisms and materials, follow local lab-safety rules, and keep liquids away from exposed electronics.
Copy/paste
# Start with the official docs and hardware bill of materials:
# https://docs.pioreactor.com/
Official-style unified Arduino/ESP-IDF library for M5Stack ESP32 devices: display, touch, buttons, speaker, microphone, IMU, RTC, and power helpers.
First move:Install it through Arduino Library Manager and open `File > Examples > M5Unified > Basic > HowToUse` on one M5Stack board.
Example use case:Prototype a tiny desk dashboard on an M5Stack Core2 that shows Wi-Fi status, sensor readings, and button-controlled pages.
Safety note:Start with USB power and harmless examples. Disconnect motors, relays, batteries, and high-current accessories until you understand the board power path.
Small REST/JSON client library for ESP32 projects that avoids large heap allocations while binding response fields directly to variables.
First move:Install it in a PlatformIO or Arduino test sketch and call a local mock API before pointing a device at real services.
Example use case:Have an ESP32 temperature node POST readings to a local API and parse a compact JSON config response without exhausting RAM.
Safety note:IoT HTTP clients can leak Wi-Fi credentials, API tokens, and sensor data. Use TLS where supported, store tokens carefully, and avoid hard-coding production secrets in sketches.
Copy/paste
# PlatformIO example:
# lib_deps = PedroFnseca/esp32-http-client
# Arduino IDE: install from the library source or release documented by the project.
Firmware and tooling that turns a Raspberry Pi Pico or ESP32-S3 into a small PKCS#11-capable hardware security module.
First move:Use a spare board, read the security considerations, and follow the official getting-started flow before storing anything important.
Example use case:Build a lab HSM that signs test certificates or stores development keys without teaching a beginner to put secrets in plain files.
Safety note:Flashing firmware can erase or brick boards, and mishandled HSM setup can lock you out of keys. Do not store production secrets until backup, PIN, firmware, and recovery paths are understood.
Arduino/ESP32/Raspberry Pi library for connecting DIY devices to the Blynk IoT cloud and mobile dashboard builder.
First move:Install the Arduino library and run a simple LED or virtual-pin demo with a throwaway project token before wiring real actuators.
Example use case:Make a phone dashboard that shows an ESP32 plant sensor reading and toggles a harmless test LED.
Safety note:Blynk projects use auth tokens and can control physical devices. Keep tokens out of public sketches and test with harmless LEDs before relays, pumps, locks, or heaters.
Popular Arduino-compatible LED library for driving addressable LED strips and matrices from ESP32, Arduino, Teensy, Raspberry Pi, and other boards.
First move:Install it through Arduino IDE or PlatformIO and blink one short LED strip from USB power before building a larger display.
Example use case:Prototype a status light for an agent workstation that turns red on CI failure and green when deployment finishes.
Safety note:Large LED strips draw serious current. Use a proper power supply, common ground, fuses where appropriate, and never power high-current strips from a laptop USB port.
Cross-platform MicroPython IDE with editor, REPL, board file browsing, pinout visualization, and serial plotting for connected microcontrollers.
First move:Download a release for your OS and connect a spare MicroPython board before experimenting with sensors or actuators.
Example use case:Edit a small ESP32 or Raspberry Pi Pico script, run it over serial, and watch sensor values in the built-in plotter while learning MicroPython.
Safety note:Only control boards you own. Disconnect relays, motors, heaters, or other high-current loads while learning the editor and REPL.
Copy/paste
# Download the current installer or AppImage from:
# https://github.com/kevinmcaleer/Snakie/releases/latest
Blockly-based hardware IDE for Arduino, MicroPython, ESP32, STM32, RP2040, and other boards, with AI assistance for prototyping and education.
First move:Download the international build, pick a spare development board, and run a blink-style project before connecting sensors, relays, or motors.
Example use case:Help a beginner turn a sensor idea into board selection, wiring guidance, generated starter code, and a first firmware upload.
Safety note:Use only boards and circuits you own. AI-generated wiring or firmware can be wrong, so verify pinouts, voltage, and current limits before powering hardware.
Copy/paste
# Download the installer for your OS:
# https://aily.pro/download
Beginner-friendly Python IDE that also works well for MicroPython on Raspberry Pi Pico and other boards.
First move:Install Thonny, run a local Python script, then connect a spare board only after you understand the interpreter selector.
Example use case:Teach a first MicroPython lesson by editing code.py, opening the REPL, and blinking an LED on a Raspberry Pi Pico without a heavy toolchain.
Safety note:Only flash and control boards you own. Disconnect relays, motors, heaters, and other high-current hardware while learning the IDE.
Open-source embedded-systems simulator for running and testing firmware for complex boards without always needing physical hardware.
First move:Run one official demo platform from the docs before importing your own firmware or custom board description.
Example use case:Reproduce a microcontroller firmware bug in a deterministic simulated board so tests can run in CI instead of only on a bench device.
Safety note:Simulation is safer than random hardware flashing, but firmware may still be proprietary or sensitive. Only analyze code you are allowed to handle and keep lab artifacts private.
Copy/paste
# Download the current package for your OS from:
# https://renode.io/#downloads
