Edition No. 55 · 19 Oct 2026
Test it, scrape it, run it on your own machine
Property-based testing, two ways to query a configuration file, a scraper you teach by example, and a database encryption proxy.
Refreshed on 19 October 2026. The repositories are the ones first published; any that are no longer maintained are left out.
Today's twelve include a test library that invents the inputs that break your code, a scraper you teach by pointing at one example, the engine that most "run a model on your own machine" products are built on, and two small command-line tools that let you query a configuration file the way you query JSON.
We aim for twelve every day. Some candidates fall out while we check them — those are listed at the end, with the reason.
If you only do three things
- HypothesisWorks/hypothesis — half an hour, on tests that already exist. You keep your test runner. You add a decorator and a description of what kind of data your function accepts, and Hypothesis tries hundreds of values looking for one that breaks it. When it finds one, it keeps cutting the example down until it is as small as it can be. That small example is usually the bug report you would have written by hand.
- kislyuk/yq 💎 — two minutes, and it is also one of today's hidden gems. If you already know
jqfor JSON, this gives you the same thing for YAML, XML and TOML files. Onepip installand the configuration files you edit by hand become something you can query and change from a script. - future-architect/vuls — one afternoon, and then it runs on a schedule. It logs into Linux machines over SSH, lists the software installed on each, and tells you which of those versions have publicly reported security holes. Nothing is installed on the machines being scanned. ---
Every link in one place
| # | Repository | Official site | Stars | Licence |
|---|---|---|---|---|
| 1 | HypothesisWorks/hypothesis | hypothesis.works | 8,939 | MPL-2.0 |
| 2 | python/mypy | mypy-lang.org | 20.6k | MIT |
| 3 | wntrblm/nox 💎 | nox.thea.codes | 1,560 | Apache-2.0 |
| 4 | scrapy/scrapy | scrapy.org | 64.5k | BSD-3-Clause |
| 5 | PrefectHQ/prefect | prefect.io | 23.8k | Apache-2.0 |
| 6 | alirezamika/autoscraper | none listed | 8,057 | MIT |
| 7 | ggml-org/llama.cpp | llama.app | 131.7k | MIT |
| 8 | EleutherAI/lm-evaluation-harness | eleuther.ai | 14,153 | MIT |
| 9 | future-architect/vuls | vuls.io | 12.3k | GPL-3.0 |
| 10 | cossacklabs/acra 💎 | cossacklabs.com/acra | 1,492 | Apache-2.0 (Community Edition) |
| 11 | kislyuk/yq 💎 | kislyuk.github.io/yq | 2,963 | Apache-2.0 |
| 12 | TomWright/dasel | daseldocs.tomwright.me | 8,007 | MIT |
Test it, scrape it, run it on your own machine
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
9.1k stars · MPL-2.0 · v6.170.2 (2026-10-19) · Track this in Scout · Share this tool
A Python library that generates test inputs and reduces any failure to the smallest example that still fails.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You add one decorator to an existing test function and say what kind of data it takes. Hypothesis then builds examples from that description — integers, text, lists, dates, dictionaries, or combinations you define yourself. It runs your test once per example, by default around a hundred times per test. When a test fails, it starts shrinking: it removes list items, lowers numbers and shortens strings until any further simplification makes the test pass again. It also remembers failures between runs in a local database file, so a case that broke yesterday is tried first today. It plugs into pytest and unittest rather than replacing them, and it can also check that a sequence of method calls on an object never reaches a bad state. It does not test a running website or an API over the network, it does not measure how fast your code is, and it is Python only.
Why it matters
Who it suits. Anyone who writes code that parses, converts or validates data and has no colleague to review it. Encoders, date handling, money arithmetic, anything with string input, anything where the awkward case is the one you did not think of. It fits well where a bug is cheap to find and expensive to ship. Skip it if your code mostly calls other services, because the interesting failures there are in the network and not in the inputs.
Verdict. Worth half an hour, and it is the rare testing tool that pays back on the first afternoon. The thing that makes it worth the time is not the random inputs, it is the shrinking: a failure arrives as a two-character string rather than a six-kilobyte blob, so you can read it. The real cost is thinking clearly about what your function actually accepts, which is work, and it is also most of the benefit. Two meters to set honestly: it will slow your test suite down, because a hundred runs take longer than one. Keep it on the tests where inputs vary and leave your plain examples alone. Version 6.170.1 landed on 16 October 2026 and code was pushed on 31 August 2026. For other languages, dubzzz/fast-check does the same job in JavaScript and proptest-rs/proptest in Rust.
