Edition No. 8 · 2 Sep 2026
The gatekeepers, the pile of files, and the backup nobody made.
Three plain problems: arrival, a pile of collected files, and the backup nobody made.
Refreshed on 12 October 2026. The repositories are the ones first published; any that are no longer maintained are left out.
The first is arrival. A mail filter, a slow phone and an AI assistant all sit between finished work and a reader. None of them send a complaint. They simply do not deliver.
The second is the pile of collected files. Research tools produce folders of JSON files that nobody opens twice. Collecting is easy. Asking a question across everything you collected is the hard part.
The third is loss. Every tool added to a single machine raises the cost of that machine failing.
One thing worth knowing
Two version traps turned up on the same day, both the same shape. sqlite-utils’ GitHub releases page stops at 3.39 from November 2025, while PyPI is on 4.2.1 from 13 August 2026 — a major version ahead. spec-kit’s newest GitHub tag is v0.9.4 from 4 June 2026, while its PyPI package specify-cli is on 1.0.3 from 1 September. That made five projects on file where GitHub’s releases page is the least accurate source available. The rule that came out of it: for a Python tool, believe PyPI.
Worth saying plainly, five days later: this radar wrote that rule down on 2 September and then broke it on 7 September, correcting two version numbers by reading exactly the page it had just declared unreliable. Both corrections were wrong. Knowing a rule and breaking it a week later is a more useful thing to publish than either half alone — the corrections page has the rest.
If you only do three things
- Point GoAccess (4) at an existing web server log. It takes about twenty minutes. There is no JavaScript to add and no consent banner. The log file is already on disk and already holds last month's traffic.
- Install sqlite-utils (5) and load the collected files into it. One install, then one command per file. A folder of JSON becomes one database you can query and search.
- Put restic (11) on a nightly schedule. It is the only entry here whose absence can end a project rather than slow it down.
Every link in one place
| # | Repository | Official site | Stars | Licence | Latest |
|---|---|---|---|---|---|
| 1 | domainaware/checkdmarc 💎 | domainaware.github.io/checkdmarc | 321 | Apache-2.0 | 6.0.3 |
| 2 | GoogleChrome/web-vitals | web.dev/vitals | 8.6k | Apache-2.0 | 6.2.3 |
| 3 | Auriti-Labs/geo-optimizer-skill 💎 | auriti-labs.github.io/geo-optimizer-skill | 1.0k | MIT | 4.19.0 |
| 4 | allinurl/goaccess | goaccess.io | 20.9k | MIT | 1.12 |
| 5 | simonw/sqlite-utils 💎 | sqlite-utils.datasette.io | 2.2k | Apache-2.0 | 4.2.1 |
| 6 | evidence-dev/evidence | evidence.dev | 7.0k | MIT | 40.1.8 |
| 7 | typst/typst | typst.app | 55.5k | Apache-2.0 | 0.15.1 |
| 8 | qq15725/modern-screenshot 💎 | toolpkg.com/html-to-image | 2.1k | MIT | 4.7.0 |
| 9 | MinishLab/vicinity 💎 | minish.ai/packages/vicinity | 350 | MIT | 0.4.4 |
| 10 | shap/shap | shap.readthedocs.io | 25.8k | MIT | 0.53.0 |
| 11 | restic/restic | restic.net | 36.3k | BSD-2-Clause | 0.19.1 |
| 12 | github/spec-kit | github.github.io/spec-kit | 139.0k | MIT | 1.1.2 |
The last mile, and the pile in the corner
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
321 stars · Apache-2.0 · 6.0.1 (2026-09-04) · Track this in Scout · Share this tool
Checks a domain's SPF, DKIM, DMARC and MTA-STS records in seconds — whether the newsletter you have not built yet is even allowed to arrive.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a domain name and it reads that domain's public DNS records. DNS is the address book of the internet, and it holds small text records that say who may send mail for a domain. It checks SPF, DKIM, DMARC and MTA-STS, which are the four records mail providers look at. It also looks up the mail servers themselves and reports whether they answer. The output comes as readable text or as JSON, so a scheduled job can watch for a record that breaks. Each failure is explained rather than just marked red. Version 6.0.3 landed on 21 September 2026 and needs Python 3.10 or newer. It does not change anything: it reports, and the repair is done by hand at the domain registrar.
