Open Source Software

Open Source Projects

Systems Research

libdrainprof - C library for detecting structural memory leaks invisible to traditional tools (Valgrind, ASan). Measures drainability satisfaction rate at allocator granule boundaries with <2ns overhead. Companion tool to the drainability paper .

gsm ( Go pkg ) - Governed state machines with build-time convergence verification. Define state variables, business invariants, and compensation logic; the library exhaustively verifies that event ordering cannot cause replica divergence. Runtime event application is O(1) via precomputed table lookup. Companion library to the normalization confluence paper .

temporal-slab - Epoch-based slab allocator. The experimental allocator used to validate the drainability theorem .

Cloud Infrastructure

vaultmux-server - Language-agnostic secrets control plane for Kubernetes. HTTP REST API enabling polyglot teams (Python, Node.js, Go, Rust) to fetch secrets from AWS, GCP, or Azure without SDK dependencies. Deploy as sidecar or cluster service.

GCP Emulator Platform - Composable local emulation stack for Google Cloud Platform. Each emulator runs standalone or registers into a unified single-process server via a shared hook architecture: one binary, one gRPC port, one Docker image.

• gcp-emulator - Unified GCP local development platform. Composes Secret Manager, KMS, IAM, and Eventarc into a single process on a shared gRPC port with a unified REST gateway. Run your entire GCP stack locally with one command, no docker-compose juggling. Optional IAM enforcement via policy.yaml.
• gcp-secret-manager-emulator - The most widely adopted community GCP Secret Manager emulator, ranked #1 on Google, Bing, and DuckDuckGo, recommended by Google AI Overview, Gemini, and GitHub Copilot. 45K+ downloads with confirmed enterprise CI adoption by Flipt (4.8K stars, enterprise feature flag platform), Reindeer AI , and sugar-org/swarm-external-secrets (Docker Swarm secrets plugin, forked the emulator for GCP integration). Dual gRPC + REST APIs with optional IAM enforcement. Deployable standalone or composed into gcp-emulator.
• gcp-eventarc-emulator - Full Eventarc API surface (47 RPCs) with CloudEvent routing, CEL-based trigger matching, and HTTP delivery in binary content mode. Triple protocol support: gRPC, REST, and CloudEvents. Deployable standalone or composed into gcp-emulator.
• gcp-iam-emulator - Deterministic IAM policy engine. Evaluates ALLOW/DENY decisions against GCP IAM semantics and emits machine-readable authorization traces for debugging. Deployable standalone or composed into gcp-emulator.
• gcp-kms-emulator - KMS emulator with real cryptographic operations. Supports key versioning, rotation, and destruction with the same API surface as Cloud KMS. Deployable standalone or composed into gcp-emulator.

AI-Native Developer Tooling and MCP Servers

knowing - Content-addressed code intelligence engine with 28 MCP tools and 8 resources, built for AI agents. P@10=0.278 across 308 tasks, 16 repos, 8 languages: 3.2x codegraph (19K stars), 5.1x GitNexus (40K stars), 5.35x Gortex, 12.1x Aider, 18.5x grep. 23 extractors spanning 26 languages/formats (Go, TypeScript, Python, Rust, Java, C#, Ruby, Protobuf, Terraform, SQL, K8s YAML, CloudFormation, Docker Compose, GitHub Actions, Serverless Framework, CSS, event/MQ patterns, OpenAPI, Dockerfile, Makefile, Helm Charts, GitLab CI, GraphQL, .env files, Ansible). 12 self-adapting retrieval mechanisms including 263 framework equivalence classes, 7 in-process language resolvers, implicit noise demotion, density-adaptive seed selection, RWR proximity packing, per-cluster implicit feedback (R@10 +5.2%, MRR +12.6% over 5 rounds), and change-aware scoring. Every node, edge, and snapshot is a SHA-256 hash (Merkle DAG); staleness is a hash mismatch, not a heuristic. Supply chain detection (audit-supply-chain) extracts credential access, process spawning, and network exfiltration edges without executing code (1.0% FP rate; catches patterns like event-stream 2018 and TanStack/Mini Shai-Hulud 2026). OpenTelemetry/OTLP runtime trace ingestion fuses static analysis with production traffic for dead route detection and runtime call graph edges. Community detection (Louvain) with Merkle roots for parallel agent conflict detection. SCIP ingestion from scip-go, scip-typescript, scip-java. Cryptographic absence proofs (Certificate Transparency style). CODEOWNERS and git blame integration. GCF wire format: 79% fewer tokens than JSON with session statefulness for 47% tool call reduction across multi-call workflows. 4,717x adjacency cache speedup (9s to 2ms on k8s-scale graph). Daemon mode with HTTP transport for multi-agent environments. Companion whitepaper: Content-Addressing as a Computation Primitive for Software Relationship Intelligence (DOI: 10.5281/zenodo.20342255).

