Silence is not the same as working

01

louislam/uptime-kuma

91.1k stars · MIT · 2.5.3 (2026-08-22) · Track this in Scout · Share this tool

Self-hosted uptime monitor with alerts and a status page — find out the site is down before a visitor does.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You run it as one container — a container is a way of running a program inside its own sealed box, so it cannot disturb anything else on the machine. You then add monitors through a web form. A monitor can be a web address, a plain network port, a DNS record, a database, a container, or a TLS certificate, which is the file that makes the padlock appear in a browser. Each monitor has its own interval, its own retry count and its own history of response times. When a check fails it sends a message through one of more than ninety channels, including Telegram, email, Slack and ntfy (#4). It also publishes a status page, which is a public page saying what is up and what is not. What it does not do is tell you why something broke: there are no logs, no traces and no measurements from inside the program being watched.

Why it matters

Who it suits. Anyone responsible for a site or a service that other people reach over the internet, and who currently finds out about an outage because somebody mentions it. It suits a small team especially well, because the whole setup is a form rather than a configuration language. It also suits anyone who has ever been caught by an expiring certificate, because it watches those too. Skip it if the service is already covered by a monitoring system that checks availability from outside, because this would be a second alarm for the same event.

Verdict. Worth fifteen minutes, and it is the easiest recommendation in this edition. Two things to settle on the first day. First, do not run it on the only machine it watches: if that machine dies, the monitor dies with it and nobody is told. A second small host, or the free tier of a hosted checker alongside it, is the honest answer. Second, set the retry count and the interval deliberately, because a monitor that cries wolf is ignored within a fortnight. Edition 5 covered henrygd/beszel, which measures processor, memory and disk on a machine; it will say the machine is at 92% memory and never that the page is returning an error, which is the gap this fills. TwiN/gatus is the better choice if you would rather keep the checks in a file in version control than in a web form.

Stars91.1k

LicenceMIT

Latest2.5.3 (2026-08-22)checked 7 Sep 2026

Written inJavaScript

NeedsDocker Compose and Docker

RunsSelf-hosted on your own server

Setup effort

1 / 5

Payoff

5 / 5

Good

• One container and a web form, with no configuration file to learn.
• More than ninety notification channels, so the alert reaches a person rather than a dashboard.
• It watches certificates and plain ports as well as web pages, which catches the expiry a week early.

Watch for

• Run on the machine it monitors, it fails at the same moment as the thing it is watching.
• It checks from one place, so it cannot tell that a site is unreachable from another country.
• It says that something is down, never why; that needs a different tool.

Replaces

There is a second use worth as much: watching your TLS certificates and your PostgreSQL port, which is how you find out about the expiring certificate a week early instead of on the morning it breaks.

Install

docker run -d --restart=always -p 3001:3001 \
  -v uptime-kuma:/app/data --name uptime-kuma \
  louislam/uptime-kuma:2

⧉

Screenshots

02

bugsink/bugsink

💎 hidden gem

2.1k stars · PolyForm Shield 1.0.0 — source-available, NOT OSI open source · 2.5.1 (2026-08-31) · Track this in Scout · Share this tool

Sentry-compatible self-hosted error tracking, small enough to run beside everything else.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You run it as one container and point an application at it. It accepts reports from the ordinary Sentry client libraries — Sentry is the best-known error-tracking service, and its libraries exist for most languages — so the change in an application is one address, called a DSN. Each report arrives with a stack trace, which is the list of function calls that led to the failure, plus the address of the page, the browser and a count of how often the same error has occurred. Errors are grouped so that one problem hit a thousand times is one item, not a thousand. It is deliberately small: one process, with no queue, no worker fleet and no search cluster behind it. What it does not do is the rest of what a monitoring platform does — no session replay, no performance traces, no measurements. It also does not pretend to be fully open: the main tree is PolyForm Shield 1.0.0, and the ee/ folder carries its own separate terms.

Why it matters

Who it suits. Anyone running an application that strangers use unattended, who would rather host the error reports themselves than send them to a third party. It suits regulated or privacy-conscious work especially well, because the stack traces often contain fragments of real data and here they never leave the building. Skip it if you already pay for a hosted tracker and are happy, because the saving is in hosting rather than in features.

