Appearance
Catalogue — seeds, never the ceiling
Load when: you already know how to choose (./choosing-tools) and want a starting point rather than a blank search.
Load the row, not the file. This is the longest document here and almost none of it is about your task: reading it whole to answer "what do we use for email" spends a large slice of a context window on ninety categories nobody asked about, and everything after it in the session pays. Search for the need and read what matches — grep -i "<need>" ./catalogue, or the site's own search. Every category is a row that begins | **Name** |, so one line is the whole answer, and the four headed sections below say which neighbourhood to look in. Read more than one row only when the choice genuinely spans them — a stack decision, or a tool that could sit in either of two categories.
This is the fastest-rotting file here, and it knows it. Prices move, free tiers close, projects get acquired, licences change. So two rules govern it:
Every row carries a check-date, and a row past its recheck is unknown, not fine. The freshness checker reads this file, and a release does not go out with entries past the threshold — scripts/check-freshness.py.
Prices are not recorded here; whether a free tier exists is. They rot at different speeds and lumping them together cost this file its most useful fact. A number moves every quarter — a per-seat rate, a request ceiling, an egress charge — and a cached one is worse than none, because it makes someone skip the check they should have run. Whether the thing can be used for nothing at all is close to stable: a project that has a free tier on the day it is listed almost always still has one a year later, and it is the single fact that decides whether a small team can start today.
So a row says free tier or OSS, self-host and stops there — never the limit, never the price. The ceiling is verified when you wire the thing, in the unit that will actually bite, and recorded in the project's tooling register with its date (./choosing-tools).
A row is a seed. For this project, go and look: awesome-{topic}, registries, the craft's own English terms. A frozen list reconstructs worse than a search, and the reason to keep any row at all is that it carries a licensing or fallback decision worth not rediscovering.
No per-industry section, deliberately. The moment one domain gets its own list, this stops being a method and becomes one author's project → ./choosing-tools.
Services by need
| Need | Default | What you'd use it for |
|---|---|---|
Spec-driven workflow (spec_mode: custom) | OpenSpec (MIT) · Spec Kit (MIT) | only when the owner chose custom → ./writing-work. OpenSpec is the default here for a structural reason, not a taste one: a change is a folder of plain markdown — proposal, spec, design, task checklist — archived when done, which is project = f(repo) already. Its loop is /opsx:explore · propose · apply · archive. Spec Kit is the phase-gated alternative — constitution → specify → plan → tasks → implement → analyze — worth it where a project genuinely wants those gates, at the cost of a heavier setup. Both drive 30+ agents by slash command, so neither binds you to a runtime. The three things custom must answer are unchanged by either choice: where specs live, how a task references one, and that closing a task updates them. Check-date: 2026-08-01 |
| Version control | GitHub | one repository is one project — several deliverables inside it are areas, other repositories are dependencies. Pull requests are the merge gate; their events can trigger automations. Check-date: 2026-07-28 |
| Backend / DB | Supabase · Convex (reactive TS backend — functions + realtime DB, strong for agent-written code) · Prisma when the shape you want is an ORM over your own Postgres rather than a backend platform — typed schema and migrations agents write well. Read the licence at the repo, not the site: the site now sells a managed Postgres-and-compute platform and reads proprietary, while the ORM has its own terms — the two are not the same product. Free tier on the hosted side. Checked 2026-08-02 | Postgres + auth + storage + realtime + edge functions in one; RLS for permissions; good MCP |
| All-in-one client DB | InstantDB | Firebase-alternative: realtime relational DB + auth + presence + storage; CLI-first, built for AI agents to drive without dashboards; offline-first multiplayer UIs |
| Offline-first sync | PowerSync | syncs Postgres/MongoDB/MySQL/SQL Server into in-app SQLite; kills hand-rolled state-over-API plumbing; web, RN/Expo, Flutter, Swift, Kotlin |
| Deploy / hosting | Vercel (web) · Railway (backends/workers/DBs) | web apps & sites with preview deploys per PR (Design QA loves them), edge functions, cron; Railway when you need long-running services, queues, or a hosted Postgres/Redis beyond serverless |
| CI/CD & release automation | GitHub Actions + the official GitHub MCP server | build/test/deploy on push/PR — and, via MCP, agents read workflow runs, analyze build failures, manage releases (the feedback loop that lets the QA gate fix its own red builds). Alternatives with agent-readable CI: CircleCI (official MCP — pipeline graph, build history, failure logs, artifacts) · Buildkite (heavy parallelism, managed Anthropic model provider) · Dagger (containerized pipelines that run identically locally and in CI, so an agent reproduces a failure on its own machine). Publishing: Fastlane (OSS, store submission/signing) · EAS Build/Submit (Expo) · Xcode Cloud · electron-builder / tauri-action + notarization (desktop). Versioning: Changesets or semantic-release. Gates the launch checklist |
| CDN & media delivery | Cloudflare (CDN + R2 storage with no egress fees — the differentiator, not the tier) · bunny.net (cheap, pay-as-you-go, image optimizer + video) · jsDelivr (free for public/OSS assets) | serving images, video, downloads and static assets fast and cheaply — egress is what actually bills you, so start with a no-egress-fee or free-tier origin; Vercel/Netlify already CDN their own deploys, this is for your media, which is where the assets-home decision lands |
| Video hosting & streaming | PeerTube (AGPL-3.0 — self-host, name the copyleft) · Owncast (MIT — self-host live streaming) · Mux · Cloudflare Stream (SaaS) | delivering video — adaptive streaming, a player, live — which the CDN and ffmpeg rows don't cover (they move and transcode bytes, they don't run a video platform). AGPL is fine for a service you self-host, not embed. Licences checked 2026-07-26 |
| Containers & servers | Docker + Compose (dev parity, the default) · a VPS (Hetzner · DigitalOcean) or Fly.io when you need a long-running box · Kubernetes only past real scale (it is an ops job, not a default) | packaging and running things that aren't serverless. Jamstack (static build + APIs) stays the cheapest shape for content sites. Where data lives: a database for rows, object storage (S3/R2) for files and big blobs — never the DB, never the repo, and a CDN in front of anything users download repeatedly |
| Where to run the OSS tools you pick | Coolify (Apache-2.0 — self-host on your own VPS, 280+ apps: the free-first default) · PikaPods (cheap managed, per-app) · Elestio (premium managed — a VM per app, backups/updates/SSL handled) · RepoCloud · CapRover (Apache-2.0) | standing up the OSS tools you chose (Grafana, Penpot, Metabase…) without hand-rolling a box — distinct from Deploy / hosting (that is for your code). The 200–400-app catalogues double as a discovery source (what one-click installs even exist). Local vs managed is the owner's call; name the cost shape of both. Licences checked 2026-07-26 |
| Headless CMS | Sanity · Strapi · Payload · Directus (all OSS or free-tier) | when non-engineers must edit content without a deploy; repo-first markdown stays better for docs and for content only engineers touch |
| Product / site search | Meilisearch (core MIT; Enterprise Edition BUSL-1.1 — verify per component; the self-hostable core is the licence-cleanest default) · Typesense (GPL-3.0 — self-host, name the copyleft) · Algolia (SaaS, free tier) | instant, typo-tolerant search over a product's content or catalogue — anything past a handful of items needs it. Both OSS options self-host, so start there before a hosted index; the CDP/analytics rows tell you what people search for. Licences checked 2026-07-26 |
