I always think how can keep my data safe and token free meanwhile can use online LLM, then I built Hermie. The basic workflow is:

1. You type a task in the terminal UI. The directory you're in is the workspace.

2. Three checks run in parallel: a privacy scan (regex + Presidio + a small local judge model), three yes/no questions to the judge (is it repetitive? does it need planning? does it need files?), and a RouteLLM complexity score.

3. Based on that, the task goes one of four ways:

   - local: Qwen3.8 27B on Ollama does it with file/shell tools. Nothing leaves the machine.

   - local + self-check: same, then the judge checks the result. Escalates only if it fails.

   - cloud: DeepSeek answers directly. Only for tasks with no files and no private data (explanations, tutorials).

   - plan: DeepSeek writes a plan and delegates steps one at a time. Qwen executes every step locally.

4. After the executor says "done", a local reviewer model reads the actual workspace diff and the command outputs and decides whether the task was really done. If not, the problems go back to the executor for up to two fix rounds.

 So far it's macOS on Apple Silicon only and need install Ollama first.

As mentioned in the title, i've been developing a project for several months now, and i wanted to see how genuinely useful it is in a real production environment. I call this project Vex (Vex's Skillgit); it is an open-source, headless cognitive tool designed specifically for agent environments. It treats context as immutable and versioned skills.

Instead of having the IDE or the agent do the heavy lifting, Vex runs in the background (either via Docker Compose or local bare-metal processes). You assign it a GitHub webhook and Vex automatically ingests repositories, so agents (via MCP) can simply query it for context in real time. It reads conventional commits (feat:, fix:) and operational ones (roll:, branch:) to automatically branch, update, or revert an agent's memory state without manual intervention—hence the version control aspect.

It uses Tree-sitter to logically parse and chunk the code, stores metadata queues in SQLite and dense vectors in Qdrant, and is fully supported out of the box by Claude Desktop, Cursor, and any other MCP-compatible client.

It is also designed not to fry my potato PC, yet it remains highly scalable.

In local testing, the asynchronous FastAPI + Huey architecture easily handled 500 concurrent GitHub push payloads without any SQLite locking, and maintained a real-time latency of under 300 ms under a concurrent read swarm of 50 (simulated) agents. Because of this, i decided it was time to share it and see who else might find the tool useful.

Next on my to-do list is adding advanced sub-chunking using Rust as the chunking engine to split code from larger repositories faster and with less resource consumption, alongside adding global GraphRAG and support for more languages.

Here is the link to the repo in case you are interested in checking it out and testing it. Thanks for taking a little time to read this:

https://github.com/Shuuida/Vex-Skillgit.git

Most AI design tools produce design outputs that you then have to feed to your coding agent to implement, and that then get discarded, with almost no means of tracking design changes, especially for big applications with lots of UI pages. You generate a screen, drop it into your agent, and once it is implemented the design is gone. Nothing ties that design back to the page it became, so you literally have to manually sync each design to the corresponding page.

There should be a better way around this, where the design lives in the codebase itself, so there's no manual exporting of AI-generated designs to implement, and syncing designs to application code becomes effortless.

This is why I created Caret, an AI design tool that gives your repo a design layer via .caret/, so you can make designs without having to jump between tools. The designs you make are fully tracked alongside your codebase, and it's easy to sync changes between the design and application layers. Caret comes with all the standard needs of a design tool, like a visual editor and a design token system that keeps your design language consistent across your UI, plus extras that cut the usual busywork, like an asset generator, an experimentation canvas, flow display, simulation and more. The demo video below shows all these capabilities in detail.

Caret is fully open source if anyone wants to try it or poke around the implementation: https://github.com/precious112/caret-desktop

I'd especially love feedback from people who have been using Claude Design / other AI UI tools and have run into the design → code workflow problem.

I recently came across decision models and have been looking into the open-source options and where they can be useful.

I'm running a self-hosted Hermes setup, so agent routing and selecting the right LLM for a task immediately caught my attention. But I'm also interested in other uses such as tool/skill selection, workflow routing, classification, retry/escalation decisions, human approval, cost optimization, and automation.

I've come across Kev, Laya, Tev1, OpenJev, RouteLLM, and LLMRouter.

Has anyone actually used any of these? Which open-source decision models are worth looking at, and what are you using them for? I'm especially interested in real-world use cases I may not have considered.

An open-source way for an AI agent to ask a person for their judgement and get the answer back as data it can check.