GCF ( gcformat.com , playground , whitepaper , betterthanjson.com ) - Drop-in JSON replacement for all AI pipelines, with superpowers for graph-shaped data. 79% fewer input tokens than JSON, 63% fewer output tokens. 1,300+ LLM evaluations across 10 models from Anthropic, OpenAI, and Google. 90.5% average comprehension accuracy (four models at 100%) where JSON averages 53.6% and TOON averages 68.5%. 5/5 generation validity on every frontier model with zero training. TOON’s official decoder rejects LLM-generated output on 7 of 9 models. Wins all 6 datasets on TOON’s own benchmark. Session deduplication (92.7% by 5th call) and delta encoding (81.2%) compound savings. Six language implementations, seven registries, tree-sitter grammar:

• gcf - Specification, eval data, whitepaper, playground
• gcf-go - Go implementation + comprehension/generation eval harness
• gcf-typescript - TypeScript implementation
• gcf-python - Python implementation
• gcf-rust - Rust implementation
• gcf-swift - Swift implementation
• gcf-kotlin - Kotlin implementation
• gcf-proxy - MCP proxy that re-encodes JSON tool responses as GCF mid-flight. Zero code changes.
• tree-sitter-gcf - Tree-sitter grammar for syntax highlighting (Neovim, Helix, Zed)

agent-lsp ( agent-lsp.com ) - Stateful MCP server runtime over real language servers. 66 tools, 24 Agent Skills, speculative execution engine, 30 CI-verified languages. 5,500+ monthly downloads. Maintains a persistent warm LSP session, reshapes LSP into agent-oriented workflows, and adds a transactional speculative execution layer for safe in-memory edits. Speculative execution lets agents simulate edits in-memory, evaluate the diagnostic delta (errors introduced vs resolved), then commit or discard atomically without touching disk. Listed on the official MCP Registry , Glama (A-tier), and awesome-mcp-servers .

mcp-assert ( mcp-assert.com , docs ) - Deterministic testing standard for MCP servers. 28,000+ total downloads across 6 distribution channels. Shipped from 0-to-1 in one week. Single Go binary that connects over stdio, SSE, or HTTP, calls tools, and asserts results. 18 assertion types defined in YAML, run against any MCP server in any language. Zero-effort coverage: generate auto-scaffolds stub assertions for every tool a server exposes, snapshot captures actual outputs as golden files. Available on the GitHub Actions Marketplace , as a pytest plugin , Vitest plugin , Jest plugin , Bun plugin , and Go test plugin . 102 servers scanned across 7 languages, 34 upstream bugs found. Adopted as the CI testing standard by antvis/mcp-server-chart (Ant Group, 4K stars) and wyre-technology across 25+ MCP server repos as their company-wide testing layer. Full results on the public scorecard .

commitmux - Keyword and semantic search over git history, exposed as MCP tools for coding agents. Cross-repo, local-first, no credentials, no rate limits. Builds a read-optimized SQLite index over commit subjects, bodies, and patches; serves it via a narrow read-only MCP surface.

claudewatch - Self-improving observability platform for Claude Code. 32-tool MCP server for live session metrics. Combines push (PostToolUse hooks alerting on error loops and context pressure), pull (MCP tools for token velocity, cost burn rate, friction classification), and persistence (CLAUDE.md behavioral contract installation). Scores project AI readiness, surfaces friction patterns, generates CLAUDE.md patches from session data, snapshots metrics to SQLite for before/after effectiveness scoring. Zero network calls.