- The shrinking is the feature, and almost nothing else does it as well.
- Works inside pytest and unittest, so nothing has to be rewritten.
- Remembers past failures locally and retries them first.
- Test suites get slower. A hundred examples per test is a hundred runs.
- A test can fail for a reason that is technically correct but of no interest, and tuning that out takes some reading.
- Python only. Other languages need the alternatives named above.
- dubzzz/fast-check
The same generate-and-shrink idea for JavaScript and TypeScript; smaller library, same approach, MIT licence.
Track this in Scout - proptest-rs/proptest
The Rust version, directly inspired by this project; its own README says it now sees mainly passive maintenance.
Track this in Scout 
schemathesis/schemathesisBuilt on Hypothesis, but aimed at web APIs: it reads an OpenAPI description and generates requests rather than function arguments.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install hypothesis pytest
20.7k stars · MIT · 2.4.0 (2026-10-01, from the Python package index) · Track this in Scout · Share this tool
The reference type checker for Python, run from the command line.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You add type annotations to your Python source. An annotation is a short note that says what kind of value a function takes and what kind it returns. Then you run mypy over the files, and it reads the code without running any of it, follows values from one function into the next, and prints each mismatch with a numbered error code. It knows the standard library, and it reads the type information that installed packages ship with themselves. Strictness is a dial: you can start with one file and no annotations and add one flag at a time, or turn on --strict and work through the list that comes back. It also ships mypyc, a compiler that turns annotated Python into a C extension module, which is how the checker itself is made fast. Release 2.4.0 was published on 1 October 2026, and code was pushed to the repository on 19 October 2026. It does not find mistakes in your logic, it does not check anything while a program is running, and it does not change the way the code is written.
Why it matters
Who it suits.
Anyone looking after a Python codebase of more than a few files, and above all one with several authors. The gain is largest at the edges of a program, where a value arrives from a web request, a file or a database and could be anything at all. It also suits a team that wants one place to settle an argument about what the typing rules actually say. Skip it if the project is a single script that can be read end to end, because writing the annotations will cost more than they return.
Verdict.
This is the reference implementation, and the typing rules for Python are written against it, so when two checkers disagree this is the one that settles it. It is also the slowest of the serious options, which matters if the checking is meant to happen while you type. Treat the choice as a pairing rather than a contest: one of the fast checkers in the editor, this one in the step that runs before code is merged. Edition 44 covered astral-sh/ty and Edition 47 covered facebook/pyrefly, both written in Rust and both much quicker, and microsoft/pyright is the one already built into Visual Studio Code. The project is plainly alive: code was pushed on 19 October 2026 and release 2.4.0 is three weeks old. One thing to read before redistributing it: the licence is MIT, but parts of the tree carry other licences.
- The reference checker, so its reading of an unclear rule is the one that counts.
- Switches on gradually. One file, one flag, one module at a time.
- Every error code is documented, so a confusing message can be looked up.
- Slow on a large codebase next to the checkers written in Rust.
- Some error messages take a few readings before they make sense.
- The licence is MIT, but parts of the tree carry other licences, including the Python Software Foundation licence.
- microsoft/pyright
A fast checker and language server, and the engine behind the Python experience in Visual Studio Code; a command-line tool as well, but editor-first in a way mypy is not.
Track this in Scout 
facebook/pyreflyA Rust checker and language server built for speed on large codebases, covered in Edition 47.
Track this in Scout
astral-sh/tyAnother Rust checker aiming at the same job with very fast runs, covered in Edition 44.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install mypy mypy your_module.py
1.6k stars · Apache-2.0 · 2026.08.17 (2026-08-18) · Track this in Scout · Share this tool
Runs your tests and other jobs in fresh isolated environments, described in an ordinary Python file.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You write a file called noxfile.py containing functions marked with a decorator. Each function is a session: a job nox will run inside a clean virtual environment it creates for you. A session can be parameterised over several Python versions, so one function becomes four runs. Inside a session you say which packages to install and which commands to run, using plain Python — loops, conditions and variables all work, because it is a program and not a configuration file. Running nox executes every session; nox -s tests runs one; nox -l lists them. It can use uv or conda to create the environments instead of the standard venv. Version 2026.8.17 landed on 18 August 2026 and code was pushed on 13 October 2026. It does not install Python versions for you, and it does not publish packages or build wheels on its own.
