Edition No. 9 · 3 Sep 2026
Twelve repositories for knowing who is actually using the thing
Product analytics, session replay, feature flags, and how to run them without renting a stranger's database.
Eight editions have laid pipe: analytics, backups, dashboards, search, subtitles, transcription, dubbing, error tracking, session queues, PDF ingest, embedded vectors, static content sites, monitoring, uptime, notifications, deliverability. Almost every entry has been a mechanism. Almost none has been a person.
That is a natural way for a technical founder to spend the first weeks: laying track. It is not how the second weeks pay. What is missing from the ledger — and, if you look honestly, from Grasppy today — is the shape of everything that happens once a real human being finds you. The forum question they type into the corner widget. The lead that becomes an actual open thread. The four-minute recording of the moment they left the map screen. The PDF they signed and sent back. The article they subscribed to and forwarded to a colleague.
Today's slate turns back to those five moments. Five heavier tools that do the person-facing work, three small sharp ones that fit around them, three that push the product forward, and one that reads what all of that produces.
Seven entries are marketing-shaped, three sharpen the products, two are the wildcards. All twelve are new to the ledger — no repeats today, deliberately. Three genuine hidden gems under 3,000 stars. Seven candidates were verified and deliberately left out; they are named in the appendix with the reason.
This edition, in numbers
| Repos | 12 |
| Hidden gems (<3k stars) | 3 |
| Marketing / product / wildcard | 7 / 3 / 2 |
| New to the ledger | 12 |
| Repeats | 0 |
| Dropped on check | 7 |
Two things worth knowing, separate from the recommendations
- The scheduled-task queue was quiet all day yesterday. Editions 6 and 7 flagged missing bookkeeping steps; Edition 8 said the guard held and today's run confirms it. Three editions in a row have now come out cleanly from the same guard. Left in place. - Twenty's licence is worth reading before installing. Most of the codebase is GNU AGPLv3, but specific enterprise files carry / @license Enterprise / and require a paid subscription for production use. Everything you would need for a solo-founder CRM sits under the AGPL half. Same shape as GrowthBook (Ed.3 #6) and LiteLLM (Ed.5 #9).
If you only do three things
- OpenReplay (#3) — one afternoon to install, one recorded session watched end-to-end, and you will know more about why the Grasppy map screen loses people than any dashboard has told you in eight editions.
- Twenty CRM (#1) — five leads a month become five open threads, not five names you cannot remember by Friday. Every other marketing tool in this ledger produces raw material; Twenty is what turns it into follow-through.
- Firecrawl (#11) — feed it three competitor domains tonight, land the JSON in last edition's
research.db, and by Friday you have a full competitor map to write about.
Every link in one place
| # | Repo | Website | Stars | Licence |
|---|---|---|---|---|
| 1 | twentyhq/twenty | twenty.com | 56.0k | AGPL-3.0 + Enterprise |
| 2 | chatwoot/chatwoot | chatwoot.com | 33.9k | MIT |
| 3 | openreplay/openreplay | openreplay.com | 12.2k | Multiple — read LICENSE |
| 4 | documenso/documenso | documenso.com | 13.6k | AGPL-3.0 |
| 5 | TryGhost/Ghost | ghost.org | 55.1k | MIT |
| 6 | altcha-org/altcha 💎 | altcha.org | 2.3k | MIT |
| 7 | benvinegar/counterscale 💎 | counterscale.dev | 2.1k | MIT |
| 8 | cheshire-cat-ai/core 💎 | cheshirecat.ai | 3.0k | GPL-3.0 |
| 9 | datalab-to/marker | datalab.to | 39.5k | Apache-2.0 |
| 10 | paradedb/paradedb | paradedb.com | 8.9k | AGPL-3.0 |
| 11 | firecrawl/firecrawl | firecrawl.dev | 166k | AGPL-3.0 (SDKs MIT) |
| 12 | simonw/datasette | datasette.io | 11.2k | Apache-2.0 |
The people, not the pipes
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
56.4k stars · AGPL-3.0 + commercial licence over enterprise files marked /* @license Enterprise */ · sdk/v2.38.1 (2026-09-06)
The place where a lead becomes a person you owe an answer to, not another line in a spreadsheet.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A self-hosted CRM built by a French team and released under the GNU AGPL with a thin commercial layer over specific enterprise files. TypeScript, NestJS, PostgreSQL, React — the same stack shape as everything else you run.