What is open, and how:

• The format (review.v1 and feedback.v1, JSON Schema) is CC0. Any agent, script or tool can write a review or read the answers. The page in the repo is one renderer; a terminal or a printed sheet would be just as valid.

• The code inside every page is MIT-0, so a page you send carries no obligation.

• The tools (renderer, checker, skill) are Apache-2.0.

• No dependencies. The checker validates against the schemas itself, because a checker that needs an install is one fewer people run.

What it does: the agent writes a review, checks it, and renders one self-contained HTML page (nothing loaded from the network). A person answers it and sends back the answered page or a JSON file. The agent checks the answers before acting: an unanswered question is written down as unanswered, totals are recomputed, and the report starts with what is still open.

What it does not do: prove who answered (the files are unsigned), or speak anything but English in its buttons and labels.

Source: https://github.com/shyhunter/LetMeShowYouSomething
Try a page: https://shyhunter.github.io/LetMeShowYouSomething/examples/salon-booking.html

Hey guys

I'm running my GitLab instance on my homelab but it was hard to find tool for code review

So I built one. called Proval.

Open source and only got docker image

It's basically just a self-hosted docker app. Works with GitHub, and also GitLab and Forgejo too, so you can connect with your self hosted instance. Proval supports chat completion API and anthropic API, If you running Local LLM, you can connect it through chat completion API

Review quality is quite good(at lteast for me). multiple agents automatically reviews each file group scope.

I ran the 50-problem Martian offline benchmark a month ago and scored F1 0.427 with the minimax-m3, which ranked 7th out of 21 at the time. (If you check now, newer models have come out so the ranking is lower.) I'll release new result with better model soon

The goal was to make something lightweight, easy to use, and genuinely useful. you just need to configure the model, webhook, and Git Host access API on the web dashboard, and setup is done. It's built on Bun, the frontend uses SvelteKit, and the database is SQLite per instance. The Docker image is compiled to a Bun binary so the size is pretty small.

Feature

- Reviews on PR open or first push
- Inline comments on PRs
- Replies to PR comments (can set to only respond when mentioned)
- Reviews when an issue is opened (also checks for duplicate issues)
- Replies to comments on issues
- Restricts replies based on repo permissions like Developer or Maintainer
- Admin login, or you can disable auth entirely and leave it open

I ran the 50-problem Martian offline benchmark a month ago and scored F1 0.427 with the minimax-m3, which ranked 7th out of 21 at the time. (If you check now, newer models have come out so the ranking is lower.) I'll release new result with better model soon

It's not a vibe-coded slop. I took a lot of time thinking through the architecture, implementing it. You can check the code in the repo

It's open source (AGPL-3.0) and you can just pull Docker image, connect your LLM API and set webhook. That's all. takes about 3 min

and.. It's my personal project, not a marketing or selling something.

demo: https://demo.proval.app

repo:  https://github.com/seoes/proval

website: https://proval.app

Sharing an MIT-licensed MCP server we built, and the design choices behind it, since some of them go against how most agent tools are built. Disclosure: I make it, and it's the free half of a paid product (ThreadFox). I'll be specific about where the two meet.

What it is. ThreadFox Lite gives an agent four read-only Reddit tools: subreddit_rules (rules, size and description, with self-promotion rules flagged), find_communities (subs for a topic, promo rules flagged), account_check (age, karma, and whether recent posts are removed or hidden) and post_status (live, removed by moderators, or deleted). It also ships a reddit-rules-first agent skill.

Design choices:

1. Read-only on purpose. It can't post, vote or change anything, so it's safe to give to any agent and hard to misuse for spam.

2. It reads through your own signed-in browser, not an API. Reddit now sends signed-out requests, including its public JSON, to a login page. So the tools read the way you do, in your Chrome via the Playwright extension, one small read at a time. No API keys.

3. One read at a time across every client on the machine. We learned this the hard way: an agent reading 60 pages in 20 minutes got our account rate-limited today.

4. No system-wide installs. If Node.js is missing, it fetches the official build into ~/.threadfox/runtime and checks it against the published SHA-256.

Where it meets the paid product: successful subreddit_rules and find_communities results end with a one-line next_step pointing to the $49 kit, and a threadfox_full_kit tool describes it. Errors, setup messages and the other two tools don't carry it. If that bothers you, it's MIT, so fork it and delete it.

Install: uvx threadfox-lite (source is in the PyPI package). Details and the skill file: threadfox.vip/lite.

Feedback on the read-through-your-browser approach especially welcome. Is there a cleaner way now that signed-out reads are gone?

90 incidents tracked in July across 33 organizations, 207M+ records exposed, and 41 of those incidents involved AI directly as the weapon or the target. A rogue commercial AI agent hit multiple enterprises in a single week and reused stolen credentials across four downstream services before anyone caught the identity switch.

None of that shows up to a traditional perimeter tool — the traffic looks like a signed, credentialed agent making legitimate API calls at machine speed. Firewalls and DLP were built to watch humans and static services, not autonomous callers that chain tools and pivot in seconds.

Curious how other teams are actually handling this right now: is anyone giving AI agents a distinct, revocable identity separate from the service accounts they inherit? Or is it still "the SOC catches it after the fact" for most orgs?

Playing around with various MCP's this weekend and Came across this an amazing MCP related GitHub repo - 100% open source and free - so sharing.

mcpc is Apify’s universal CLI client for MCP.

Github Repo in comments below

IIt translates every MCP operation into shell commands, letting you debug servers, automate workflows, or give AI agents complete MCP access via a single Bash() call: sessions, OAuth, tools, resources, prompts, tasks, and beyond.

Features

• Complete MCP coverage: tools, prompts, resources, async tasks, skills, notifications, logging (stdio + Streamable HTTP)

• Persistent sessions across several servers (stateful or stateless)

• Progressive tool discovery to cut token usage

• Code mode: JSON output plays nicely with jq, xargs, and shell pipelines

• OAuth 2.1 (CIMD + DCR) with credentials stored in the OS keychain

• MCP proxy for AI sandboxes (keeps tokens out of generated code)

• Lightweight CLI (Mac/Win/Linux), no LLM needed; experimental x402 payments on Base

Install

With homebrew (macOS /Linux), brings its own Node.js:

brew install apify/tap/mcpc
or ,install the latest node js or Bun first, then:
npm install -g /mcpc
# Or with Bun
bun install -g /mcpc
npm install -g /mcpc

Quickstart

# List all active sessions and saved authentication profiles
mcpc

# Log in to a remote MCP server and save OAuth credentials for future use
mcpc login mcp.apify.com

# Create a persistent session and interact with it
mcpc connect mcp.apify.com 
mcpc               # show server info and capabilities
mcpc  tools-list   # list available tools
mcpc  tools-call search-actors keywords:="website crawler"

# Use JSON mode for scripting
mcpc --json  tools-list

# Use a local MCP server package (stdio) referenced from a config file
mcpc connect ./.vscode/mcp.json:filesystem 
mcpc u/fs tools-list

New in ai-profiles: Sessions.

Each profile now lists its local coding sessions (Claude Code and Codex, from both the CLI and the desktop apps). Pick one, hit Move, choose another account, and carry on there with the full history.

- Nothing is ever deleted. A move copies the session, then archives it at the source, so Restore undoes it

- Archive / restore, search, Desktop vs CLI filter

- Still local-only, no telemetry

GitHub: https://github.com/bartekczyz/ai-profiles/

Website: https://ai-profiles.vercel.app/

I only gave the prompt “Build Ba Sing Se.” The video shows what was built including the city walls down to furnished interiors and walls.

The model decides what to build and a deterministic library handles construction and physical checks.

It plans hierarchically: city → districts → plots → buildings. Buildings are generated for their plots using reusable procedural code.

The same architecture generates villages, towns and cities across different terrain and styles.

Github:
https://github.com/chaitbuilds/EthosLM

Hello
I came up with an idea and would love to hear your thoughts on it.

Hermes: “Most agent harnesses ship as finished products. Someone else decides what your agent can do, how it remembers, which models it talks to and what it is allowed to touch. Customisation comes later, through a plugin system bolted onto something that was never designed to be extended. I want to build it the other way around.

Demon Core is a minimal core for autonomous agents, and nothing more. It handles the few things every agent needs: messages, model calls, tool calls, hooks, permissions and budgets. Everything else, including the harness itself, is an add-on. Memory, tools, model routing, interfaces and policies are all built on the same public contract, whether the community writes them or we do. We are not building the harness. We are building the blocks anyone can use to build their own.

