30 free GitHub tools that actually solve problems in 2026: dev, office, and automation

Every week on GitHub there is another “must-install open source tools for 2026” list. Stars only mean someone clicked Star—they do not tell you which concrete job a tool takes off your plate. The 30 below are grouped by problem: ten each for development, office work, and automation. A project makes the cut only if it runs on your own hardware, the license lets you use it yourself, and it replaces a clearly named kind of work: searching code, reading diffs, merging PDFs, budgeting, watching a site, or actually storing backups somewhere else.

n8n and many “open source dashboards” are common, but their licenses are not MIT, Apache, or GPL, so they are not here. Workflow orchestration goes to Activepieces’ MIT core and Node-RED. Image tags and terms change—open that repo’s LICENSE and README before you install. You do not need all 30 at once.

How this list is filtered

Three buckets are enough—no need to split again into “AI / productivity / geek.”

• Command line: install on your dev machine today; search code, read diffs, manage language versions, call APIs.
• Desktop or local notes: data lands on your disk first; sync comes later.
• Self-hosted: use Docker Compose from the repo. Bind admin UIs to loopback, then reach them through SSH from your own browser.

Development: ten repos you open every day

Most of this group is command-line, with clean licenses; on macOS, Homebrew installs them. On Linux, use distro packages or upstream install scripts—the commands are the same.

1. ripgrep: find content in a repo

BurntSushi/ripgrep · Unlicense · CLI

System grep works; in a large repo you want respect for .gitignore, line numbers, and speed that keeps up with your editor. That is what ripgrep does. VS Code search often uses it under the hood; a terminal install keeps scripts and the editor on the same ignore rules.

macOS: brew install ripgrep, then from the repo root run rg "TODO|FIXME". If you search a tiny project once a year, skip stacking ack or ag on top.

2. lazygit: see what you actually changed

jesseduffield/lazygit · MIT · Terminal UI

It does not teach Git—it lays out staged hunks, branches, and recent commits on one screen. Stage by hunk, stash, browse reflog—faster than bouncing through git status. Dangerous keys live in the same UI; know the difference between git reset and git revert before you drop commits.

brew install lazygit, run lazygit in a repo. Treat it as a view, not “I never need commands again.”

3. delta: diffs you can read

dandavison/delta · MIT · CLI

Default git diff on a big change is two blobs of red and green. delta adds syntax highlighting and side-by-side or inline views so you review your own commits with fewer surprises. After brew install git-delta:

git config --global core.pager delta
git config --global interactive.diffFilter "delta --color-only"

If you already have a diff setup you trust, do not install another just for colors.

4. GitHub CLI: PRs without leaving the terminal

cli/cli · MIT · CLI

gh handles GitHub: open PRs, watch checks, pull issues, read Actions logs. Repo history is still git. Sign in with gh auth login; keep tokens in the system keychain or gh’s credential store—not in shell history or the repo.

brew install gh
gh pr create
gh run watch

5. act: run the workflow locally before you push

nektos/act · MIT · CLI + Docker

act runs GitHub Actions in Docker on your machine. When you change a workflow, act -l lists jobs, then run the one you touched—fewer “push ten times until green” cycles. brew install act; Docker must be running.

It emulates common Linux runners, not GitHub’s macOS runners. Workflows that need Xcode, signing, or simulators are not replaced by act—run those on a real Mac.

6. uv: stop stacking three Python toolchains

astral-sh/uv · MIT OR Apache-2.0 · CLI

pip, venv, pyenv, and pip-tools on the same machine means day one for a newcomer is “why did this install but not import.” uv folds installing Python, creating venvs, and adding deps into one command set.

brew install uv
uv python install 3.12
uv init
uv add ruff

If the team already standardized on Poetry or PDM in docs and CI, do not parallel-introduce uv unless you plan to change lockfiles and runbooks.

