Edition No. 16 · 10 Sep 2026
Twelve repositories for coding agents, servers and video
Five are new to the radar, four have fewer than three thousand stars, and one of them checks whether your leaked keys still work.
The web version carries the English / Русский switch. The Russian text of this edition is also in the file radar-2026-09-10-ru.md, delivered into the chat on the day. This archive stays English only.
Thursday, 10 September 2026 · A plugin with 134,000 stars that makes AI write less code
The most popular thing in today's edition does not add a feature to anything. It is a small plugin for coding assistants, it has about 134,000 stars, and its whole job is to stop your assistant writing code it did not need to write. That is entry #1.
You asked for three repositories through the panel. All three are here. All three were checked the same way as everything else, and all three shipped code in the last month.
Two things worth knowing
- All three of your requests passed, and one of them is very large. Ponytail (#1) shows about 134,000 stars today and sits near the top hundred repositories on GitHub. Graphify (#2) shows about 116,000 and released a fix yesterday. FreeLLMAPI (#3) shows about 24,900 and released on 7 September. Popularity is not quality, so all three were opened and read like anything else. One warning came out of that reading and it is in entry #3: FreeLLMAPI's own documentation says it is for personal experimentation, and asks you not to build anything real on it. - MongoDB gave away a security tool under a licence you can actually use. MongoDB's own database ships under the SSPL, which is not open source in the usual sense. Kingfisher (#4) does not. Its licence file is the plain Apache License 2.0, with no added restriction on commercial use. There is one thing to know before you run it: to check whether a leaked key still works, it sends that key to the provider. On your own code that is fine. On a client's code it may not be. The switch --no-validate turns it off.
If you only do three things
- mongodb/kingfisher (#4) — tonight, about ten minutes, free, nothing to keep running. It reads your project for passwords and keys that got left in the files. Then it does the part that matters: it asks each provider whether that key still works. You get a short list of live keys to change today, not a long list of maybes.
- DietrichGebert/ponytail (#1) — five minutes, two commands, and you can remove it just as fast. You build everything with Claude Code. This changes what Claude Code decides to build, before it writes anything.
- warp-tech/warpgate (#5) — this weekend, two or three hours. Your Hetzner box almost certainly has its login port open to the whole internet. This puts a door in front of it, with a password and a second factor, and it records every session.
Every link in one place
| # | Repository | What it does | Stars | Licence | Latest | Website |
|---|---|---|---|---|---|---|
| 1 | DietrichGebert/ponytail | Makes a coding assistant write less code | 134k | MIT | v4.9.0, 7 Aug 2026 | ponytail.dev |
| 2 | Graphify-Labs/graphify | Turns a codebase into a map you can click | 116k | Apache-2.0 and MIT | v0.9.57, 9 Sep 2026 | graphify.com |
| 3 | tashfeenahmed/freellmapi | One address in front of many free AI accounts | 24.9k | MIT | v0.9.8, 7 Sep 2026 | freellmapi.co |
| 4 | mongodb/kingfisher 💎 | Finds leaked keys and checks if they still work | 1.2k | Apache-2.0 | v2.2.0, 9 Sep 2026 | mongodb.github.io/kingfisher |
| 5 | warp-tech/warpgate | A guarded door in front of your server | 7.9k | Apache-2.0 | v0.28.6, 1 Sep 2026 | warpgate.null.page |
| 6 | owncast/owncast | Live video and chat on your own domain | 11.4k | MIT | v0.3.0, 3 Sep 2026 | owncast.online |
| 7 | mifi/lossless-cut | Cuts video in seconds without spoiling it | 43.4k | GPL-2.0 | v3.69.0, 4 Jun 2026 | losslesscut.app |
| 8 | radix-ui/colors 💎 | A ready colour set that works light and dark | 1.7k | MIT | no releases; ships on npm | radix-ui.com/colors |
| 9 | puckeditor/puck | Lets someone else arrange your page | 13.3k | MIT | v0.23.0, 7 Aug 2026 | puckeditor.com |
| 10 | StJudeWasHere/seonaut 💎 | Crawls your site and lists what is broken | 763 | MIT | no releases; ships as a container | seonaut.org |
| 11 | rilldata/rill 💎 | Dashboards written as files, not clicked together | 2.9k | Apache-2.0 | v0.89.4, 1 Sep 2026 | rilldata.com |
| 12 | juspay/hyperswitch | One payment API in front of many providers | 43k | Apache-2.0 | v1.126.0, 24 Aug 2026 | hyperswitch.io |
A plugin with 134,000 stars that makes AI write less code
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Ponytail is a plugin for coding assistants such as Claude Code, Codex and GitHub Copilot CLI. It installs a short list of questions the assistant must answer before it starts writing.What it is good for. Anyone who builds software by asking an assistant to do it. The usual complaint is not that the assistant writes bad code. It is that it writes far too much of it, and a solo builder then owns every line. The project's own testing claims about 54% less code produced and about 20% lower cost, which is their figure and not a measured promise. The example in the README is a good one: instead of pulling in a component library for a date picker, it uses the date field the browser already has. This one is directly for you. You build Grasppy and ScalpingMate with Claude Code, and every extra file it writes is a file you will have to understand later on your own.
