186 results for “gh”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types2042 Articles771 Papers465 Write-ups322 Repos186 Threads117

More types6

Advisories98 Talks29 Tools29 Courses9 Other8 Videos8

📦 Repos “gh”Clear all

github.comrepo🧠 AI

Show HN: I Turned DOOM into a Transformer

Doomformer compiles integer neural networks into ZDoom maps that run in ViZDoom. Voodoo dolls do the arithmetic, and sector light levels and plane heights hold the values. Python reads every value back and compares it with a NumPy integer reference at tolerance 0. It runs MNIST (97.16 % on all 10,000 digits, every pass exact), small transformers, a learning perceptron and a SUBLEQ machine. It is about 23,000 times slower than NumPy on a small MLP.

ViZDoomZDoomACS+10

DoomformerDOOMFreedoom+6

research, inference· Added 30 Oct 2026, published 29 Oct 2026

github.comrepo🛡️ Security

Show HN: Auto Dismiss Mac OS "Allow <app> to find devices on local networks?"

dontallow is a two-file Swift launchd agent for macOS 15 and later that clicks "Don't Allow" on the "find devices on local networks" prompt. It watches the UserNotificationCenter process through an Accessibility observer, supports pause and allowlist, and can decode the Local Network rule store to show orphaned rows. It explains why Chromium temp-bundle paths make the prompt recur, and gives a PPPC profile route for fleets.

macOSSwiftlaunchd+2

Local Network privacy promptPPPCTCC

Cloud & Infra· Added 30 Oct 2026, published 29 Oct 2026

github.comrepo🧠 AI

Show HN: Hob - Open-source, on device alternative to Claude Cowork and ChatGPT

Hob is an MIT-licensed desktop app from Frigade that runs open-weight models such as Gemma and gpt-oss locally on Mac, Windows and Linux. It picks the best open-weight model that fits the user's computer and sets it up. It is positioned as a free, private, offline alternative to Claude and ChatGPT for tasks like filling out PDFs and working through documents. The page gives no technical detail on its runtime.

GemmaClaudeChatGPT+4

FrigadeHobgpt-oss

inference, llm-apps· Added 27 Oct 2026, published 26 Oct 2026

github.comrepo🧠 AI

KhulekanisiyandaMchunu/llm-trading-arena

wtfibought (llm-trading-arena) is an MIT-licensed live arena where LLM agents trade virtual capital on real market data with all reasoning public. Users bring their own model and key, set the wake candle interval, leverage range and margin budget, with at most three symbols and twelve model calls per wake. The stack is Spring Boot on Java 25 with Spring AI, PostgreSQL, Redis and a React 19 frontend.

Spring AISpring BootJava+10

wtfibought

agents, evals· Added 26 Oct 2026, published 23 Oct 2026

github.comrepo🛡️ Security

eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

php2shell is the name given to two critical pre-auth remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, in PHP core's session upload progress handler (php_session_rfc1867_callback), where zend_hash_update frees live zval pointers that are later reclaimed and redirected into zend_call_function to run zif_system. This repository ships poc_109618.py, a fully automated four-stage HTTP exploit that leaks ASLR offsets via Set-Cookie headers against php:8.4.26-apache on Debian Bookworm, along with a root-cause C source patch, mitigation scripts to disable session.upload_progress, and WAF/ModSecurity/Lighttpd/Apache rules plus detection guidance for anomalous PHP worker child processes. Confirmed PHP versions include 8.4.4 and 8.2.34, with EOL branches (5.x, 7.x, 8.0, 8.1) left without official vendor patches.

PHPDockerCloudflare+1

CVE-2026-109618CVE-2026-109619PHP2Shell+6

Offensive Security, AppSec, Blue Team & Detection· Added 23 Oct 2026, published 21 Oct 2026

github.comrepo🛡️ Security

ikow/php2shell-poc

php2shell-poc is a proof-of-concept and detection toolkit for CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities tied to session.upload_progress handling and a Zend engine out-of-memory bailout path affecting PHP 5.4.0 through 8.5.11. The repository includes three working exploit chains, a Docker-based lab (PHP-FPM, nginx, Apache mod_php) for reproduction, and pre-built Suricata, Sigma, ModSecurity, and Lua detection rules. The author recommends disabling session.upload_progress as an interim mitigation, noting the underlying memory corruption requires a full PHP patch to fix.