Verdict. Worth an hour to stand up, and the escape route is the best thing about it: because it speaks the Sentry protocol, moving away later is a change of address rather than a rewrite. Read the licence first and decide deliberately. PolyForm Shield 1.0.0 permits running it for a business and forbids using it to build a competing error-tracking product, which is irrelevant to most work and fatal to some, and it means this is a dependency that cannot be forked if the terms ever change. Two practical notes. The quickstart creates an administrator account with the password admin, so change it before the port is reachable from anywhere else, and the secret key it asks for must be a genuinely random string of at least fifty characters. Then mute the noisy errors in the first week, or it becomes another unread dashboard. getsentry/sentry is the full platform if you want everything and can run it; this is the small one that fits beside other things.

Stars2.1k

LicencePolyForm Shield 1.0.0 — source-available, NOT OSI open source

Latest2.5.1 (2026-08-31)checked 7 Sep 2026

Written inPython

NeedsDocker

RunsSelf-hosted on your own server

Setup effort

2 / 5

Payoff

4 / 5

Good

• The Sentry client libraries, their documentation and their examples all transfer, and so does the way out.
• One process against an ordinary database, with no queue or worker cluster to operate.
• It catches the failure the visitor saw and the failure on the server in one timeline.

Watch for

• PolyForm Shield 1.0.0 is source-available, not open source, and the ee/ folder is licensed separately again.
• Two thousand stars and a small company behind it, so the exit route matters more than usual.
• The quickstart's administrator password is admin, and the README does not say which databases are supported — that is in the separate installation documentation.

Install

docker run \
  -e SECRET_KEY=PUT_AN_ACTUAL_RANDOM_SECRET_HERE_OF_AT_LEAST_50_CHARS \
  -e CREATE_SUPERUSER=admin@example.org:admin \
  -e PORT=8000 \
  -p 8000:8000 \
  bugsink/bugsink

⧉

Screenshots

03

janreges/siteone-crawler

💎 hidden gem

896 stars · MIT · v2.5.1 (2026-06-27) · Track this in Scout · Share this tool

One command, one HTML report: broken links, redirects, titles, descriptions, image weight, response times.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You give it a web address and it walks the site, recording every page and every asset with its status code, response time, size, headers and title. It can also start from a sitemap or a list of addresses instead of following links. It then reports on broken links, redirects, SEO, security headers, accessibility and performance, and gives a score out of ten in five categories. The output can be a self-contained HTML report, JSON, or coloured text, and a built-in mailer can send the report by email. It also exports a working offline copy of a site, converts a site to Markdown files, generates sitemaps, runs a simple load test, and exits with a failure code when a quality threshold is missed, which is what makes it usable in an automated build. Pages that need JavaScript are rendered in Chromium when the browser option is used; since version 2.5.1 the browser support is in the ordinary downloaded binaries. Since first publication the project has been rewritten in Rust, and its own page claims 25% faster execution and 30% lower memory use than the previous version while producing identical output. What it does not do is fix anything, and in sitemap-only mode it does not discover links beyond that sitemap.

Why it matters

Who it suits. Anyone who looks after a site of more than a few dozen pages and has no idea how many of its links still work. It suits a documentation site particularly well, because missing titles and descriptions are exactly what stops pages being found. It also suits anyone who wants an archived copy of a site before a redesign, which is one command here. Skip it if the site is three pages long, because reading them is faster.

Verdict. Worth an hour, and the report is worth handing straight to whoever makes the fixes. The practical change since this edition first ran is the install: Homebrew and the Linux package repositories now carry it, so there is no longer any need to fetch a file from a releases page. Published limits are worth knowing before the first run: it defaults to three workers and ten requests a second, and it stops at 9,000 queued and 10,000 visited addresses, so a very large site needs those raised. The musl build, which is the one that runs on older Linux systems, is 50 to 80% slower during the export features. Edition 2 covered harlan-zw/unlighthouse, which answers one question well — how each page scores in a browser performance audit — and says nothing about dead links. Use lycheeverse/lychee instead if link checking on every deploy is all that is wanted.