Why it matters
Who it suits. Anyone about to send bulk email from their own domain for the first time, and anyone whose newsletter open rate dropped without explanation. It also suits a small team that wants a nightly check so a broken record is noticed in hours rather than months. Skip it if all mail goes through a hosted provider that manages the records and reports on them already.
Verdict. Worth ten minutes before the first campaign, and worth a scheduled run afterwards. The failure it catches is silent, which is what makes it valuable: the sending dashboard reports success while the messages land in spam. Run it against two or three well-run domains as well, to see what a correct setup looks like. Pair it with parsedmarc from the same author once DMARC reports start arriving, and with Mailpit for testing the messages themselves.
- It works against any domain, including ones you do not control, so comparison is easy.
- JSON output makes it simple to run on a schedule and alert on a change.
- The explanations are readable by someone who has never edited a DNS record.
- It only diagnoses. The repair is manual, slow to take effect, and easy to get subtly wrong.
- Correct records are necessary but not sufficient. Sending reputation and list quality still decide the outcome.
- At 321 stars it is a small project with few maintainers. Treat it as a tool to run, not as a dependency to build on.
# needs Python 3.10 or newer pip install checkdmarc checkdmarc example.com
8.6k stars · Apache-2.0 · v6.2.1 (2026-08-26) · Track this in Scout · Share this tool
~3 KB of JavaScript that measures Core Web Vitals on real visits — the field data behind Unlighthouse's and SiteOne's lab scores.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It measures Core Web Vitals, the handful of speed numbers Google uses in search ranking. Those are largest contentful paint, which is how long the main content takes to appear, interaction latency, which is how long a tap takes to respond, and layout shift, which is how much the page jumps about while loading. It reports one measurement per visit, as a plain number. You decide where it goes: an analytics event, an HTTP endpoint of your own, or a log line. The library is roughly 3 KB and loads without blocking the page. Version 6.2.3 is current on npm, and the Chrome team updates it as the metric definitions change. It does not store, chart or interpret anything, and it provides no dashboard.
Why it matters
Who it suits. Teams that have already made pages lighter and want to know whether it worked for real visitors on real phones. It suits a site where a large share of traffic arrives from a link on a phone, because that is where lab tests are most misleading. Skip it if the site gets a few hundred visits a month, because the numbers will be too noisy to act on.
Verdict. Install it, but only once something is ready to receive the numbers. On its own it produces measurements nobody reads. The honest sequence is a log or an analytics endpoint first, this second. Lighthouse and Unlighthouse answer the related question of what to fix, and they do it before launch rather than after.
- About 3 KB, loaded asynchronously, with no measurable cost to the page it measures.
- It sends to anything, so there is no vendor to sign up with.
- Maintained by the Chrome team and updated as the metric definitions change.
- It is a measuring tool and nothing else. Storing and charting the numbers is separate work.
- Field data is noisy at low traffic. One visitor on a train can move a monthly median.
- Some metrics are Chromium-only. Safari and Firefox report less, which skews an iPhone-heavy audience.
npm install web-vitals
776 stars · MIT · v4.17.1 (2026-08-31) · Track this in Scout · Share this tool
Audits whether ChatGPT, Perplexity and Google AI Overviews can find and cite your site — CLI, Python library, MCP server and Astro integration.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It fetches a site and checks the signals an AI assistant uses to read and cite it. Those include robots.txt, which tells crawlers what they may read, llms.txt, which is a plain summary file written for language models, JSON-LD schema, which is structured data describing the page, plus page metadata and heading structure. It produces a score from 0 to 100 across eight scored categories. It can also generate the fixes, including robots.txt rules, an llms.txt file and schema blocks. It runs as a command-line tool, a Python library, an MCP server, a GitHub Action and an Astro integration, so it can run on every build. Version 4.19.0 was published on 9 October 2026. It does not get a site mentioned by an assistant: it only removes the mechanical reasons it would not be.
Why it matters
Who it suits. People publishing documentation or a content site who have noticed that assistants answer questions in their subject without naming them. It also suits a team already running checks on every build, because this slots in beside them. Skip it if the site is not published yet, since there is nothing to score.