PHPWordPressDocker+3

CVE-2026-109618CVE-2026-109619GHSA-w8hw-w9fx-j79w+3

AppSec, Offensive Security, Blue Team & Detection· Added 23 Oct 2026, published 21 Oct 2026

github.comrepo🧠 AI

DeepInfer: High-performance inference framework for DeepSeek models

DeepInfer is DeepSeek's open-source inference framework for offline inference of DeepSeek-V4.1-Flash, released under Apache 2.0. It covers attention data parallelism, MoE expert parallelism with load balancing, draft-token decoding with confidence-scheduled verification, batch-invariant inference, deterministic sampling and structured outputs. It runs on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. The KV cache system, prefill/decode disaggregation and load balancing are not included.

DeepInferFlashMLADeepGEMM+13

DeepSeekDeepSeek-V4.1-FlashNVIDIA

inference· Added 21 Oct 2026, published 20 Oct 2026

github.comrepo🧠 AI

Show HN: WhatsApp MCP running free on Cloudflare

whatsapp-mcp is an MCP server that runs in the user's own Cloudflare account and lets MCP clients such as Claude Code and Claude Desktop search and read WhatsApp chats. It links as a WhatsApp Web-style device through Baileys, stores messages in SQLite with FTS5 inside a Durable Object, and is read-only. The README documents deployment, OAuth sign-in, contact naming through agents, and workerd shims for Baileys.

Model Context ProtocolCloudflareCloudflare Workers+11

mcp· Added 20 Oct 2026, published 18 Oct 2026

github.comrepo🧠 AI

DietrichGebert/ponytail

Ponytail is a single skill prompt (skills/ponytail/SKILL.md, with a compact AGENTS.md) that makes coding agents write only the code a task needs, reusing existing components while keeping validation, error handling, security and accessibility. The author benchmarked it in Claude Code with Opus 5.5 over 39 tasks, 5 runs each, including a real FastAPI + React repo. They report -53% code, -41% time, -26% cost and -45% tokens, and 98% of risky logic shipping with a test versus 68% without. It adds /ponytail-review and /ponytail-audit commands, a Claude Code cost/token band with a local board, and installs through Claude Code and Codex plugin marketplaces or as a rules file for Cursor, Copilot, Gemini, OpenCode and others.

Claude CodeCodexCursor+7

PonytailClaude Opus 5.5Windsurf+5

coding-agents, prompting, evals· Added 17 Oct 2026

github.comrepo🛡️ Security

OWASP/MCP-Security-Testing-Guide

OWASP MCP Security Testing Guide is a living, GPL-3.0 collection treating the Model Context Protocol as a security boundary from user through model, MCP client, MCP server and tool to the target system. It covers threats, secure development, host/client controls, supply chain, enterprise gateways, detection, incident response, taxonomy, public incidents, case studies and review checklists, with 79 tests in Chapter 3 (sections 3.1–3.19). It includes a finding template, and it links the MCP Goat lab for safe practice. It is useful to AppSec, red team and SOC people assessing MCP deployments.

Model Context ProtocolLLM

OWASPMCP Goat

AI Security, AppSec· Added 17 Oct 2026

huggingface.corepo🧠 AI

DeepSeek-v4.1-Flash-1017

Model card for DeepSeek-V4.1-Flash-1017, a minor update to DeepSeek-V4.1-Flash with MIT-licensed weights. It claims gains in reasoning, coding, agentic tasks and visual benchmarks, with shorter task time and output length that move the performance–cost Pareto frontier across agent harnesses (Claude Code for Terminal-Bench 4.0, Mini-SWE-V2 for DeepSWE v1.1). It ships no Jinja chat template. It provides a reference encoding.py for multi-turn chat, tool calling, thinking mode, numeric reasoning effort and interleaved images, plus deepseek-recipe, Rust libraries with Python bindings for prompt encoding and output parsing. Serving recipes are given for Transformers, vLLM, SGLang and Docker Model Runner.