Why it matters
Every previous edition of this ledger surfaces tools that bring people to the site. None of them tell you what to do when a person actually arrives. A lead who filled a Typebot form last Tuesday, a person who mailed Chatwoot (#2) on Wednesday, a commenter under a YouTube video on Thursday are three separate names now, and by next Monday they are forgotten. Twenty is the place those three names become one open thread with a next action attached. At five leads a month, this is more valuable than any tool that produces more of them.
- Runs on the Postgres you already have — no second database
- The AGPL half covers everything a solo founder needs; you keep the source
- API-first, so n8n and Chatwoot pipe into it without custom code
- Heavy Next.js/NestJS stack — comfortable on your VPS, not tiny
- Enterprise files (SSO, advanced roles) carry a subscription requirement — read the LICENSE before assuming you can modify freely
- A CRM is a habit before it is a tool; installed and unused, it is clutter
A paid CRM subscription — Hubspot, Pipedrive, Attio
Chatwoot for the conversations, n8n to feed contacts in, Listmonk to push engagement back as tags
Docker Compose beside Grasppy on the VPS.
36.6k stars · MIT · v4.17.1 (2026-08-27)
The little bubble that turns 'someone left' into 'someone asked something specific.'
▶Repo detailsthe review · specs · pros & cons · install
What it is
A Ruby-on-Rails omni-channel customer engagement platform: a live-chat widget for the site, plus email, WhatsApp, Instagram and Facebook Messenger inboxes in one place. MIT — no strings.
Why it matters
Libredesk (Ed.5 #3) has been sitting in the ledger unacted for five days now. Chatwoot is the heavier alternative — bigger stack, but a real JavaScript widget on Grasppy's landing page. Someone confused by the map screen types "what does this do?" and you get an email. That is the highest-signal marketing data any tool in this ledger produces, and it needs no marketing plan. The Instagram and WhatsApp inboxes also matter for the Russian-speaking audience, which is not on email.
- MIT — one of the cleanest licences in the ledger
- Actual chat widget, plus every channel you might reasonably run
- Well-maintained: Chatwoot Inc. sells hosted, the OSS is not going away
- Ruby + Rails + Sidekiq + Postgres + Redis — a heavier install than a single Go binary
- Live chat you never answer is worse than none; a broken "reply within 24h" promise destroys trust
- Overlaps Libredesk (Ed.5 #3) — pick one, not both
Intercom, Crisp, and any per-seat live-chat subscription
Twenty, via an n8n webhook that turns a conversation into a lead
Docker Compose on the VPS.
12.8k stars · Multiple licences — LICENSE file references sub-directory licences separately · v1.27.0 (2026-05-05)
Four minutes of watching one real person struggle with Grasppy will teach you more than a month of guessing.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Self-hosted session replay — Hotjar or FullStory, but on your own infrastructure. Records mouse movement, clicks, scrolls, network calls and console errors as one replayable timeline you scrub through in the browser.
Why it matters
Umami tells you a page bounced. GoAccess (Ed.8 #4) tells you at what URL. Neither can show that the visitor clicked the map screen twice, waited, clicked again, and left. OpenReplay does. For a product where the map screen is the product, seeing one person use it is worth more than every dashboard combined. This is the empirical answer to "why do people leave the map screen" that no analytics tool in the ledger has produced.
- Heavy: needs Postgres, Redis, ClickHouse and S3-compatible storage for the recording blobs
- Licence is not pure MIT/Apache — read the LICENSE file before assuming rights, especially before embedding in a paid feature
- Storage grows fast — an hour of active use is tens of MB per recording; write a retention policy on day one
FullStory, Hotjar, LogRocket
Twenty — a recording ID on a contact record pulls up the visit when they email
Docker Compose alongside Grasppy.
14.9k stars · AGPL-3.0 · v2.17.0 (2026-08-19)
The document you send that comes back signed, not thumbed-through and forgotten in a folder.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A self-hosted electronic signature service — AGPL, Next.js plus Postgres. Sends signable PDFs by email link, tracks who opened, who signed, when, and emits an audit trail.
Why it matters
This will not earn traffic. It is the missing hinge for two moments that stall founder-led deals: enterprise customers who ask for a DPA, MSA or NDA before purchasing, and any consulting or partnership work. Right now the choices are DocuSign at $25/month per user or DOCX by email with no trail. Documenso costs a box you already have and doubles as the delivery mechanism for signed Typst-produced proposals (Ed.8 #7).
