标签：#rce

I've been working on Churo, an open-source voice assistant built entirely in Python. It features high-quality speech-to-text and text-to-speech, web search, image understanding, and agentic capabilities. It runs with Ollama models and is designed to be easy to modify and extend. The goal is to provide a capable, local-first voice assistant that developers can actually inspect, customize, and build on. Repository: https://github.com/MathObsession/Churo-assistant or run it with(You need Ollama): pip install churovoice churovoice --voice male Feedback, issues, and contributions are welcome.

What are MCP Servers? The Model Context Protocol (MCP) is an open standard that lets AI agents use external tools through a unified interface. Think of it as USB-C for AI — one protocol connects any AI client (Claude Desktop, Cursor, VS Code with Cline) to any tool or data source. I built three production-ready MCP servers and published them to PyPI and GitHub. Here's what they do and how to use them. 1. Web Search MCP Server uvx crewai-web-search-mcp Two tools: web_search(query) — Searches Google/SerpAPI and returns ranked results with snippets extract_content(url) — Fetches and extracts readable content from any web page Use cases: Ask your AI about current events, research competitors, pull documentation, verify facts in real time. { "mcpServers" : { "web-search" : { "command" : "uvx" , "args" : [ "crewai-web-search-mcp" ] } } } 2. Code Review Automation MCP uvx code-review-automation Three tools: review_code(diff) — Analyzes code changes for bugs, security issues, anti-patterns, style violations check_quality(path) — Runs static analysis and returns a quality report analyze_pr(diff) — Produces a structured review: what changed, what's risky, suggestions Use cases: Paste a PR diff and get an instant review. Catch issues before they reach production. 3. Document Intelligence Server uvx document-intelligence-server Three tools: extract_document(path) — OCR and text extraction from PDFs, scanned docs, images classify_document(path) — Identifies document type (invoice, report, contract, article) summarize_document(path) — Generates a structured summary from extracted content Use cases: Process uploaded PDFs, extract data from scanned forms, summarize long reports. Pricing All three servers use a shared credit system: Tier Price Credits Free $0 50 calls/day Starter $20 2,000 calls Pro $100 12,000 calls Buy credits once, use them across any server. Credits never expire. How it works: Install with uvx crewai-web-search-mcp Use 50 free calls per day — no key needed For u

A product page is not a contract. It is a presentation surface. That distinction matters more once AI agents start interacting with commerce systems. Traditional ecommerce platforms can rely on human interpretation. A human can read a product title, inspect images, compare delivery notes, scan a return policy, notice uncertainty, and decide whether to continue. A product page can be visually useful even when the underlying commercial state is incomplete, stale, or spread across several systems. An AI agent needs a different interface. It should not need to scrape a product page, infer policy meaning from free text, guess whether inventory is fresh, or decide whether a price is reliable enough to quote. If the platform expects agents to recommend products, compare alternatives, prepare checkout, or act within delegated authority, then the platform needs to expose more than product presentation. It needs to expose commercial truth. This is the second article in the Agent-Ready Commerce series. Part 1 introduced the broader model: Facts → Eligibility → Authority → State transition → Evidence → Audit This article focuses on the first part of that chain: facts . The central argument is simple: a raw product record is not enough for agent-ready commerce. The platform needs a source-backed, freshness-aware, action-supporting view of the product before agents can safely act on it. Product pages hide too much state A normal product page compresses many different concerns into one human-readable surface: Product identity Price Inventory Images Description Badges Variants Delivery estimate Return policy snippet Warranty information Promotional copy Reviews Cross-sell modules Checkout call to action That compression is useful for presentation, but it is lossy from a systems perspective. The page may show “In stock,” but the inventory value may be several hours old. It may show a price, but the pricing source may have changed since the last feed publication. It may show a return

GitHub热门项目 | LTX Director and a variety of other custom ComfyUI nodes and workflows | Stars: 1,535 | 234 stars this week | 语言: JavaScript

Why did I build Aegis Pulse? As always, it started with a simple thought that keeps getting me time and time again: "I should automate this." So, I announced Aegis Stack publicly on Reddit on December 3rd. From that very moment, I became great friends with the Unique Clones / Total Clones & Unique Visitors / Total Views charts in GitHub's analytics page. Due to the nature of aegis-stack, every stack that is spun up will clone the actual repo itself (outside of caching situations, which may vary from user to user). I didn't realize it at the time, but those clone numbers, especially the Unique Clones, would become the most important metric for me to track usage. There's this funny thing that happens when you release an OSS tool. You expect people to say something, maybe tell others, ask questions... just... something... Instead, the person looks at the tool, sees if it makes their life easier, and puts it in their bag of other tools. I know this, because this is me! I never thought about it until I'm on the other side. I had to mentally go through all the tools I had used over the years, and realized I never cared about anything other than the tool itself. And if it didn't work, I would try to make it work, and if not, just move on. Time is money, and all of that. All of that is to say, clones are something I have been tracking since day one. Now... GitHub has a 14-day rolling window period in which they have daily values, and the 14-day rolling totals. And when I say 14 days, I mean it. That's all you get, and it's on you to keep track of everything outside of that. Fair enough. Thus began the daily ritual of going and grabbing the latest numbers from the previous day, and pasting the data into 3 separate AI chats: ChatGPT, Claude Opus, and Google Gemini. I figured that since I was already storing all of this data, I might as well see what type of insights I could get from these chats (which were preloaded with enough context to know what's going on). It was a great