TransformersvLLMSGLang+5

DeepSeekDeepSeek-V4.1-FlashDeepSeek V4+3

models, inference· Added 18 Oct 2026, published 17 Oct 2026

huggingface.corepo🧠 AI

Meta Muse Spark Open (816B-A42B) open-weights model card

Model card for Meta Superintelligence Labs' Muse Spark Open, an open-weights, natively multimodal model with 816B total and 42B active parameters and a 1M-token context window. It targets coding and agentic work (tool use, long-horizon tasks, multimodal reasoning, synthetic data generation, LLM-as-judge). It ships in BF16 and NVFP4, needs about 700GB VRAM (NVFP4) or 2TB (BF16), runs on SGLang, vLLM, Transformers, TensorRT-LLM, Unsloth, llama.cpp and MLX, and supports a reasoning_effort setting. The Muse Model License requires "Built with Muse Spark Open" attribution and a separate agreement for Model-as-a-Service above $20M revenue. The card reports safety results against Kimi K3 on cyber, chem/bio and loss-of-control evals.

Hugging FaceTransformersvLLM+8

Muse Spark OpenMetaMeta Superintelligence Labs+15

models, multimodal, inference· Added 17 Oct 2026

github.comrepo🧠 AI

Llama.cpp on a jailbroken PS5: run any GGUF model natively on the console

PS5LM is a homebrew app for jailbroken PS5s (firmware 7.00–13.60). It runs llama.cpp with the ggml-vulkan backend on the console's RDNA 2 GPU, using 11.4 GB of shared memory, and loads any GGUF model. It serves OpenAI /v1/chat/completions, Anthropic /v1/messages (usable from Claude Code, Codex and opencode) and a browser chat page on port 8081. It also supports image-projector vision models and TypeSafe-style decision models through a /v1/systemone endpoint. A planner picks the longest context and best cache that fit the free memory, and the app downloads models from Hugging Face.

llama.cppGGUFVulkan+9

TypeSafeClefGemma 4+2

inference, models· Added 17 Oct 2026, published 16 Oct 2026

github.comrepo🛡️ Security

gichirimaku/wp2shell-PoC

wp2shell-PoC is a Python proof-of-concept exploiting a pre-authentication RCE chain in WordPress core, combining CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection in WP_Query). It demonstrates escalation from the route-desync bug through blind SQLi, customize_changeset forgery, and hook re-entry to administrator account creation and arbitrary command execution via a malicious plugin upload. The tool supports vulnerability checking, data extraction (union, error-based, blind techniques), and full shell access with or without existing admin credentials.

WordPressPython

CVE-2026-63030CVE-2026-60137SQL injection+1

AppSec, Offensive Security· Added 23 Oct 2026, published 15 Oct 2026

github.comrepo🧠 AI

morluto/rea

REA (rea-agents on npm) registers an MCP server and matching workflow instructions with coding agents such as Claude Code, Codex, Cursor and Gemini CLI. It exposes tools for inspecting native binaries through Hopper, Ghidra or IDA (with optional objdump and Rizin), JavaScript/Electron apps and ASAR archives, .NET assemblies and websites. Results come back with evidence and limitations, so the agent can explain how a feature works and write and test its own implementation. Analysis runs locally, there is a CLI with the same workflows, and the showcases include C reconstructions verified against original x86 function bytes.

Model Context ProtocolClaude CodeCodex+14

REAIDA

mcp, coding-agents· Added 14 Oct 2026

github.comrepo🛡️ Security

morluto/rea

REA (rea-agents) is an MIT-licensed toolkit that exposes native-binary, JavaScript/Electron, .NET assembly and website analysis to AI agents via MCP, and also as a local CLI. It drives Hopper, Ghidra, IDA, objdump or Rizin for disassembly and pseudocode, recovers modules and Electron IPC boundaries from ASAR/JS apps, and returns findings with evidence and limitations. Showcases include reconstructing a x86 audio helper into byte-matching C and tracing an Electron clipboard API through preload and IPC; the README also carries lawful-use and licensing guidance.