| CDP / event pipeline | Jitsu (MIT, re-verified alive 2026-07-26 — vendor-neutral default) · RudderStack (Elastic-style custom licence — flag) · Snowplow (licence split — core Apache-2.0, newer components SLULA; verify per component) · Segment (managed). PostHog is itself a full CDP (sources · transformations · realtime-webhook + batch destinations, per posthog.com/docs/cdp, checked 2026-07-26) — legitimate as the layer inside its own ecosystem; a dedicated pipeline is for when the layer must be vendor-neutral | one place events are defined and fanned out to analytics/warehouse/ads — so swapping a destination is a config change, not a re-instrumentation. Worth it once two or more destinations exist, or events arrive from 2+ platforms (web + mobile + desktop) |
| CRM & sales | Twenty (OSS, native MCP — agents read and write the CRM in natural language, which makes it the default) · SuiteCRM (AGPL-3.0 — the most feature-complete OSS) · EspoCRM (OSS) · HubSpot (free tier) · Attio (SaaS, no self-host) | only when someone is actually selling to named humans; before that a spreadsheet is honest. Twenty leads because its MCP lets agents operate it — a CRM they can drive beats one they can't. Licences checked 2026-07-26 |
| Marketing automation | Mautic (GPL-3.0, the mature OSS default — self-host) · Listmonk (AGPL-3.0 — newsletters at scale) · SendPortal (MIT — ⚠ dormant, last push 2024; flag per the stale-map rule) · Dittofeed (MIT — customer messaging/journeys) · Apache Unomi (Apache-2.0 — CDP) | drip sequences and lifecycle messaging once a product markets to a list — wire to what's already here, don't duplicate: posting (Postiz/Buffer), transactional send (Resend), the event pipeline (Jitsu/PostHog). Opt-in; surfaces only for a project that produces marketing. Licences checked 2026-07-26 |
| Media, image & video tooling | sharp · ImageMagick · ffmpeg (conversion, resizing, transcode — scriptable, so agents can run them) · Squoosh · generative tools for product shots/video when the brand allows · PhotoRoom (background removal, free) · Lexica (AI-image gallery/search, free) | asset pipelines, format conversion, thumbnails, social crops; pairs with ComfyUI for generated imagery. Checked 2026-07-26 |
| Generative media (hosted inference) | fal.ai (verified 2026-07-26 — 1000+ models across image/video/audio/3D behind one API; pay-per-output or GPU-hourly — fetch live prices at decision time) · Replicate (the breadth peer — run or fine-tune community models over an API). Self-host end of the same ladder: ComfyUI (graphs on your own GPU) | hosted image/video/audio/3D generation for content and marketing pipelines when you don't want to run a GPU — an API an agent drives, not a dashboard. Generated output is logged like any other asset (docs/assets.md) under the same free-assets/licence discipline. Prices are the vendors' claims, re-fetched at use |
| Voice — speech-to-text / text-to-speech | Whisper (MIT — runs locally, the default) · Deepgram · ElevenLabs (both SaaS) | transcription and voiceover — load-bearing for content pipelines: interview audio → transcript feeds the QDA/persona chain, video gets narration, podcasts get captions. Local Whisper keeps the audio on the machine and off a meter; hosted for scale or the best synthetic voices. Licence checked 2026-07-26 |
| Free assets / stock — where to source | Every source here carries two contracts, and they do not have to agree: the licence on the content, and the terms on the way you reached it. Worked example, verified 2026-07-31 — Pexels: the content licence requires no attribution (and forbids selling unmodified copies, implying endorsement, or re-listing on other stock sites), while the API terms require prominent attribution to Pexels in your app and cap you at 200 requests/hour and 20,000/month. Same photo, opposite obligation, decided by whether a human downloaded it or an agent fetched it. So: read the licence page and the API/terms page, and where an API reports its own ceiling in response headers (Pexels sends X-Ratelimit-Limit, -Remaining, -Reset) read the ceiling at runtime instead of recalling it. licence-first: prefer CC0 / public-domain / permissive, verify per item. Photos Pexels · Unsplash · Pixabay · Video Mixkit · Coverr · Pexels · Audio Pixabay Music · Mixkit (⚠ FMA/Uppbeat/Freesound need credit) · Public-domain art The Met · Art Institute Chicago · Rijksmuseum · Smithsonian · Cleveland · Getty · SMK (search "museum + open access") · Icons Lucide · Heroicons · Tabler · Simple Icons · Iconify · Illustrations unDraw · Open Peeps · 3D/textures Poly Haven · ambientCG · Kenney · Fonts Google Fonts · Fontshare · Meta-search Openverse (filter CC0) · Patterns/gradients Hero Patterns · SVGBackgrounds · Haikei · GradientHunt (⚠ usage terms unverified — check before shipping an asset) | sourcing images/video/audio/icons/3D you can edit and ship commercially without credit; this is where to get, distinct from the processing row above and from generation. The owner's own brand kit / licensed stock / named source wins — never push free stock over it, and their assets stay theirs. Discipline: log every asset actually used in docs/assets.md (what · source · licence · where) — provenance is portability, and the licence must be provable; name the source in use ("search icon from Lucide, MIT"); commit to one chosen set (icon pack · illustration style · photo look) for consistency, widening only on a real gap |
| Animation & motion | GSAP (web, now free incl. plugins) · Rive (interactive, runtime state machines) · Lottie (After-Effects export) · Framer Motion (React) · Cavalry (designer-side, AE alternative) · Jitter (SaaS, free tier — quick motion by hand for social/marketing clips; the OSS default for automated video stays Revideo / Motion Canvas, see Programmatic video) · Motion Prompts (200+ GSAP/WebGL animation components written to be regenerated by an agent rather than copied — licence not stated) · GodUI (MIT, React motion components) · transitions.dev (curated UI transitions — modals, cards, loaders — free tier, with a paid tier) · single-effect drops: Border Beam and Thinking Orbs (npm, React/SwiftUI/RN — licence not stated). Checked 2026-08-02 | motion in product and marketing; Rive/Lottie ship as data the app plays, GSAP for direct control. Checked 2026-07-26 |
| Programmatic video (video-as-code) | Revideo (MIT — render API, server rendering, templates: the default for automated pipelines) · Motion Canvas (MIT — hand-authored explainer animation) · Remotion (⚠ custom source-available "Remotion License" — free for individuals and small orgs, paid Company Licence beyond; not BUSL, no change date; fetch current terms; video as React components) · MoviePy · Editly (both MIT — scripted assembly over ffmpeg) | rendering video from code for automated content pipelines — distinct from the ffmpeg row (conversion/transcode) and from Animation & motion (interactive/runtime). Default OSS by the ladder; the most popular pick, Remotion, is the one that isn't free — say the licence out loud. Licences checked 2026-07-26 |
| Canvas / WebGL effect components | Paper Shaders (Apache-2.0 — licence-cleanest default; 30+ animated WebGL shader effects, zero-dep, vanilla + React) · Canvas UI (MIT + Commons Clause — free, no reselling the components themselves; effects render over live DOM via the experimental html-in-canvas API, so name the browser caveat; React/Solid/Preact/Vue/Svelte/vanilla, shadcn-CLI model, ships an MCP server so agents drive it out of the box) · tsParticles (MIT — particles/animated backgrounds, every major framework) · Vanta.js (MIT, dormant since 2024-03 — list only with the flag) · OpenShaders (WebGPU effects directory, frontier flag — browser support). Liquid Metal (npm, a single liquid-metal shader wrapping a button or shape — licence not stated, checked 2026-08-02) · Compose-your-own layer below: three.js + drei · OGL · PixiJS. Facts checked 2026-07-25 | generative shader & particle effects — hero/marketing backgrounds, ambient product motion — composed from a library, not hand-written GLSL; distinct from Animation & motion above, which is timeline/interactive motion, a different craft |
| 2D graphics — canvas & SVG (programmatic) | canvas: Konva (interactive scene-graph, best framework bindings — react-konva etc.; licence field NOASSERTION, historically MIT — verify) · Fabric.js (MIT — design-editor object model, SVG import/export bridge) · PixiJS (MIT — WebGL-accelerated when performance is the point). SVG: svg.js (licence field NOASSERTION — verify; manipulation/animation) · two.js (MIT — one API over SVG/canvas/WebGL renderers) · D3 (ISC — data-driven documents) · SVGO (MIT — the optimization step in any SVG pipeline). Hand-drawn: rough.js (MIT, stable/low-churn). Creative coding: p5.js (LGPL-2.1 — name the licence). Dormant/legacy, flag per the stale-map rule: Paper.js · Snap.svg. Whiteboard SDKs: Excalidraw (MIT) vs tldraw (custom licence — watermark unless paid) — licence-first favours Excalidraw. Facts checked 2026-07-25 | programmatic 2D — Fabric for design editors, Konva for interactive UIs/dashboards, Pixi for high-perf/games (≈500K/400K/200K weekly downloads, pkgpulse 2026-02 — re-verify) · SVG generation, animation and optimization · whiteboards; distinct from Mermaid (diagrams-as-text) |