Why it matters
Who it suits. Anyone publishing a Python library that other people install, where "works on my machine" is not enough. Also anyone whose test, lint and documentation jobs have drifted into a pile of shell scripts nobody can read. Skip it if you ship a single application pinned to one Python version, because one virtual environment is all you need and nox adds a layer for nothing.
Verdict. Worth an hour to set up, and then it mostly disappears, which is the right behaviour for this kind of tool. The choice here is between nox and tox-dev/tox, and it is a genuine preference rather than a ranking: tox is older, more widely used and configured in an .ini file, while nox is configured in Python. If you have ever written a conditional into a tox file and found yourself fighting the format, nox is the answer to that specific frustration. If you prefer a declarative file that cannot surprise you, stay with tox. Pairs well with the test tools above: Edition 50 covered vitest-dev/vitest for the JavaScript side of the same problem. One caution: you still need the Python versions themselves on the machine, and that is the step people forget.
- Configuration is real Python, so a loop is a loop and a condition is a condition.
- Every session runs in a clean environment, so a test cannot pass because of something left over.
- Small, stable and quick to read. The whole idea fits on one page.
- It will not install Python 3.9 for you. You need the interpreters already present, which usually means another tool.
- Creating fresh environments is slow the first time, especially for several versions at once.
- Fewer worked examples online than tox, so an unusual setup means reading the source.
- tox-dev/tox
The older and more common tool for the same job, configured declaratively in a file rather than in Python.
Track this in Scout - pypa/hatch
A wider project manager that covers environments, testing, building and publishing, so it replaces more than nox does and takes more buying into.
Track this in Scout
pipx install nox
64.9k stars · BSD-3-Clause · 2.19.0 (2026-09-10) · Track this in Scout · Share this tool
A Python framework for fetching and parsing large numbers of web pages.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You create a project with scrapy startproject, then write a spider: a Python class with a list of starting addresses and a method that receives each page and returns either extracted data or more addresses to visit. Pages are fetched concurrently on an event loop, so hundreds can be in flight without threads. Selectors use CSS or XPath to pull values out of HTML. Middleware sits in the request and response path and handles cookies, retries, caching, user agents and proxies, and you can add your own. Pipelines take each extracted record and clean, validate or store it, with built-in export to JSON, JSON lines, CSV and XML. It reads robots.txt by default and has settings for delay between requests and concurrency per site. It does not run JavaScript on its own, so pages built in the browser need an extra component, and it is not a point-and-click tool.
Why it matters
Who it suits. Anyone who needs to collect structured data from thousands of pages on a repeating schedule, and who is comfortable writing Python. Price monitoring, research datasets, catalogue collection, link checking at scale. Skip it if you need twenty pages once, because a loop with requests will be finished before the project is set up, and skip it if every page you want is rendered by JavaScript, because you will spend your time on the browser layer instead.
Verdict. Still the sensible default for crawling at scale in Python, and the reason is unglamorous: the hard parts of crawling are retries, politeness, deduplication of addresses and not falling over on page four thousand, and those are the parts Scrapy has already solved and tested for years. Version 2.19.0 landed on 10 September 2026, so it is actively maintained rather than coasting. The newer tools in this space are easier to start with and give up less of your control than you might expect. Edition 25 covered apify/crawlee, which is the closest equivalent for JavaScript and now has a Python version too. Edition 33 covered D4Vinci/Scrapling, which is the one to look at if your difficulty is sites that actively block scrapers, and Edition 25 covered unclecode/crawl4ai for turning pages into text for a language model. Choose Scrapy when the job is volume and discipline.
- Concurrency, retries, caching and politeness are already built and already tested.
- Pipelines and middleware make a crawler extensible without forking it.
- Exports to JSON, CSV and XML with no extra code.
- A real framework, so you learn its shape before you get anything done.
- No JavaScript rendering on its own. Dynamic pages need a browser component added.
- Nothing in it helps with sites that deliberately block automated visitors.
apify/crawleeThe same job for Node.js and TypeScript, with browser automation built in rather than bolted on; covered in Edition 25.
Track this in Scout
D4Vinci/ScraplingAimed at pages that resist scraping and at selectors that keep working when a site changes its markup; covered in Edition 33.
