Links
AddHow to design, build, and operate AI agents for infrastructure teams — safely. 13 chapters covering architecture, sandboxing, credentials, change control, observability, and more.
AI agents can write IaC, fix compliance findings, detect drift, review PRs, and respond to incidents — all autonomously. But autonomy without guardrails is a liability. Agents that can terraform apply can also terraform destroy. Agents that read configs can leak secrets. Agents that loop can burn budgets.
This guide covers every architectural decision you need to make when building infrastructure agents — with real patterns, code snippets, multiple alternatives, and the risk framework to evaluate your choices.
Unified Security Platform from Code to Runtime.
Protect against malicious code installed via npm, yarn, pnpm, npx, and pnpx with Aikido Safe Chain. Free to use, no tokens required.
Threat Designer is a GenerativeAI application designed to automate and streamline the threat modeling process for secure system design.
Threat Designer is an AI-driven agent that automates and streamlines the threat modeling process for secure system design. Harnessing the power of large language models (LLMs), it analyzes system architectures, identifies potential security threats, and generates detailed threat models—empowering developers and security professionals to incorporate security from the earliest stages of development.
Scale Machine Learning & AI Computing.
Ray is an AI compute engine. Ray consists of a core distributed runtime and a set of AI Libraries for accelerating ML workloads.
A toolkit to run Ray applications on Kubernetes.
KubeRay is a powerful, open-source Kubernetes operator that simplifies the deployment and management of Ray applications on Kubernetes.
runn ( means "Run N". is pronounced /rʌ́n én/. ) is a package/tool for running operations following a scenario.
Key features of runn are:
-
As a tool for scenario based testing.
-
As a test helper package for the Go language.
-
As a tool for workflow automation.
-
Support HTTP request, gRPC request, DB query, Chrome DevTools Protocol, and SSH/Local command execution
-
OpenAPI Document-like syntax for HTTP request testing.
-
Single binary = CI-Friendly.
Cloud native batch scheduling system for compute-intensive workloads.
Volcano is a Kubernetes-native batch scheduling system, extending and enhancing the capabilities of the standard kube-scheduler. It provides a comprehensive set of features specifically designed to manage and optimize various batch and elastic workloads, including Artificial Intelligence (AI) / machine learning (ML) / deep learning (DL), bioinformatics / genomics, and other "Big Data" applications.
Open Source Data Labeling.
The most flexible data labeling platform to fine-tune LLMs, prepare training data, or evaluate AI systems. Label Studio is a multi-type data labeling and annotation tool with standardized output format. Label Studio is an open source data labeling tool. It lets you label data types like audio, text, images, videos, and time series with a simple and straightforward UI and export to various model formats. It can be used to prepare raw data or improve existing training data to get more accurate ML models.
Cartero (Spanish for "postman") is a content aggregation and distribution bot written in Go.
A personal content aggregator that filters multiple news sources for quality and relevance into a single, high-signal feed.
I enjoy reading tech news on HackerNews, Lobsters, and hundreds of RSS feeds I’ve curated over the years. However, they often have too much content, and not all of it matches my interests. So, I built Cartero—a personal curator that aggregates content from different sources, filters it based on my interests and quality, and pushes it into a single feed.
Memory Management Kit for Agents - Remember Me, Refine Me.
🧠 ReMe is a memory management framework built for AI agents, offering both file-based and vector-based memory systems.
It addresses two core problems of agent memory: limited context windows (early information gets truncated or lost during long conversations) and stateless sessions (new conversations cannot inherit history and always start from scratch).
ReMe gives agents real memory — old conversations are automatically condensed, important information is persisted, and the next conversation can recall it automatically.
Lightning-Fast RL for LLM Reasoning and Agents. Made Simple & Flexible.