Verdict. Worth an afternoon, and genuinely worth wiring into a build so the score does not quietly rot. Two warnings. It grades machine readability, which is a proxy; a perfect score on a site nobody links to still gets cited by nobody. And the project moves fast, with four point releases since the summer, so pin the version you audit against. llms-txt is the specification behind its most common finding. elmo is the self-hosted way to track mentions over time rather than audit a site once.
- It turns a vague goal into a checklist, with eight scored categories rather than opinions.
- The MCP server lets a coding assistant run the audit and apply the fixes in one session.
- Clearly alive: 1.0k stars and version 4.19.0 published on 9 October 2026.
- The score measures machine readability, not reputation. Links and authority still decide citations.
- The maintainers also sell a hosted monitoring product, so read the "track this continuously" advice with that in mind.
- Four major versions in a year. Expect the output to change between upgrades.
Running it as an Astro integration means the score gets checked on every build instead of once, in an afternoon, and then forgotten.
# no install needed uvx --from geo-optimizer-skill geo audit --url https://example.com # or install it, Python 3.9 or newer pip install -U geo-optimizer-skill geo audit --url https://example.com
20.9k stars · MIT · v1.11 (2026-07-20) · Track this in Scout · Share this tool
Real-time nginx log analyser — the first honest traffic numbers, from data already on the server, with no JavaScript and no consent banner.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It reads the access logs that nginx and Apache already write. It parses them and produces either a live dashboard in a terminal window or one self-contained HTML file you can open in a browser. It reports visitor counts, the most requested pages, referring sites, status codes, bandwidth and the user agents that made each request. Because it reads the server's own records, it sees requests from visitors with ad blockers, requests to an API rather than a page, and AI crawlers such as GPTBot, ClaudeBot and PerplexityBot. It is written in C, uses a few megabytes of memory, and parses millions of lines in seconds. The current stable version is 1.12, published on the project's own site. It cannot see anything that never reaches the server, so there is no scroll depth, no click tracking and no signup funnel.
Why it matters
Who it suits. Anyone running a site with no analytics at all, who wants a real number today rather than a better number next month. It also suits people who need to know which AI crawlers are visiting, because a JavaScript tracker cannot see them. Skip it if the site is hosted somewhere that gives you no access to the raw logs.
Verdict. The best twenty minutes on this page. Going from nothing to a real visitor count is a bigger step than any refinement afterwards. Two cautions: log files count robots as visitors unless you configure the filters, and log rotation will quietly delete history unless retention is set deliberately. Umami remains the right next step for behaviour on the page, and Matomo is the fuller self-hosted option if a complete analytics product is wanted.
- Nothing is added to the website. No tracking code, no consent banner, no change to any page.
- It works retroactively, as far back as the logs are kept.
--real-time-htmlproduces a live dashboard at a URL, which is pleasant to leave open.
- Logs mislead in specific ways. One page view can be many lines, and robots inflate every count.
- It sees only what touches the server. No clicks, no scrolling, no conversion tracking.
- Log rotation deletes history silently unless retention is configured on purpose.
sudo apt install goaccess goaccess /var/log/nginx/access.log --log-format=COMBINED -o report.html # live dashboard at a URL goaccess /var/log/nginx/access.log --log-format=COMBINED \ --real-time-html -o /var/www/html/report.html
2.2k stars · Apache-2.0 · 4.2.1 (2026-08-13) · Track this in Scout · Share this tool
Pours JSON and CSV into a real SQLite database with no schema design, then indexes it and adds full-text search.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It reads JSON or CSV and creates a SQLite database table that matches the data. SQLite is a database that lives in one ordinary file, with no server to run. The tool works out the columns itself, which suits messy collected data where the shape is not known in advance. It can add indexes, create full-text search over chosen columns, transform columns, and extract repeated values into a lookup table. The same features are available as a Python library. Version 4.2.1 was published on 13 August 2026, and the GitHub releases page now shows it correctly, which it did not a year ago. It is not a database server and not a replacement for PostgreSQL in a live application.
Why it matters
Who it suits. Anyone sitting on a folder of collected files who wants to ask one question that cuts across all of them. It also suits people who want to hand research to a coding assistant as a database it can query, rather than as forty attachments. Skip it if the data already lives in a proper database, because you would be moving it for no reason.