Track this in Scout- MechanicalSoup/MechanicalSoup
Much smaller: it fills in and submits forms and follows links, with no crawling engine and no JavaScript.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install scrapy scrapy startproject mycrawler cd mycrawler scrapy genspider example example.com scrapy crawl example -O out.json
24k stars · Apache-2.0 · 3.8.8 (2026-10-06) · Track this in Scout · Share this tool
Adds scheduling, retries and a run history to Python functions you already have.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You put a @task decorator on a function and a @flow decorator on the function that calls it. That is the whole change to your code. Running the flow now reports every task's start, finish and result to a server, which you can run yourself with prefect server start. Failed tasks retry on a policy you set, with a delay between attempts. Flows can run on a schedule, on a cron expression, or when triggered. Tasks that do not depend on each other run concurrently, and results can be cached so a re-run skips work that already succeeded. The web interface shows each run as a timeline with logs and the exact error. Deployments describe where a flow runs — locally, in a container, or on a worker pool. It is Python only, it does not move or transform data by itself, and the self-hosted server has no built-in user accounts or permissions, which the project states plainly.
Why it matters
Who it suits. Anyone with a handful of Python jobs on a timer who currently has no idea whether last night's run worked. Report generation, data refreshes, backups that are really scripts, anything where silence looks the same as success. It suits people who want to keep writing ordinary Python rather than learning a pipeline description language. Skip it if one cron line and an email on failure already tell you what you need, because this is a server to run and keep running.
Verdict. Worth an afternoon, and the appeal is how little it asks of your existing code — two decorators, and you can take them off again. That is a real difference from the heavier orchestrators, where adopting the tool means rewriting your job as the tool's object. Version 3.8.8 landed on 6 October 2026. The caution is honest and comes from the project itself: run the open server behind something that handles authentication, because it does not do that for you. apache/airflow is the industrial choice with the largest ecosystem and the steepest start, and dagster-io/dagster is the one to look at if you think in terms of the datasets being produced rather than the steps being run. Edition 45 covered kestra-io/kestra for the same problem described in YAML instead of Python.
- Two decorators and your existing functions are orchestrated. Reversible in a minute.
- The run history and the error view answer "did it run, and what broke" immediately.
- Retries, caching and concurrency are configuration rather than code.
- The self-hosted server ships with no accounts or permissions. Put it behind a proxy that has them.
- It is a server and a database to keep alive, which is more to maintain than a cron line.
- Python only, and the major versions have broken things before, so read the upgrade notes.
- apache/airflow
The long-established platform for the same job, with the widest set of connectors and a much larger setup; workflows are written as code but in Airflow's own shape.
Track this in Scout - dagster-io/dagster
Organised around the data assets being produced and their lineage, rather than around the steps that run.
Track this in Scout 
kestra-io/kestraThe same problem described in YAML files, so the jobs need not be Python at all; covered in Edition 45.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install prefect prefect server start # leave this running; the interface is on port 4200
8.1k stars · MIT · v1.1.14 (2022-07-17) · Track this in Scout · Share this tool
A Python scraper that learns what to extract from one example you give it.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You create a scraper object, pass it a page address and a list of wanted values — the actual text you can see on the page, not a selector. It fetches the page, finds where each value sits, and records the shortest reliable rule for getting back to it. Call get_result_similar on another address and it applies the same rules there, which is how you turn one example into a list page. Rules can be saved to a file and loaded later, so the learning happens once. The whole library is a few hundred lines on top of requests and BeautifulSoup, with no browser and no framework. It does not run JavaScript, it has no crawling engine, no scheduling, no retry policy and no rate limiting — if you need those, they are yours to write around it.
Why it matters
Who it suits. Anyone who wants a specific value off a few hundred similar pages and does not want to spend the evening in the browser inspector. Price checks, directory listings, a table that one site publishes and nobody else does. It is a good fit for someone who is not a professional programmer, because the thing you have to supply is an example rather than a selector. Skip it if the pages are built by JavaScript, if you need thousands of pages fetched politely, or if the site changes its markup often, because a learned rule breaks silently when the page moves.
Verdict. Genuinely clever, genuinely small, and genuinely not maintained in the way the word usually means — so judge it on both halves. The last release on the Python package index is 1.1.14 from 17 July 2022, while code was last pushed to the repository on 29 July 2026. That gap is a real warning and it is also not the same as abandonment: the library is small enough and depends on little enough that it keeps working. Read it as a sharp tool with no support rather than a dead one. Use it for the first draft of a scrape, and if the job turns out to matter, move to scrapy/scrapy above. Edition 6 covered adbar/trafilatura for the related but different job of pulling the article text out of a page, and Edition 36 covered omkarcloud/botasaurus for scraping with a real browser.