Stars896

LicenceMIT

Latestv2.5.1 (2026-06-27)checked 7 Sep 2026

Written inRust

NeedsRust and cargo and ffmpeg

RunsLocally, on your own machine

Setup effort

1 / 5

Payoff

4 / 5

Good

• MIT licensed, a single program with no runtime to install, on macOS, Linux and Windows.
• One pass covers the unglamorous checks: broken links, redirect chains, titles, descriptions, image weight, response times.
• The offline export, the Markdown export and the sitemap generator are genuinely useful side effects.

Watch for

• Fewer than a thousand stars and essentially one maintainer, so it is a tool to run rather than a dependency to build on.
• It reports and fixes nothing; the report is worth only the time spent acting on it.
• The queue caps and the three-worker default have to be raised by hand for a large site, and the musl build is much slower on the export features.

Install

brew install janreges/tap/siteone-crawler

⧉

Screenshots

04

binwiederhier/ntfy

34.1k stars · Apache-2.0 · v2.28.0 (2026-08-27) · Track this in Scout · Share this tool

Push notification to your phone from one line of curl — the missing last step of every alert and long job in this ledger.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You send an HTTP POST to a topic address, and the message appears as a notification on every device subscribed to that topic. There is a free public server at ntfy.sh and the same software can be run privately as one small program written in Go. Mobile applications exist for both phone platforms, and a browser can subscribe too. Messages carry a title, a priority, tags, a click action and file attachments, and a message can be scheduled for later. The private server can require accounts and restrict who may read or write each topic, store messages for a chosen period, and since version 2.30.0 it has an experimental mode in which several servers share one PostgreSQL database — the release notes say that mode is not ready for production. What it does not do is deliver anything by itself: it is the last step of somebody else's script, not a scheduler, a monitor or a workflow tool.

Why it matters

Who it suits. Anyone with scripts, backups, long builds or monitors whose results currently end in an email that gets read tomorrow. It suits the owner of a small server best of all, because wiring a shell script to a phone is otherwise a surprising amount of work. Skip it if the team already lives in a chat tool with webhooks, because the notification probably belongs in the channel people are already reading.

Verdict. Two minutes well spent, and the thing it fixes is real: a monitor that writes to a dashboard nobody opens has not told anyone anything. louislam/uptime-kuma (#1) has it as a built-in notification target, so connecting the two is a dropdown rather than a project. The caution is the public server: a topic name there works as the password, so anyone who guesses it can read the messages or post to it. Use a long random topic name, and move to a private server before anything sensitive goes through it. Self-hosting is one small program, although reliable notifications on iPhones are the fiddly part of an otherwise trivial setup. caronc/apprise is the better answer if the goal is to send to many different services rather than to run one.

Stars34.1k

LicenceApache-2.0

Latestv2.28.0 (2026-08-27)checked 7 Sep 2026

Written inGo

RunsSelf-hosted on your own server

Setup effort

1 / 5

Payoff

4 / 5

Good

• curl -d "message" ntfy.sh/your-topic is the whole integration, from any language or shell.
• Self-hosting is one small Go program, with optional accounts and per-topic permissions.
• Attachments, priorities, tags and scheduled delivery are all built in.

Watch for

• On the public server the topic name is the only secret, so a guessable name is an open channel.
• Reliable delivery to iPhones is the hard part of running a private server; the Android path is much smoother.
• Notifications are easy to overuse. Three topics are useful and thirty are noise.

Install

curl -d "ingest finished: 412 rows" \
  ntfy.sh/a-long-random-topic-name

⧉

Screenshots

05

egbertbouman/youtube-comment-downloader

💎 hidden gem

1.3k stars · MIT · 0.1.83 (2026-07-30) · Track this in Scout · Share this tool

Every comment under any YouTube video as JSON — no key, no quota. The complaints under competitors' tutorials are your next ten video titles.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You give it a video address or a video id and it writes the comments to a file, one JSON object per line, with the text, the author, the timestamp, the number of likes and the replies. Output can also be ordinary JSON, comma-separated or semicolon-separated values. You can cap the number of comments, choose between the most popular and the most recent, and set the language used for automatically generated text. It works as a command and as a library you call from Python. It does not use the official YouTube interface, so there is no key to obtain, no consent screen and no daily quota to spend. What it does not do is anything else: no video details, no channel statistics, no transcripts, and no promise that the route it uses will keep working.