| Game engines | Godot (MIT — the free-first default) · Bevy (Rust, Apache-2.0) · Phaser (MIT — web games) · LÖVE (zlib) · Defold (source-available, custom Defold licence — verify) · Unity / Unreal (proprietary, royalty terms — only if the owner names them) | building a game or an interactive real-time surface; the OSS engines carry no per-title royalty, the trap in the proprietary two. Licences checked 2026-07-26 via GitHub API |
| Secrets management & KMS | Infisical (core MIT, open-core — RBAC, versioning and SSO past Google/GitHub are Pro, dynamic secrets/SCIM Enterprise even self-hosted; verify per feature; Postgres+Redis, .env/k8s sync, a CLI and API an agent can drive — the free-first default) · OpenBao (MPL-2.0, Linux Foundation — the open fork of the last MPL Vault, API-compatible; for Vault-class machinery: dynamic secrets, leases, policies. Vault itself is BUSL-1.1 — flag) · SOPS + age (MPL-2.0, CNCF — encrypted secrets as files in the repository, which is this system's own shape; the GitOps default) · External Secrets Operator (Apache-2.0, CNCF — Kubernetes sync from any backend) · Cosmian KMS (BUSL-1.1, source-available — flag; KMIP-compliant, FIPS 140-3, Rust — a KMS proper: key lifecycle, not value distribution) · Bitwarden Secrets Manager (licence split per component — verify) · Doppler (managed SaaS). Licences checked 2026-07-30 | one audited place a project's keys live and rotate — CI, deploy targets, the product's backend. The register still records where a secret lives, never its value (./permissions): a secrets manager is the grown-up form of "the environment or a keychain", not an exemption from the register. A secrets store ≠ a KMS — the first distributes values, the second manages key lifecycle (KMIP/HSM); most projects need the first, compliance names the second. A key that has appeared in a chat or a log is rotated, not debated |
| Local AI models | Ollama · LM Studio · llama.cpp | when data must not leave the machine, or a cheap local model is enough for bulk/offline work; the AI gateway stays for the heavy calls |
| Colour & palettes | Coolors · Color Hunt · Realtime Colors (all free) | palette exploration that then becomes design-system tokens — inspiration is an input to the system, never a substitute for it |
| Where the demand signal lives | pick by category, not by habit: developer tools → Reddit, then GitHub issues · consumer goods → Amazon reviews, then YouTube comments · B2B/professional → LinkedIn and community Slacks · anything visual → TikTok/Instagram comments | listening in the wrong place returns confident nonsense. Two or three sources per question, chosen deliberately, beat scraping everything. Feeds research, audience and the support role. Aggregators exist (RequestHunt and similar) but are credit-priced — start with the free reads |
| Deep research, run as a job | Webhound — an agent that runs a bounded web-research pass and returns a sourced report or a dataset, with the budget as an input. Free to start; licence not stated. Checked 2026-08-02 | for the shape of question where the answer is a survey rather than a fact — a landscape, a list of players, a dataset that does not exist yet. It is a search tool, not a source: what comes back is graded by the row below like anything else, and a claim that matters is followed to its primary source. A budget cap is the feature to notice — an unbounded research agent is the classic way to spend a week's tokens on a question worth ten minutes |
| Academic & research sources | General index: OpenAlex (data CC0, ~2× Scopus coverage and better on non-English work — but the API now requires a free key and meters a $1/day free budget, so it is free-with-a-ceiling, not free-forever; verified 2026-07-31) · Semantic Scholar (+ a free API) · ACM Digital Library (much of it now Open Access) · Scinapse. Preprints: arXiv (CS/physics/math) / bioRxiv · medRxiv (clinical). Life sciences & medicine: Europe PMC (EMBL-EBI, free, REST API, ~48.5M records including preprints; verified 2026-07-31) · PubMed · ClinicalTrials.gov for a trial's own record — phase, endpoints, status | when research needs a primary source for an evidence-backed claim, not a web-search paraphrase — pairs with an argument without a source is an opinion. Free reads; cite the paper, don't launder it. Match the source to the field, or the rule is followed and the answer is still wrong: arXiv/ACM settle a CS claim and say nothing about a drug, a clinical or regulatory claim is settled at Europe PMC / PubMed / ClinicalTrials.gov, and a news story or an industry site reporting a study is not the study — cite what it paraphrases. Row rechecked 2026-07-31 (OpenAlex, Europe PMC verified live; the rest carried from 2026-07-26) |
| Structured comparison data | Versus — 90+ categories side by side, and far past gadgets: cities and countries (demographics, salary, unemployment, public healthcare, rents by room count and centre/outskirts, climate, museums and theatres, commute time and the Commuter Pain Index, tourists per year) · universities and law/medical/business schools · foods down to oils and legumes · apps and operating systems. Free. Measured by browsing it 2026-07-31, not by trusting its own page: it 403s any plain agent fetch and reads normally in a browser — this is the row above's use case, not a fetch-tool one · its stated process is official authorities for cities and countries, manufacturers for products, DxOMark/Geekbench secondary, with sources listed per comparison · product pages carry affiliate links and commission, disclosed — a bias to hold for products and not for cities · and the listing's "Versus score" publishes no weighting: its world top ten came back Sochi · Da Nang · Navi Mumbai · Jamshedpur, so it measures something specific and is not a "best city" ranking however it reads | the fast way to find which axes even differ between two options — the framing step, not the evidence step. And the data has visible holes: on one listing pass Thane showed 1.16 people/km² beside Vasai-Virar's 3,900, and several cities carried no temperature at all. So frame the comparison here and re-fetch from the authority any figure a decision rests on — which is where their own accuracy note points anyway. Feeds the comparison shape in ./consulting and the market side of research |
| Reading and choosing a licence | SPDX License List (Linux Foundation, v3.28.0 at check — the identifier authority: MIT, Apache-2.0, GPL-2.0-only, and the deprecated ids kept for history) · choosealicense.com (GitHub, CC BY 3.0 — picking one, including the "my project isn't software" path for docs, data and art). Both free, verified 2026-07-31 | this file flags a licence in nearly every row and had nowhere to send anyone to read one — the gap only shows when the answer is "which licence should this be" rather than "what licence is this". An identifier is not a reading: SPDX settles which licence is meant, the text settles what it permits, and neither is a lawyer — a copyleft obligation on something a client will ship is where that stops being a formality. Custom and source-available terms (BUSL, Commons Clause, "Remotion License") have no identifier to look up and are read in full, at the moment of use |
