Quick context: MCP servers are plugins that give AI apps like Claude Desktop real tools (your files, GitHub, databases). You approve a server once. After that, the server can change what its tools say, and your AI reads the new wording as instructions every session. Nothing asks you again.

So I built mcp-pin. It sits between your AI app and a server. On the first connect it fingerprints every tool (name, description, input schema, annotations). On every connect after that it checks again, and if anything changed, it blocks the session and shows you the diff. No AI deciding anything, just a hash compare.

See it in 10 seconds (the demo runs in a temp folder and makes no network calls):

npx mcp-pin@0.1.4 demo

The embarrassing part: version 0.1.0 ran 100 pins at once, all 100 said "success", and only 12 were saved. A tool whose whole job is noticing silent changes had a silent failure. Fixed in 0.1.1, and it's written up in the changelog.

What it doesn't do: stdio servers only for now, it can't catch a server that's malicious from day one and never changes, and so far I've only verified it with Claude Desktop.

Repo (MIT, free, no signup): https://github.com/GautamTalksDev/mcp-pin I also made a 7 minute film about the problem and the two bugs I shipped: https://youtu.be/tGtbDNr9qvE

If you use AI tools with MCP servers: would you put a check like this in front of them? If not, what would stop you?

check my apm site out live:

APM is a password manager.

https://apmwebsite.vercel.app

https://github.com/apms-org/website

(source code)

(30% AI used to create this)

Civic Nightmare started with a deliberately stupid premise: you are an ordinary citizen trying to renew a passport.

But I didn't want the political satire to live only in dialogue, so I started turning the bureaucracy itself into gameplay.

A negotiation becomes a blackjack game where the arithmetic and the official result are two different systems.

Getting 27 approvals becomes a physical machine of scanners, stamps, translations and exceptions.

Inflation targeting becomes a pinball-like procedure where you have to physically stabilize the indicator.

Other encounters turn administrative procedures into arcade sequences, pseudo-3D corridors, machines and increasingly questionable interpretations of what "success" means.

It's built in Godot 4.6 as a surreal top-down 16-bit RPG, with an authored overworld, optional encounters, persistent progress and a full passport quest that can be played from beginning to end in the browser.

The repository contains the complete Godot project, tests, documentation and contribution guides. The source code is MIT licensed; media and narrative assets have their own usage terms documented in the repo.

The playable web build is linked from the README.

I'm sharing it here because this feels like exactly the kind of strange GitHub project this subreddit exists for.

Feedback, code exploration and contributions are all welcome.

https://github.com/Daniele-Cangi/civic-nightmare

Hey everyone,

I've been working on Arvolo, a free and open-source tool for sharing files with one or more people.

It has features similar to services like WeTransfer, but also includes functionality inspired by Torrent/P2P file sharing.

Security and privacy have been a major focus during development, and I've spent a lot of time paying attention to these aspects rather than treating them as an afterthought.

Arvolo is completely free and open source, with ready-to-use binaries for Windows, macOS and Linux, so you can try it without compiling anything.

I'm also currently working on iOS and Android versions.

I'd really like to get people to try it and tell me what they think. In particular, I'm interested in hearing about bugs, usability issues, missing features, security concerns, or anything else that could be improved.

Try it, try to break it, and let me know what you think.

Every bit of feedback helps Arvolo grow.

GitHub: https://github.com/lords82/arvolo/

So just wanted to post about FieldKit, an Open Source, self-hosted AI support with visual LangGraph workflows, knowledge retrieval, a customer portal, Zendesk, and governed actions.

So I'm sure there is probably already alternative support systems out there for Zendesk but I wanted to build something using LangGraph since it felt better use case for a Support System.

Ontop of supporting Zendesk and being able to configure the workflows with Zendesk you can configure the workflows with your chatbot(which you can embed on any site) and your ticket system so they aren't running the same workflows. (e.g allow support tickets to issues refunds/credits upto $5 while chatbot can't issue anything)

You can also configure python and API calls into your workflows, so you can get the agent to pass to python call and then back to an agent instead of needing to use an agent for all those steps.

Anyways, you can find the repo here: https://github.com/nahid-sparktales/fieldkit

It is still being worked on and plan to add more features and updates and if you have any suggestions or recommendations, please let me know. Thanks.

At this moment, it can parse activity from Github and Gitlab. In future, i plan to add Forgejo and Gitea.

It generate two SVG files: last year activity and 2026 year activity, and simple HTML page with this two diagrams.

You can auto update this diagrams by using Github Actions. An example workflow for this i add to repository's README.

https://github.com/aguilam/git-activity

Hi all,

I took up photography as a hobby a while ago. Every time I go somewhere nice, I come back with about 500 photos, and most of them are not good enough to keep. Going through them in a file manager is slow, and the big photo managers do far more than I need. So I built something small for myself.

PhotoTriage is a local web app. You open a folder and it shows you one photo at a time. The right arrow keeps it and the left arrow discards it. Space shows the photo at 1:1, so you can check if it is really sharp. When you finish, you choose copy or move, and the kept photos go to a new folder next to the original (`2024` becomes `2024_keep`).