Model Context ProtocolGhidraHopper+3

REArea-agentsASAR

Malware & RE, AI Security· Added 14 Oct 2026

github.comrepo🧠 AI

BijectiveLabs/trading-research-agents

Open-source Python CLI (`tra`) for autonomous trading desks in which LLM analysts (technical, macro, on-chain, sentiment) and validators only give opinions on figures the system computed. Fixed rules do the arithmetic: pricing the round-trip cost, applying risk limits, sizing, cost gates, and sending a single order with stop attached via ccxt (Bybit and OKX demo accounts tested). It supports multiple model providers with per-role models, effort settings and fallbacks. Every answer is parsed against a closed schema, every refusal is logged with the figure behind it, and models can tighten but never loosen controls. This makes it a concrete reference for keeping LLM agents away from arithmetic and money.

Pythonccxtuv+2

Bijective LabsBybitOKX+8

agents, ai-infra· Added 18 Oct 2026, published 13 Oct 2026

github.comrepo🧠 AI

santosomar/AI-agents-for-cybersecurity

Companion repository for Omar Santos's Pearson and O'Reilly trainings and books. It has eight parts of runnable Python labs: chat models, embeddings, prompt templates, LCEL prompt chaining, Chroma-based RAG, ReAct/LangGraph/CrewAI/DeepAgents agents, and FastMCP servers (nmap, CISA KEV, Shodan). It also includes guides to six agentic frameworks (OpenClaw, Hermes, Agent Zero, OpenHands, Paperclip, Buzz), a tokenomics module on agent cost (context compounding, prompt caching, model routing, token budget guards, batch API, cost per accepted outcome), and a vendor-neutral design spec for a human-gated multi-agent assessment harness. It is a current, practical curriculum for building and operating agents. Some examples act on real systems and should only be run in an authorized lab.

PythonuvLangChain+17

Omar SantosPearsonO'Reilly+15

agents, llm-apps, mcp· Added 13 Oct 2026

github.comrepo🛡️ Security

santosomar/AI-agents-for-cybersecurity

Omar Santos's companion repo for his Pearson/O'Reilly trainings and books, organised in eight parts. They cover LangChain prompts, chains and RAG (Chroma), and agents (LangGraph, CrewAI, DeepAgents). They also cover FastMCP security servers (nmap, CISA KEV, Shodan) and attack-surface-management and SOC agent examples. Later parts have security guides to six agentic frameworks (OpenClaw, Hermes, Agent Zero, OpenHands, Paperclip, Buzz) with hardening notes and 2026 CVE mapping, agent cost/tokenomics scripts including denial-of-wallet budget guards, and a vendor-neutral spec for a human-gated multi-agent security-assessment harness (scope manifest, approval gates, kill switch). Useful as a hands-on path into AI-agent security tooling, with warnings that some examples act on real systems.

Model Context ProtocolLangChainOpenClaw+3

Omar SantosSSRFCISA KEV+2

AI Security, Learning· Added 13 Oct 2026

github.comrepo🧠 AI

Show HN: SolidCraft – Open-Source Parametric CAD in Rust (With MCP Support)

SolidCraft is an open-source parametric 3D CAD application written in pure Rust. It has constrained sketches with its own solver, a feature timeline, assemblies, sheet metal, and STEP/IGES/3MF/STL export. It runs on desktop (egui+wgpu), in the browser, and as a headless CLI. The built-in MCP server (`solidcraft-cli mcp`) gives agents tools such as execute, batch, inspect_design, measure, set_parameter, screenshot and export. They can model headless or drive the running app over a JSON-lines control channel. A rover with 3,323 timeline steps was built entirely through MCP, which shows agent-driven parametric modelling working at scale.