| Behavioural & cognitive reference | Reusable index — licence-clean: Wikipedia's list of cognitive biases (CC BY-SA, grouped by task and by mechanism; the working-language edition is the door to use — ru.wikipedia.org/wiki/Список_когнитивных_искажений and its siblings carry the same licence and their own history, which every offline mirror of them has lost) · the Cognitive Bias Codex (180+, Benson's categorisation drawn by Manoogian, CC BY-SA 4.0 — attribution and share-alike, so a derivative carries the licence with it). Bigger, and not reusable: The Decision Lab (~150, free reads, copyrighted) · Growth.Design (106 entries, many still Coming Soon, all rights reserved, no per-entry citations — built on the Codex and trade books) · Laws of UX (30 principles, CC BY-NC-ND 4.0 — non-commercial and no derivatives, which rules out both a client project and a reworded copy). The largest one is gone: Neurofied's 200+ database was open-sourced and taken offline, its author citing AI companies copying it without credit — a fact worth carrying, since it is the exact use this row must not become. Deceptive patterns: deceptive.design (18 named types mapped to laws and enforcement actions; Testimonium Ltd, no open licence stated — cite, don't reproduce). Whether an effect holds: never here — the paper, through the Academic & research sources row. All verified 2026-07-31 | the instrument behind a rule that already exists: every persona carries two to four named biases and a proto's grounding is published literature, source named (./audience). An index answers what it is called; it does not answer whether the effect survives — and a persona built on a finding that failed to replicate is a caricature with a citation on it, which is the same failure the demographics ban exists to prevent. Product-side the split repeats: the taxonomy names what a design is doing, and the law it maps to is what makes it a risk rather than a style. This row is not where the conversational ones live: sycophancy, response-order effects and silicon sampling are a closed set this system acts on itself, each already pinned to its own paper in ./sources. An index is needed only for the open set — a persona may name any bias at all, and that is the one with nowhere to look it up |
| Codebase orientation | a maintained map in the repo (docs/ARCHITECTURE.md: what lives where, entry points, the paths a change usually touches). Past a large codebase, a generated index — graphify (dual-licensed Apache-2.0 / MIT, verified 2026-07-28; Tree-sitter AST parsing; code is parsed 100% locally — "nothing leaves your machine" and the zero-LLM-credit graph build are its README's claims, not our measurements) — with Data Structure Protocol (.dsp/, stable UIDs surviving renames) or a repo-map tool as alternatives | every task starts in a fresh worktree with zero context, so whatever is not written down is re-derived by every agent on every run. A stale map is worse than none: it falls under docs-follow-decisions like any other doc |
| Context compression / token economy | Headroom (Apache-2.0, local-first — 62k★, pushed 2026-07-25) | shrinks what an agent reads before it reaches the model — tool output, logs, RAG chunks, history; library / proxy / MCP modes. Directly on the minimum-resources mission and complementary to graphify: the graph cuts what you fetch, Headroom cuts how much you send. Its 20% / 60–95% token-savings figures are the project's own claims — measure on your own workload. Licence checked 2026-07-26 |
| Screening imported tooling | claude-skill-antivirus (OSS, pattern-based) | scans a candidate skill, MCP server or CLI tool — anything whose code runs on your machine or whose text enters an agent's context — for destructive commands, exfiltration of .ssh/.aws/.env, unexpected external endpoints, over-broad tool grants, injection text, risky MCP configs and sub-agent abuse; severity-scored, block/confirm/warn. Pattern matching, so false positives are normal (a password-manager integration looks like credential access) — it informs the human gate, it isn't the gate |
| Finding alternatives / OSS catalogs | OpenSource Alternative · OpenAlternative · AlternativeTo (filter to OSS) · awesome-selfhosted · public-apis (MIT, alive 2026-07-25) for the other search — not "what replaces this tool" but "is there already an API for this": currencies, weather, geocoding, the thing a project would otherwise build | the search step behind the selection ladder — when a tool dies, is acquired, or closes its free tier, or you just want the OSS equivalent of a paid default. Feeds the free → OSS → self-host ladder, doesn't replace the judgement. A listed API is a candidate, not a decision: its licence, rate limit and price are fetched at the moment of use like any other fast-rotting fact, because a directory records what was true when someone submitted it. Checked 2026-07-29 |
| Security scanning (your own code) | Claude Security plugin (beta, shipped 2026-07-22 — re-verify at wiring time; /plugin install claude-security@claude-plugins-official) — a pre-commit diff scan plus a full multi-agent codebase review, both running on the owner's existing Claude inference (a free-first win over standing up a new-vendor scanner). Code projects only — it needs a Claude Code runtime, and it is not for audit of a markdown skill repo. The free OSS set it complements, which is what most projects actually wire: gitleaks / trufflehog (secrets, in CI) · semgrep OSS (static analysis) · CodeQL + Dependabot (free on GitHub) · npm audit / osv-scanner (dependencies) · Arcjet (free tier — fetch its current ceiling at decision time; rate limiting, bot protection, email validation as an SDK, which closes the no rate limiting on public endpoints classic miss) · OWASP ZAP and nuclei for the automated pentest pass under a human one. Method and the misses this set exists to catch → ./security. Names carried 2026-07-31; each verified at wiring time like any other row | vulnerabilities caught before they merge and on demand across the codebase; it is the natural tool behind the "security pass before anything public ships" LATER trigger, and a reviewer-side diff-scan option in code companies — installing it on a runtime is a config change, so ask first and log the ledger line |
| Skill compression | skills-optimizer (semantic-compressor, OSS) | shrinks a skill or agent file fail-closed: an inventory of concepts that must survive is built first, commands/tools/paths/numbers/errors/security rules are preserved verbatim, an independent reviewer judges equivalence, and nothing is written until --apply. States include NOT_COMPRESSIBLE — an honest outcome, not a failure. An idempotence marker stops re-compression, which is what compounds loss. Point it at the always-loaded body only, and hold the output to prose a person can read — a skill is opened by a human to screen, approve and diagnose it, and a wall of clipped fragments breaks all three gates while looking like a win. Note the divergence from this system: here fitting is selection, never rewording, and it fails open with an announcement |
| Reading pages agents can't fetch | cf-browser (OSS Worker over Cloudflare Browser Rendering) · Playwright for anything you already test with | JS-rendered pages, screenshots, PDFs, accessibility snapshots, multi-page crawls — for research, competitive monitoring and checking your own live page. Free tier is metered by rendering minutes; interaction tools need the paid plan — fetch current limits and price at decision time |
| Browser control (for agents) | Playwright MCP (Apache-2.0 — local, accessibility-tree driven, free: the default) · Chrome DevTools MCP (Apache-2.0 — profiling, network and console of a live page) · Firecrawl (AGPL-3.0 — others' sites at volume, hosted or self-host) · cf-browser (above) | drive from the accessibility snapshot, not a screenshot — cheaper and more robust. Distinct from Reading pages agents can't fetch: that pulls content, this operates a browser (navigate · fill · test). Licences checked 2026-07-26 |
| Cloning a page you are allowed to clone | Ditto (MIT, free, self-hostable or a hosted API) — takes a URL and emits componentised Next.js or Vite code, deterministically rather than by asking a model to guess: it extracts the design system, tokens and interactions. Checked 2026-08-02 | the honest use is your own site — a rebuild, a migration off a builder, or lifting your live styling into a new stack — and a competitor's layout as a reference you then design away from. Cloning someone else's page and shipping it is a legal question, not a technical one, and this row does not answer it |
| Prompt-to-code builders | v0 · Bolt · Lovable · Replit Agent | they emit real code into a repo, so an agent picks the work up afterwards — that makes them an accelerator through the blank page, not a platform you live on. Use for a first cut of a screen or a spike, then treat the output as code: reviewed, tested, owned. Their free tiers are generation-capped and change often — check before promising anyone a workflow |
| No-code site builders | Framer (AI generation, design-first, publishes) · Webflow | excellent when a human designer owns the marketing site and iterates on it directly; the trade is that the canvas is the source of truth, so your agents can't work there — copy changes, A/B tests and SEO fixes queue behind a person. Framer exposes a CMS API, so content can be automated even when layout can't. their own subdomain versus a custom domain is where the boundary sits — price it at decision time |