Why it matters

Who it suits. Anyone who wants evidence about an audience rather than an opinion about one — somebody planning what to write or film next, somebody checking which part of a subject confuses people, somebody studying a public conversation. Reading the comments under the twenty most-watched videos in a subject takes an evening and the same six complaints appear in different words every time. Skip it if the work needs the official interface's guarantees, because this one has none.

Verdict. Still the sharpest cheap research tool in this archive, and still the same version it was when first published: 0.1.83 on PyPI, dated 30 July 2026, with no code since. For something this small that is closer to finished than to neglected, but it is worth knowing before depending on it. Two warnings. It uses an endpoint that was never meant for this, so run it from an ordinary machine rather than a data-centre address, where the blocks land first. And comment sections are mostly noise, so expect to discard most of what comes back, which is the job entry 7 exists for. One thing this project illustrates nicely: its GitHub releases page stopped in August 2025 and looks abandoned, while PyPI shows a release from July 2026. For a Python package, believe the package registry. Edition 5 covered jdepoix/youtube-transcript-api, which is the same shape of tool for what was said in the video rather than under it.

Stars1.3k

LicenceMIT

Latest0.1.83 (2026-07-30)checked 7 Sep 2026

Written inPython

RunsLocally, on your own machine

Setup effort

1 / 5

Payoff

5 / 5

Good

• No key, no consent screen, no quota, and nothing to register.
• MIT licensed, pure Python, and it writes line-delimited JSON that goes straight into a file or a database.
• Comments are the one research source written by the audience rather than by the publisher.

Watch for

• An unofficial route that can stop working at any time, and data-centre addresses get blocked first.
• About eighty commits and one maintainer, so it is replaceable rather than dependable.
• Most of what it returns is spam, jokes and noise that has to be filtered out afterwards.

Works well with

Install into a virtual environment on the Mac beside your Edition 6 research tools.

Install

python3 -m venv venv
source venv/bin/activate
pip install youtube-comment-downloader

⧉

Screenshots

06

praw-dev/praw

4.2k stars · BSD-2-Clause · v8.0.3 (2026-08-12) · Track this in Scout · Share this tool

The mature Python client for Reddit's official API — search the archive where buyers describe the problem in their own words.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You register an application with Reddit, which gives you a client id and a secret, and the library handles authentication from there. It exposes subreddits, posts, comments and search results as ordinary Python objects, so a post's comment tree is something you walk rather than something you parse. It respects Reddit's own request rules internally, which means no waiting code of your own. A streaming mode yields new posts and comments as they appear. It can also write — post, comment, vote and moderate — and the moderation support is substantial. What it does not do is work around the official limits: there is no access to deleted content, no bulk historical export, and Reddit's own search is as weak through the library as it is on the site. It needs Python 3.10 or newer.

Why it matters

Who it suits. Anyone doing research on what people say about a subject in public: a writer looking for the words real readers use, a researcher collecting posts, a maintainer watching for questions about their project. It also suits moderators, who are a large part of why the library is as complete as it is. Skip it if the need is historical bulk data, because that is a different problem with a different answer.

Verdict. Worth the setup if the reading is going to be regular rather than once. The archive and the search are the valuable half early on, because the need is usually to read the last two years of questions rather than to be told about the next one. Three cautions. Registering the application is genuinely tedious, Reddit's terms for automated access have changed more than once, and the site's own search is poor enough that the practical approach is to pull broadly and filter locally. Using it to post links is the trap: an account that only ever drops links gets banned, correctly. Edition 4 covered DIYgod/RSSHub, which turns a subreddit into a feed of new items and cannot search the past at all; the two are complementary. Version 8.0.3 of 12 August 2026 is current and code landed in October, so the project is quiet and tended rather than slowing down.

Stars4.2k

LicenceBSD-2-Clause

Latestv8.0.3 (2026-08-12)checked 7 Sep 2026

Written inPython

NeedsPython 3

RunsLocally, on your own machine

Setup effort

2 / 5

Payoff

4 / 5

Good

• BSD-2-Clause, the official interface, and mature enough that example code is almost always correct.
• Request limits are handled inside the library, so an overnight script is safe to leave running.
• Historical search and full comment trees, which a feed cannot give.