I Deployed 6 AI Systems Live — Here's What Actually Broke A few weeks ago I wrote about the 5 bugs that cost me 60+ hours building 49 AI systems. Every one of those bugs lived inside the code itself wrong array layout, a renamed model class, a serialization mismatch. This article is the second half of that story, and it taught me something more uncomfortable: code that runs perfectly on your machine can fail completely the moment it leaves your machine for reasons that have nothing to do with your code. I took 6 of my pinned GitHub projects and deployed every one of them live on Streamlit Cloud. Locally, all 6 worked without a single error. Deploying them surfaced 5 failures I had never seen before, none of which were bugs in my logic. Here they are, in the order I hit them. Failure 1 — A Module That Existed Yesterday, Gone Today My RAG chatbot used this import, unchanged for weeks: from langchain.chains import ConversationalRetrievalChain Locally: works. Deployed: instant crash. ModuleNotFoundError: No module named 'langchain.chains' The cause had nothing to do with my code. My local environment had an old, cached version of LangChain installed months ago. The deploy environment did a clean install and pulled whatever the latest version was at that moment and recent LangChain releases moved legacy chain classes like this one out of the core package entirely. The fix that actually worked pin the exact version that still contains the class, rather than chasing the newest API pattern under deployment pressure: langchain = =0.3.7 langchain-community = =0.3.7 The lesson: "it works on my machine" is frequently true specifically because your machine never reinstalled anything recently. A clean deploy environment has no such luxury it gets whatever is newest the moment it builds. Pin your versions before you ever need to debug this at 1 AM. Failure 2 — A File That Exists, Until It Doesn't My construction RAG project loads a prebuilt FAISS vector index from disk: vectorstor

Unit converters are everywhere online, but they all seem to either require an account, run ads that cover half the screen, or send your input to a server for no reason. I built one that runs entirely in your browser, with no dependencies, no tracking, and no round-trips. 👉 https://unit-converter-dev.pages.dev What It Does Seven conversion categories, 70+ units, real-time bidirectional conversion: Category Example units Length mm, cm, m, km, in, ft, yd, mi, nmi, light-year Weight mg, g, kg, t, oz, lb, st, short ton Temperature °C, °F, K, °R Volume ml, l, m³, fl oz, cup, pint, quart, gallon, tbsp, tsp Area mm², cm², m², km², ha, acre, ft², in², mi², yd² Speed m/s, km/h, mph, ft/s, knot, Mach Data bit, byte, KB/KiB, MB/MiB, GB/GiB, TB — both SI and binary Features: Bidirectional — type in either field, the other updates instantly Swap button — flip from/to with one click All-units panel — see your input converted to every unit in the category simultaneously Formula display — shows the conversion factor (e.g. "1 Mile = 1.609344 Kilometer") Zero dependencies — single HTML file, no build step, no npm Implementation Notes Linear vs. non-linear conversions Most unit conversions are linear: multiply by a factor to get to the base unit, divide by another factor to get to the target. The approach: function convert ( catKey , fromUnit , toUnit , value ) { const base = toBase ( catKey , fromUnit , value ); // → base unit return fromBase ( catKey , toUnit , base ); // base unit → target } function toBase ( catKey , unit , value ) { const u = CATEGORIES [ catKey ]. units [ unit ]; if ( u . toBase ) return u . toBase ( value ); // non-linear (temperature) return value * u . factor ; } Temperature is the classic non-linear case. You can't just multiply to convert between Celsius, Fahrenheit, and Kelvin — you need offset arithmetic: temperature : { units : { C : { toBase : v => v + 273.15 , // °C → K fromBase : v => v - 273.15 , // K → °C }, F : { toBase : v => ( v - 32 ) * 5 / 9 + 2