RustModel Context ProtocolClaude Code+5

SolidCraftSELENE

mcp· Published and added 13 Oct 2026

github.comrepo🧠 AI

Show HN: Atticus – Hold-to-talk voice assistant for macOS that runs on Claude -p

Atticus is an MIT-licensed macOS 26+ hold-to-talk voice assistant that uses Apple's on-device speech transcription and runs AI requests through Claude Code on an existing Claude Pro/Max plan, so no API key is needed. Simple commands skip the model entirely (apps open in 0.08 s), actions it has seen once are learned as zero-cost shortcuts, and a "remember…" memory persists across asks. It also sets up no-AI background watchers (polling every 5 s) and holds itself to a budget of a median under $0.002 and 6 s per AI ask, with a system prompt under 10,000 characters.

Claude CodeClaudeCodex+6

AtticusAnthropicApple+1

agents, coding-agents, multimodal· Published and added 12 Oct 2026

github.comrepo🧠 AI

argoproj-labs/mcp-for-argocd

TypeScript MCP server for Argo CD that lets MCP clients (Cursor, VS Code, Claude Desktop) list, inspect, create, update, delete and sync applications, read logs and events, and run resource actions through natural language. It supports stdio and HTTP stream transports, with a stateless mode for multi-replica Kubernetes deployments. The security design is detailed: API tokens are read only from env vars or headers and never from tool arguments, the default token is bound to the default base URL, a per-host token registry covers extra instances, a read-only mode disables write tools, and the HTTP listener binds loopback by default and requires an inbound auth token if exposed.

Model Context ProtocolArgo CDNode.js+7

Akuity

mcp· Added 10 Oct 2026

huggingface.corepo🧠 AI

Qwen3.8-27B (Apache-2.0, multimodal dense, 262k ctx)

Model card for Qwen3.8-27B, a 27B dense vision-language model from the Qwen team with a hybrid Gated DeltaNet / Gated Attention layout (64 layers, 16×(3 DeltaNet + 1 attention)), MTP training, and 262k native context extensible to 1M via YaRN. It targets coding, research and long-horizon agentic tasks, with thinking on by default, reasoning_effort levels (xhigh/medium/low) and preserve_thinking. The card gives deployment recipes for Transformers, vLLM, SGLang and TokenSpeed, recommended sampling parameters, video-token settings for hour-scale video, and benchmark notes (SWE-bench Pro, NL2Repo-Bench, DeepSWE, HLE, MathVision, WebArena-Verified, etc.).

Qwen3.8-27BHugging FaceTransformers+8

QwenQwen3.5SWE-Bench Pro+14

models, multimodal, inference· Added 9 Oct 2026

github.comrepo🧠 AI

Show HN: Let your AI agents paint big arrows, boxes and text on your screen

bigarrow is an MIT-licensed, single-binary Swift macOS CLI that draws a click-through arrow and sign over all windows so an AI agent can show a human where to click, paste or act (permission prompts, 2FA, OAuth consent). It ships an Agent Skills package (installed via `bigarrow install-skill`) for Claude Code and Codex, with JSON output and exit codes, and can target by Accessibility label, coordinates, window or Peekaboo snapshot. The README documents the skill's token cost (182 tokens for the description, 1,398 for the instructions) and 104 automated tests.

SwiftmacOSClaude Code+6

bigarrowNameplatePeter Steinberger+2

coding-agents, prompting, agents· Published and added 9 Oct 2026

github.comrepo🧠 AI

Show HN: Apogee: Rebuilding Mozilla's Orbit, fully local and private

Apogee is a privacy-first browser extension (Chrome/Firefox) that summarizes articles, YouTube/Bilibili videos, PDFs, DOCX and pasted text entirely on-device, inspired by Mozilla's discontinued Orbit. It runs models via WebGPU or WebAssembly in the browser, or connects over loopback to a local Ollama or llama.cpp server, with local passage retrieval for Q&A, grounded sentence highlighting, and Opus-MT translation. It shows a practical no-backend, no-API-key architecture for local LLM apps, with a Node.js extractor test harness for contributors.