7. Ruff: lint and format from one binary

astral-sh/ruff · MIT · CLI

It covers much of what teams split across Flake8, isort, and Black—fast enough for on-save and CI. ruff check . for issues, ruff format . for style. Do not run Ruff format and Black on the same repo; two formatters will fight.

Put rules in pyproject.toml. Run defaults for a week, then tighten for false positives—do not enable every plugin on day one.

8. mise: versions follow the repo

jdx/mise · MIT · CLI

Node 22, Python 3.12, Go 1.23 should not depend on everyone’s ~/.zshrc folklore. mise uses .mise.toml in the project; entering the directory switches to what that repo needs, leaving restores the previous default. It replaces “nvm + pyenv + an unmaintained asdf layer,” not the languages themselves.

After brew install mise, add the activation hook from the README to your shell config. Binaries alone, with no hook, will not track directories.

9. k9s: look at the cluster before you change it

derailed/k9s · Apache-2.0 · Terminal UI

Pod won’t start, service has no endpoints, logs just rotated away—in kubectl that is three or four commands. k9s puts namespaces, pods, logs, and port-forwards in one keyboard-driven UI. brew install k9s, then k9s.

Use read-only kubeconfig on production. Delete and exec shortcuts exist—do not mount cluster-admin on a shared machine.

10. Bruno: API collections in the repo

usebruno/bruno · MIT · Desktop

When a Postman collection lives in one person’s account, base URLs and sample requests drift. Bruno stores requests as text (.bru) so they ride code review. brew install --cask bruno.

Secrets go in gitignored env files, not in committed .bru files. If the team already standardized on another API client, do not add a collection only you use.

Office: ten tools that can replace subscriptions

“Office” here means PDFs, notes, diagrams, spreadsheets, tasks, budgeting, file sync, and scanned-document archives. Run locally first when you can, instead of paying per seat up front. When a self-hosted license splits “core” and “enterprise directories,” we call that out below.

11. Stirling-PDF: stop uploading PDFs to random sites

Stirling-Tools/Stirling-PDF · Core MIT, plus proprietary directories · Self-hosted

Merge, split, rotate, compress—contracts should not go through a one-off web uploader. Stirling-PDF bundles common PDF ops on infrastructure you deploy. The repo LICENSE states: outside directories such as proprietary, saas, and engine, content is MIT; where those directories exist, each has its own LICENSE. Official terms also cover production use for some features.

Before deploy, read which image and tag the README recommends, then read the LICENSE for that tag. Fine for personal files on your own machine; if you run it as a service for others or resell, finish the proprietary-directory terms first. Do not assume the default image ships Chinese OCR language packs.

12. SiYuan: knowledge on your disk first

siyuan-note/siyuan · AGPL-3.0 · Desktop / self-hosted

Block references, bidirectional links, local-first. Note bodies live in this machine’s data directory—not in an account that only half-exports. Official sync is an optional paid service; self-sync can follow their S3 documentation. License is AGPL-3.0: fine for personal use and modification; offering it as a network service to the public triggers AGPL obligations.

If the kernel serves a web UI, bind 127.0.0.1. Do not listen on 0.0.0.0 for phone convenience without authentication.

13. Joplin: clip and encrypted sync

laurent22/joplin · Client AGPL-3.0 · Desktop / mobile

More notebook than block editor: Markdown, web clipper, end-to-end encryption. Sync targets can be your own Joplin Server, WebDAV, or object storage. The repo root declares AGPL-3.0 by default; if packages/server has a separate LICENSE, open it before you deploy a server.

Lose the encryption password and synced notes stay locked—record recovery in your password manager, not in the notebook. If SiYuan is already your knowledge base, do not mirror the same notes into Joplin; two outlines will diverge.

14. draw.io desktop: architecture diagrams in the repo

jgraph/drawio-desktop · GPL-3.0 · Desktop

Flowcharts, network diagrams, and sequence diagrams save as .drawio (XML), fit in Git, and diff ugly—but they are not locked in an account that only exports PNG. The desktop repo is GPL-3.0 today. When you do not need live cursors, desktop is enough; skip a drawing server.