- AGPL-3.0 — self-hosted, your data
- Handles the ceremony (authenticated links, signed audit trail) that DocuSign is famous for
- Emits webhooks: n8n can route "contract signed" into Twenty (#1) as a stage change
- eSignature legality varies — for EU counterparts, read eIDAS and whether Documenso's basic level meets what your customer expects
- Sending is your problem — needs SMTP with SPF/DKIM/DMARC. checkdmarc (Ed.8 #1) is the tool to test that
- Nobody uses this weekly at your scale; installing before the first request is premature — the case here is "know it exists"
DocuSign, PandaDoc, and per-signature pricing
The same SMTP setup as Listmonk and your transactional email — one configuration pays off three times
Docker on the VPS.
55.2k stars · MIT · v6.62.0 (2026-09-01)
The buy-the-assembled-thing answer for 'publish, email, and take payment for it', from a decade of shipping only that.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A Node.js CMS built around publishing plus paid membership and newsletters — MIT-licensed, hosted for money at ghost.org, freely self-hostable. Every post can become an email; paid tiers happen inside Ghost via Stripe.
Why it matters
This is a deliberate tension with the Astro + Starlight + Listmonk + remark42 stack Editions 3-5 assembled. That stack is more flexible; Ghost is finished. If the goal is "get one article a week out and a newsletter attached," an out-of-the-box product beats the assembly. A hosted ghost.org tier at $9/month is a legitimate answer too — the choice here is buy vs. build vs. assemble, and Ghost is the "assembled" answer.
- Weekly releases (v6.62.0 two days ago)
- MIT, self-hostable; hosted paid tier exists as fallback
- Newsletter, membership and payment work out of the box — Listmonk does not do payment; Astro does not send email
- Node.js + MySQL (or SQLite for small installs) — a third database on the box
- Ghost editor replaces the markdown-in-git workflow you already know from Starlight
- Choosing this contradicts the assembled Astro stack; do not run both
Substack, Beehiiv, and a separate CMS plus newsletter tool
Twenty, via a webhook on every new member
Docker Compose or Ghost-CLI on the VPS.
2.7k stars · MIT · v3.2.2 (2026-08-19)
The invisible little box in front of every form, and Google is not reading the room.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A self-hosted CAPTCHA replacement using proof-of-work. Instead of "click all the traffic lights," the visitor's browser silently solves a small computation. GDPR-safe, WCAG 2.2 AA, no third-party tracking, no cookies.
Why it matters
Every form on Grasppy (Typebot, Listmonk signup, contact) will get bot-submitted the moment it exists. The default is reCAPTCHA, which sells the visit to Google — a bad trade for a founder who wants European trust and a good geo-optimizer-skill score (Ed.8 #3). Altcha is small, invisible in normal use, works client-side, and is exactly the kind of privacy-by-default detail that makes the "trust" story credible without a footnote.
- MIT, tiny library (about 30 kB of JavaScript)
- No third-party dependency — GDPR/EAA compliant with no cookie notice change
- Handles both the browser widget and the server-side verification
- Proof-of-work makes the visitor's phone do ~100ms of work per submit — negligible on new phones, real on very old ones
- Does not stop determined bots; it makes cheap spam expensive
- Server-side rate limiting is still your job — Altcha is not a WAF
reCAPTCHA and hCaptcha — and the visitor data they collect
Typebot forms, Listmonk signup, and any contact form on the site
FastAPI verifies the token; the React shell embeds the widget.
2.1k stars · MIT · v3.4.1 (2025-12-15)
A Cloudflare Worker plus one Analytics Engine binding — the cheapest analytics service you can run this year.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A tiny web analytics service purpose-built for Cloudflare Workers. Runs on Cloudflare's free tier (Workers + Analytics Engine, effectively zero dollars for small sites) and shows visits, pageviews, referrers, top pages, countries and browsers in a Remix dashboard.
Why it matters
You still have not installed Umami. GoAccess (Ed.8 #4) is answering that for now, but it cannot show a visitor journey. Counterscale is Umami's spiritual opposite: it runs on infrastructure you don't own (Cloudflare) instead of hardware you do (Hetzner). If Cloudflare already fronts Grasppy for DNS or CDN, this is genuinely the fastest analytics answer of the year. If not, it's a question of whether you want to add Cloudflare in front of everything — then re-read the Umami repeat in Edition 5.