AReaL is an open-source fully asynchronous reinforcement learning training system for large reasoning and agentic models, developed by members from Tsinghua IIIS and the AReaL Team at Ant Group. Built upon the open-source project ReaLHF, we are fully committed to open-source principles by providing the training details, data, and infrastructure required to reproduce our results, along with the models themselves. AReaL aims to help everyone build their own AI agents easily and affordably. Our team loves milk tea because it's delicious, customizable, and affordable—we hope you enjoy our project just as much as you'd enjoy real milk tea. Cheers!
A tool for analyzing the size of compiled Go binaries, offering cross-platform support, detailed breakdowns, and multiple output formats.
Related contents:
Launched in 2016, the HTTP Observatory enhances web security by analyzing compliance with best security practices. It has provided insights to over 6.9 million websites through 47 million scans.
Related contents:
Zsh is a shell designed for interactive use, although it is also a powerful scripting language. Many of the useful features of bash, ksh, and tcsh were incorporated into zsh; many original features were added.
Related contents:
a delightful & open source framework for Zsh.
🙃 A delightful community-driven (with 2,400+ contributors) framework for managing your zsh configuration. Includes 300+ optional plugins (rails, git, macOS, hub, docker, homebrew, node, php, python, etc), 140+ themes to spice up your morning, and an auto-update tool that makes it easy to keep up with the latest updates from the community.
Related contents:
Looking for inspiration? Browse our curated collection of HTML UI components ready to drop into your next project.
Build your retro component library
A set of 8-bit styled components and a code distribution platform. Works with your favorite frameworks. Open Source. Open Code.
Ship Faster With Catalyst. Next.js Starter Kit.
A modern, full-stack Next.js starter kit with authentication, payments, database, and everything you need to build your next project.
🛰 Monitor how many tokens your code and configs consume in AI tools. Set budgets and get alerts when limits are hit.
Token Limit helps you monitor how many tokens your AI context files consume. Set token budgets for your prompts, documentation, and configs, then get alerts when limits are exceeded.
Keep your AI costs predictable and avoid hitting context window limits that break your applications.
Lightweight, composable MCP framework for TypeScript.
A small, fetch-first implementation of the Model Context Protocol (MCP) server APIs.
mcp-lite is a ground-up rewrite of the TypeScript MCP SDK. It keeps only the pieces you need to stand up a server: JSON-RPC handling, typed tool definitions, and an HTTP + SSE transport that works anywhere Request and Response are available (Node, Bun, Cloudflare Workers, Deno, Supabase Edge Functions, browsers with Service Workers).
The Monster Terminal UI Kernel for Rust.
Minimal, high-performance terminal UI kernel with diff-based rendering, inline mode, and RAII terminal cleanup.
Extract Dominant Colors from Images. Go CLI, REST API & JavaScript Library.
Extract dominant colors from images using k-means clustering. A fast, cross-platform CLI tool that extracts dominant colors from images using k-means clustering.
The version control system for AI agents. Embeddable version control system for AI agents.
Lix is a version control system that can be imported as a library. Use it to, for example, enable human-in-the-loop workflows for AI agents like diffs and reviews.
one command-line tool for Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, and more. Dynamically built from Google Discovery Service. Includes AI agent skills.
One CLI for all of Google Workspace — built for humans and AI agents. Drive, Gmail, Calendar, and every Workspace API. Zero boilerplate. Structured JSON output. 40+ agent skills included.
gws doesn't ship a static list of commands. It reads Google's own Discovery Service at runtime and builds its entire command surface dynamically. When Google Workspace adds an API endpoint or method, gws picks it up automatically.
Related contents:
OpenAPI to TypeScript in seconds.
Generate production-ready SDKs and validators from your OpenAPI spec. Used by Vercel, OpenCode, and PayPal.
🌀 OpenAPI to TypeScript codegen. Production-ready SDKs, Zod schemas, TanStack Query hooks, and 20+ plugins. Used by Vercel, OpenCode, and PayPal.
Related contents:
Bringing stdlibs of other programming languages to TypeScript for fun.