Watch for

• Registering an application for a client id and secret is a tedious first half hour.
• Reddit's rules for automated access have changed sharply in recent years; read the current ones before building a habit.
• Reddit's own search is weak, so expect to pull broadly and filter locally.

Works well with

RSSHub gets you a feed of new items.

Install

python3 -m venv venv
source venv/bin/activate
pip install praw

⧉

Screenshots

07

simonw/llm

12.5k stars · Apache-2.0 · 0.35 (2026-09-07) · Track this in Scout · Share this tool

Command-line pipe to any model, with every prompt and response logged to a queryable SQLite file.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You install one command and give it an API key per provider. Text arrives on standard input or as an argument, and the answer comes back on standard output, which means it composes with ordinary shell tools. Every prompt and response is written to a local SQLite file, and llm logs searches it. Saved templates turn a prompt you spent an hour refining into a named command. Fragments let long reference texts be attached and reused, schemas make a model return structured records rather than prose, and tools let a model call functions you define. It talks to the major hosted providers, and plugins add more, including models running on the same machine. It also computes and stores embeddings, which are numeric representations of text used for similarity search. What it does not do is manage spending, run a server or balance across providers, which is where a gateway belongs instead.

Why it matters

Who it suits. Anyone with a large pile of text and one question to ask of all of it: extracting complaints from nine thousand comments, classifying support threads, summarising four hundred transcripts. It also suits anyone who wants a prompt saved as a reusable command, and anyone who wants the record of what was asked to still exist in three months. Skip it for conversational work, where a chat interface is simply better.

Verdict. Worth installing the first time there are more than about fifty files to process, and before that it will feel redundant. The two features that earn their place beyond bulk are the saved templates and the log: the log turns throwaway work into something that can be queried in SQL afterwards. The caution is cost, because a loop over four hundred files is a real bill — pick a cheap model as the default and cap the spend before the first large run. Edition 5 covered BerriAI/litellm, which is the right tool for that cap when several people or several programs share one budget. Version 0.36 of 22 September 2026 is current; the project moves quickly, so pin the version and use the part you need. One note for anyone reading it from a mirror: the GitHub releases page and PyPI agree on 0.36, while the ungh.cc mirror was still showing 0.35 on the day of this refresh.

Stars12.5k

LicenceApache-2.0

Latest0.35 (2026-09-07)checked 7 Sep 2026

Written inPython

RunsLocally, on your own machine

Setup effort

1 / 5

Payoff

4 / 5

Good

• Apache-2.0 and shaped like a Unix tool, so it composes with cat, xargs and a loop.
• Every prompt and response is logged to SQLite, which makes past work searchable.
• Reusable templates, structured output, fragments and a large plugin ecosystem, including local models.

Watch for

• It calls paid services, and a loop over hundreds of files is a real bill with no built-in cap.
• The plugin ecosystem moves quickly; pin a version rather than tracking the newest.
• It overlaps whatever coding assistant is already installed, so the value only appears at volume.

Install

python3 -m venv venv
source venv/bin/activate
pip install llm
llm keys set anthropic

⧉

Screenshots

08

paulirish/lite-youtube-embed

6.3k stars · Apache-2.0 · v0.3.4 (2025-11-10) · Track this in Scout · Share this tool

Renders a YouTube embed as a thumbnail until someone presses play — roughly an order of magnitude less initial page weight.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You include one JavaScript file and one CSS file, then replace the <iframe> tag with a <lite-youtube> tag carrying the video id. The element renders the video's thumbnail with a play button over it. When a visitor clicks, the real player is inserted and starts playing. The measured difference in what the page loads first is roughly a factor of ten. Optional attributes cover the accessible play label, a title, player parameters, and a custom poster image set through CSS, and there is an option that loads the player interface so the player can be driven from code. The embed uses the youtube-nocookie.com address. What it does not do is work for other video services, and it is not a player: everything after the click is YouTube's own code.

Why it matters

Who it suits. Anyone with videos embedded on pages where loading speed matters: a landing page, a documentation page, a blog post that ranks in search. It suits a static site best of all, because there is no build step and nothing to configure. It is also a reasonable answer for anyone who would rather no third-party script ran before a visitor asked for it. Skip it if the video is the whole point of the page and everyone who arrives presses play, because then the player is needed anyway.