- You supply an example, not a selector. That removes the hardest step for a non-programmer.
- Learned rules save to a file, so the pattern is reusable and inspectable.
- Tiny. Two dependencies, and you can read the whole thing in an hour.
- No release since July 2022. Code was pushed in July 2026, but nothing is being shipped.
- No JavaScript, no crawling, no rate limiting, no retries. You build all of that yourself.
- A learned rule can keep returning the wrong thing after a page changes, with no error.
scrapy/scrapyThe full framework for the same data at much larger volume, with retries and politeness built in; you write selectors yourself.
Track this in Scout- MechanicalSoup/MechanicalSoup
Handles cookies, forms and link-following for pages behind a login, which this cannot do; no learning from examples.
Track this in Scout 
adbar/trafilaturaExtracts the main article text and metadata from any page without being taught, which is a different job: whole articles rather than chosen fields. Covered in Edition 6.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install autoscraper
131.7k stars · MIT · v0.7.0 (2026-10-15) · Track this in Scout · Share this tool
A C and C++ library and command-line tool for running language models locally.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It loads a model stored in the GGUF file format and runs it on the processor, with optional help from a graphics card. There is a command-line tool for a single prompt or an interactive chat, and a local server that answers over HTTP with a familiar request format, so existing client code can point at it. Quantisation is the central idea: a model's numbers are stored at reduced precision, which cuts the memory needed by a large factor in exchange for some accuracy, and several levels are available. It supports Apple Silicon, CUDA, Vulkan, ROCm and plain processors, and it will split a model between graphics memory and main memory when the card is too small. A library interface lets other programs embed it, which is what most of the local-model applications do. It does not have a model catalogue or a graphical interface, it does not train or fine-tune models, and it will not choose a model for you.
Why it matters
Who it suits. Anyone who wants a language model running on hardware they control, with no outside service in the path, and who is willing to read about file formats and memory. Also anyone building a product that needs local inference inside it, since the library is the point. Skip it if you want to type one command and chat, because the friendlier wrappers exist for exactly that reason.
Verdict. This is the foundation, and that is both the recommendation and the warning. Edition 42 covered ollama/ollama, Edition 52 covered janhq/jan and mudler/LocalAI, and the easy experience those give you is built on the work in this repository. Come here when you want control the wrappers do not give you: a specific quantisation, a build tuned to your hardware, or an embedded library rather than a background service. The project moves very fast, with tagged builds most days, and the newest tag could not be read from the releases page today — code was last pushed on 5 October 2026, so currency is not in question. Build from a tag rather than from the tip if you want the same behaviour next month. For serving many users at once on server graphics cards, vllm-project/vllm is the better-suited engine.
- Runs on ordinary hardware, including machines with no graphics card at all.
- Quantisation levels let you trade accuracy for memory in steps you choose.
- A real library, so other software can embed it rather than shelling out to it.
- You find, download and choose the model file yourself. That is the part beginners get wrong.
- It changes daily, and build flags and option names have moved before.
- Memory is the hard limit. A small model wants roughly 4 to 8 GB; a large one wants far more.
ollama/ollamaWraps this engine with a model catalogue, one-command pulls and a background service; far easier, less control. Covered in Edition 42.
Track this in Scout
vllm-project/vllmBuilt for serving many simultaneous requests on server graphics cards rather than for running one model on a laptop.
Track this in Scout
mudler/LocalAIA self-hosted service that puts a familiar API in front of several engines, including this one, and covers images and audio too. Covered in Edition 52.
Track this in Scout
brew install llama.cpp
14.3k stars · MIT · v0.4.13 (2026-08-31) · Track this in Scout · Share this tool
Runs standard question sets against a language model and reports the scores.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You name a model and a list of tasks, and it runs each task's questions through the model and scores the answers. Several hundred task definitions ship with it, covering reasoning, reading comprehension, mathematics, factual recall and more, and each one carries the exact prompt format and scoring rule in a YAML file. It can drive a model loaded locally through Hugging Face Transformers, one served over HTTP by an API, or one running under a serving engine. Few-shot evaluation is built in: you set how many worked examples go into the prompt, which is how published figures are usually produced. Results come back as a table and as JSON, with the number of questions and a standard error for each score. Adding your own task means writing a YAML file, not code. It does not judge open-ended writing quality, it does not test an application built around a model, and it is slow by nature.