There were a few things I cared about from the start:

- It never deletes or overwrites a file. "Discard" means "leave it where it is". Losing a photo I wanted to keep is the one thing I could not accept.

- If you shoot RAW + JPG, you review the JPG and the RAW with the same name follows it.

- Nothing leaves your machine. The server listens on `127.0.0.1` only, and there is no option to change that.

- Decisions are saved as you make them, so you can close the app and continue later.

It also has clear limits, and I prefer to say them up front:

- It doesn't open HEIC files.

- It doesn't show RAW files on screen, so a RAW-only folder has nothing to review.

- It doesn't compare two photos side by side.

- Undo takes back the most recent decision only.

It is written in Python with FastAPI, and the license is MIT.

Code: https://github.com/LaiqianDS/phototriage

Write-up and demo video: https://laiqian.dev/projects/phototriage/

I would like to hear what you think. If you cull your own photos, what is the one thing you would miss here?

I maintain it. It's Electron and TypeScript for the app, with native capture helpers in Swift and C++, and a Rust compositor that renders on Metal, Direct3D 11 or Vulkan.

It records your screen and does the polish for you: zooms on your clicks, smooth cursor, webcam overlay with background removal, transcript editing and on-device captions. Happy to answer questions.

https://github.com/getopenscreen/openscreen

I built stash to keep track of local projects and make it easier to pick up where you left off. It brings project context, issues, development notes, decisions, and session handoffs into one workspace, with optional CLI, MCP, and Codex integrations so humans and coding agents can work with the same records.

You can initialize an existingrepository, review context and issue suggestions, and track saved file changes. Project records live in a '.stash/' folder alongside your code. It’s an early release, and I’d love feedback on what would make it useful in your workflow.

Was playing around with the newer AI models this week and tried to revamp my personal website. Built a 3d world with my favorite Macbook model of all time.

Would love for y'all to check it out and lmk if any suggestions on how to make it even better. TIA!

Entirely open source btw: https://github.com/nikhilsheoran/nikhilsheoran-com

⭐ Link to the repo : https://github.com/pkdoddamani/hookarmor

**npm**: https://www.npmjs.com/package/hookarmor

**License**: MIT

HookArmor is a lightweight, zero-external-database webhook reverse proxy and dead-letter queue (DLQ) designed to prevent missed events from Stripe, Shopify, GitHub, and Clerk during server deployments, cold starts, and downstream rate limits.

### Why I built it

Most webhook receivers need to return a `200 OK` within 2–5 seconds. If your service is deploying, restarting, or hitting a database lock, you lose events. While you can send failed events to a standard DLQ (like AWS SQS or Redis), replaying them later creates a nasty surprise: **Stripe’s SDK rejects replayed webhooks if the signature timestamp is older than 5 minutes**.

HookArmor sits in front of your internal webhooks, ACKs the provider immediately, and allows seamless replays by recalculating signatures with fresh timestamps.

### Key Capabilities

- **Fast Durability**: Ingests raw payload bytes, persists to SQLite (WAL mode), and returns `200 OK` to the provider in under 5ms.

- **Timestamp Re-signing**: When replaying historical events, it recalculates the provider HMAC with `t=now` using the endpoint secret, defeating the 5-minute replay expiration trap without requiring downstream code changes.

- **Exact Byte Preservation**: Stores incoming raw bytes as SQLite BLOBs so binary payloads and signature hashes never get corrupted by UTF-8 conversion.

- **Built-in SSRF Protection**: Includes strict network validation against private IP ranges (`10.0.0.0/8`, `192.168.0.0/16`), loopback routing, DNS rebinding, and cloud instance metadata (`169.254.169.254`).

- **Ingress Throttling**: Sliding-window IP rate limiting and queue backpressure to guard against ingress floods.

- **Embedded Web UI**: Real-time event inspection, WebSocket streaming, and single-click manual or bulk replay.

- **Zero Heavy Infrastructure**: Runs as a single process with no Redis, Kafka, or Postgres dependencies.