Verdict. Ten minutes of work that makes several earlier collection tools worth more. The real boundary is SQL: the tool does nothing until someone writes a query, and that is a genuine skill step even though the queries here are simple. Keep it on the research side of the line and leave the live application on PostgreSQL. Datasette from the same author puts a browsable web interface over the database it creates. DuckDB is the better choice when the files are large and the questions are analytical.
- No schema design. It reads the data and creates the columns, which is right for messy input.
- Built-in full-text search means "every comment containing this word" is one command.
- The result is one file. Back it up, copy it, open it anywhere, with no server involved.
- You will be writing SQL, or asking an assistant to. The tool stops being useful until you do.
- Version 3 to version 4 was a breaking change. Read the changelog before upgrading an existing database.
- SQLite is the wrong home for a live application with many writers.
Its sibling Datasette will serve the same file as a browsable web UI if you ever want to click instead of type, and entry 06 will chart it.
Standalone on your Mac, alongside the scrapers, which for yt-dlp and the comment downloader is where they have to run anyway.
pip install sqlite-utils sqlite-utils insert research.db comments comments.json sqlite-utils enable-fts research.db comments text sqlite-utils research.db "select count(*) from comments"
6.9k stars · MIT · @evidence-dev/evidence@40.1.8 (2026-02-06) · Track this in Scout · Share this tool
Business intelligence as Markdown files with SQL in them, building to a static site — a dashboard Claude Code can write.
▶Repo detailsthe review · specs · pros & cons · install
What it does
Each page is a Markdown file. You write a SQL query inside it, give the result a name, and drop in a chart component that reads that name. The build runs the queries, renders the pages, and writes a static website. It connects to PostgreSQL, MySQL, SQLite, DuckDB, CSV files and several warehouses. Charts, tables, filters and value formatting are built in. The whole project is text in a repository, so changes are reviewed as code and an assistant can write a page the same way it writes application code. The npm release is 40.1.8 from February 2026, and code was last pushed on 24 September 2026, so the project is active even though releases are infrequent. It queries at build time, so it does not show live data.
Why it matters
Who it suits. A small team whose numbers are spread across several databases and who want one page that joins them. It suits people who already work in a code repository and dislike dragging widgets around a builder. Skip it if the data has to update every few seconds, because a scheduled rebuild is the only refresh available.
Verdict. The right shape of reporting tool for a text-first workflow, and the wrong one for anybody who wants to click. Be honest about timing: it is premature until something is actually producing numbers, so read this now and install it after entry 4 has been running for a few weeks. The build toolchain is a real ongoing cost. Metabase is the better answer when non-technical people need to build their own charts, and Superset when the organisation is larger.
- Everything is text in version control. Changes are reviewed, and nothing is trapped in a builder.
- The output is a static site, so there is little to keep running and little to secure.
- It talks to PostgreSQL, SQLite and DuckDB natively, which covers most small setups.
- A Node build toolchain is a second ecosystem to keep working, and version drift costs time.
- Queries run at build time, so a live view means a scheduled rebuild.
- Releases are infrequent even though code lands regularly, which makes the project look quieter than it is.
# needs Node 18 or newer npx degit evidence-dev/template my-dashboard cd my-dashboard npm install npm run sources npm run dev
55.9k stars · Apache-2.0 · v0.15.1 (2026-07-17) · Track this in Scout · Share this tool
Modern typesetting: plain-text source compiles to a polished PDF in milliseconds, with excellent Cyrillic support.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You write content in a short markup language with real scripting built in, and it compiles to PDF. Headings, lists, tables, figures, footnotes, bibliographies and cross-references are all built in. The scripting is a proper language, so a document can generate a table from data or produce several variants from one source. Compilation is fast enough to preview as you type, and errors point at the line that caused them. Multilingual typesetting is handled properly, including Cyrillic text and hyphenation in several languages in one document. Version 0.15.1 was released on 17 July 2026. It is still before version 1.0, and it is not a visual design tool: layout beyond the supplied templates means reading documentation.
Why it matters
Who it suits. Anyone producing a long document that must look professional and will be revised often, such as a guide, a report or a manual. It suits teams who want documents reviewed in version control alongside code. Skip it if the document is short, or if the people writing it expect a word processor.