It is not a design system—component styles and labeling rules are still yours to agree on. The official VS Code extension helps when you want to edit one diagram without leaving the editor.

15. Penpot: design files you can keep

penpot/penpot · MPL-2.0 · Self-hosted

Mocks, components, and handoff notes trapped in someone else’s cloud leave screenshots when the account stops. Penpot self-hosts with files leaning toward open SVG/CSS. License is MPL-2.0. The stack has frontend, backend, PostgreSQL, and Redis—not worth operating for one person sketching twice.

When the team truly needs “design files on our metal,” use the repo’s Docker Compose and pin a version you have read. Otherwise stay on draw.io or local files.

16. Grist: when Excel became a database

gristlabs/grist-core · Apache-2.0 · Self-hosted

A sheet passed around in chat with IDs, statuses, and notes mixed in one column is not a spreadsheet—it is a database without constraints. Grist keeps the spreadsheet view with relational columns underneath and formulas. Core is Apache-2.0.

It is not BI. For big screens and complex permissions, clean the data model first, then visualize. When self-hosting, back up the database—not a one-off xlsx export.

17. Vikunja: task lists without a heavyweight suite

go-vikunja/vikunja · AGPL-3.0 · Self-hosted

Todos, lists, boards, sharing with a few people—often sold as “deploy full project management first.” Vikunja is smaller; SQLite is enough to start, PostgreSQL when you outgrow it. License AGPL-3.0.

When tickets must tie to the code repo, support inbox, and SLA clocks, it is not enough. Keep that flow in what you already use—do not nurture a parallel task source of truth.

18. Actual: budgeting starts with which envelope holds the money

actualbudget/actual · MIT · Local-first

Envelope budgeting: every dollar of income splits across rent, tax, servers, misc. Actual keeps ledgers local with optional self-hosted sync. License MIT. Bank auto-import depends on region and connectors—do not assume domestic cards pull transactions automatically.

Personal or small-team money, not tax filing or corporate GL. Invoices and vouchers go to Paperless; do not keep PDF receipts only as attachments inside the budget app.

19. Syncthing: folder sync without someone else’s cloud

syncthing/syncthing · MPL-2.0 · Desktop / server

Sync a folder between two laptops and a phone without uploading to a drive first. Devices pair by ID; traffic is peer-to-peer. License MPL-2.0.

Deletes sync too. Delete by mistake on one machine and the others follow. That is not backup. For important directories, add restic for encrypted copies with history.

20. Paperless-ngx: make scanned text searchable

paperless-ngx/paperless-ngx · GPL-3.0 · Self-hosted

Drop contracts, receipts, and shipping labels into a folder; it OCRs, tags, and files by correspondent. License GPL-3.0. Chinese needs Tesseract language packs (e.g. chi_sim); default images may not include them.

Originals use disk; OCR uses CPU. Do not run it on the same 16GB machine that is building iOS. Keep the admin UI off the public internet; back up originals and the database together.

Automation: ten projects that absorb repeat work

Automation here means one workflow, one notification, one backup run, one dependency bump. If a script plus cron explains it, do not reach for an orchestration platform first.

21. Activepieces: when you want a visual flow, know what is MIT

activepieces/activepieces · Core MIT, ee directory separate · Self-hosted

Form in, write to a table, send email—a script can do it, but a diagram hands off cleaner. Activepieces LICENSE: outside packages/ee/ is MIT; enterprise directories use a separate enterprise license—using those features in production requires their subscription terms.

n8n’s Sustainable Use License allows self-hosting but restricts offering it as a managed service to others, so it is not in these 30. If you already run n8n privately, you do not need to migrate for this list. For new flows with an MIT core, use Activepieces community; leave enterprise features off without a contract.