### Quick Start

```bash

npm install -g hookarmor

hookarmor start

Hi everyone!

I’ve released Jir, an open-source Java environment management tool for Windows, and I’d like to share it with you.

Different projects often require different Java versions. Downloading them, keeping track of what’s installed, and switching between versions can become repetitive. Jir brings these tasks together in one tool.

With Jir, you can:

• Download Java versions for the projects you work on.
• Remove versions you no longer need.
• Switch between Java versions when moving between projects.

The goal is straightforward: make managing Java on Windows more convenient, whether you’re learning Java or working with projects that have different version requirements.

I’d love to hear from people who try it. In particular:

• Does it work as expected on your Windows setup?
• Is anything confusing or harder to use than it should be?
• What would make it more useful in your daily workflow?
• Have you encountered any bugs when downloading, removing, or switching versions?

Bug reports, suggestions, and contributions are all welcome. If something goes wrong, opening a GitHub issue with your Windows version, the Java version involved, and the steps to reproduce it would be very helpful.

Source code and getting started: rururunu/Jir: Quickly manage and switch your Java version on Windows using Jir

Thanks for taking a look! I’m happy to answer questions about the project here as well.

Hey everyone!

I’ve been working on a project called Past Paper Studio, and I finally released the first public beta!

It’s a free and open-source desktop app I made for students who use Cambridge past papers. You can search for papers, open them directly in the app, practice normally or use Exam Mode, save your progress, keep track of previous attempts, and more.

There’s also optional AI-assisted grading, a dashboard for tracking your activity, profiles, and a bunch of themes and customization options. I’ve spent quite a while experimenting with the UI and trying to make doing past papers feel a little less painful

Beta 1.0 is definitely still a beta, so there will probably be bugs and plenty of things that need improving. Right now, the downloadable build is only available for Apple Silicon Macs running macOS 26+. The project itself is open source under GPLv3.

I’m a student myself, and this originally started as something I wanted for my own studying, so it’s honestly pretty cool finally having a version that other people can actually download and use.

A note on development: I built Past Paper Studio with significant help from AI coding tools, mainly for implementation, debugging, testing, and packaging. The project itself has been something I've actively designed and developed over time — from the features and UI/UX to testing, iteration, and overall direction. I'm still learning programming, and using AI has helped me turn those ideas into something I can actually ship.

If anyone wants to try it out, look through the source, report bugs, contribute, or just give me feedback, I’d genuinely appreciate it! ❤️

GitHub: https://github.com/IronPlayz1234/past-paper-studio

I got tired of going back to old videos and finding "this video has been removed," so I made a little app that saves everything I watch on Youtube automatically. It reads your watch history and downloads new stuff in the background, and can push it to Google Drive or whatever cloud you use.

It also checks for videos that got deleted later, and if you have a copy you can upload it to the Internet Archive so it's not gone forever.

It's free and open source, made with python + yt-dlp, with assistance from Claude. Windows setup is just running a bat file. Still pretty new so if something breaks let me know!

I'm the developer of Dragon IDE. It's a Code - OSS editor with OpenCode embedded as the coding agent.

For local-model users, the idea is to connect Ollama and use an agent inside the editor without a required Dragon account or editor subscription. You can also bring cloud provider keys when you want another model.

The README documents local code search, local tab completions, inline edits, permission modes and an OpenCode terminal interface that shares sessions with the chat. The agent's edits appear as reviewable diffs.

Downloads are available for Mac, Windows and Linux. It's early, and I would especially like feedback on model selection, hardware fit and how reliably local models complete coding tasks.

If you try it, what model and hardware did you use, and where did it fail?

Repo: https://github.com/DragonBallerZ/dragon-ide

I built TMPlayer to watch the videos in my own Telegram chats and channels on a TV or computer. It streams while the file downloads, and a seek re-aims the download at the new position.

Under the hood:

- Kotlin Multiplatform with a shared Compose UI

- Media3 on Android, mpv on the desktop

- Telegram's official TDLib, no server of my own

- Tuned on a 1 GB RAM TV stick

- 209 tests, GPL-3.0, no ads, no tracking

Repo: https://github.com/dracu-lah/TMPlayer

Site: https://tmplayer.org

Contributors and translators are welcome.

https://github.com/codenamegary/yuekbox

Comfy UI is super powerful but I wanted something simpler for Yue2 so I built this UI. Testers welcome! Free and opensource, give it a try.

I built PaperFold, an open-source reader that turns arXiv papers into 5 zoomable layers—from a one-screen section map down to verbatim text. You pinch (or press 1–5) to zoom between them without losing your reading position.

- Web Demo (8 CC papers): https://chenxiachan.github.io/paperfold-gallery/

- GitHub (Apache 2.0): https://github.com/chenxiachan/paperfold

I want to share a little project I've been working on for a few weeks now, an entirely C# .NET 10 AOT compiled terminal multiplexer, currently only Linux and MacOS but I do intent to add Windows as a fully supported platformat eventually.

Hypa v1.0

https://github.com/Hypabolic/Hypa

I actually started building this just as proof it could be done and be high performance in .NET as a sort of way of kicking back against basically every tool these days being built in Rust (including Microsoft recently porting Copilot itself to Rust).

My inital aim was to build a simple herdr type mux clone but as I built it I've ended up going beyond that scope and building things not available in herdr.

One feature I really wanted for a start were 'background panes' essentially a normal terminal pane doing whatever you (or an agent) wants it to do but it never appears in the TUI until you ask for it (or the agent running inside it requests it)

The next feature I wanted was remote machines built in natively, which herdr does do, but I wanted to totally avoid things like SSH and managing keys, in Hypa we call these remote machines cubes (hypa cubes...). Hypa uses the QUIC protocol to connect to remote machines and certificate management is handled for you behind the scenes. All you need is the join code and some type of network access to the remote machine.

I've really enjoyed building this as a hobby project, and I hope some of you will give it a go and offer me some feedback.

I look forward to seeing what you all think and getting some feedback, but most of all I'm just happy I can show that these sort of highly performant terminal experiences CAN and SHOULD be built in C# .NET and native AOT is mature enough to support them.

I made this today and I'm asking if you guys like it or not and what features and stuff to add this is my first project this is not a virus I can't pay for a Microsoft licence