- Free on Cloudflare Workers' free tier — genuinely $0/month at Grasppy's traffic
- Single Worker file; you can read and patch it in one afternoon
- Ships with a dashboard, not just a data collector
- Cloudflare-only — not portable to the Hetzner box, which is the ledger's home turf
- Ties analytics to a vendor whose terms and free tier can change
- Ben Vinegar (ex-Sentry) is essentially the one maintainer — good sign, not a large team
Google Analytics, and the cost of running your own analytics box
Nothing on your server — deliberately separate infrastructure, so an outage on one does not take the other
Standalone script tag on grasppy.com.
3.1k stars · GPL-3.0 · 2.0.23 (2026-07-08)
The opposite architecture from the LiteLLM-plus-custom-code path — batteries actually included: FastAPI, RAG, plugin loader, WebSocket chat, all in one image.
▶Repo detailsthe review · specs · pros & cons · install
What it is
An opinionated framework for a custom AI agent as a microservice. Ships a FastAPI service with built-in retrieval-augmented generation, a plugin loader, and a WebSocket chat endpoint. GPL-3.0.
Why it matters
Not for the app itself — Grasppy is its own architecture. The Cat is worth knowing about as the shortest path to a "chat with your docs" widget on the marketing site: point it at your Docling-produced pages, drop the widget into Starlight, and a reader on a tutorial can ask a follow-up. The alternative is building this yourself with LiteLLM + Instructor + pgvector — which you should for the actual product, but not for a marketing chatbot.
- Under 3k stars but a real Docker image and real docs — a working thing, not a research demo
- RAG, plugins and WebSocket chat all included
- GPL-3.0 — self-host and modify freely
- GPL-3.0 on a marketing chatbot is fine; embedding it inside a paid Grasppy feature is not
- Small community (3.0k stars); if the maintainer disappears, you are on your own
- Overlaps a stack you are already assembling — pick a lane, do not run both
A paid 'chat with your docs' widget
Docling for the markdown it reads, and a docs site to embed the widget in
Docker service beside Grasppy.
39.6k stars · Apache-2.0 · v2.0.0 (2026-07-20)
The recognised open state-of-the-art PDF-to-Markdown converter — Docling's head-to-head, on a corpus of your users' actual uploads.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A Python PDF-to-Markdown-and-JSON converter built on layout models by the datalab.to team. Apache-2.0. Ships as CLI, Python library, and a hosted service.
Why it matters
Docling (Ed.3 #9) is IBM's answer; Marker is the community's. Both are alive and neither has one obvious win. This is the same head-to-head Ed.6 asked for on BERTopic vs turftopic vs LightRAG: two engines with overlapping strengths, and the only fair test is on real inputs. Marker tends to handle equations and tables better; Docling handles more input types. Run both on ten real PDFs and keep the winner. Both are Apache/MIT so no licence trap either way.
- Legitimate head-to-head option: no single PDF converter is best at everything
- Apache-2.0 — safe inside a paid Grasppy feature
- Fast, layout-aware, actively developed by a real team
- Model weights are large (~1 GB) — noticeable RAM footprint on the VPS
- Better with a GPU, though v2.0 improved CPU support
- Pick ONE (this or Docling) as the default — running both in production wastes resources
Paid PDF-extraction APIs
A chunker downstream, and a background job queue to run it out of the request path
Python library called from a Procrastinate job (Ed.5 #10).
9.2k stars · AGPL-3.0 · v0.25.6 (2026-08-27)
BM25 and full-text search that live inside Postgres, not in a separate Elasticsearch cluster that also needs backups.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A PostgreSQL extension that adds Elasticsearch-quality search (BM25, full-text, faceting) as ordinary SQL. Written by a small team, AGPL-3.0 for the community edition.
Why it matters
Grasppy has pgvector (Ed.2 #11) for semantic search and nothing serious for keyword search. Pagefind (Ed.7 #9) is static-site search only. When a user types "the polymorphism thing my colleague mentioned" into the top of a chat, semantic-only search can miss the specific word; BM25 catches it. ParadeDB adds that without a second server, so nothing about the backup story (restic, Ed.8 #11) changes. It rules out Elasticsearch, which is what a "startup engineer" would install by default and quietly regret.
- No new server — everything stays in the Postgres you already back up nightly
- The right complement to pgvector: semantic AND keyword search from the same query planner
- AGPL: fine for self-hosted Grasppy — the code stays yours
- Postgres extension — check Hetzner Postgres superuser access before assuming you can install
- AGPL: same rule as pgvector — self-host fine, embedding in a closed distribution is not
- Small maintainer team; extension breakage across Postgres major upgrades is a real risk
Elasticsearch, and the second datastore it drags in
pgvector — keyword search and semantic search over the same columns, in one query
CREATE EXTENSION pg_search; then index the same message columns pgvector reads.
177.7k stars · AGPL-3.0 · v2.11.289 (2026-09-02)
trafilatura on a single URL is 20ms and free. Firecrawl on a whole domain, JS-rendered, in structured JSON, is where the real research goes.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A crawler service that fetches pages (with a headless browser when needed), extracts clean Markdown, and offers structured JSON output tuned for LLMs. Ships as a hosted service and a self-hostable Docker stack. REDIRECT: mendableai/firecrawl now resolves to firecrawl/firecrawl (moved into a dedicated org).
Why it matters
Edition 6 gave you trafilatura and yt-dlp for research. Edition 8 gave you sqlite-utils to land the pile in one file. Firecrawl is the layer for when trafilatura is not enough: competitor documentation sites with heavy JavaScript, structured extraction of pricing tables, and — the real payoff — the "crawl the whole site and return JSON" mode that trafilatura does not have. That is the shape of "map a competitor's whole content universe" in one command.
- Releases ship daily — v2.11.289 was yesterday
- Both AGPL-3.0 self-hosted and firecrawl.dev hosted are available — pick per-job
- LLM-schema extraction is a real capability, not marketing copy
- Self-hosted is heavy: headless browser, queue, storage — same order as OpenReplay
- AGPL — same rule as Docmost or Papermark: self-host is fine, embedding is not
- Hosted tier is not cheap; a batched-token spend cap on day one is the discipline
Paid scraping APIs, and hand-rolled extraction on JavaScript-heavy sites
A SQLite research file as the landing place, and Datasette to browse what it collects
Python SDK called from a Procrastinate job.
11.4k stars · Apache-2.0 · 1.0a38 (2026-08-06)
sqlite-utils fills the database. Datasette lets you (or, if you point it at the world, anyone) browse and query it.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A Python web server that opens any SQLite file as a browsable, queryable, JSON-endpoint-emitting web app. By Simon Willison — same author as sqlite-utils (Ed.8 #5) and llm (Ed.7 #7).
Why it matters
Edition 8 was explicit: sqlite-utils is the bucket under yt-dlp, youtube-transcript-api, PRAW and (from today) Firecrawl. Datasette is the natural companion — point it at the same research.db and you get a web UI. Every query is a URL you can bookmark; every URL is a JSON endpoint n8n or Claude Code can call. It is how "your competitor research database" becomes something you can browse on your phone during a walk, then hand to Claude Code as a database instead of a stack of files.
- Reads the existing SQLite file directly — no schema, no import step
- Every query is a shareable URL; every URL is a JSON endpoint
- Actively maintained (1.0a38 on 6 August, 1.0 in reach)
Nothing paid — it is the missing web UI over data you already have
sqlite-utils, which writes the file Datasette reads, and anything that fills it
pip install datasette
Checked, and left out
These were opened for this edition and did not make it, with the reason.
rilldata/rill
rilldata/rill (2.7k, Apache-2.0) — sidebar shows v0.87.2 (June 2026); releasealert.dev reports v0.88.4 (July 2025). The disagreement itself is disqualifying for something in the request path. Backlogged.
plausible/community-edition
plausible/community-edition (2.8k, MIT) — the self-host distribution for Plausible Analytics. Dropped because the repo has no releases at all, only a rolling docker-compose.yml. Backlogged.
glasskube/glasskube
glasskube/glasskube (3.5k, Apache-2.0) — last release January 2025, past the 18-month dormancy line. Backlogged.
Zulko/moviepy
Zulko/moviepy — re-verified for a possible ScalpingMate visualisation angle; still fifteen months since a PyPI upload. Left in backlog.
outerbase/studio
outerbase/studio (5.8k, AGPL-3.0) — nice Postgres/SQLite GUI, but v0.10.2 was March 2025. Backlogged as an alternative to Datasette if it revives.
BoundaryML/baml
BoundaryML/baml (8.9k, Apache-2.0) — 'programming language for agents', but recent releases were only nightly wrapper bumps. Instructor (Ed.5 #11) already solves the structured-output problem. Backlogged.
hoarder-app/hoarder
hoarder-app/hoarder — REDIRECT: now karakeep-app/karakeep (28.8k, AGPL-3.0). Alive and well, but not a marketing tool. Dropped for slate fit; backlog worth if he ever wants a self-hosted bookmark research vault.