| No-code internal tools & data | Appsmith · ToolJet · Budibase (all OSS, self-host) · Retool · Baserow / NocoDB (OSS Airtable-likes) · Airtable | admin panels, ops dashboards and back-office CRUD that would otherwise eat engineering weeks. Prefer the OSS ones: they self-host, their config is files you can commit, and a leaving vendor doesn't take the tool with it |
| Forms, scheduling, signatures | Tally · Formbricks (OSS) · Typeform · Cal.com (OSS scheduling) · Documenso (OSS e-sign) | the small pieces every company needs and nobody should build. All have APIs, so submissions can flow into issues instead of a dashboard nobody opens |
| Competitive monitoring | changedetection.io (OSS) · Visualping · Browse AI (trainable scraper bots, free tier) · Brand24 (mention monitoring + sentiment) | watch competitors' pricing/changelog/landing pages and feed research; cheap early warning without a subscription. Brand24 widens it from pages to mentions — brand and demand signal. Checked 2026-07-26 |
| Domains | Namecheap | buy domains cheap; DNS can stay here or move |
| DNS | Vercel DNS or Cloudflare | if the site lives on Vercel, its DNS is simplest (per-subdomain, zero config); Cloudflare when you want a proxy/WAF/workers in front or many non-Vercel services |
| Payments | Stripe | cards/subscriptions/invoices, full control (needs your own tax handling); for solo digital products a Merchant-of-Record may fit better (MoR handles VAT): Polar (dev-first, OSS-friendly) · Lemon Squeezy · Paddle; pricing/entitlements layer over Stripe → Autumn |
| E-commerce / storefront | Medusa (MIT) · Saleor (BSD-3-Clause) — both OSS, self-host · Shopify (SaaS) | a real storefront (catalogue · cart · checkout) when the product is selling things — Payments above is the money rail, this is the shop around it. Domain-neutral: a physical-goods brand needs it, a SaaS does not. Licences checked 2026-07-26 |
| Auth + billing | Clerk | drop-in auth UI (social, MFA, orgs) + subscription billing glued to it; fastest path for SaaS |
| Resend | transactional + marketing sends from code; React Email templates | |
| Push / user notifications | Novu (open-source notification infra — gh licence field NOASSERTION, historically MIT; verify) · OneSignal (SaaS) | multi-channel notifications to your end users (in-app · push · SMS · email fan-out) — distinct from the support inbox (signal coming in) and from transactional email (one channel). Surfaces only once a product actually notifies people. Checked 2026-07-26 |
| Analytics | PostHog — product events, funnels, replay, flags, with SDKs across web / mobile / desktop so an app (not just a web page) is captured · cookieless web-only analytics where a script suffices: Umami (MIT — licence-cleanest default) or Plausible (AGPL-3.0 — flag); search further (Matomo…) at write time | product events, funnels, session replay, feature flags, A/B; pairs with the Analyst role's whitelist. Pick by platform — a web-only site can run a lightweight script, anything with mobile/desktop apps needs SDK capture. Define events once and route them through the CDP / event-pipeline row so a destination swap (or a warehouse like ClickHouse at volume) is a config change, not a re-instrumentation. Licences checked 2026-07-26 |
| Error tracking | Sentry | crash/error reports with releases + sourcemaps; wire alerts to an autopilot triage sweep |
| Cache / queues | Upstash | serverless Redis + QStash (queues/cron over HTTP); rate limits, sessions, job fan-out |
| Vectors / memory / recall (for the product) | pgvector (Supabase) for small; Pinecone for scale; mem0 / Supermemory (managed agent memory) or Memori (SQL-native) for per-user recall; Memgraph when relationships dominate | RAG, semantic search, long-term/per-user memory, a knowledge graph — only if the app you're building needs it. Pick by shape: vector = similarity, graph = relationships |
| Dashboards (product + team) | Metabase or Grafana (both OSS, self-host) · PostHog's built-in boards for product events · repo-first: a generated docs/analytics/ page | one place answering "is it working, and what did it cost": product metrics (North Star + supporting, funnels) and team metrics (throughput, cycle time, cost per feature from the ledger, limit-killed runs). Start with the analytics tool's own boards; add Metabase/Grafana when you need to join sources or track team numbers next to product ones |
| Documentation (all kinds) | repo-first markdown, Obsidian-compatible (docs/ opens as a vault) · VitePress/Docusaurus for a published site · Mintlify (managed, free tier) · Scalar or Redoc for OpenAPI reference · Bump.sh publishes that reference and its changelog from the spec on every push, and generates an MCP server from it — so the API becomes agent-callable from the same source (licence not stated, free tier unclear; checked 2026-08-02) · Mermaid for diagrams-as-text · ADRs for decisions | one source of truth in git, rendered wherever needed. Diagrams live as Mermaid in the docs (reviewable in a PR, unlike an exported image); an API gets a generated reference, not a hand-written one. Owner-side knowledge-base apps (a GUI over your own notes — the repo-first docs stay the team's source of truth): AppFlowy (AGPL) · AFFiNE (custom/mixed licence — verify) · SiYuan (AGPL) · Logseq (AGPL) — AGPL is fine for an app you run, not embed. Checked 2026-07-26 |
| Short links & attribution | Dub (OSS) · short.io | campaign/marketing links with UTM + click analytics; feeds measure alongside product metrics |
| Where design is drawn | Pen.dev (.pen, repo-embedded — a full MCP: components, importable libraries (Shadcn/Lunaris/Flux), tokens, export_html, agent-drivable) · Penpot (OSS, self-host, open API) · Figma (cloud, MCP + many figma-* skills) · plain HTML+tokens in-repo (free, but no design affordances — this is what produces gradient placeholders) | Compose from a component library, do not hand-write screens. The selection ladder points at Pen.dev for repo-first + free-of-cloud + real agent tooling; Figma when the team already lives there. Pair any of them with Shadcn UI (MCP) for real component code. Run process first — the tool is chosen per design step, not up front. Who pays for the AI is worth checking per tool, and Pen.dev answers it the way to prefer: its MCP server runs on the owner's machine and drives their agent, so generation is billed to a subscription they already hold and can see, rather than to a credit pool inside the product. A design tool that calls a model itself is a second meter — ask which before adopting one, because that spend does not appear in the run records everything else here is measured by. Checked 2026-07-29 |
| Visual hierarchy & predicted attention | Measurable with no model and no service: contrast ratios by the WCAG formula (from an image or from the DOM) · size, weight and position ordering · spacing and grouping · tap-target sizes. Most of "does the hierarchy work" lives here. Predicted attention is a different claim: the research models are open — the DeepGaze / SALICON-trained families, TranSalNet, SUM — and the UI-specific work is where to look first: Aalto's mobile-UI saliency study and dataset (Leiva et al., MobileHCI 2020, dataset released, licence not stated — check before reuse). Commercial attention services wrap this same class of model. Verified 2026-07-31 | A heatmap is a prediction, not eye tracking — measured is reserved for a study with people in it, and the two never merge into one verdict. The Aalto work is the reason to distrust a generic map over a screen: UI attention is expectation-driven — a strong top-left bias, text and images pulling first — while bottom-up colour and size matter less than on natural images, and classic saliency models scored poorly on UIs until retrained on UI data. A natural-image saliency map over a dashboard is a confident picture of the wrong thing. Measure what is measurable, label what is predicted, and put real people on the question that decides something |
| Design system catalog | Storybook | living catalog of UI components + their states; tokens live as files in the repo (CSS vars / style-dictionary) and Storybook renders them; native apps → SwiftUI Previews / a catalog target; non-digital → template library or brand book in docs/design-system/; official Storybook MCP (github.com/storybookjs/mcp) lets agents drive the catalog directly |