Locutus is ~500 TypeScript implementations of standard library functions from PHP, Go, Python, Ruby, C, and more. Each function is individually importable and tree-shakeable.
Most of these started as rainy Sunday afternoon puzzles. Some are genuinely useful. Some are just fun to write. All of them are a way to learn how different languages solve the same problems.
Network monitoring tool that maps process-to-network connections, identifies cloud providers, and detects beaconing activity. Zero-flag agent binary for deployment, aggregation server, offline ASN lookup.
Related contents:
mquire, a play on the memory and inquire words, is a memory querying tool inspired by osquery.
Zero-dependency Linux memory forensics PoC — leverages kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
Related contents:
Boot-to-Breach red team lab on AWS. Mythic, Sliver, and Havoc C2 behind a production-style Apache redirector. Deployed via Terraform.
Related contents:
Extensible MacOS system telemetry generator.
MacNoise is an extensible and modular macOS system telemetry generation framework. It generates real system events (network connections, file writes, process spawns, plist mutations, TCC permission probes, and more) so security teams can validate that their EDR, SIEM, and firewall tooling detects what it is supposed to detect.
Related contents:
CredData (Credential Dataset) is a set of files including credentials in open source projects. CredData includes suspicious lines with manual review results and more information such as credential types for each suspicious line.
CredData can be used to develop new tools or improve existing tools. Furthermore, using the benchmark result of the CredData, users can choose a proper tool among open source credential scanning tools according to their use case. We sincerely hope that CredData will help minimize credential leaks.
Related contents:
CredSweeper is an advanced credential detection tool designed to identify exposed credentials such as passwords, API keys, tokens, and other sensitive information across source code, configuration files, documents, and binary assets. CredSweeper scans regular files, embedded data in containers, and files added in Git commits. The tool combines pattern-based detection, machine learning–based validation, and deep file inspection to deliver comprehensive and accurate security scanning for modern codebases and repositories.
Related contents:
An executable to convert SOCKS5 proxy into HTTP proxy.
Related contents:
An open-source desktop application to create and manage application launchers (.desktop files) on GNOME-based Linux systems.
Related contents:
a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems.
Tinyproxy is a small, efficient HTTP/SSL proxy daemon released under the GNU General Public License. Tinyproxy is very useful in a small network setting, where a larger proxy would either be too resource intensive, or a security risk. One of the key features of Tinyproxy is the buffering connection concept. In effect, Tinyproxy will buffer a high speed response from a server, and then relay it to a client at the highest speed the client will accept. This feature greatly reduces the problems with sluggishness on the Internet. If you are sharing an Internet connection with a small network, and you only want to allow HTTP requests to be allowed, then Tinyproxy is a great tool for the network administrator.
Related contents:
A self-hosted control plane for Nebula overlay networks.
Related contents:
Incus-based container management with native KDE/Plasma integration. A distrobox-like tool using Incus as the container/VM backend, designed for KDE Linux.
Related contents:
Symfony bundle to isolate your app's doctrine database tests and improve the test performance.
This bundle provides features that help you run your Symfony-framework-based App's testsuite more efficiently with isolated tests.
It provides a StaticDriver that will wrap your originally configured Driver class (like DBAL\Driver\PDOMysql\Driver) and keeps a database connection statically in the current php process.
Related contents:
The free and open source React Native vibe coding IDE Text to mobile apps in seconds Ask chat anything, and turn your words into iOS, Android and web apps at the same time.
The React Native Vibe Code SDK lets you build text to mobile & web apps in seconds. A full suite of packages to run your your own vibe coding features or platform.
Get Better at Getting Better.
DORA is the largest and longest running research program of its kind, that seeks to understand the capabilities that drive software delivery and operations performance. DORA helps teams apply those capabilities, leading to better organizational performance.
Related contents:
Take Back Control of DevOps.
Configuration as data lets you see what will happen before it happens.
