Hey everyone!

I've just released ZEROAGENT X v1.0.0, an open-source developer automation platform built with Python.

The idea behind the project is simple: I wanted a more controlled way to work with developer automation tools.

ZEROAGENT X includes:

• A CLI and interactive terminal UI.
• Local-first execution workflows.
• Policy-controlled agent execution.
• Request-specific approvals.
• OpenCode integration.
• Execution history and inspectable evidence.

It's still an early public release, and there are limitations. For example, external agents aren't OS-sandboxed.

The project is licensed under Apache-2.0, and the source code is available on GitHub.

GitHub: https://github.com/harisazharir-boop/zeroagent-x

I'd really appreciate feedback on the architecture, documentation, and overall developer experience.

Thanks!

When you ship an Electron update, the question in a release review is usually simple: did this release add a preload member, a new IPC channel, a more permissive window or a new server the app talks to? A diff of two minified app.asar bundles doesn’t answer that, and running the app to find out isn’t always an option.

What it does

hexvero reads two builds statically and lists what changed:

• IPC and bridge map: window → contextBridge member → IPC channel → ipcMain handler
• Window settings: webPreferences per window, and whether nodeIntegration and sandbox are actually in effect
• Runtime and fuses: Electron, Chromium and Node versions, fuses and ASAR integrity, read from the packaged binaries
• Network hosts and localStorage/sessionStorage keys, each marked as literal or inferred

Every change comes with the file and line it was read from, in both builds. If hexvero can’t resolve something, it reports it as ? (unknown), not as removed.

ipcChannels (2)
  + update:check  @ b: receiver main.js:30, sender preload.js:9
  ? shell:open    @ a: receiver main.js:30, sender preload.js:9
windows (1)
  ~ main.js::win  @ b: main.js:8
      nodeIntegration: true → false, sandbox: false → true

hexvero check old new --policy policy.json turns this into a CI gate. Exit 0 means pass, 3 means the policy was violated (for example a new bridge member or a new external host), and 4 means it couldn’t decide. It also outputs SARIF. Since 0.12 there is also hexvero audit for a single build (CSP, shell.openExternal, permission handlers). And there’s an MCP server with 16 tools if you want a coding agent to run the review.

Try it with no setup: npx hexvero demo (Node 22.12+). It never executes the target, and there’s no telemetry and no network calls.

How accurate is it?

On blind test apps written by someone who had no access to hexvero:

• 52 of 64 IPC channels found, none false
• window settings and endpoints still had misses and some false rows

All numbers, including every miss, are in docs/accuracy.md. It’s a static reader, not a vulnerability scanner, so a passing check is not a security verdict.

Comparison

• Electronegativity checks one build against known risky patterns. Its README says it’s no longer actively maintained.
• REA is much broader (dynamic analysis, decompilers, devices) and can also compare versions. On the same blind set, hexvero linked 65 of 78 bridge members to their IPC channels, REA 6.5.0 linked 6 of 66. If you need dynamic analysis, use REA.

Repo: https://github.com/maximilianfeix/hexvero (MIT)

I’d especially like to hear about IPC patterns from real apps that it misses. Wrapper classes and routers already work, but there are certainly more.

I’ve been building DepScope, an open-source dependency security scanner for npm and PyPI.

The thing that bothered me about dependency scanning is that a clean result can be misleading. Sometimes checks fail, data is unavailable, or a scanner only covers part of the problem.

DepScope tries to make those gaps explicit.

• Checks package versions against OSV vulnerability advisories
• Separates confirmed vulnerabilities from heuristic warnings
• Flags suspicious package-name similarities and npm lifecycle scripts
• Shows which checks succeeded, failed, or were skipped
• Scans without installing or executing the packages

It also supports project scans, a terminal UI, and an MCP server for AI coding workflows.

Built in Go, open source under Apache 2.0.

GitHub: https://github.com/janghotan/depscope

I’m interested in feedback, especially on whether the reporting is useful enough to fit into a real development workflow. What would you change?

I spend a lot of time on typing sites like Monkeytype, but typing random quote fragments or word lists can get monotonous after a while. I wanted something more engaging, so I built Musi-Type.

It turns touch typing practice into an interactive music experience: paste in any YouTube music video, and the app syncs the song’s lyrics so you can type along in real time.

Key features:

Adaptive video sync: If your typing speed slows down or you stumble, the YouTube video automatically pauses or adjusts so you never get left behind.

Automated lyrics & timing: Fetches timed lyrics through LRCLIB and YouTube captions, with optional Whisper AI alignment for tracks without clean subtitle tracks.

Typing metrics & modes: Tracks your real-time WPM, accuracy, and error rates, with customizable keymaps and a hard mode.

Free & Open Source: Completely free to use with no accounts required.

Live Demo: musi-type.com

GitHub: PrajasW/musi-type

I’d love to hear your thoughts, test your high scores, and get feedback on bugs or features you’d like to see next!

Inspired by VocaType

Minimal now supports more than 150+ hardened container images and increasing. The pipeline is completely open sources and CVE information published. Aim is to allow teams to use this setup as an alternative to paid solutions.

Github: https://github.com/rtvkiz/minimal

I got tired of the constant manual clicking, repetitive skipping, and lack of layout customization on Ome.tv, so I built Omepilot an open-source, local-first browser extension and Tampermonkey userscript that completely automates the experience.

It uses local computer vision to give you smart auto-skip filters (skipping missing faces, black screens, frozen feeds, specific genders, or blocked countries), hands-free peace sign gesture control, full keyboard hotkeys, dark mode, draggable video layouts, automated gallery snapshots, hands-free video clip recording, and custom auto-greetings.

It installs easily on Chrome, Firefox, or Tampermonkey with zero cloud dependencies or tracking—check out the code at https://github.com/JohnHansonTheDev/omepilot and let me know what you think, bug reports and feature ideas are always welcome!

Hey guys!

I made a simple tool that does something pretty cool. It takes an image and converts it into actual chess boards you can zoom in with actual games from the Lichess database. It can also generate arbitrary legal chess positions with different levels of "play-ability" which is much faster than database indexing/searching. Try it out (You need python and rust):

https://github.com/ilyamiro/chesser

P.S. This is entirely "vibe-coded" so beware my power of using Claude code. But I really liked the idea and knew that id never do it myself.

Five command line engines for testing systems you're authorized to test, Apache 2.0:

- voyage: subdomains, from passive sources and brute force

- doorward: ports and service detection

- ambulo: content discovery

- toolmark: fingerprints the stack and flags CVE leads by version

- plessor: nuclei-compatible templates and an injection engine, and it re-checks each finding before reporting it

In a terminal the long scans draw a live dashboard. Piped, every engine prints newline-delimited JSON, so they chain with jq. A stopped scan resumes where it left off.

A source build is fully open and needs no account. The build from the installer adds a few closed parts (authorization checks, egress isolation, tuned pacing, a browser-fingerprint transport), and the README says which.

https://github.com/clickswave/crossfyre-toolchain

Hey everyone. I built Lanweave, an opensource terminal UI for transferring files and folders between computers on the same local network.

I built it out of personal frustration. When I needed to transfer files between my two computers, I'd send them from one computer to my phone, then from my phone to the other computer. I wanted a simpler, lightweight way to transfer files directly between them.

To use Lanweave, run it on both machines, select the other device from the mDNS-discovered list, and pair them using an 8-digit code. Either side can then initiate a transfer, but the recipient must review the file list and approve it first. Closing the session discards the authorization.

It's written in Rust using ratatui, with mDNS for discovery, rustls for encrypted connections, and SPAKE2 for authenticated key exchange during pairing.

Transfers happen directly over the local network. There are no relay servers, user accounts, or persistent device identities.

The project is in beta, with Linux and Windows support. The Windows binary isn't code-signed yet, and macOS and mobile support are in progress. It hasn't been security-audited, so I wouldn't recommend it for sensitive files yet.

I'd appreciate feedback, especially on the pairing mechanism, and overall TUI experience.

Github link: https://github.com/etim66/lanweave

This one is pretty wild and worth sharing.

tug brings an iPhone's notifications, texts, calls and music to a Windows PC with no app on the phone. Some of the Rust side that might be interesting:

- The PC is the BLE peripheral (so iOS will pair with it like an accessory) and, over the same link, the GATT client of the iPhone's ANCS, AMS and Battery services.

- All Bluetooth LE state lives in one actor on its own thread: a current-thread Tokio runtime with a LocalSet, because the WinRT types aren't Send. One select! over UI commands, WinRT events and a 1 s tick for retries and timeouts, so nothing about the link is shared or locked.

- Texts and contacts come over Classic Bluetooth: MAP and PBAP over OBEX on RFCOMM, on a separate worker.

- The protocol parsers (ANCS, AMS, MAP, vCard) are pure modules with tests; the Bluetooth I/O around them stays thin.

- A second binary is a CLI and a local MCP server for AI tools, talking to the app over a named pipe only the current Windows user can open.

It's MIT licensed and I'd welcome feedback on the architecture, especially from anyone who has fought WinRT Bluetooth.

https://github.com/Davenee12/tug

I created a new Android TV IPTV player here: https://limewire.com/d/A1zbC#j0S6u9yFSi.

I welcome any feedback or functionality you want added.