| Component libraries — per platform | pick ONE per surface and stay in it (mixing kits reads amateur — same rule as icon sets). React: shadcn/ui (default, in the web stack) · Base UI (headless, a11y-first — for building a design system from scratch) · React Aria (Adobe, deepest a11y) · Mantine (120+ components, batteries included) · HeroUI (ex-NextUI, React Aria + Tailwind) · MUI (Material look) · Vue: shadcn-vue · Reka UI (headless) · Naive UI · PrimeVue · Svelte: shadcn-svelte · Melt UI · Cross-framework headless: Ark UI (React/Vue/Svelte, one API) · Extending shadcn rather than replacing it — the ecosystem is where most new work lands, and awesome-shadcn-ui (MIT) is the directory that indexes it: blocks.so (MIT, 60+ copy-paste page sections) · 8bitcn/ui and 8bit/cnlibs (both MIT — retro 8-bit styling, a deliberate look rather than a default one) · 8StarLabs UI (MIT — the niche pieces a kit never ships: timeline, JSON viewer, heatmap, flip clock) · Componentry and Fluid Functionalism (shadcn-CLI installable, motion-first — licence not stated on either, check before shipping) · beUI (MIT, Framer Motion + Tailwind) · Originkit (animated, beta — licence not stated) · ogBlocks (paid, one-time commercial licence — the only non-free entry in this row, listed because a bought block is sometimes the right call). Checked 2026-08-02 · Vue: also NxUI (Vue 3 + Tailwind, licence not stated) · Web Components: Web Awesome (ex-Shoelace) · daisyUI (CSS-only, framework-free) · React Native: react-native-reanimated (MIT, Software Mansion — the animation layer everything else on RN builds on; not a component kit) · AnimateReactNative (a marketplace of Reanimated/Moti/Skia snippets — a few free, the rest licensed; checked 2026-08-02) · Tamagui (perf-first, web+native) · gluestack (NativeBase successor) · React Native Paper (Material) · NativeWind (Tailwind syntax) · iOS/macOS native: the system IS the kit — SwiftUI built-ins + SF Symbols + HIG; catalog via SwiftUI Previews · Android native: Jetpack Compose + Material 3 (official) · Flutter: Material/Cupertino built-in · forui · GetWidget (MIT, 1000+ themable widgets) · the directory for everything else is awesome-flutter (CC0-1.0). Checked 2026-08-02 · Windows native: WinUI 3 / Fluent · CLI/TUI: Ink (React for terminals) · Charm (Go: Bubble Tea/Lip Gloss) · Textual (Python) — agents build CLIs constantly, these make them feel designed | Reference design systems to learn from (not to copy wholesale): Material 3 · Apple HIG · Fluent 2 · Carbon (IBM) · Polaris (Shopify) · Primer (GitHub) · Spectrum (Adobe) · USWDS / GOV.UK (accessibility gold standard) — mine their tokens, patterns and a11y decisions when designing your own. awesome-design-md (MIT, alive 2026-06-16) is that same list in the form an agent reads: one DESIGN.md per system, dropped in so generated UI matches a house style instead of the model's defaults. Treat it as an imported skill, not a stylesheet — its text joins the agent's context and becomes something it believes, so it goes through screening and the prose diff first (./security), and it is trimmed to the one system this project actually uses rather than attached whole. Checked 2026-07-29 |
| Agent & chat interface components | assistant-ui (MIT — composable TypeScript/React primitives for chat interfaces; the licence-cleanest default here) · Agent Elements (React components and docs for chat, tool-call and workflow UIs — licence not stated, check before shipping) · Beautiful UI (primitives for AI-native interfaces: streaming text, thinking states, approval cards, composers — licence not stated) · AIcss (free components for rendering an agent's thinking and tool-call output in a chat — licence not stated). All checked 2026-08-02 | the surface every product in this catalogue's own domain ends up needing: a thread, a streaming answer, a tool call the user can watch, an approval the user must give. Three of the four state no licence, which is a blocker rather than a detail — copy-paste components become your source, so an unlicensed one is unlicensed code in your repo. The approval card is the piece worth stealing conceptually: this system's own rule is that a destructive or outward act is gated, and the UI for that gate is what these libraries have already drawn |
| Icon sets | Heroicons Animated (MIT, 316 animated icons built on Heroicons with Motion, React) · Nucleo (proprietary, 40k+ SVG icons with a management app and React packages — free tier) · and the sets already inside the component libraries above. Checked 2026-08-02 | pick ONE set per surface and stay in it — the same rule as component kits, and for the same reason: two icon families in one screen is the fastest way to read amateur. An animated icon is a motion decision, not an icon decision — it belongs to the same budget as the rest of the motion on the page, and a page where every icon moves has no hierarchy left to spend |
| Data tables | AdaptTable (MIT — headless React data table that renders natively into Mantine, MUI, Chakra or shadcn/ui). Checked 2026-08-02 | the one component nobody wants to write twice, and the one where a kit's own table usually runs out: sorting, grouping, virtualisation, column state. Headless is the point — the table's behaviour stops being a reason to switch component kits, which is the mixing this catalogue warns about everywhere else |
| Billing & pricing UI | Billing SDK (GPL-3.0 — flag the copyleft: fine for something you self-host, a real decision for something you ship to a client) — React/shadcn components for pricing tables, subscriptions, usage meters and the billing screens. Checked 2026-08-02 | the screens between a working product and a paid one, which every project rebuilds badly. The licence is the whole judgement here — the components are the cheapest part of billing and the copyleft is the expensive part, so this is a row where the free thing may be the wrong thing |
| Utility layer for the framework you picked | VueUse (MIT — 200+ Vue 3 composables: state, browser, sensors, networking) · useHooks (50+ server-safe React hooks from ui.dev — licence not stated, so read before copying). Checked 2026-08-02 | the layer between a framework and a component kit: debounce, local storage, media queries, intersection, clipboard — the things every project rewrites badly and an agent writes from memory even worse, because these are exactly where a hallucinated API looks plausible. Prefer the one that ships as source you can read over a black box, and pin it like any other dependency |
| Calling an API by hand | Insomnia (Apache-2.0 — REST, GraphQL, gRPC and WebSocket, with the collections in files rather than a vendor's cloud). Checked 2026-08-02 | the step before any integration is written: see the real response, not the docs' example of it. The licence is the reason this row names one tool — an API client holds your tokens and your staging endpoints, so an OSS one you can self-host beats a free tier that syncs your collections somewhere by default. Collections belong in the repo like every other entity here, which is what makes them reviewable and what stops them rotting in one person's desktop app |
| Review workflow for stacked changes | Graphite — stacked pull requests, merge queues and review chat, with an AI review pass (licence not stated, free tier unclear; checked 2026-08-02) | for the shape this system produces constantly: a feature cut into tasks whose branches depend on each other, where one big PR hides the seams and separate PRs each wait on the last. Stacking is the workflow that matches the decomposition. The AI review pass is not the review this system means — reviews here is another craft looking, with a name attached; a machine pass is a linter with better prose, and merging the two into one verdict is how a review becomes a formality |
| i18n / localization | Weblate (OSS, self-host) · Crowdin / Lokalise (free tiers) · i18next / ICU MessageFormat in code | translation workflow + the library that actually formats plurals/dates; agents translate, humans review via reviews; string extraction belongs to the build, not to copy-paste |
| Support & feedback inbox | Chatwoot (OSS, self-host) · Crisp (hosted) | where feedback signal physically arrives — chat/email/social in one inbox; an autopilot triages it into the backlog |
| Product feedback portal & roadmap (stakeholder-facing) | Quackback (AGPL-3.0, self-host, MCP — one tool covering customer intake and a public portal, which is what this row is for. Not /opsinist:report, which packages a defect in this skill into a file you post yourself and involves no service) · Fider (AGPL-3.0 — the leading clean OSS voting portal) · Astuto (AGPL-3.0) · LogChimp (GPL-3.0) · ClearFlask (Apache-2.0) · SaaS: Canny · Featurebase · Productboard (no self-host, data lives with them, per-maker pricing — warn honestly) | the PM core is already native (ROADMAP + ICE · feedback · roadmap); a portal is for when external people (customers, stakeholders with no CLI) vote and watch the roadmap. AGPL is fine for a service you self-host. Licences checked 2026-07-26 |