Verdict. An hour including testing, and the gain is on the measurements search engines use. The honest caution is the project's pace: the last release, v0.3.4, is 10 November 2025 and the last code change the same day, which is eleven months before this refresh. It is small and finished rather than abandoned — there is no deprecation notice and the alternatives are listed in its own README — but nothing new is coming, so treat it as a file that has stopped moving. Two smaller things. The thumbnail comes from YouTube's own image addresses, so a poor automatic thumbnail has to be overridden by hand. And the watch-time figures reported by an embed loaded on click look slightly different, so do not compare them with last month's.

Stars6.3k

LicenceApache-2.0

Latestv0.3.4 (2025-11-10)checked 7 Sep 2026

Written inHTML

Setup effort

1 / 5

Payoff

3 / 5

Good

• One script, one stylesheet, one changed tag, and no build step or framework.
• Apache-2.0, with no dependencies at all in the published package.
• Written by a browser performance engineer, which is the right background for a page-weight fix.

Watch for

• No release or code change since 10 November 2025, eleven months before this refresh.
• The thumbnail comes from YouTube's automatic images, so a bad one needs a poster set by hand.
• Autoplay after the click is on by default, which is not always what a page wants.

Replaces

Swap <iframe> for <lite-youtube> and the page that ranks for "how do I summarise a long chat" stops being slow because of the demo video sitting on it.

Install

npm install lite-youtube-embed

⧉

Screenshots

09

Pagefind/pagefind

5.5k stars · MIT | [pagefind.app](https://pagefind.app) · v1.5.2 (2026-04-12) · Track this in Scout · Share this tool

A search library that indexes a built static site and runs entirely in the browser.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You run one command against the folder your site was built into. It reads the generated HTML, works out what the content of each page is, and writes a set of index fragments plus a small WebAssembly search engine — WebAssembly is a way of running compiled code inside a browser at near-native speed. At search time the browser fetches only the fragments that a particular query needs, so a large site costs a visitor tens of kilobytes rather than a whole index. A ready-made search interface ships with it, and there is a JavaScript interface for building a custom one. It supports filters, sorting, weighted content, multi-page sites in several languages, and indexing of non-HTML content through a separate mode. What it does not do is search anything that is not in the built output: data behind a login, records in a database, or a page published without a rebuild stays invisible until the next build.

Why it matters

Who it suits. Anyone with a documentation site, a blog or a handbook of more than a few dozen pages and no search at all, who does not want a hosted service in the path. It suits multilingual sites unusually well, because many static search tools handle anything other than English badly. Skip it if the content changes continuously outside the build, or if the thing people need to search is application data rather than pages.

Verdict. Worth an afternoon, and there is a second payoff that is easy to miss: what people type into a site's own search box is the clearest statement of what they expected to find. Wiring the query into an analytics event takes a few lines of code and produces a list nobody else in the market has. Edition 1 covered umami-software/umami for the analytics side of that. Version 1.5.2 of 12 April 2026 is current and code landed in October, and that release is worth knowing about if the build runs on an older Linux: 1.5.0 had an allocator problem that halved indexing speed on musl builds, and 1.5.2 fixes it. The project is also already the search engine inside Starlight, covered in Edition 4, so for a site built with that, extending the same search across the rest is configuration rather than a new dependency.

Stars5.5k

LicenceMIT | [pagefind.app](https://pagefind.app)

Latestv1.5.2 (2026-04-12)

Good

• MIT licensed, with no server, no service and no cost per search; the index is static files beside the pages.
• Multilingual support that treats languages other than English properly.
• A ready-made interface for a quick start and a JavaScript interface for a custom one.

Watch for

• It indexes built output, so anything published outside a build is invisible until the next one.
• It cannot search an application's own data; that needs a database or a vector index instead.
• Capturing what people searched for needs a few lines of your own code — the second payoff is not automatic.

Install

npx pagefind --site dist

⧉

Screenshots

10

data-privacy-stack/presidio

11.3k stars · MIT | [presidio.dataprivacystack.org](https://presidio.dataprivacystack.org) · 2.2.364 (2026-07-22) · Track this in Scout · Share this tool

A framework for detecting and removing personal data in text, images and tables.

▶Repo detailsthe review · specs · pros & cons · install

What it does

It has two main parts. The analyser finds personal details and returns what it found, where, and how confident it is. The anonymiser then redacts, masks, hashes, encrypts or replaces them. Detection combines regular expressions, checksum validation, context words and named-entity recognition from a language model — spaCy by default, with transformer models and hosted services available instead. More than fifty kinds of detail are recognised out of the box, including country-specific identifiers, and you can add your own recogniser for an internal code or a project name. Separate packages handle images, where text is found by optical character recognition and then painted over, and tabular data. It runs as a Python library or as containers behind an HTTP interface. What it does not do is guarantee completeness: detection is statistical, it misses things, and it flags things that are not personal data. Coverage outside English is noticeably thinner.

Why it matters

Who it suits. Anyone whose program accepts text written by a human and then sends it somewhere else — to a model, to a log, to a search index, to a test environment. It suits teams with a privacy obligation they have to be able to describe rather than merely assert, because this turns a promise into a step somebody can inspect. Skip it if the text is already structured and the sensitive fields are known by name, because then removing a column is both simpler and safer.

Verdict. Worth a day to put in a pipeline, and worth measuring afterwards: the good detection needs a language model held in memory, which is a real cost on a small machine. Start with the light spaCy model and watch the memory. Two things changed since this edition was first published, and the first is the headline. The project is no longer Microsoft's: it has moved to an independent, community-governed organisation called Data Privacy Stack, the repository is now data-privacy-stack/presidio, and the old address redirects. The licence stays MIT and the Python package names are unchanged, but new container images are published under the new organisation and the old registry's images are no longer updated, so any image reference needs changing. The second thing is the governance: the steering committee is widening beyond Microsoft and the detailed rules are still to be published. Test on real text in every language that matters before making any claim that covers them all.

Stars11.3k

LicenceMIT | [presidio.dataprivacystack.org](https://presidio.dataprivacystack.org)

Latest2.2.364 (2026-07-22)

Good

• MIT licensed, with more than fifty kinds of personal detail recognised before any customisation.
• Extensible: a client code or an internal project name can be masked as easily as an email address.
• Separate packages cover images and tables, not just plain text.

Watch for

• Detection is statistical and never complete; it misses things and flags things it should not.
• Good accuracy needs a language model in memory, which is a real cost on a small machine.
• Coverage outside English is much thinner, and the project's move to new ownership means image references and documentation addresses are still settling.

Install

python3 -m venv venv
source venv/bin/activate
pip install presidio-analyzer presidio-anonymizer
python -m spacy download en_core_web_lg

⧉

Screenshots

11

jameskerr/react-arborist

3.7k stars · MIT | [react-arborist.netlify.app](https://react-arborist.netlify.app/) · v4.0.1 (2026-10-11) · Track this in Scout · Share this tool

A tree list component for React that stays fast with thousands of nodes.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You give it your data and a component to render one row. It renders only the rows in view, which is what keeps a large tree responsive. It handles keyboard navigation, type-to-find, multiple selection, inline renaming, and drag-and-drop reordering between branches, and it has a built-in filter that hides rows that do not match. You can let it hold the open and selected state itself or control that from your own state. What it does not do is show relationships between separate branches, which is the thing a drawn map does and a list cannot. It also does not include the drag-and-drop engine any more: since version 4 the react-dnd libraries are peer dependencies, which means they are installed alongside rather than bundled in.

Why it matters

Who it suits. Anyone building a file browser, a category picker, an outline view or a settings tree in React, who has discovered that a plain nested list stops being usable at a few hundred rows. It is also the right companion for an interface whose main view is a drawn map: the map is better on a wide screen and a searchable list is better on a phone, and the two can render from the same data. Skip it if the tree has thirty items, because the plain nested list is less code.

Verdict. Worth a day, and the two hard parts — only drawing visible rows, and keyboard movement that a screen reader can follow — are already done. The thing to know before installing is the version situation, which changed four days before this refresh. Version 4.0.1 is tagged on GitHub and published on npm, but the latest tag on npm still points at 3.16.0, so a plain install gives the older line. Version 4 needs React 18 or newer and expects react-dnd version 16 installed alongside, where version 3 bundled version 14 itself; it also moved some internal drag fields, so code that read them directly needs updating. Pick the line deliberately and pin it. The repository also changed owner: it is now under its author's own account rather than Brim Data, where it was written, and the old address redirects.

Stars3.7k

LicenceMIT | [react-arborist.netlify.app](https://react-arborist.netlify.app/)

Latestv4.0.1 (2026-10-11)

Good

• Only visible rows are drawn, so a tree of thousands stays responsive.
• Keyboard navigation and the accessible tree behaviour are built in, which is the part most components skip.
• Rows are your own components, so existing cards and styles can be reused rather than redesigned.

Watch for

• On npm the default install still gives 3.16.0 while 4.0.1 is published, so the version has to be chosen by hand.
• Version 4 needs React 18 or newer and the drag-and-drop libraries installed separately, so an upgrade is not free.
• A tree cannot show links between branches, so for a map-like view it is a companion rather than a replacement.

Install

npm install react-arborist@4 react-dnd react-dnd-html5-backend

⧉

Screenshots

12

optuna/optuna

14.8k stars · MIT · v5.0.0 (2026-09-07) · Track this in Scout · Share this tool

Hyperparameter search that samples the promising regions and prunes hopeless trials early — a week of sweeps back as an afternoon.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You write one function that takes a trial, asks it for each parameter value, runs whatever you are measuring, and returns a score. Because the parameters are requested inside the function, the search space can depend on earlier choices, including conditions and loops. A sampler then decides what to try next; the default for a single objective is a tree-structured estimator, and version 5.0.0 made a different sampler the default for several objectives at once. A pruner stops a trial that is clearly going nowhere before it finishes, which is where most of the saved time comes from. Every trial is written to storage — a file, a database or a journal — so a search survives a restart and can be inspected afterwards in SQL. Several processes or machines can work on the same study with no change to the code. Plotting functions draw the history and the importance of each parameter. A separate dashboard package shows the same thing in a browser. What it does not do is validate anything: it finds candidates, and whether a candidate is real is a separate question.

Why it matters

Who it suits. Anyone whose measurement is expensive and whose settings are many: training a model, tuning a database, sizing a cache, searching the parameters of a simulation. It suits modest hardware better than it sounds, because pruning is what turns a week of full runs into an afternoon. Skip it if the whole search is small enough to run exhaustively, because then a loop over every combination is simpler and gives a complete answer.

Verdict. Worth a day, and the warning is the important part: a smarter search reaches an overfitted result faster than a stupid one. The more combinations tried, the more likely it is that the best of them is luck, so pair every study with data the search never saw and, where the subject allows it, a test for multiple comparisons — Edition 6 covered bashtage/arch, which has one. Version 5.0.0, published on 7 September 2026, is a genuine upgrade and a genuine break. It changes several defaults, makes the Gaussian-process sampler a stable interface, and removes a list of things: the multi-objective module, the older framework integrations, positional arguments in the study and trial interfaces, and some plotting arguments. Read the release notes before upgrading an existing study rather than after. An experimental Rust reimplementation called Rustuna now exists in the same project, and its own documentation says it lacks features and probably contains defects.

Stars14.8k

LicenceMIT

Latestv5.0.0 (2026-09-07)checked 7 Sep 2026

Written inPython

NeedsPython 3

RunsLocally, on your own machine

Setup effort

2 / 5

Payoff

4 / 5

Good

• MIT licensed, pure Python, and it wraps around existing code rather than asking for a restructure.
• Pruning is the feature that matters on modest hardware, because a hopeless trial is abandoned early.
• Studies persist to storage, so a long search survives a restart and every trial stays inspectable.

Watch for

• It makes overfitting faster; a study without held-out data will find beautiful noise.
• Version 5.0.0 removed several interfaces and changed defaults, so upgrading an old study is not automatic.
• Defining a good search space is a real skill: too wide and it wanders, too narrow and it confirms what was already assumed.

Install

python3 -m venv venv
source venv/bin/activate
pip install optuna

⧉

Screenshots