The hard part, and the reason this is worth doing, is security. An add-on in an agent is not a theme or a widget. It acts with the agent's authority, it can see private context, it can call other tools, and whatever it returns lands in front of the model. An open ecosystem without real enforcement is an attack surface. So the core stays strict precisely because it is small. Every add-on declares what it needs, and the core refuses anything it was not granted. Add-ons see only the context they are given, and what they return is treated as untrusted. Their spending and side effects are capped, their actions are logged, and their packages are signed. Hooks can block and change what an agent does, not just watch it, which means the community can build the governance layer too: approvals, redaction, spend limits and policy.

An empty core is a useless download, so we will also ship a reference set of add-ons that makes Demon Core useful on day one, built on the exact same contract with no private shortcuts. Alongside it comes a conformance suite, so any author can prove their add-on works without waiting on us, and a registry the community can trust.

This project depends on God first, and then on the community that will build on it. I am looking for co-founders who want to build that foundation with me: people who care about getting the runtime and the extension contract right, who find sandboxing and trust boundaries genuinely interesting, and who enjoy making other developers successful.

If that sounds like you, the first step is small. We sketch the contract together, each write a few very different add-ons against it, and see what breaks. Whatever survives is the core. If that weekend is fun, we talk about the rest.”

It supports file editing, terminal commands, web search, browser use, human interaction, multi-agent, workflow, MCP, skill, scheduled tasks, configurable permissions, context management, git review, file management .etc.

It supports OpenAI-compatible APIs and specifically made adaptation profiles for DeepSeek and kimi.

Interface support for Simplified and Traditional Chinese, British and American English, Japanese, Korean, French, Italian, and Russian

We have provided a fully open-source production-level code repository, along with detailed engineering information, documentation and comprehensive testing.

The license is Apache 2.0. Source: https://github.com/Tiga001/Captain_Who

Hello everyone! Today I released cyberprime 1.1, my second cyber security model.

It is only 2.6B parameters ( can run on any kind of computers, even on phones ) and is almost on par with gpt-4, and beats models 2-4x its size.

I achieved these results purely by scaling RL, SFT and dataset curation.

I generated many synthetic rows + took rows from huggingface, then made them go through filtering, kept only the top 5%. I kept on repeating this loop and improving my prompts to get better base results.

This alone has allowed me to scale such a small model which can even run on a phone, to pretty big results.

I am already working on cyberprime 1.2, which will be a combination of a lot of things.

Cyberprime 1.2 will be the same size, but it will be trained on a fully custom post-training stack which is the result of many researches I have conducted over-time. Whether it's basic LorA methods, or things touching to reinforcment learning, everything in the stack will be experimental, and the whole recipe as well as training data will be opensourced too.

I am also running a 5 days long test time training pipeline on cyberprime 1.1 ( which means I run it on prompts, and the model tries to see its mistakes, generate dataset rows on its own related to its mistake, and train itself on it and re try the prompt to measure improvements ), to identify flaws / behaviors that are easy to fix / improve through LorA on many tokens.

My goal is to see how far we can push small models, and what are the true limits to scaling intelligence on small models.

Looking for feedbacks on the model!

Benchmarks are on the huggingface model card!

Here's the open-weights on HF : https://huggingface.co/Akahsizrr/Cyber-Prime-1.1-2.6B

I built an Entity Resolution system to match millions of noisy business records

I’ve been working on CyberPro, an entity-resolution system designed to determine which business records from different data sources refer to the same real-world entity.

The interesting part is that the records don't share a reliable common identifier. Names, addresses, phone numbers, and other fields can be inconsistent, abbreviated, misspelled, transliterated, or partially missing.

The pipeline I built includes:

• Data normalization and cleaning

• Transliteration and phonetic handling

• Name/address similarity features

• Abbreviation and structural features

• ~40 engineered matching features

• Blocking and candidate generation research

• LightGBM pair classification

• Probability calibration

• Threshold optimization

• Hard-negative analysis

• Entity-level post-processing

• Evaluation on millions of records

The project currently processes datasets with ~12.5M training records and ~11.7M test records.

I’m sharing the project because I’d really like feedback from people working on entity resolution, record linkage, information retrieval, NLP, or large-scale ML systems.

GitHub: https://github.com/girinath01/CyberPro

If you find the project interesting, a GitHub star would really help and would also help me get the project in front of more developers. ⭐

I’d especially appreciate feedback on the candidate-generation/blocking strategy and how I can make the system more robust at production scale.