| Team chat (self-host) | Zulip (Apache-2.0, verified 2026-07-26 — licence-first default; threaded model) · Mattermost & Rocket.Chat (custom/mixed licences — name it) · Stoat (ex-Revolt, the Discord-shaped community option — licence NOASSERTION, per-crate, predecessor was AGPL-3.0; verify) | a self-hosted alternative when the managed Slack / Lark integrations (./tooling) aren't wanted — real-time team comms you own; owner-side, not where agents hand off (that stays issues + @mentions). Licences checked 2026-07-26 |
| Visual review on a live page | Superflow (pinned comments that survive redeploys, plus automated a11y/link/spelling/OG passes) · BugHerd · Marker.io · Agentation (desktop; click an element, add a note, and it emits structured context you paste into a coding agent — free for internal use, a licence for redistribution; checked 2026-08-02) | the fastest way for a non-technical reviewer to say "this, here, is wrong"; feeds Design QA and reviews checkpoints without a screenshot round-trip |
| Sharing a build or a bug | capture a bug someone can see — Jam.dev (free tier, ships an official MCP so agents drive it — verified in live use 2026-07-26) · Bird Eats Bug: a shareable link carrying console + network + a repro video, a different craft from the annotate-a-page tools in Visual review on a live page above (those mark up a page, these capture the repro). Tunnel to local dev — Cloudflare Tunnel (cloudflared, Apache-2.0, verified 2026-07-26 — free-first default) · ngrok (freemium) · Tailscale Funnel. Distribute a test build — TestFlight (iOS/macOS, free) · Firebase App Distribution · Sparkle (macOS auto-update; MIT with bundled-component notices — gh field NOASSERTION, verified 2026-07-26) | getting a running thing in front of a human fast — a bug they can watch, a local build reachable over a link, or a fresh binary in a tester's hands. A chat-bot channel is a legitimate distribution lane: an autopilot posts each green build to a Telegram/Slack bot (build passes → bot posts the artifact), which beats a store pipeline for a tight tester loop — don't assume everyone ships through TestFlight. Licences checked 2026-07-26 |
| Where feedback and test results accumulate | the repo and the board: raw signal → issues tagged by theme; usability sessions and persona runs → docs/research/; test output → CI artifacts linked from the issue | tools collect, but the analysable record lives in git and issues — that is what measure and audience read later. Avoid a private tool becoming the only place a finding exists |
| Human-side helper tools (advise the person, not the agent) | scrcpy (Apache-2.0 — mirror an Android phone) · SF Symbols (Apple's icon set) · Lookin (inspect a running iOS UI) · Comparably (company/salary data). Versus moved out of this row to Structured comparison data above — it turned out to be an input to research, not a courtesy to the owner | tools the advisor recommends to the human when they'd speed up their side of the work — not agent infrastructure. Named on the spot with what it does, never pushed. Checked 2026-07-26 |
| Status page & uptime | Uptime Kuma (OSS, self-host) · BetterStack / Instatus (free tiers) | post-launch essentials: synthetic checks on key flows + a public status page; failures feed measure and health |
| Privacy & compliance | Klaro (OSS cookie consent) · policy generators · a DPA template; PostHog/Plausible self-host when data must stay yours | GDPR-style basics for anything public: consent, privacy policy, data-processing agreements, retention. Legal Counsel owns the texts, Security the implementation |
| SEO & discoverability | Google Search Console (free — the only source of your own real queries) · Ahrefs Webmaster Tools (free) · Google Trends (+ Ahrefs' free keyword tools) for what people search now · sitemap + schema.org in the build; deeper tactics: awesome-seo. Technical crawl: Screaming Frog SEO Spider — 300+ checks, free to 500 URLs, with JS rendering, scheduling, custom extraction and API integrations behind the licence (fetch its current price at decision time; it was an annual per-seat licence at this check). Bing Webmaster Tools — free and no advertising account required, which is the difference that matters: its Keyword Research returns actual search volumes, where Trends gives only relative interest and Google's Keyword Planner sits behind an Ads account. Also Site Scan (on-demand technical audit), a backlink profile, and an API, so an agent drives it instead of a human reading a dashboard. The volumes are Bing's index — directional for Google demand, never a stand-in for it. Open-source, and agent-drivable: OpenSEO — keyword research, backlinks, rank tracking and site audits, self-hostable for free with an MCP server, so an agent drives it rather than a person reading a dashboard (a hosted option exists; checked 2026-08-02). Getting the change seen: IndexNow — a free open protocol that pushes added/updated/deleted URLs to Bing, Naver, Seznam, Yandex and Yep (Google is not on that list; there, the sitemap and Search Console remain the lever). Both verified 2026-07-31 | complements the seo-audit skill with actual measurement; run before and after ship. The trend sources answer what to write about, not just how a page ranks — and Trends is not volume: per Google's own documentation each point is divided by total searches for that geography and window, then scaled 0–100, so it reads as relative popularity and an absolute number cannot be recovered from it. Quoting a Trends figure as demand is the same error as quoting an aggregator as a source. Checked 2026-07-26; the crawl, protocol and Trends rows 2026-07-31 |
| GEO — being cited by AI assistants | robots.txt allowing GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot alongside the classic crawlers · FAQPage + Article JSON-LD · a plain /llms.txt index | answer engines cite sources rather than rank pages, so this is a writing rule before it is a markup one: answer first, then explain; short paragraphs under clear H2/H3; concrete statistics and named sources in the copy, since cited, quantified prose is what gets quoted back — and keep that copy readable (Hemingway, free, flags dense sentences). Owned by the copywriter with the web engineer; measured the same way as SEO, before and after ship. Verify current bot names when you set this up — the list changes. This stopped being a fringe concern while nobody was looking: as of 2026-07-31 Microsoft's own webmaster product brands its features "SEO/GEO tools" outright, so the engine side now names the thing too — check what it exposes before hand-rolling a measurement for it. Checked 2026-07-26; the GEO-branding observation 2026-07-31 |
| Share-preview debuggers (how a link unfurls) | force a re-scrape per platform after changing OG / twitter: meta: Facebook Sharing Debugger (OG parse + Scrape Again; its cache also drives WhatsApp) · LinkedIn Post Inspector · Pinterest URL debugger (Rich Pins) · Telegram @WebpageBot (send it the URL to purge Telegram's cache) · VK pages.clearCache (RU-audience projects) · generic tester for local iteration — metatags.io (or opengraph.xyz · socialsharepreview.com). X/Twitter's standalone card validator is retired — verify by posting to a private draft. No official tool for Slack, Discord, Mastodon or Bluesky — they unfurl plain OG through their own caches, so the generic tester + a re-post is the only lever. Checked 2026-07-26 | previews are cached per platform, so a stale OG tag ships a stale card — an agent preparing a launch or a post runs this sweep before publishing. Adjacent: Google Rich Results Test for structured data (different craft) |
| Visual / node-based pipelines | ComfyUI (OSS — image/video generation graphs) · n8n (fair-code, automation with AI steps) · Flowise · Langflow · Dify (OSS LLM apps + RAG + observability) · Rivet (OSS, local, embeddable agent graphs) | two distinct uses: (a) an asset pipeline the design squad runs (ComfyUI for brand/marketing imagery at volume), (b) AI features inside the product you're building. All self-hostable and free |
| AI gateway | OpenRouter | one API to 400+ models / 70+ providers, OpenAI-SDK-compatible; fallbacks when a provider is down; per-model data policies; credit-based |
Selection ladder — the default preference order. When several options cover the need, prefer in this order, and say out loud when you skip a rung:
- Free — no card, no ceiling surprise (then: name the ceiling, below).
- Open source — inspectable, forkable, no vendor exit tax.
- Self-hostable / local — runs on the owner's machine or box; no third party in the loop, nothing to leak.