22. Node-RED: one message from webhook to the next system

node-red/node-red · Apache-2.0 · Self-hosted

Built for events: receive a webhook, reshape JSON, call another API or queue. Apache-2.0. Export flows to Git. Tokens live in its credential store—not in flow JSON you commit.

High volume and heavy retry logic should not grow on one endless canvas. Use Windmill or your existing job system for that.

23. Windmill: when scripts fill a drawer, give them an internal page

windmill-labs/windmill · Community edition mostly AGPL · Self-hosted

Repo LICENSE: default AGPL, some Apache-2.0 files, enterprise features under proprietary terms. Good for turning a Python or TypeScript script into “colleague fills a form and runs it” with scheduling.

One cron and one script do not need it. If you adopt it, separate community from enterprise features first, then decide whether AGPL works for you.

24. ntfy: notifications should not live only in logs

binwiederhier/ntfy · Server Apache-2.0 · Self-hosted

Backup failed, cert expiring, build red—if that only hits server logs, you were not notified. ntfy pushes with one HTTP request to phone or desktop. Server is Apache-2.0. On public ntfy.sh, topic names get guessed; self-host and use access tokens.

curl -d "backup failed" -H "Authorization: Bearer TOKEN" https://ntfy.example/ops

Swap in your token and domain. Do not reuse the example topic name in production.

25. Uptime Kuma: know when it is down

louislam/uptime-kuma · MIT · Self-hosted

HTTP, TCP, ping, cert expiry—one status page is enough for a small team. MIT. It is not metrics; CPU and latency histograms belong in Prometheus—do not pile them into Kuma.

Public status pages leak internal hostnames. Keep internal checks on the LAN or behind SSH; only expose what users should see. Wire alerts to your own ntfy.

26. changedetection.io: the page changed—you did not refresh all day

dgtlmoon/changedetection.io · Apache-2.0 · Self-hosted

Prices, doc paragraphs, hiring pages, release notes—set a selector, notify on change. Apache-2.0. JavaScript-heavy pages use a browser; CPU cost beats static HTML—stretch the interval.

Respect site terms and robots. Do not hammer logged-in pages or content that forbids scraping. Notifications still go through ntfy—skip another chat bot just for this.

27. Renovate: dependency bumps as PRs you can reject

renovatebot/renovate · AGPL-3.0 · GitHub App / self-hosted

Stale lockfiles are rarely ignorance—they are nobody wanting to hunt breaking changes in a giant diff. Renovate splits PRs per package; config lives in renovate.json in the repo. License AGPL-3.0. Public repos often use the hosted GitHub App; for private repos without a third-party app, self-host.

Do not auto-merge majors in week one. Dependabot is GitHub’s product—not on this self-hosted list; if it already works, keep it.

28. restic: backup means you practiced restore

restic/restic · BSD-2-Clause · CLI

Encryption, deduplication, repos on local disk, SFTP, or object storage. BSD-2-Clause. Syncthing mirrors current state; restic keeps historical snapshots.

restic init --repo /path/to/repo
restic -r /path/to/repo backup "$HOME/Documents"
restic -r /path/to/repo snapshots
restic -r /path/to/repo restore latest --target /tmp/restore-test

Put the password in RESTIC_PASSWORD_FILE pointing at a file outside Git. Restore at least quarterly and confirm snapshots are not empty.

29. Vaultwarden: password vault server you operate

dani-garcia/vaultwarden · AGPL-3.0 · Self-hosted

It implements a server API compatible with Bitwarden clients—lighter than the official server, license AGPL-3.0. This is a community implementation, not Bitwarden Inc.’s official server. Clients stay on the official Bitwarden apps.

HTTPS is mandatory. Admin tokens do not go in the repo. Back up the data directory and keep the vault password somewhere else—data backup with password only in your head means a dead machine is a dead vault. Do not expose it on the public internet without authentication.