Why it matters
Who it suits. Anyone choosing between models or quantisation levels for something they run themselves, and anyone who needs a number they can defend rather than an impression. It is the right tool for the question "if I drop to the smaller file, what do I lose?". Skip it if what you are testing is a product built on a model, because the thing that breaks there is your prompt and your retrieval, not the model's score on a reasoning set.
Verdict. Worth the setup if you make model choices more than once, because the alternative is trying a few prompts and trusting a feeling. The honest caveat is cost: a full run on a sizeable task set can take hours and pin your graphics card, so pick two or three tasks that match what you actually do rather than running everything. Version 0.4.13 landed on 31 August 2026 and code was pushed on 14 September 2026. Pair it with the application-level tools rather than choosing between them: Edition 45 covered confident-ai/deepeval and Edition 26 covered promptfoo/promptfoo, both of which test the thing you built rather than the model underneath it, and Edition 27 covered huggingface/lighteval for a lighter take on this same job. Use this one for the model, those for the product.
- The task definitions are the ones published figures use, so your score is comparable.
- Works against a local model, an HTTP API or a serving engine without changing the task.
- New tasks are YAML files, so a domain-specific question set needs no Python.
- Slow and hungry. A serious run is hours of compute, not minutes.
- Scores move with prompt formatting and few-shot count, so two runs are only comparable if the settings match exactly.
- It measures nothing about the application you wrapped around the model.
huggingface/lightevalThe same job with a smaller surface and several backends, easier to start with and covering fewer tasks. Covered in Edition 27.
Track this in Scout
confident-ai/deepevalTests the application you built on a model, in the shape of ordinary unit tests, rather than scoring the model itself. Covered in Edition 45.
Track this in Scout
promptfoo/promptfooCompares prompts and models against your own cases from a configuration file, aimed at product decisions rather than published benchmarks. Covered in Edition 26.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install lm-eval
12.3k stars · GPL-3.0 · v0.42.0 (2026-10-15) · Track this in Scout · Share this tool
Scans Linux machines over SSH for installed software with publicly reported security holes.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You list the machines to scan in a configuration file with their SSH details. Vuls connects, reads the package list from the system's own package manager, and compares each version against vulnerability records it has downloaded in advance. Those records come from the public vulnerability database and from each Linux distribution's own security advisories, which is what lets it tell a real problem from one the distribution has already patched. It covers Red Hat, Ubuntu, Debian, Amazon Linux, SUSE, Alpine and FreeBSD, and it also reads programming-language dependency files and WordPress installations. Results are a report you can read in the terminal, with a severity score and a link for each finding, and it can post them to chat or email. Because it works over SSH and reads only the package list, there is no agent to install and no process left running on the scanned machine. The databases must be fetched first by separate companion tools, and that is the part of the setup people underestimate. It does not patch anything, it does not scan container registries, and it is Linux and FreeBSD only.
Why it matters
Who it suits. Anyone responsible for a handful of Linux machines who currently finds out about a security hole by reading the news. It is the right shape for a small team with no security budget: one scheduled job, one report, no agent on every box. Skip it if everything you run is in containers rebuilt from a fresh base image on every deploy, because then the image scanners are the better fit and the running machine barely matters.
Verdict. Worth an afternoon, with the honest warning that the afternoon is mostly spent on the vulnerability databases rather than on the scanner. Once past that it is genuinely low-effort: a scheduled run and a report. Version 0.42.0 landed on 15 October 2026, so it is in active maintenance. Where it sits against what the radar has already covered is the useful part. Edition 42 covered aquasecurity/trivy and Edition 39 covered anchore/grype, and both are aimed primarily at container images and filesystems; Edition 52 covered pypa/pip-audit for Python dependencies alone. Vuls answers a question those do not: what is installed on this long-running machine right now. If you run containers, start with Trivy. If you run servers that stay up for months, start here.
- No agent. It reads the package list over SSH and leaves nothing behind.
- Uses each distribution's own advisories, so it does not shout about holes already patched.
- Covers language dependency files and WordPress as well as system packages.
- The vulnerability databases must be fetched and kept fresh by separate tools first. This is the real setup cost.
- The configuration file is fiddly, and getting SSH access right across several machines takes care.
- Linux and FreeBSD only, and it reports rather than fixes.
aquasecurity/trivyScans container images, filesystems and code repositories for vulnerabilities, misconfigurations and secrets; broader, and aimed at the build rather than the running machine. Covered in Edition 42.
