$0Free Stack Directory
ServicesMy StackHarnessDocsAPI key TesterGitHub ↗

Product documentation

Free Stack Directory docs

The project is both a curated directory of free and open-source tools and a real-world example of a maintainable, secure $0 starting stack.

Browse 466 servicesOpen My StackOpen credential tester
On this page
OverviewSearch and filtersMy StackAgent accessCredential safetySupabase schemaCatalog modelSourcesMaintenance

Overview

The site contains 466 services across 30 categories and 8 audience profiles. It covers development, DevOps, IT, security, data, design, productivity and business operations.

Catalog metadata was last reviewed on 2026-07-13. Provider limits and licenses change, so official provider documentation remains the source of truth.

01

Search broadly

Fuzzy search matches names, descriptions, categories and tags, including small misspellings.

02

Narrow precisely

Combine multiple categories, audiences, plans, tags and the live-key-test filter. Filters are saved in the URL.

03

Build My Stack

Save services locally without an account, then sign in to merge and sync them across devices.

04

Connect safely

Copy the agent-access prompt, grant read-only permissions first and use the credential tester where supported.

Search, filters and cards

Search is client-side, debounced and fuzzy. Selected filters use OR logic inside categories, audiences and plans; selected tags use AND logic so each result contains every chosen tag.

  • Multi-select categories, audiences, free-plan models and tags.
  • Live-key-test toggle and quick audience filters for DevOps, IT and Productivity.
  • Sort by relevance, name, verification date, open-source status or live-test availability.
  • Active filter chips, URL persistence, browser navigation and incremental rendering.
  • Every card includes official links, source, verification date, audiences, tags, platforms, deployment, credentials, agent access and Save to My Stack.

My Stack: local-first and account sync

Saving a service does not require an account. Anonymous selections are validated against the compiled catalog and stored in a versioned browser key. The personalized page is marked noindex.

Local mode

  • No Supabase configuration is required.
  • Selections remain in the current browser.
  • Unknown, duplicated and malformed service IDs are discarded.

Account mode

  • Local and account selections merge after login.
  • The API uses the user's session-bound Supabase client.
  • RLS limits reads and writes to stacks owned by auth.uid().

The service-role client is never used for My Stack writes. It is reserved for private operational functions such as distributed rate limiting.

Agent access prompts

Every service card generates a context-aware prompt containing the provider name, category, audience, tags and official links. The prompt requires official tooling and supply-chain verification.

Agent execution order

  1. Official provider-maintained MCP server.
  2. Official CLI using the current documented installation method.
  3. Official SDK or API only when no official MCP or CLI exists.
  4. Read-only verification and a sanitized implementation report.

Credential endpoint security

  • Prefer a provider-maintained official MCP server, then its official CLI, then its official SDK or API.
  • Verify the publisher, package namespace, repository and release provenance before installation.
  • Start with read-only, least-privileged scopes and expand permissions only for a concrete task.
  • Keep credentials in a secret manager or ignored environment file. Never place secret values in chat, source control or logs.
  • Use a harmless identity, account, list, version or status command before allowing write operations.

Request controls

Supported live tests use fixed read-only provider endpoints. The API validates origin and JSON content type, caps request and token sizes, refuses redirects, returns request IDs, disables caching and sends restrictive security headers.

Distributed rate limiting

With Supabase configured, the endpoint HMAC-hashes the client identity and calls an atomic Postgres function. The raw IP is never stored. The backing table lives in a private schema, and only service_role may execute the RPC. Configured production deployments fail closed if rate-limit storage is unavailable.

Supabase schema and environment

Run supabase/schema.sql to create profiles, stacks, RLS policies, the private limiter table and its atomic RPC.

NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
RATE_LIMIT_SECRET=
NEXT_PUBLIC_SITE_URL=

Generate RATE_LIMIT_SECRET with openssl rand -base64 32. Keep the service-role key and rate-limit secret server-only.

Catalog data model

Catalog files live in lib/catalog-a.ts through lib/catalog-e.ts. The parser supports both the original compact rows and extended metadata.

Name|category|audiences|plan|summary|signup|docs|tags|testerId|lastVerified|source|platforms|deployment

Legacy rows receive the catalog review date and repository source automatically. Categories and tags infer additional audiences without a destructive migration.

Curated sources

Awesome DevOps ↗

Cloud, CI/CD, containers, infrastructure as code and platform engineering.

Awesome Sysadmin ↗

IT operations, backups, monitoring, identity, networking and remote access.

Awesome Productivity ↗

Notes, task management, collaboration, office and personal productivity.

Awesome Selfhosted ↗

Self-hosted collaboration, business operations, data, knowledge and homelab tools.

Awesome lists are discovery sources, not automatic imports. Each entry still uses official provider URLs and is reviewed for maintenance, licensing and free-use eligibility.

Maintenance and validation

npm run typecheck
npm test
npm run catalog:validate
npm run catalog:stats
npm run build
npm run check

Tests cover catalog parsing, fuzzy filters, URL state, stack validation, HMAC hashing, rate-limit windows and pruning. GitHub Actions and Vercel builds run the full validation pipeline.

Open the repository ↗