30. IT-Tools: small chores in the browser

CorentinTh/it-tools · GPL-3.0 · Browser / self-hosted

Base64, hashes, JWT decode, cron explanations, regex—you do these weekly; each does not need another sketchy webpage. IT-Tools runs locally or self-hosted. GPL-3.0. Much runs in the browser.

Still do not paste production tokens into a company-wide instance you have not audited. A copy on your own machine is enough.

What to install in week one

Thirty entries is a menu, not an install script. Keep only what follows for seven days, then add.

brew install ripgrep lazygit git-delta gh uv ruff mise
git config --global core.pager delta
git config --global interactive.diffFilter "delta --color-only"
uv python install 3.12

Self-hosting pitfalls

1. Bind admin UIs to 127.0.0.1 and SSH local-forward to your laptop. Same for Uptime Kuma, Vaultwarden, SiYuan, Paperless, Activepieces.
2. Enterprise directories are not “clone and go.” Activepieces packages/ee, Stirling proprietary directories, Windmill enterprise features, and projects like AFFiNE (MIT frontend, separate enterprise server terms)—read that LICENSE before production. This article uses SiYuan instead of treating AFFiNE self-hosted backend as a free plan for that reason.
3. AGPL for personal use is usually fine; offering network service to the public triggers source obligations. When unsure, read the license—not the marketing “open source” line.
4. Sync is not backup. Syncthing propagates deletes; restic keeps snapshots. Store vault passwords separately from the data directory.
5. Pin versions. In Compose, use a tag you have read—not floating latest. Check migration notes before upgrades.
6. Secrets stay out of Git. Bruno env files, Node-RED tokens, restic password files, ntfy Bearer tokens—gitignored paths only.

On a Cloud Mac

Install the command-line group with Homebrew on the Mac; it barely touches RAM. Docker workloads for OCR, design collaboration, and workflow engines eat memory and disk. On 16GB, if Xcode and simulators are running, do not stack Paperless Chinese OCR or Penpot’s full database on the same box. PDFs and scans fit better on a machine with more disk and less compile contention.

act uses Linux containers; it does not replace GitHub Actions that need Xcode. iOS builds, signing, and simulators stay on the Mac; when the workflow is only lint or Linux tests, use act to rehearse locally.

Keep admin UIs on loopback. SSH-forward from your own computer—for example, map a remote port to your local browser—instead of publishing Vaultwarden or Kuma on a public IP. Put restic repos on object storage or another disk; the Mac should not be the only copy. Notes and .mise.toml, Ruff config go in Git; passwords and API tokens do not.

FAQ

Are lots of stars a reason to install? No—not by themselves. Stars mean reach, not that the license fits you or that the tool solves your problem. Write down one piece of labor you want to shed this week, then pick from the tables above.

Why is n8n missing? It uses the Sustainable Use License, not MIT, Apache, or GPL. Many people self-host without offering it as a service—you do not need to migrate for this list. Clearer-license alternatives here are Activepieces’ MIT core or Apache-2.0 Node-RED.

Do I need all 30? No. Week one is only the rows in “What to install in week one” that apply to you. One stack each for notes, sync, orchestration, and backup.

AGPL vs MIT for your own machines? Using and modifying on your own hardware—both are fine. The gap is distribution and network service: AGPL adds source obligations when you offer service over the network; MIT mostly requires keeping copyright notices. Enterprise directories and proprietary add-ons need their own read—you cannot summarize the whole repo as “MIT because the homepage says MIT.”

Is a self-hosted password vault safe? Vaultwarden puts data on your disk and leaves HTTPS, updates, backups, and passphrase custody to you. Official Bitwarden hosting is a different tradeoff. Either way, separate passphrase from data backup and practice restore.

Can one Cloud Mac run all of it? Command-line tools, yes. OCR, Penpot, and multiple databases do not belong in 16GB with Xcode. Admin UIs over SSH forwarding; restic copies not only on that Mac.