Google's NotebookLM is great. But handing your research notes, PDFs, and meeting transcripts to Google's cloud is a hard sell for a lot of people — especially when those documents contain client data, unpublished research, or internal strategy. So I spent a weekend testing five open-source alternatives. Three things mattered: can I docker compose up in under 10 minutes, does the podcast feature actually work offline, and what breaks first? Here's what I found. The Contenders Project Deploy Time Min VRAM True Offline License Open Notebook (lfnovo) ~8 min 8 GB Yes MIT Notex (smallnest) ~3 min 4 GB Yes Open source KnowNote (MrSibe) ~2 min 4 GB Yes Open source NotebookLM-Local (nagaforcloud) ~15 min 8 GB Qwen-3 4B bundled Open source InsightsLM (phsphd) ~30 min 8 GB Yes N8N SUS license 1. Open Notebook — The One to Beat git clone https://github.com/lfnovo/open-notebook cd open-notebook docker compose up -d Eight minutes from git clone to the web UI on localhost:3000 . It ships with 18+ model providers pre-configured — Ollama, OpenAI, Claude, DeepSeek, Gemini, all selectable per notebook. The podcast generator supports 1-4 speakers with different voices, and it runs entirely offline when you point it at an Ollama backend. What works: Document ingestion is fast — SurrealDB's vector + full-text index handles 200-page PDFs without choking Model switching is genuinely useful — Claude for deep analysis on one notebook, local Qwen for quick summaries on another Podcast quality with 2 speakers is close to NotebookLM's. 4 speakers is still rough. What breaks: Citation highlighting is still being rebuilt (work in progress as of June 2026) Single-user only — no team/workspace isolation built in Docker required. No native binary. 2. Notex — Single Binary, Zero Dependencies Notex is written in Go. You download a single binary (~25MB) and run ./notex . That's it. No Docker, no Python venv, no database setup. It supports PDF, TXT, MD, DOCX, HTML, audio, and YouTube/Bilibili URLs as so

QR codes look like magic — a grid of black and white squares that encodes anything from a URL to a business card. But how do they actually work? I decided to find out the hard way: implement the full QR Code Model 2 algorithm in vanilla JavaScript, zero external dependencies. The result: QR Code Generator — a free, client-side tool that generates QR codes from any text or URL. 👉 https://qr-code-generator-e83.pages.dev Why No Libraries? I maintain a collection of browser-only developer tools at devnestio . Every tool has the same rule: zero external dependencies. No npm installs, no CDN scripts, no servers. For most tools (JSON diff, Base64 encoder, UUID generator) that's easy. QR codes are different. The spec is a 126-page ISO document. Most developers just npm install qrcode and call it a day. But writing it from scratch taught me more about error-correcting codes, Galois field arithmetic, and matrix encoding than I ever expected. Worth every hour. What the Tool Does Real-time generation as you type (debounced at 80ms) Size selector — 128 × 128, 256 × 256, or 512 × 512 pixels Error correction level — L (7%), M (15%), Q (25%), H (30%) Color picker — any foreground and background color PNG download via canvas SVG download with crisp vector output at any scale How QR Codes Actually Work QR Code Model 2 (the standard you see everywhere) has six major steps. Here's the short version: 1. Data Encoding Text gets encoded into one of three modes based on content: Numeric ( 0-9 ): packs 3 digits into 10 bits — most compact Alphanumeric ( 0-9 A-Z $%*+-./:space ): 2 chars into 11 bits Byte (everything else): UTF-8, one byte per 8 bits The encoder picks the mode automatically and finds the minimum QR version (1–40) that fits the data. function detectMode ( text ) { if ( /^ \d +$/ . test ( text )) return NUMERIC_MODE ; if ( text . split ( '' ). every ( c => ALPHANUMS . includes ( c ))) return ALPHANUM_MODE ; return BYTE_MODE ; } 2. Reed-Solomon Error Correction This is the hard

The document hub, our vision of DocuShark . We want to make collaboration simple again. There are too many amazing tools, too many surfaces to get lost in. Bring them together - and you've got a near-endless wealth of knowledge for anyone with access. The editor is out, and loaded with features, only getting more powerful. Our editor offers: high-speed, realtime collaborative editing on documents in your Cloud Workspace, documents that can write, draw, and store files at the same time, never lose access when your network goes out - offline copies let you use every feature anywhere, and agent endpoints (MCP) for all your agentic needs. The page and canvas are one, with generous file storage, allowing you to design whitepaper-level PDFs in hours, not weeks, with every file, reference, and diagram within that document, all while offline with changes saving when you're back online. It's a mini Google Drive in each document, with offline storage so you can edit anywhere, anytime with changes syncing across your team. The Integrations Story - Combine, don't Compete DocuShark isn't here to compete, it's here to integrate, and keep complex ideas lean and organized across platforms. As we release our integrations, knowledge drift shrinks, leaving you with richer context while you keep working with your favorite apps - or don't, we have rich editor tools as well. An Agent Powerhouse - Keep your Context Close DocuShark is built for agents from the ground up. Citations keep your agent's research properly attributed. Fields eliminate drift and block duplication before it starts. Anchored edits make changes surgical, not sweeping. More is in the works, and the roadmap is moving fast. Try DocuShark - The Editor's Free and Fast You can either launch straight into the editor , or get a cloud workspace and start collaborating today!