WebGPUWebAssemblyOllama+4

ApogeeMozillaOrbit+2

inference, llm-apps· Published and added 9 Oct 2026

huggingface.corepo🧠 AI

Aleph Alpha Kolibri-1 (78B MoE, Apache 2.0)

Kolibri-1 is Aleph Alpha's 78B-parameter mixture-of-experts reasoning model focused specifically on German and English, released under Apache 2.0 with weights, a vLLM plugin, and an extensive model card. It supports explicit reasoning-effort levels, Hermes-style tool calling, and a native 262144-token context validated to over 1M via sliding-window attention; the card details its UniBPE German-aware tokenizer, pre-training mid-training and long-context training recipe, MergeMix-based data-mix search, Merlin-Arthur hallucination-mitigation RL protocol, and benchmark results against Qwen3.5, Gemma 4, Nemotron 3 Nano, and Apertus on MMLU-Pro, GPQA, AIME, SWE-bench Verified, Terminal-Bench 2.1, and HLE.

Hugging FacevLLMPyTorch+3

Aleph AlphaKolibri-1Kolibri Base+21

models, training, evals· Added 8 Oct 2026

x.comrepo🛡️ Security

Dark Web Informer (@DarkWebInformer) on X

Infoooze is an open-source command-line OSINT reconnaissance toolkit (github.com/devxprite/infoooze) that consolidates common footprinting tasks into one CLI: username enumeration across platforms, email discovery, subdomain enumeration, port scanning, WHOIS/DNS lookups, IP/HTTP header analysis, EXIF metadata extraction, GitHub recon, and URL scanning/expansion. It automatically saves results, making it a lightweight all-in-one alternative to running several separate recon tools.

GitHub

OSINT· Published and added 8 Oct 2026

github.comrepo🧠 AI

microsoft/mxc

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted workloads — model output, plugins, and tool calls — behind a unified containment model with Rust, .NET, and Node SDKs. It offers multiple containment backends (ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt, MicroVM/Nanvix, Hyperlight, WSLC) with JSON-based filesystem, network, and UI policies, plus diagnostics like audit mode for building policies from observed access.

Rust.NETNode.js+1

Microsoft

ai-infra· Added 8 Oct 2026

github.comrepo🛡️ Security

microsoft/mxc

MXC is Microsoft's cross-platform sandboxed code execution system for running untrusted code such as LLM/agent output, plugins, and tools, offering containment backends ranging from OS-native process sandboxes (Windows Sandbox, LXC, Bubblewrap, Seatbelt) to full VMs (Nanvix MicroVM, Hyperlight). It exposes a unified JSON-based policy model for filesystem, network, and UI access controls, with Rust, .NET, and Node SDKs plus diagnostic tooling (audit mode, access-denied logging) to help developers tune containment rules for agentic workloads.

WindowsLinuxmacOS+3

AI Security, Offensive Security· Added 8 Oct 2026

github.comrepo🛡️ Security

chainguard-dev/malcontent

malcontent is Chainguard's open-source malware/supply-chain discovery tool that analyzes binaries (ELF, Mach-O, PE, a.out) and scripting-language source across Linux, macOS and Windows using 14,500+ YARA rules (including third-party rules from Avast, Elastic, FireEye, Mandiant, Nextron and ReversingLabs). Its standout feature is differential analysis ("mal diff"), which compares two versions of a build artifact or OCI image against a known-good baseline to surface newly introduced risky behaviors — the technique the project demonstrates on the 3CX supply-chain compromise by flagging unexpected high-risk changes to libffmpeg. It also supports threshold-based scanning ("mal scan") and unfiltered capability enumeration ("mal analyze"), and is designed to run inside CI/CD pipelines, including air-gapped environments via embedded rules.

YARAGoRust+4

3CX Compromise

Supply Chain, Malware & RE, Blue Team & Detection· Added 8 Oct 2026

Showing 30 of 186