Track this in Scout
anchore/grypeA focused vulnerability scanner for container images and filesystems, quick to run in a build step. Covered in Edition 39.
Track this in Scout- quay/clair
Runs as a service that analyses container images as they arrive in a registry, rather than as a command you call.
Track this in Scout
The quickest honest path is the project's own container images, which avoid building the Go programs yourself.
1.5k stars · Apache-2.0 (Community Edition) · 0.96.0 (2024-09-09) · Track this in Scout · Share this tool
A proxy that encrypts individual database fields on the way in and decrypts them on the way out.
▶Repo detailsthe review · specs · pros & cons · install
What it does
AcraServer stands between your application and PostgreSQL or MySQL and speaks their wire protocols, so to the application it looks like the database and to the database it looks like a client. You tell it which tables and columns are sensitive, and it encrypts those values as they are written and decrypts them as they are read, for clients that hold the right keys. It can also do the encryption inside the application instead, through client libraries, so values are already encrypted before they leave the process. On top of that it offers searchable encryption, where an exact-match lookup still works on an encrypted column, masking and tokenisation, and it logs queries so unusual access patterns can be spotted. Keys are managed separately from the data, with rotation. It does not encrypt a whole database file, which is what a disk-level feature does, and it does not support every database — PostgreSQL and MySQL are the supported ones. It is also not a secrets manager for application credentials.
Why it matters
Who it suits. Anyone storing personal data in PostgreSQL or MySQL who needs a specific answer to "what happens if the database is copied", and who cannot change the application much. It fits a small team facing a compliance question with no budget for a commercial product. Skip it if whole-disk encryption already satisfies your requirement, because this adds a service in the data path for protection you may not need, and skip it if your database is not one of the two supported.
Verdict. A small project doing a serious thing, and the reason it earns a place is that field-level encryption with searchable columns is rare in open source — most of the alternatives are either narrower or commercial. Be clear-eyed about three things. It is open-core: the Community Edition is Apache-2.0, and the company sells an Enterprise Edition with features held back, so read what is in which before building on it. The last tagged release is 0.96.0 from 9 September 2024, while code was pushed on 23 April 2026, so development continues without shipping, which is a gap worth knowing about. And a proxy in the data path is a new thing that can fail, so test what happens when it does. If the problem is secrets rather than stored records, Edition 50 covered Infisical/infisical and Edition 24 covered getsops/sops, both of which solve that instead.
- Speaks the PostgreSQL and MySQL wire protocols, so the application often needs no rewrite.
- Searchable encryption keeps exact-match lookups working on encrypted columns.
- Keys live apart from the data and can be rotated.
- Open-core. The Community Edition is Apache-2.0 and some features sit in a paid edition.
- Last tagged release September 2024, with code pushed April 2026. Active, but not shipping.
- A proxy in the path between application and database is one more thing that can break, and it costs some latency.
- michelp/pgsodium
Encryption inside PostgreSQL itself as an extension, so there is no proxy; smaller in scope and no searchable encryption or query logging.
Track this in Scout - openbao/openbao
Stores and hands out secrets, certificates and keys, and can encrypt values on request; a different job, and the right one if what you need is key custody rather than a database proxy.
Track this in Scout 
getsops/sopsEncrypts values inside configuration files rather than inside a database, for secrets kept in version control. Covered in Edition 24.
Track this in Scout
git clone https://github.com/cossacklabs/acra cd acra ls examples
3k stars · Apache-2.0 · v4.4.5 (2026-10-11) · Track this in Scout · Share this tool
A wrapper that lets `jq` read and write YAML, XML and TOML as well as JSON.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It converts the input document to JSON, runs your jq expression over it, and converts the result back. Three commands are installed: yq for YAML, xq for XML and tomlq for TOML. The jq expression syntax is unchanged, so anything you already know works. By default it prints JSON; -y prints YAML and -t prints TOML, which is what you want when editing a file in place rather than reading from it. It handles multi-document YAML files, the kind with --- between sections, and it preserves comments and key order on round trips when you ask it to. Because it is a thin layer, every jq feature is available, including functions, variables and --arg. It needs jq installed separately and it is a Python program, so starting it is slower than starting a compiled tool. It does not implement a query language of its own.
Why it matters
Who it suits. Anyone who already uses jq and keeps hitting YAML files — container definitions, continuous integration configuration, infrastructure descriptions. The appeal is not learning anything new. Skip it if you have never used jq, because then you are learning a query language anyway and the compiled alternative below is the better place to start.