AI can now scan major open-source projects and surface a batch of real, exploitable vulnerabilities in a single pass. That's a defensive win — until you remember attackers have the same tools. Anthropic, Google, Microsoft, OpenAI, AWS, and 15 other organizations aren't waiting for that race to get worse. On Thursday they launched Akrites under the Linux Foundation — a coordinated body built specifically for AI-era vulnerability discovery, remediation, and disclosure in critical open-source software. What actually changed A shared Security Incident Response Team (SIRT) replaces the fragmented model where multiple orgs independently scan the same libraries, file duplicate CVEs, and bury maintainers in noise Patch first, publish second — findings are held under strict confidentiality until a fix is ready and tested Fallback maintainer coverage — if a project has no active maintainer, Akrites steps in so fixes still reach downstream users Funded by Alpha-Omega , an OpenSSF project with $7M+ annual budget backed by the same founding members Three membership tiers — Premier (critical infra operators), General (contributing orgs), Associate (OSS foundations, free) The name comes from the Akritai — Byzantine soldiers who guarded the empire's outermost borders. The places most exposed, most frequently attacked, and most dependent on whoever showed up to defend them. The problem it's actually solving The current coordinated disclosure model was designed around a world where finding vulnerabilities took weeks of expert work. AI has collapsed that timeline. Endor Labs CEO Varun Badhwar put a number on it: thousands of validated open-source vulns surfaced by AI in recent months, with fewer than 5% patched. And the old model makes it worse — every org independently sitting on knowledge of an unpatched flaw is another leak risk before a fix exists. "For years, we have believed finding vulnerabilities was never the hard part. Fixing them was. AI has made that gap impossible to igno

Back in May we here at Waggy Labs launched the beta release of our Web Component UI kit " Yumekit ". Yumekit is a pure web component UI toolkit. Upon its release, it was comprised of roughly 36 fully styled and fully functional UI components that work with just about every web architecture straight out of the box. No configuration or setup necessary, all one needs to do is include the Yumekit script (using either a CDN or installed through NPM) and start building. All components come styled out of the box with no need to include any style sheets. Last week, we launched version 0.5. With this latest release, that job is being made easier with the inclusion of new components that add several layout options as well as new Data, Navigation, and Utility components, bringing the total number of components to 51. For us, this toolkit has provided us a framework-agnostic solution for our internal tools as well as any client projects. With over 60 themes spread over 9 well-known (and some brand new) open source Design Systems all built directly into the library, we have plenty of options available to us to keep our designs fresh without needing to spend hours dealing with CSS. It's light-weight, dependency free, and well documented. New in 0.5 Animate The y-animate component allows you to animate entrances and exits for nested components using a few simple configuration attributes. Code The y-code component allows you to display formatted and colorized code, as well as providing a few easy and convenient ways for your users to copy the provided code. Help The y-help component provides a tutorial experience for users of your application with minimal configuration. Simply provide the elements to be highlighted, the messages to be shown, and it handles the rest! Paginator y-paginator provides a configurable set of pagination buttons to help your users navigate through large data sets. Sidebar We had originally included a y-appbar component (which we still do) that had a "Sideba

GitHub热门项目 | A cross-platform GUI library for Rust, inspired by Elm | Stars: 30,845 | 10 stars today | 语言: Rust

GitHub热门项目 | A faster, lighter, cheaper alternative to sandboxes. Run any coding agent inside an isolated Linux VM, with agent orchestration built in. | Stars: 3,278 | 52 stars today | 语言: Rust

GitHub热门项目 | This is the Rust course used by the Android team at Google. It provides you the material to quickly teach Rust. | Stars: 33,156 | 31 stars today | 语言: Rust

GitHub热门项目 | AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs | Stars: 47,870 | 47 stars today | 语言: TypeScript

GitHub热门项目 | The batteries-included full-stack framework for the AI era. Develop JS/TS web apps (React, Node.js, and Prisma) using declarative code that abstracts away complex full-stack features like auth, background jobs, RPC, email sending, end-to-end type safety, single-command deployment, and more. | Stars: 18,504 | 29 stars today | 语言: TypeScript

GitHub热门项目 | The flexible backend for all your projects 🐰 Turn your DB into a headless CMS, admin panels, or apps with a custom UI, instant APIs, auth & more. | Stars: 36,297 | 44 stars today | 语言: TypeScript

GitHub热门项目 | Google Cloud Client Library for Node.js | Stars: 3,181 | 0 stars today | 语言: JavaScript

GitHub热门项目 | 网文/小说写作 skill 包，覆盖长篇与短篇网络小说的扫榜、拆文、写作、去AI味、封面图全流程 | Stars: 3,165 | 51 stars today | 语言: JavaScript