Related contents:
The Open Container Initiative is an open governance structure for the express purpose of creating open industry standards around container formats and runtimes.
Established in June 2015 by Docker and other leaders in the container industry, the OCI currently contains three specifications: the Runtime Specification (runtime-spec), the Image Specification (image-spec) and the Distribution Specification (distribution-spec). The Runtime Specification outlines how to run a “filesystem bundle” that is unpacked on disk. At a high-level an OCI implementation would download an OCI Image then unpack that image into an OCI Runtime filesystem bundle. At this point the OCI Runtime Bundle would be run by an OCI Runtime.
Related contents:
Universal Sandbox Infrastructure for AI Applications.
Securely run commands, filesystems, code interpreters, browsers, and developer tools in isolated runtime environments.
OpenSandbox is a general-purpose sandbox platform for AI applications, offering multi-language SDKs, unified sandbox APIs, and Docker/Kubernetes runtimes for scenarios like Coding Agents, GUI Agents, Agent Evaluation, AI Code Execution, and RL Training.
The Swiss Army knife for WiFi, Bluetooth Low Energy, wireless HID hijacking, CAN-bus and IPv4 and IPv6 networks reconnaissance and MITM attacks.
bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and attacking WiFi networks, Bluetooth Low Energy devices, CAN-bus, wireless HID devices and Ethernet networks.
OS for z80 calculators
KnightOS is a third-party operating system for TI calculators. It provides a passable Unix-like system for calculators. KnightOS is built on top of the KnightOS kernel.
Vite plugin that reimplements the Next.js API surface — deploy anywhere.
Related contents:
In December 1990, an application called WorldWideWeb was developed on a NeXT machine at The European Organization for Nuclear Research (known as CERN) just outside of Geneva. This program – WorldWideWeb — is the antecedent of most of what we consider or know of as "the web" today.
In February 2019, in celebration of the thirtieth anniversary of the development of WorldWideWeb, a group of developers and designers convened at CERN to rebuild the original browser within a contemporary browser, allowing users around the world to experience the rather humble origins of this transformative technology.
Advanced Command and Control Framework for Authorized Red Team Operations
Security proxy for AI agents. Scans every message for prompt injection, PII, and secrets. Defense-in-depth: Go proxy + iptables firewall + eBPF kernel monitor. YAML policy engine, audit logging, 5 AI agents with RAG knowledge bases.
Security proxy for AI agents. Sits in front of OpenClaw and scans every message for prompt injection, PII leaks, and secrets — before they reach the model or leave the network.
Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!
A reverse-engineered proxy for the GitHub Copilot API that exposes it as an OpenAI and Anthropic compatible service. This allows you to use GitHub Copilot with any tool that supports the OpenAI Chat Completions API or the Anthropic Messages API, including to power Claude Code.
Related contents:
sub-500ms latency phone agent orchestration. A voice agent framework in ~600 lines of Python.
Related contents:
pre-trained enterprise-grade Voice Activity Detector.
Related contents:
A collection of AI agent skills for working with Expo projects and Expo Application Services
A batteries-included framework for building interactive terminal user interfaces with React and Ink.
giggles is a batteries-included framework for building terminal user interfaces (TUIs) with React and Ink. It handles focus management, input routing, screen navigation, and theming out of the box — along with a component library covering most TUI use cases and terminal utilities for things like handing off control to external programs. Everything is declarative and composable, so you can build polished CLI apps without wiring up the low-level details yourself.
Dependency tools for git
A git subcommand that indexes your dependency changes into a queryable database. Find out who added a package, when, and why.
Related contents:
Square’s meticulous HTTP client for the JVM, Android, and GraalVM.
Related contents:
Java Evolved. Your Code Can Evolve Too!.
A collection of side-by-side code comparisons showing old Java patterns next to their clean, modern replacements — from Java 8 all the way to Java 25.
Mesurons le niveau de dépendance technologique de nos organisations, et reprenons notre destin numérique en main.
Related contents: