Ollama: Run LLMs on Your Own Machine (GitHub, Scanned)
Run open models on your own machine with one command, and talk to them over a local API.
6 min read
Loading…
/** @open-source,-scanned */
AI Tools on GitHub
Open-source AI repositories worth installing. Each one is cloned and scanned for secrets, malicious code, install hooks and known vulnerabilities before we write about it, and the findings are in the post.
GitHub is where most of the useful AI software lives now. It is also where a star count can be bought, a README can promise anything, and an install script can do whatever it likes to your machine. So before a repository gets a post here we clone it and scan it: for leaked credentials, for code that decodes and executes itself, for installers that reach for sudo or your shell profile, for committed binaries, for CI workflows that leak secrets, and for known vulnerabilities in every pinned dependency.
Every post names the commit scanned and the date, lists the raw findings, and keeps what the scanner counted apart from what a person concluded after reading it. A clean scan is not a guarantee. It means that at that commit nothing in those checks looked wrong, and that we read every hit rather than trusting a number.
llama.cpp: The Engine Under Local AI (GitHub, Scanned)
The C++ inference engine underneath most local AI apps, with a CLI and an OpenAI-compatible server of its own.
5 min read
Open WebUI: Self-Hosted AI Chat for Everyone (GitHub, Scanned)
A self-hosted chat interface for local and cloud models, with users, documents, tools and a plugin system.
5 min read
ComfyUI: Node-Based Image and Video AI (GitHub, Scanned)
Node-based image and video generation: every step of the pipeline is a box you can see and rewire.
4 min read
Dify: Build LLM Apps Without the Plumbing (GitHub, Scanned)
Build and ship LLM apps and agents from a visual workspace, with the prompts, tools, data and logs in one place.
6 min read
AnythingLLM: Private Chat With Your Own Documents (GitHub, Scanned)
Private chat over your own documents, as a desktop app or a Docker container, with agents and multi-user support.
5 min read
OpenHands Agent Canvas: Run Coding Agents Yourself (GitHub, Scanned)
A self-hosted control centre for coding agents: run OpenHands, Claude Code or Codex locally or in Docker, and automate them.
6 min read
browser-use: Let an AI Agent Drive a Real Browser (GitHub, Scanned)
Give an agent a real browser and let it finish the task: forms, logins, searches and multi-step flows.
4 min read
OpenAI Codex CLI: A Coding Agent in Your Terminal (GitHub, Scanned)
OpenAI's coding agent for the terminal, open source and written in Rust, with sandboxing built in.
6 min read
cost-xray: What Claude Code and Codex Really Cost (GitHub, Scanned)
See what Claude Code and Codex actually send to the API on every turn, and what each part of it costs.
4 min read
// How we scan
Before a repository gets a post here we clone it and run the same checks on every one. The scanner is a script in this site's own repository, its findings are written out with file and line, and a person reads every hit before writing the verdict in the post. The last full run was on Sep 16, 2026.
- Pinned commit
- A fresh clone of the default branch. The commit and date are on every report, so the findings are about one snapshot, not the repository in general.
- Secrets
- Credential patterns with a known shape: cloud access keys, API tokens for OpenAI, Anthropic, Slack, GitHub, Google and Stripe, chat webhooks, private key blocks.
- Suspicious code
- Code that decodes a string and then executes it, pipes a download straight into a shell, opens a raw socket to a shell, reaches a known exfiltration service, mines cryptocurrency, or looks packed.
- Install-time code
- npm lifecycle scripts, setup.py command classes, Cargo build scripts, and installer shell scripts: whether they use sudo, edit your shell profile, or fetch and run remote code.
- Committed binaries
- Executables and compiled objects identified by their bytes, not their file extension, so a renamed binary still shows up.
- CI workflows
- GitHub Actions that run on pull_request_target and check out the pull request head (a classic way to leak secrets), write-all permissions, and third-party actions pinned to a tag instead of a commit.
- Network hosts
- Every host the source code talks to, so an unexpected one stands out.
- Known vulnerabilities
- Every pinned dependency in the repository's lockfiles looked up in OSV.dev, counted by severity. Includes development dependencies, which is why the counts are not zero for a large web app.
- Project hygiene
- A security policy, automated dependency updates, CodeQL, a licence, contributing guidelines.
- OpenSSF Scorecard
- The Open Source Security Foundation's independent score, where the project has one.
Clean means no credential patterns, no decode-and-execute code, no exfiltration hosts, no undocumented install-time behaviour, no risky workflow, and nothing in the findings a reviewer could not explain.
Clean, read notes means the same, plus something you should know before installing: an installer that pipes to a shell, a tool that reads a credential you already have, a licence with conditions, or a lockfile with unpatched advisories.
Not covered: we do not run the software, audit its logic, or review commits made after the scan. The date and commit are on every report. Check them, and read the code yourself before you trust it with anything that matters.
// Questions
- Are these GitHub AI tools free to use?
- All of them are free to download, run and modify. The licences differ: most are MIT or Apache 2.0, ComfyUI is GPL-3.0, and Open WebUI and Dify ship their own licences with conditions on rebranding and multi-tenant hosting. Each post says which licence applies and what it asks of you.
- What does it mean that a repository was scanned?
- We cloned it at a specific commit and ran the checks listed under How we scan: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. Every hit was read by a person before the verdict was written, and the findings are in each post.
- Why do known vulnerabilities show up in a clean scan?
- Because a lockfile pins development dependencies too. A large web app carries thousands of packages and OSV knows of advisories in some of them; most affect build tooling and never reach a user. Each post shows the counts per lockfile and the worst entries so you can see where they sit, and the notes say whether any of it ships to you.
- How current is a scan?
- The date and commit are printed in every post. Active projects merge dozens of commits a week, so treat a report as a snapshot of that commit, not a standing guarantee, and re-check the repository before installing anything on a machine you care about.
- Which of these should I start with?
- To run a model on your own computer, install Ollama and add Open WebUI for a chat interface. For images and video, ComfyUI. To build an app or agent without much code, Dify. To let an agent write code or use a browser, OpenHands, Codex or browser-use. If you already use Claude Code or Codex, cost-xray shows what each session actually costs.