- Embeddable in the repo — config/tokens/templates live as files under git, so the repo stays the source of truth and everything is versioned and reviewable.
- Agent-drivable — an MCP server, a clean CLI, or a documented API, so agents operate it without a human clicking a dashboard.
A managed or paid option is fine — it just has to earn the exception with a stated reason (the free/OSS one can't do it, ops burden outweighs control, compliance demands it). Record the reason in docs/TOOLING.md next to the tool.
Decision rules the assistant applies:
- Fewest services that cover the need — Supabase already gives auth/storage/ pgvector; add Clerk/Pinecone only when its specific strength is needed.
- MoR vs Stripe: selling globally as a solo/indie → MoR handles sales tax; platform features/marketplaces → Stripe.
- DNS: site on Vercel → Vercel DNS; otherwise Cloudflare.
- Product memory ≠ team memory. The memory row above is for the product you build. The agent team's own memory is the repo + issues (git-versioned, the source of truth) — never add a memory store as a second source. If a very large history ever needs semantic recall, add a vector index as a derived index rebuilt from the repo/issues, never something agents write to independently.
- Need an API or a free tier? Check public-apis (github.com/public-apis/public-apis) APILayer Marketplace is the commercial counterpart — third-party APIs by category, subscribed rather than found (licence and free tier per API, not per marketplace; checked 2026-08-02). for a ready data/API source and free-for.dev for free-tier services before paying — both pair with the free-first rule here.
- Free tier first — and name the ceiling. Default to the free plan, and when proposing a service say where its free tier ends in the unit that will actually bite (build minutes, MAU, rows/storage, events, seats, emails/day) and what happens at that edge — throttle, hard stop, or auto-charge. Record the chosen plan + that ceiling in
docs/TOOLING.md;healthwatches headroom andauditflags what's close. Crossing into paid is spend — owner-gated like any other, never a silent upgrade. - Node-based tools build the product, not the team. ComfyUI/Rivet/Flowise/Dify are for asset pipelines and the AI features you ship — never a second orchestration layer over this one. Wiring a visual flow engine on top creates a competing source of truth, the same anti-pattern as a second memory store. Product-side, they are a normal stack choice.
- Pick CI your agents can read. The decisive feature is not build speed but whether failures come back as structured, fetchable context. A pipeline agents cannot read turns every red build into a human errand — exactly the bottleneck this system exists to remove.
- Verify currency at wiring time. These are seeds, and the market moves — before connecting any of them, sanity-check it's still the right pick for this project (same research-first rule as assets-home in the interview).
- Some tools we deliberately don't stock. AI-text "humanizers" and AI-detectors (Undetectable AI, Originality, and the like) exist to pass AI writing off as human — that contradicts say what you know, and how you know it, so they are neither a default nor a recommendation; if a client insists, that is their call, not our suggestion. (Same logic as n8n over Zapier: the free/OSS/self-host option already wins on our rules.)
- Anything here can be swapped by naming an alternative — research, compare, wire.
Default libraries — AI-fluent stacks
LLMs write best in what they've seen most; picking mainstream stacks measurably cuts hallucinated APIs and review churn. Defaults (override any via interview):
| Platform | Default stack | Why |
|---|---|---|
| Web app / site | TypeScript + React + Next.js + Tailwind + shadcn/ui (Radix under the hood) | deepest LLM training coverage; shadcn is copy-in code agents can edit directly; 21st.dev — community shadcn-style components to copy from before building anew |
| Mobile | React Native + Expo (cross-platform) · SwiftUI (iOS-native) · Jetpack Compose (Android-native) | Expo for one codebase; native pairs when the product demands platform depth |
| Desktop | Tauri (light, Rust shell + web UI) · Electron (max ecosystem) · SwiftUI/AppKit (macOS-native) | pick by footprint vs ecosystem vs nativeness |
| API / backend | TypeScript (Next.js API/Hono/Fastify) or Python (FastAPI) | both are LLM home turf; match the team's main language |
| CLI / tooling | TypeScript (commander) or Go | distribution ease vs single-binary |
| AI features | Vercel AI SDK (+ OpenRouter as the gateway) | streaming/tool-calling glue LLMs know well; patterns & evals reference: awesome-generative-ai-guide |
Always pair with live docs — Context7 (MCP/skill) for current library/framework/OS-SDK APIs, so agents code against today's versions, not a frozen training cutoff.
Rule of thumb: deviate from these only when the project itself dictates (a DSP app is C/Swift no matter what LLMs prefer) — and record the deviation in the guide.
Testing — every stage of the loop, per platform
Free/OSS-first defaults; as always, seeds not a closed menu.
| Platform | Unit / component | E2E | Visual / a11y / perf |
|---|---|---|---|
| Web / PWA | Vitest + Testing Library; Storybook interaction tests | Playwright (free, cross-browser) | Playwright screenshots or Chromatic (free tier) for visual regression; axe-core (a11y); Lighthouse (perf + PWA installability/offline audit) |
| Mobile | XCTest (iOS) · JUnit/Robolectric (Android) · Vitest (RN logic) | Maestro (free, cross-platform flows) · Detox (RN) · XCUITest / Espresso (native) | platform snapshot tests; store-review checklists |
| Desktop | per shell: Vitest (Electron/Tauri web core) · XCTest (native macOS) | Playwright (Electron) · WebDriver (Tauri) · XCUITest (macOS) | same visual tools as web for web-shells |
| API / backend | Vitest/pytest + supertest/httpx | contract/integration suites against a test DB (Supabase branch DBs) | k6 (OSS) load tests |
Cross-cutting testing tools (beyond the per-platform matrix; licences checked 2026-07-26): API clients — Hoppscotch (MIT, default) · Bruno (MIT — offline, git-friendly collections); API mocking / service virtualization — Mockoon (MIT) · WireMock (Apache-2.0); LLM / AI-feature testing — promptfoo (MIT) · DeepEval (Apache-2.0), directly relevant to AI products; test data — faker-js (MIT — the LICENSE file is MIT under a custom header, verified 2026-07-26); self-host A/B & flags — GrowthBook (MIT core + commercial enterprise — verify) beside PostHog's built-in.
Where each sits in the loop:
- Build — unit/component tests are part of the code DoD (tests/review gate).
- Review — QA gate runs E2E + the platform suite; Design QA reviews visual regression against the design system; a11y (axe) and perf (Lighthouse) budgets here.
- Ship — smoke E2E on the real build/prod + the launch checklist.
- Measure — synthetic checks/uptime (e.g. a cron autopilot hitting key flows) + Sentry errors feed
measurealongside product metrics.
Research & reference galleries (design · brand · visual)
The method, not the list. Per project, run style discovery: name the feeling in words → collect references → extract what actually carries it (type, spacing, colour, motion) → turn that into tokens. A frozen link list ages faster than anything else in this file, so keep only the anchors that carry a licensing or fallback decision and search awesome-{topic} for the rest.
| Need | Anchor | Why this one |
|---|---|---|
| UI & product patterns | Mobbin (paid, has an MCP) — free fallback: search awesome-design-inspiration | the only one worth paying for; the fallback matters when nobody has a licence |
| UX guidance & rationale | NN/g (research-backed articles) | the place to look for a sourced argument behind a design call — pairs with an argument without a source is an opinion. Search at nngroup.com/search and re-apply the Articles filter each time — it doesn't persist in the URL. Free articles |
| Typography | Google Fonts for licensing-safe families · Practical Typography for the rules | licence clarity is the whole point |
| Colour | Coolors · Color Hunt | fast palettes that export as tokens |
| Boards | Are.na | where the moodboard lives without becoming a private silo |
Visual styles — method, not a baked-in taxonomy: name the style in the owner's own words, gather references, extract the carriers, encode as tokens in docs/design-system/. What is "clean" to one owner is "sterile" to another; the words are theirs, the extraction is yours.