Open source · 13 projects
Projects
Small open source tools I’ve built, mostly in Go, mostly because I needed them. Each page says what it does, how to get it, and links to anything I’ve written about it.
- sarifix experimental Turns any SARIF-emitting scanner into a verified fixer. Today it diffs, plans and reports findings, and tells Claude Code about the ones its changes introduced.
- tfmetrics active Org-wide Terraform metrics from static parsing: inventory, version drift, module adoption and hygiene, without terraform init, plan or state.
- sminer active Reads your Claude Code transcripts, finds the corrections you keep repeating, and proposes a hook, CLAUDE.md line or skill for each.
- muscles active Explains container images layer by layer, finds the bytes an image stores but never shows, diffs two images and fails CI when an image breaks its budgets.
- guardrails active A Claude Code plugin that formats and lints every edit, and won't let Claude finish a turn until the code builds, passes its tests and meets your coverage bar.
- limabean active Disposable Ubuntu dev VMs on a Mac from layered Lima templates, with pinned toolchains, keys that stay on the host, and an MCP server so Claude can drive them.
- vlx active A terminal explorer for Varlink services like systemd's io.systemd.* APIs. Read-only by default.
- sdvarlink active Typed Go clients for systemd's Varlink APIs, generated from systemd's own interface definitions.
- sdmetrics experimental Connects Go and OpenTelemetry to systemd's metrics framework: publish metrics from a Go daemon the way systemd's own services do, and export every source on a host as OTLP.
- imagegate active A Docker authorization plugin that refuses to create a container unless its image is cosign-signed by an identity you trust and carries a signed SBOM.
- postmarkd active A small daemon that runs next to your apps and delivers their mail through Postmark, whether they send over HTTP, SMTP, sendmail or a CLI.
- keyload active Go library that reloads TLS certificates, keys and CA bundles at runtime, and keeps the last good material when a reload is bad.
- brownout active Go HTTP middleware for shedding some or all traffic to selected routes at runtime, from Go, a JSON admin API or a watched file.