- Two commands to install, and removing it is just as quick. Nothing about your project changes.
- It is a plugin, not a service. There is no account, no server and no cost.
- The safety parts are protected. Input checking, security, error handling and accessibility are never treated as code to remove.
- It works through the plugin system of each assistant. If you use a tool with no plugin support, this does nothing for you.
- Node.js must be on your system path for the plugin hooks to run. The skill files work without it, the hooks do not.
- "Write less" is a preference, not a law. Sometimes the longer answer is the right one, and you still have to read what comes out.
/plugin marketplace add DietrichGebert/ponytail /plugin install ponytail@ponytail
▶Repo detailsthe review · specs · pros & cons · install
What it is
Graphify is a command-line tool that parses source files locally and builds a knowledge graph from them. A knowledge graph is a set of things joined by named connections, so you can ask which part uses which other part.What it is good for. Anyone who has inherited a codebase, or written one over six months and lost the thread. It supports 37 languages, including Python, TypeScript, Go and SQL. Code parsing happens on your machine with tree-sitter, which is a fast local parser, so no keys are needed and no code leaves the room. Documents, PDFs, images and audio are handled by your assistant's model instead, and that part does cost money. There is a real connection to your own work here. Grasppy takes one long conversation and turns it into subtopics you can click. Graphify takes one long codebase and does the same thing. It is worth an hour just to see how somebody else solved the problem you are solving.
- Your code never leaves your machine. The parser runs locally and no API key is needed for it.
- Three outputs, not one:
graph.htmlto click through,GRAPH_REPORT.mdto read, andgraph.jsonto query later. - It states plainly that there is no telemetry, no usage tracking and no analytics.
- It is still at version 0.9.57. Expect the commands and the output to change.
- The graph file has a 512 MiB size limit by default. On a very large project you will have to raise it or narrow what you scan.
- Documents and media need a model, so the interesting half of the feature list is not the free half.
uv tool install graphifyy graphify install
▶Repo detailsthe review · specs · pros & cons · install
What it is
FreeLLMAPI is a self-hosted router. Self-hosted means it runs on a computer you control rather than on somebody else's service. It presents one OpenAI-shaped /v1 endpoint and forwards each request to whichever provider you have configured.What it is good for. Anyone doing a lot of cheap, low-stakes model work: testing prompts, bulk classification, drafts nobody will publish. Instead of six accounts and six keys in six scripts, there is one address. It is tiny, about 40 MB of memory when idle, and it runs on a Raspberry Pi. For your own work there is one honest use and one honest warning. The use is experiments — trying a prompt fifty ways costs nothing. The warning is that Grasppy is a product people pay for, and a stack of free tiers has no guarantee behind it, so this does not belong under a paying customer.
- You bring your own accounts and the keys are stored encrypted. The project is not handing you somebody else's access.
- Very small. Node 20 or newer, roughly 40 MB of memory at rest, and it runs on Windows, macOS, Linux or a small ARM board.
- One
/v1address means your existing OpenAI-shaped code needs no changes.
- The documentation says plainly that this is for personal experimentation and asks you not to build anything real on it. Take that seriously.
- No top-tier models, changeable speed, and no service guarantee. Quality drops late in the day as the free daily limits run out.
- The free install gets a monthly snapshot of which models exist. Same-day updates cost $19 a year, or $49 once.
curl -fsSL https://freellmapi.co/install.sh | bash
▶Repo detailsthe review · specs · pros & cons · install
What it is
Kingfisher is a command-line secret scanner written in Rust. It carries 485 detection rules, and 246 of them can validate a match by calling the provider.What it is good for. Anyone who has been the only person touching a codebase for a long time, which is exactly the situation where nobody has ever checked. The output is what makes it useful. A plain scanner produces a worry; this produces a to-do list in priority order. It also maps what a live key can reach, using read-only calls, so you can see how bad a particular leak actually is. It runs on one folder, or on a whole GitHub organisation. There is a good use for your own boxes: run it once over the Grasppy repository and once over the ScalpingMate one, before anything else on this list.
- Nothing to keep alive. It is one binary, you run it, it finishes and exits. No database, no server, no port.
- The licence is the plain Apache 2.0, not MongoDB's usual SSPL. Commercial use is allowed with no added conditions.
- It knows about staged files, so it can run as a check before every commit and stop a key ever reaching the history.
- Checking whether a key is live means sending that key to the provider. On your own code that is reasonable. On somebody else's it may not be. Use
--no-validateif you are unsure. - No memory or processor minimum is published. On a small VPS, scan the repository rather than the whole disk.
- A clean result is not a promise. It finds the shapes it has rules for, and a home-made token format may not match any of them.
docker run --rm -v "$PWD":/src ghcr.io/mongodb/kingfisher:latest scan /src
▶Repo detailsthe review · specs · pros & cons · install
What it is
Warpgate is a bastion. A bastion is a single guarded machine that all access goes through, so the machines behind it never face the internet. It handles SSH, HTTPS, databases and remote desktop, and it needs nothing installed on your laptop.What it is good for. Anyone running one or two servers alone, which is the case where this is normally skipped. You can work two ways. Open the web page and get a terminal, or a MySQL or PostgreSQL session, in the browser. Or keep using your normal ssh command and point it at Warpgate instead. The session recording is worth more than it sounds. The first time a customer asks whether you keep access logs, the honest answer stops being no.
- One binary and no separate database. It uses SQLite, a database that lives in a single file, so there is nothing extra to install or back up.
- Nothing to install on the machine you connect from. A browser is enough, and your normal
sshstill works. - The project states that it is free and will stay free, with no features held back for a paid tier. Two-factor sign-in is included, which some competitors charge for.
- You are adding a single point of failure in front of your only server. Keep another way in before you switch over — your hosting company's console, or a firewall rule allowing your own address through.
- No memory or processor minimum is published, so plan to watch it for the first week.
- It is a small project funded by support contracts. The licence is safe, but the number of people maintaining it is not large.
docker run --rm -it -v /opt/warpgate:/data ghcr.io/warp-tech/warpgate setup docker run --rm --name warpgate -p 8888:8888 -p 2222:2222 \ -it -v /opt/warpgate:/data ghcr.io/warp-tech/warpgate
11.5k stars · MIT · v0.3.0 (2026-09-03)
Self-hosted live video streaming and chat — your own Twitch, on your own domain.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Owncast is a self-hosted live streaming server. It accepts a stream from OBS or similar software and serves a web player with chat, and it can also post to the fediverse so followers are told when you go live.What it is good for. Anyone who wants live video without handing the audience to a platform. A workshop, a launch, office hours, a Russian-language session at a time that suits that audience. The interesting part for a small channel is that the viewer never leaves your site, so a live session and your written pages sit at the same address. Be honest about the trade: a platform sends you strangers, and your own page does not. This is for an audience you already have.
- MIT licensed and complete. Video, player and chat in one program, with no paid tier.
- No separate database to run. It keeps its own data in a single file.
- It can announce itself to the fediverse, so followers get told when you start.
- Bandwidth and processor time are the real bill. Converting video for several qualities at once is heavy, and a small VPS will struggle.
- Building from source needs a C compiler, FFmpeg, Go 1.24 or newer, and Node.js. Use the container unless you enjoy that.
- There is no native Windows server support. On Windows you would run it inside WSL2.
docker run -d --name owncast -p 8080:8080 -p 1935:1935 \ -v /opt/owncast:/app/data owncast/owncast:latest
43.5k stars · GPL-2.0 · v3.69.0 (2026-06-04)
Trim and cut video without re-encoding — an ffmpeg GUI that is genuinely pleasant for a non-programmer.
▶Repo detailsthe review · specs · pros & cons · install
What it is
LosslessCut is a desktop program for cutting, trimming and joining video and audio. It copies the existing streams rather than encoding them again, which is why it is fast and does not lose quality.What it is good for. Anyone who records long and publishes short. The obvious jobs are removing the first two minutes before you started talking, splitting a long recording into parts, joining takes, and pulling the audio out of a video. It pairs well with two earlier entries. auto-editor from Edition 13 removes silence automatically; this is for the cuts you want to make by eye. ffmpeg-normalize, also Edition 13, fixes the loudness afterwards.
- Saving takes seconds, not hours, and the picture quality is exactly what came out of the camera.
- It is a window with buttons. Nothing here needs the command line.
- Ready-made downloads for macOS on both chip types, Windows and Linux, including a Raspberry Pi build.
- The licence is GPL-2.0. Using the program is completely free. Putting its code inside a product you sell is not practical.
- It cuts only at existing join points, so a cut can land a fraction of a second away from where you clicked. That is the price of not rebuilding the file.
- The store versions on Mac, Windows and Snap are the paid way to support the author. The GitHub download is the free one, and people confuse the two.
https://github.com/mifi/lossless-cut/releases/latest
1.7k stars · MIT · no releases published; 93 commits
A gorgeous, accessible colour system — scales with properly matched light and dark pairs.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Radix Colors is a set of colour scales delivered as CSS files and JavaScript objects. Every scale has twelve steps, plus see-through and wide-gamut versions, and the steps are built so text and background pairs meet accessibility contrast rules.What it is good for. Anyone building an interface without a designer. The real gift is not the colours, it is the numbering. Step 3 is always a subtle background, step 9 is always the solid one, step 11 is always readable text. Swap red for blue and everything still works, because the steps mean the same thing in every scale. It has no dependencies and it is not tied to React, so it works with plain CSS or anything else. There is a direct use here: Grasppy's map needs many colours that stay distinct and readable when the page switches between light and dark, and that is exactly the problem this set was built for.
- Free, MIT, and it is just data. No runtime code and nothing to keep updated.
- Light, dark, see-through and wide-gamut versions of every scale, all matched to each other.
- The contrast work is already done, so text on the recommended background is readable.
- No GitHub releases at all. To find out what changed you have to read the npm page or the changelog file, not the releases tab.
- It is colour only. Spacing, type sizes and shadows are not here — open-props covers those, and it is in the backlog.
- The project now sits under WorkOS, a company. That is not a problem today, but it is a company's project and not an independent one.
npm install @radix-ui/colors
13.3k stars · MIT · v0.23.0 (2026-08-07)
Visual editor built natively for React components.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Puck is a visual editor for React. You register your own components with it, and the person editing composes a page from them; the output is a JSON structure that you store and render yourself.What it is good for. Anyone who keeps being asked to change wording and move sections on a landing page. It moves that job to the person who wants it changed. Because you register the components, they cannot break the design — they get your blocks, with the options you allowed. This is the key difference from a full CMS: Puck edits the layout of a page built from your code, and it does not own your content or your database. GrapesJS from Edition 6 and Onlook from Edition 12 solve nearby problems, and it is worth reading all three before choosing.
- MIT, with the project stating it is fine for commercial use. No paid edition of the editor.
- The editing person can only use blocks you defined, so the page cannot end up off-brand.
- The output is plain JSON. You keep it wherever you already keep data, and rendering stays yours.
- It is a library, not an application. You supply the storage, the login and the page that hosts it.
- It needs a React app. If your public site is Astro or plain HTML, this is not a small addition.
- Still before version 1.0, and the npm package was renamed from
@measured/puckto@puckeditor/core. Old tutorials will send you to the wrong package.
npm i @puckeditor/core --save
779 stars · MIT · no releases at all; 909 commits; commit history unreachable (robots)
Self-hosted SEO auditing and reporting tool in Go — crawls a site and dashboards the technical issues.
▶Repo detailsthe review · specs · pros & cons · install
What it is
SEONaut is a self-hosted crawler with a web interface. It walks your site page by page and reports broken links, redirect chains, duplicate titles and descriptions, and problems with canonical and hreflang tags.What it is good for. Anyone with more than about twenty pages, which is the point where you can no longer keep them in your head. It has projects, so you can track your own site and check a competitor's separately, and it keeps crawl history so you can see whether a problem is getting better. SiteOne Crawler from Edition 7 does a one-off audit from the command line; this one is the version you keep, with a history and a screen. For a bilingual site there is a specific reason to care. Wrong hreflang tags — the tags that tell a search engine which page is the Russian one — are easy to get wrong and impossible to notice by eye.
- MIT, self-hosted, no paid tier and no crawl limits. Every commercial version of this charges by the page.
- It keeps history per project, so you can prove a fix worked instead of guessing.
- It catches the bilingual problems specifically: canonical tags and hreflang pairs.
- It needs MySQL 8.4, which is a database you probably do not run yet. That is an extra thing on the box.
- The example setup ships with the user
seonautand the passwordseonaut. Change both before it is reachable from outside. - No tagged releases at all. You track the container image, and you cannot pin a version by release number.
docker pull ghcr.io/stjudewashere/seonaut:latest
2.9k stars · Apache-2.0 · v0.89.4 (2026-09-01)
'Fast business intelligence tool for humans and agents' — self-hosted, would sit next to Evidence (Ed.8 #6).
▶Repo detailsthe review · specs · pros & cons · install
What it is
Rill is a business intelligence tool where dashboards are described in YAML and SQL inside a project folder. It ships with an engine that reads your data, so there is nothing to set up before the first chart.What it is good for. Anyone who has data in files or a database and no good way to look at it. Two commands and you are exploring, which is unusual in this category — most tools in it want a warehouse first. Because the definitions are files, an assistant can write them and you can review the change like any other. This suits ScalpingMate very well: backtest results, trades and daily numbers are exactly the shape it likes, and a metric defined in a file is a metric you can still explain in six months. Evidence from Edition 8 has the same file-based idea, and the two are worth comparing before you commit.
- Two commands from nothing to a working dashboard. No warehouse, no server, no account.
- It brings DuckDB or ClickHouse with it, and can also connect to S3, Postgres and about twenty other sources.
- The dashboard is text in your project, so it is reviewable, diffable and easy to copy to another project.
- The engine runs inside the tool, so your machine's memory limits how much data you can hold. No minimum is published.
- This is the free half of a paid product. Rill Cloud adds sharing, deployment and hosted dashboards, and its price is not shown in the README.
- It is at version 0.89.4 and moves quickly. Pin the version you install.
curl https://rill.sh | sh rill start my-project
43.6k stars · Apache-2.0 · v1.126.0 (2026-08-24)
Open, composable payments orchestration across many processors, with routing and revenue recovery.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Hyperswitch is a payment orchestration layer written in Rust. It gives you one API in front of many payment providers, with routing rules, retries, card storage and a merchant control panel.What it is good for. A business that already takes money and is feeling the cost of one provider — fees, a country that is not supported, or payments that fail for one card type. The routing is the point: send European cards one way and American cards another, and retry a failure with a second provider instead of losing the sale. Be clear about the stage this fits. If you have not taken a first payment yet, Polar from Edition 11 is the right size, because it handles EU VAT for you and takes a percentage. Hyperswitch is what you move to later, and it is worth knowing it exists before you write payment code you will have to unpick.
- Apache-2.0, and it comes from a company that runs payments at scale rather than a side project.
- Routing rules, automatic retries across providers, and card storage in one place.
- There is a hosted sandbox, so you can see the whole thing working before installing anything.
- It needs PostgreSQL and Redis, and the full profile also brings a monitoring stack. Use the minimal profile on a small machine.
- Self-hosting anything that touches card numbers puts the card-industry compliance work on you. That is the real cost, not the licence.
- Releases come very fast — version 1.126.0 already. Pin your version and read the notes before upgrading.
git clone --depth 1 --branch latest https://github.com/juspay/hyperswitch cd hyperswitch scripts/setup.sh
Checked, and left out
These were opened for this edition and did not make it, with the reason.
crate-ci/typos
crate-ci/typos — VERIFIED ALIVE today: v1.50.1, 1 September 2026, dual MIT/Apache-2.0, and the changelog carries the explicit year. Left out only because the twelve were already full and two other the-workshop-adjacent entries were stronger. It is first in line for a future edition. Stays queued.
pgbackrest/pgbackrest
pgbackrest/pgbackrest — VERIFIED ALIVE: v2.58.0, MIT, C. Genuinely fills a hole restic (Ed.8 #11) does not: a file-level snapshot of a running Postgres data directory can restore to a corrupt state, and this does proper point-in-time recovery. Held over because it helps only Postgres users and its setup is heavier than either security entry chosen. Added to the queue.
pocket-id/pocket-id
pocket-id/pocket-id — VERIFIED ALIVE: 9.0k stars, BSD-2-Clause, Go. A passkey-only OIDC provider. Left out because it occupies the same access-control slot as Warpgate (#5) in one edition, and at 9k with heavy 2026 coverage it is drifting toward obvious. Added to the queue.
rustic-rs/rustic
rustic-rs/rustic — VERIFIED ALIVE. A Rust reimplementation using restic's own repository format, so a reader would receive the same advice twice. Added to the queue; surface only if restic is ever marked dropped.
Coming tomorrow