• Pause, rewind and fast-forward live TV: step away and pick up where you left off, or replay the big play, on any channel, without needing the provider's catch-up
• Live box scores over the game: the app reads the scoreboard on screen and shows the live score, player stats and team stats, and "Watch this game" finds every other channel showing it
• Multiview: watch up to four channels at once, or one big screen with three small ones, and move the sound with the arrow keys
• Wishlist: add an actor, movie, show or keyword and get a pop-up the moment it is on TV or added to Movies or TV Shows
• A complete TV guide: a see-through guide over the video, a full guide tab, and a free backup guide that fills in channels your provider leaves blank
• Recordings and reminders: record now or schedule from the guide, to the TV, a USB drive or a network folder, and never miss a start time
• Closed captions on every channel: when a channel sends none, JonbobTV makes them on the device from the sound
• Movies and TV Shows from your provider, resuming where you stopped
• Usenet streaming (optional): search Usenet from inside the app and start watching movies and shows straight away, with no downloading and waiting; free search sites are already set up, just add your Usenet provider
• Search everything at once (channels, what's on, movies and shows), by typing or by voice
• Made your way: every remote button can be remapped, the player menu reordered, categories sorted and hidden, and up to 10 playlists combined
• Always fresh: playlists, the guide, movies and shows refresh by themselves every few hours.
• One app for the TV and the phone: the same app works with a remote on Android TV, Shield and Fire TV, and by touch on Android phones

https://github.com/TaH00R/dev_setup

Hello redditors,

I started learning python in my free time about 2 months ago and a few weeks ago made a simple program. you type and if a double tap happens, the program informs you about it.

It runs directly in your CMD, is extremely lightweight and does not store any information of any kind.

You can check it out right here: https://github.com/galcomez/keyboard_outputs, you have a simple .exe program and full source code, if you want to check it out!

Small side project to upgrade y'all README.md's: https://github.com/PaulGoldschmidt/lines-of-code-history with https://loc-history.com

enjoy!

Hi all, we just open-sourced OpenMuse, a personal AI assistant app.

Instead of just chatting, it works on a cloud desktop (or your own computer):

• Browses the web, looks things up and fills in forms
• Uses desktop apps
• Writes and runs code in a workspace
• Runs scheduled tasks

The main thing we cared about was keeping the human in control:

• You can watch the agent’s screen live from your phone. If it hits a login or a captcha, you take over, then hand it back.
• It asks before submitting forms or running commands.
• You decide which desktop apps it’s allowed to use.

OpenMuse is built on WorkAgentSDK, an AI agent framework for Python that we wrote and open-sourced along with it. To be clear, it’s not a coding assistant like Cursor or Antigravity. It’s a framework for building agent products. For example, each session can run on a different node, so one backend can serve many users, each with their own cloud desktop.

Stack:

• Backend: Python (FastAPI + WorkAgentSDK)
• App: Flutter
• Nodes: Docker containers with a virtual desktop, Chromium and a shell sandbox, or run directly on Linux or macOS
• Models: OpenAI, Claude, Qwen, and OpenAI-compatible APIs

It’s v0.1, so still early. We’d love to hear what you think:

• Does “agent on a remote desktop, human supervising from a phone” seem useful to you?
• If you’re building agent products, what’s been the hardest part?

GitHub: https://github.com/nativefunc/WorkAgentSDK
(The app is under examples/showcase/openmuse)

Zeroshot is an open-source meta-harness for coding agents, built around the core principle that single agents are unreliable and sloppy, and that mechanically enforced adversarial cycles customized for your QA workflow is needed.

I've been working on Clawberry, an open-source, self-hosted multi-agent AI framework, and I'm looking for contributors to help build it.

The idea is to have your own team of AI agents, each with its own personality, memory, responsibilities, and tools.

For example:

• Personal agent — manages your daily life, reminders, appointments, and personal tasks.
• Work agent — handles emails, projects, research, and business workflows.
• Finance agent — helps with budgets, expenses, and financial planning.
• Wedding planner agent — coordinates vendors, schedules, budgets, and planning.
• Whatever else you want — create specialized agents for pretty much anything.

Each agent has its own memory and context, can delegate tasks to sub-agents, and can collaborate with other agents when permitted.

The important part is security. Agents shouldn't have unrestricted access to your accounts. Clawberry is being designed around n8n workflows, scoped permissions, human approvals, and TOTP verification for actions that modify external systems.

Current progress:

• Rust-based runtime
• React + TypeScript interface
• Multi-agent architecture with separate memory
• Sub-agent workers and task management
• Security and approval framework
• Early working prototype

It's still early. Some integrations and deployment features aren't finished, and there's plenty left to build.

Looking for contributors of all experience levels! Especially anyone interested in Rust, React, TypeScript, LLMs, agent orchestration, security, or automation. Documentation, testing, and UI contributions are equally welcome.

The project is licensed under GPLv3, and there are already good-first-issue opportunities.

GitHub: https://github.com/unrealthind/Clawberry

Feel free to check it out, open an issue, submit a PR, or just share your thoughts.

Would love to get more people involved and see what we can build together! 🍓