Verdict. Worth learning if you will produce more than one long PDF. An afternoon gets you to a decent document and a day gets you to a good one. The thing to watch is the version number: the language has broken between minor releases before version 1.0, so pin the compiler in the project. The template ecosystem is still young, so an exact look may have to be built by hand. Pandoc is the better tool for converting documents between formats, and Quarto is the better one when the document must run code and show its output.
- Compiles in milliseconds with error messages that name the problem.
- Real scripting, so tables, charts and document variants can be generated from data.
- Strong multilingual support, including correct hyphenation in several languages at once.
- It is a markup language to learn, not a word processor and not a design tool.
- The package and template ecosystem is young. A template that exists for LaTeX may not exist here.
- Still before version 1.0 at 0.15.1, and it has broken between minor versions. Pin the compiler.
brew install typst # macOS # or download a single binary from the releases page on Linux and Windows typst compile guide.typ guide.pdf typst watch guide.typ # rebuilds as you edit
2.1k stars · MIT · v4.7.0 (2026-04-16) · Track this in Scout · Share this tool
Renders a DOM node to PNG, JPEG or SVG in the browser — the maintained successor to html-to-image.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it an element on the page and it returns an image. It works by copying the element into an SVG, inlining the styles and fonts it needs, and drawing the result onto a canvas. It can return a data URL, a Blob or raw canvas pixels, and it supports PNG, JPEG, WebP and SVG output. Scale, background colour and output size are options, so a small element can be exported at a size suitable for sharing. It is the maintained successor to the widely linked html-to-image, with version 4.7.0 on npm and code last pushed in April 2026. It cannot capture WebGL canvases, and cross-origin images will not appear unless they are served with the right headers.
Why it matters
Who it suits. Anyone whose application produces something visual that people would want to share: a chart, a diagram, a generated layout. It also suits teams who need image exports but do not want to run a headless browser on a server. Skip it if the thing being captured is drawn with WebGL, because it will come out blank.
Verdict. Worth an afternoon, and expect to spend most of that afternoon on edge cases rather than on the main path. Web fonts, cross-origin images and CSS filters each have known failure modes, so test on real content early. Large elements produce large files and briefly freeze the tab, so cap the size or export a visible region. html-to-image is the ancestor and still works, and html2canvas is the older approach that redraws the page itself.
- Everything runs in the browser. No server rendering, no queue, no cost per image.
- Actively maintained, with version 4.7.0 and code pushed in April 2026.
- Anything added to the element before capture appears in the image, including a title or a caption.
- Fonts, cross-origin images and CSS filters all have known failure modes. Budget time for them.
- WebGL content does not capture through this route and comes out empty.
- Large elements make large files and freeze the tab while rendering.
It is also your thumbnail pipeline: a real map exported at 1280×720 is a far better YouTube thumbnail than a stock illustration, and it feeds the same Thumbnails-Maker (Ed.
npm install modern-screenshot
351 stars · MIT · v0.4.4 (2026-04-14) · Track this in Scout · Share this tool
One interface over several nearest-neighbour backends — the throwaway in-memory index for a single conversation.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a set of vectors, which are lists of numbers representing items, and it builds an index you can query for the closest matches. It wraps several well-known methods behind one interface, including exact search, HNSW, FAISS, Annoy and others, so changing method is one argument rather than a rewrite. The index can be saved to disk or to Hugging Face and loaded again, so an expensive build can be cached. It also supports deleting and inserting items after the index is built. Version 0.4.4 was published on 14 April 2026 and code was last pushed in May 2026. It is a thin convenience layer, not a database: it stores nothing permanently and offers no server, no schema and no access control.
Why it matters
Who it suits. Developers who need similarity search over data that only exists for a short time, such as a document someone uploaded a few minutes ago. It also suits anyone comparing embedding models, because swapping the method or the model is trivial when the index is just an object. Skip it if the vectors must persist, be shared between machines, or be backed up, because that is what a database is for.
Verdict. Useful and small, with one real risk: it overlaps a vector database closely enough that a project can end up running both without a rule about which owns what. Write that rule down before adopting it. Memory is the other limit, since every index lives in RAM and many concurrent users each holding one will not fit on a small machine. FAISS is the heavyweight library underneath several of its backends, and hnswlib is the smaller one most people reach for directly.
- Changing the search method is one argument, which turns a day of work into a minute.
- No server, no schema and no migration. The index is an ordinary Python object.
- Save and load means an expensive index for a stable collection can be built once.
- It overlaps a vector database, and running both without a clear rule gets confusing.
- Everything lives in memory, so many concurrent indexes will not fit on a small machine.
- At 350 stars it is a small project. The risk is low because the backends are well known, but it is a convenience layer rather than infrastructure.
pip install vicinity
25.7k stars · MIT · v0.53.0rc0 (2026-09-07) · Track this in Scout · Share this tool
Per-prediction feature attribution — which of tsfresh's 700 features the surviving model actually leans on, and whether that reason is embarrassing.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It computes Shapley values, a method from game theory that splits credit for a result fairly among the inputs that produced it. For each prediction it reports how much each feature pushed the output up or down. TreeExplainer handles gradient-boosted trees and random forests exactly and quickly, which covers most tabular work. KernelExplainer handles any model at all, much more slowly. There are also explainers for neural networks and for text and image models. The standard summary, waterfall and dependence plots turn the numbers into pictures. Version 0.53.0 was published on 9 October 2026. It explains what the model learned, and it cannot tell you whether what the model learned is real.
Why it matters
Who it suits. Anyone with a model built from hundreds of generated features who cannot say which ones carry the signal. It suits regulated work where a decision has to be explained to a person. It also suits anyone who suspects a data leak, because a feature computed with information from the future shows up clearly. Skip it if the model is a handful of hand-chosen inputs you can already reason about.
Verdict. Worth an hour, and often the hour that saves a month. The usual result is humbling: the edge rests on a feature nobody intended, such as the hour of day, and that is a property of the data rather than a pattern worth trusting. Two practical warnings. Stay on tree models or budget real time, because the general fallback is slow on long series. And the older tutorials use an interface that has since changed, so follow the current documentation. interpret is the alternative worth knowing, offering models that are readable by design rather than explanations bolted on afterwards.
- Exact and fast on gradient-boosted trees, which is where most tabular work lives.
- The standard plots make an abstract question visual, which matters for non-statisticians.
- MIT licensed, so it can sit inside a commercial product without a licence problem.
- It explains the model, not reality. A feature the model leans on can still be noise it memorised.
- The general-purpose explainer is slow enough to be impractical on long series.
- The library is large and older tutorials use a changed interface, which causes confusion.
6 #12) beside the Optuna trials.
pip install shap
35.9k stars · BSD-2-Clause · v0.19.1 (2026-07-05) · Track this in Scout · Share this tool
Encrypted, deduplicated, versioned backups to SFTP or S3-compatible storage from one static binary.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You create a repository, which is the place backups are stored, and then run one command to make a snapshot. Data is encrypted on the machine making the backup, before it leaves, so the storage provider never sees the contents. Deduplication means identical blocks are stored once, so a nightly snapshot of a file that barely changed costs almost nothing. Snapshots are versioned, so any previous day can be restored. It writes to a local disk, SFTP, S3-compatible object storage, Backblaze B2, Azure, Google Cloud and more. restic check verifies that a repository is readable and complete, and forget with prune applies a retention policy. Version 0.19.1 was released on 5 July 2026. It does not back up a live database correctly: a running database must be dumped first.
Why it matters
Who it suits. Anyone running an application and its database on a single machine, which is most small projects. It also suits people who need the storage provider to be unable to read the contents, which client-side encryption gives by default. Skip it if a managed platform already takes verified, restorable backups and you have tested restoring one.
Verdict. The highest-value entry on this page, and the least interesting to set up. An hour of work, then a nightly schedule. Two things decide whether it actually saves you. Rehearse a restore once, calmly, because the first restore should not happen under stress. And back up the output of a database dump, never the live data directory, because a snapshot of a running database is corrupt and fails silently. Store the repository password somewhere other than the machine being backed up. BorgBackup is the close alternative and is stronger on local and SSH targets, while Kopia adds a graphical interface for people who want one.
- Encrypted on the machine before anything is sent, so the storage provider sees nothing readable.
- Deduplicated and incremental, so months of nightly snapshots cost very little to store.
restic checkproves a repository is restorable. An unverified backup is only a rumour.
- Restoring takes reading documentation. Rehearse it once or treat the setup as unfinished.
- Backing up a live database directory produces a corrupt snapshot, and it fails quietly.
- Lose the repository password and the data is unrecoverable.
sudo apt install restic export RESTIC_REPOSITORY="sftp:user@backup.example.com:/backups" restic init pg_dump mydb > /tmp/backup/mydb.sql restic backup /tmp/backup restic check # verify it is restorable restic restore latest --target /tmp/restore-test # rehearse this once, calmly restic forget --keep-daily 7 --keep-weekly 8 --prune
133.9k stars · MIT · v1.0.4 (2026-09-02) · Track this in Scout · Share this tool
GitHub's spec-driven development toolkit — intent, then specification, then plan, then the agent implements.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You run one command to set up a project, and it installs a set of slash commands and templates for the assistant you use. The commands walk through fixed stages: establish the project's standing rules, write a specification of what is wanted, clarify what is unclear, produce a technical plan, break the plan into tasks, and then implement them. Each stage writes a file into the repository, so the specification and the plan are reviewed like any other change. It supports around thirty assistants and is not tied to one vendor. The Python package specify-cli reached 1.1.2 on 7 October 2026, and code is pushed almost daily. It writes no application code itself: the assistant does that, and the quality of the result still depends on the assistant.
Why it matters
Who it suits. Someone building a sizeable product mostly through an assistant, who keeps re-deciding the same questions at the start of every session. It also suits a small team wanting the specification reviewed before the code appears. Skip it for a one-file change, where the process costs more than it saves.
Verdict. Worth adopting on a project that will run for months, and a waste on anything smaller. It is opinionated about the order of work, so if it does not match how you think, take the templates and drop the rest rather than fighting it. Expect the commands to change between versions, because the project is moving fast at 139k stars and near-daily commits. BMAD-METHOD is the main alternative, heavier and organised around named agent roles rather than a short command sequence.
- Works with around thirty assistants and is MIT licensed, so nothing locks you in.
- The specification and the plan are separate files in the repository, reviewed like code.
- Very actively developed, with
specify-cli1.1.2 published on 7 October 2026.
- It is process, and process only pays back on work large enough to need it.
- Opinionated about workflow. If the order does not suit you, the fix is to keep only the templates.
- Commands change between versions, so written notes about it go stale quickly.
Written down once, those stop being re-litigated every time you open a session.
Installed alongside Claude Code with uv , writing spec and plan files into your own repositories.
# needs uv uv tool install specify-cli --from git+https://github.com/github/spec-kit.git specify init my-feature
Checked, and left out
These were opened for this edition and did not make it, with the reason.
Zulko/moviepy
Zulko/moviepy (14.8k, MIT) — PyPI 2.2.1 (2025-05-21), fifteen months quiet, and auto-editor plus pyVideoTrans already cover the need. Backlogged.
bubkoo/html-to-image
bubkoo/html-to-image (7.2k, MIT) — v1.11.13 (2025-02-14), past the eighteen-month line. Its maintained successor modern-screenshot took the slot (Ed.8 #8). Backlogged.
AnswerDotAI/rerankers
AnswerDotAI/rerankers (1.6k, Apache-2.0) — PyPI 0.10.0 (2025-05-22); GitHub releases a year older still. Too quiet for something in the request path. Backlogged.
ai-robots-txt/ai.robots.txt
ai-robots-txt/ai.robots.txt (4.1k, MIT) — no releases and no readable commit dates; for a list whose whole value is being current, that is disqualifying. Backlogged, worth re-checking.
searxng/searxng
searxng/searxng (36.0k, AGPL-3.0) — no tagged releases to date-check, and using it as a free SERP source for rank tracking is fragile and against engines' terms. Backlogged.
adityaarsharma/youtube-marketing-skills
adityaarsharma/youtube-marketing-skills (38, MIT) — re-checked; still 32 commits, still no releases or readable dates, unchanged since 31 August. Stays backlog; check again mid-September.
Know a repository we should check?