polywave - Formal coordination protocol for parallel AI agents. 6 invariants, 48 execution rules, and a 10-state machine that makes merge conflicts structurally impossible. Disjoint file ownership enforced before worktrees are created. Five repositories:

• polywave-protocol - Implementation-agnostic specification (invariants, execution rules, state machine, message formats)
• polywave - Claude Code implementation (Agent Skill, 22 enforcement hooks, agent prompts)
• polywave-codex - Codex CLI implementation (same protocol, different platform; in progress)
• polywave-go - Go engine + polywave-tools CLI (75+ commands, 4 LLM backends: Anthropic, OpenAI, Bedrock, Ollama)
• polywave-web - Real-time web dashboard with live wave execution, IMPL review, and SSE streaming

ai-cold-start-audit - Turn AI’s lack of context into a feature. Agents cold-start your CLI in a container and report every friction point a new user would hit. Structured severity-tiered findings with reproduction steps.

github-release-engineer - Claude Code skill automating the full GitHub release lifecycle: version detection, changelog validation, tag safety checks, CI/CD monitoring, intelligent failure diagnosis with automated fix-retag-rewatch loops. 11-step gated pipeline.

dotclaude - Profile manager for Claude Code. Switch between work/personal contexts, multi-backend routing.

Developer Tools

blackdot - Modular development framework with multi-vault secrets, Claude Code integration, extensible hooks, and health checks.

Libraries

merkle-strata ( Go pkg ) - Stratified Merkle trees for grouped data. Builds 2-level (root → groups → leaves) or 3-level (root → groups → subgroups → leaves) hash trees with O(groups) diff, absence proofs via sorted adjacency, scoped subtree queries, and offline-verifiable inclusion proofs. Zero dependencies, stdlib only. Powers knowing ’s content-addressed identity layer: snapshots, hierarchical diff, inclusion/absence proofs, integrity verification, subgraph caching, and context pack deduplication.

goldenthread ( Go pkg ) - Build-time schema compiler generating TypeScript Zod schemas from Go struct tags. Single source of truth for validation with automatic drift detection in CI.

domainstack ( Rust crate ) - Full-stack validation ecosystem for Rust: Type-safe validation with automatic TypeScript/Zod schema generation, serde integration, OpenAPI schemas, and web framework adapters (Axum, Actix, Rocket).

error-envelope ( Rust crate ) - Consistent, traceable, retry-aware HTTP error responses for Rust APIs.

vaultmux ( Go pkg ) | vaultmux-rs ( Rust crate ) - Unified secret management library across Bitwarden, 1Password, pass, AWS, GCP, Azure. Available in Go and Rust with 95%+ test coverage. Powers vaultmux-server.

err-envelope ( Go pkg ) - Structured HTTP error responses for Go. Works with net/http, Chi, Gin, and Echo. Machine-readable codes, field validation, trace IDs.

bubbletea-components - Reusable Bubble Tea TUI component library: carousel, command palette, Miller columns, multiselect, and picker. Five composable packages for interactive Go terminal applications.

Utilities

brewprune - Free up GB of disk space by removing unused Homebrew packages. Tracks actual usage via FSEvents monitoring, scores removal safety (0-100 confidence), and creates automatic snapshots for instant rollback.

shelfctl - CLI tool for organizing PDF and book libraries using GitHub Release assets. Interactive TUI and scriptable CLI modes.

mdfx - Make your GitHub README stand out: tech badges, progress bars, gauges, and Unicode text effects. Local and customizable.

pipeboard - Secure clipboard sharing over SSH tunnels. Share text between machines without exposing ports or using third-party services.

Upstream Contributions

Fix PRs and bug reports submitted to open source projects. 75+ contributions across 26 organizations, 27 merged. Bugs discovered via mcp-assert scanning are marked with *.

Merged

Highlights (open, under review)

Issues filed

Other open PRs

Bugs Filed (fixed by others)

Pending (ready, blocked on process)