Verdict. Two minutes to install, and then it quietly removes a daily annoyance, which is why it is one of today's three. The decision is between this and mikefarah/yq, which Edition 41 covered, and the rule is simple. If you already know jq and want exactly that syntax, this one. If you want a single compiled program with no dependencies and do not mind a dialect that is close to jq but not identical, that one — and it is the better choice inside a container image, where a Python runtime and a separate jq are two installs you did not want. Version 4.3.0 landed on 26 September 2026 and code was pushed on 11 July 2026. With 2,963 stars against the other one's 15.9k it is the quieter option, and the difference is distribution rather than quality.
- Real
jqsyntax, not an imitation. Everything you know transfers. - Three commands for YAML, XML and TOML, with one mental model.
- Round-trips back to YAML or TOML, so it edits files as well as reading them.
- Needs
jqinstalled separately. Two things to get onto a machine instead of one. - A Python program, so each invocation starts slower. Noticeable inside a loop.
- Quieter project and fewer examples online than the compiled alternative.
mikefarah/yqA single compiled program for YAML, JSON, XML, CSV and TOML with no dependencies, using a syntax close to jq but its own; the better fit inside a container image. Covered in Edition 41.
Track this in Scout- jqlang/jq
The JSON processor this wraps, and the reason the syntax is worth learning once.
Track this in Scout 
TomWright/daselCovers more formats with one selector language of its own design, rather than reusing jq.
Track this in Scout
# macOS brew install jq # Debian or Ubuntu sudo apt install jq
8k stars · MIT · v3.11.2 (2026-06-27) · Track this in Scout · Share this tool
One command-line program that queries and edits eight structured file formats with a single selector syntax.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a file and a selector, and it returns the value. Selectors are dotted paths with index and filter forms, such as .users.[0].name or .users.all().name. The same selector works whatever the input format, because it parses the file first and queries the result. It writes as well as reads: dasel put sets a value, dasel delete removes one, and -w chooses the output format, which is how it converts between them. Formats covered are JSON, YAML, TOML, XML, INI, HCL, KDL and CSV. It is a single static binary with no runtime to install, which makes it easy to drop into a container image or a build step. Version 3.11.2 landed on 27 June 2026. The selector language is its own, so jq expressions do not work, and it is not a general transformation tool — complex reshaping is where it runs out.
Why it matters
Who it suits. Anyone writing scripts that touch several configuration formats, especially inside build steps and container images where installing a Python runtime is unwelcome. Also anyone who regularly needs to turn a YAML file into JSON or the reverse. Skip it if jq already covers everything you do, because a second selector language is a real cost for no gain.
Verdict. Worth the download if your scripts touch more than two formats. The honest comparison is against the two tools above it. kislyuk/yq reuses jq syntax exactly and needs jq and Python; mikefarah/yq, covered in Edition 41, is a single binary with a syntax close to jq; dasel is a single binary with a syntax of its own and the widest format coverage, including INI, HCL and KDL, which neither of the others handle. Judge it on formats and on dependencies rather than on quality — all three are good. Code was last pushed on 27 June 2026, four months ago, which is normal for a tool this finished and not a cause for concern. For plain JSON searching with grep, tomnomnom/gron solves a related problem in a completely different way.
- A single static binary. Nothing to install alongside it, which matters in a container image.
- Eight formats, including INI, HCL and KDL that the alternatives do not cover.
- Writes and converts as well as reads, so it edits configuration in place.
- Its own selector language. If you know
jq, you are learning a second one. - Complex reshaping is beyond it. It reads and edits well; it does not transform deeply.
- Fewer users than
jqor the mainyq, so searching for an unusual case finds less.
- mikefarah/yq
A single binary covering YAML, JSON, XML, CSV and TOML with a jq-like syntax; narrower on formats, far more widely used. Covered in Edition 41.
Track this in Scout 
kislyuk/yqReuses real jq syntax by converting to JSON and back, at the cost of needing jq and Python present.
Track this in Scout- tomnomnom/gron
Flattens JSON into one assignment per line so ordinary grep can search it, then turns it back; a different answer to the same frustration.
Track this in Scout
brew install dasel
Checked, and left out
Nothing to show for this edition. Recording the repositories that were checked and rejected began with Edition No. 4, and every edition from there on has the list.
Know a repository we should check?
Coming tomorrow