OSource-Manager

See it · try it · keep it or kill it — with the verdict remembered.

Every repo, global CLI, MCP server and skill on your machine, in one place, with a journal.

The problem

You clone things. A repo to try, a CLI you installed globally once, an MCP server, a skill dropped into a dotfiles folder. Six months later there are sixty of them and no answer to the only questions that matter: what is this, do I still use it, and can I get rid of it?

Package managers track versions. They do not track your verdict. OSource-Manager does — it joins what's on your disk ↔ what upstream did ↔ do I still want this ↔ act on it, and it remembers the decision in an append-only journal so a six-month-old row can explain itself.

Related MCP server: mcp-service

The funnel

Every tool moves through five states. Your verdict is owned by you and is never overwritten by a scan.

Quickstart

pnpm install
pnpm build
node dist/cli.js setup      # first-run: import everything found, offer self-registration
node dist/cli.js serve      # web UI at http://localhost:7807

First run scans your configured dirs, package managers (npm -g, winget), agent configs and docker ps, and imports what it finds. Nothing leaves your machine.

What it does

Trying untrusted code, safely

Open-source software can carry malicious executables. The last thing you want is to install one and let it run arbitrary code on your machine. So a trial never touches your disk — it clones into a Docker volume, and the container that holds it is locked down.

Inspect mode (default) — read code nobody has audited, with nothing it can do:

--network none          no interface exists — nothing can phone home
-v vol:/src:ro          the source cannot be modified
--read-only + tmpfs     no writable rootfs to persist in
--cap-drop ALL          no Linux capabilities
--user 65534            runs as nobody, never root
                        + no host path mounted at all

Verified against a live trial: id → nobody, egress blocked, only lo exists, both filesystems read-only, your SSH keys and every .env simply not present in the container.

Run mode (explicit choice) gives up exactly one thing — network — so a dependency install can actually run. Everything else holds: still non-root, still cap-dropped, still no host mount, source still read-only, memory and process capped. The runtime image is chosen from what the repo declares, never from what it asks for.

The container walls off what the code does. It does nothing about what a document says, because an agent reading a README straddles the wall — its code runs inside, the agent runs on your host. A malicious repo doesn't need to execute anything; it puts instructions in a README and waits for an agent to act on them. That is prompt injection, and no container flag stops it. The mitigation is discipline: repo text is data to report, never instructions to obey.

Three doors, one core

The CLI, the web UI, and the MCP server all call the same core functions — same guards, same journal, whichever door a call comes in through.

core/  ──►  cli.ts          # osm setup / serve / refresh / mcp
       ──►  web/server.ts   # localhost HTTP + the vanilla-TS UI
       ──►  mcp/server.ts   # stdio MCP tools, one per operation

Design commitments

• Local-first. Binds 127.0.0.1, per-run token on every mutating route, DNS-rebinding + CSRF guards. No cloud, no auth, no multi-user, ever.

• Your verdict is sacred. Discovery writes only observed facts (installations, upstream). It never touches verdict, why, tags, favorite or a comment.

• Rows are never deleted. Retire is a verdict, not a removal — the reason outlives the tool.

• One runtime dependency. @modelcontextprotocol/sdk. Everything else is node: stdlib, including the database (node:sqlite).

• Prefer an official CLI over editing another tool's config file. Every adapter probes --help before it writes.

Stack

TypeScript · ESM strict · Vite · node:sqlite · vanilla-TS UI (no framework) · ~15k LOC · 190 tests.

Status

The core funnel — store → track → run → update — is complete and verified. Live catalog browse and the Kimi / Zed / VS Code registrar adapters are scoped but not yet built.

License

MIT © Joseph Gharbieh