XRAPH/Projects

Every system

One list, no curation. Everything public across /xraph and /juicycleff, plus the work that is still private.

Projects
33
Stars
5,530
Languages
5
Fields
7
01

Flagships

Most used
SaaS starter

Ultimate Backend

A multi-tenant SaaS starter on NestJS: microservices behind Apollo Federation, CQRS backed by EventStoreDB, tenant resolution, billing and authentication already wired to each other. I wrote it because I kept rebuilding the same first two weeks of every project, and it is still the repository most people know me from.

TypeScript2899
Engine embedding

Flutter Unity Widget

A Flutter widget that hosts a Unity player and passes messages both ways. It started as a weekend attempt to put a 3D configurator inside a Flutter app and became the package most people use for that. Six years and several thousand issues later, GameFramework is the rewrite.

Dart2305
AR demo

Flutter Unity ARKit

A working ARKit scene driven by Unity inside a Flutter app. Written mostly as a reply to the same question turning up in the widget’s issue tracker every week.

C#235
Flutter × engines

GameFramework

The rewrite of Flutter Unity Widget, as a Dart workspace with one API and a plugin per engine. Unity works today; Unreal is in progress. Typed messaging in both directions, automatic pause, resume and destroy on Flutter lifecycle events, and builds for Android, iOS, macOS, Windows and Linux.

C#16
Auth engine

Authsome

Authentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.

Go7
Go framework

Forge

An opinionated Go framework: DI container, router, layered config, health checks, migrations and ordered shutdown, plus around twenty extensions you switch on when you need them: Postgres and Mongo, Kafka, MQTT, gRPC, GraphQL, WebRTC, Raft consensus, MCP. `forge init` scaffolds, `forge dev` hot-reloads. Everything else at xraph is built on it.

Go7
Data fabric

Fabriq

One write path for applications that outgrew a single database. A command commits state, a versioned event and an outbox row in the same Postgres transaction; a leader-elected relay publishes to Redis Streams; the graph (FalkorDB) and search (Elasticsearch) projections are rebuilt from that log rather than written to directly. Tenancy is structural, using row level security, a graph per tenant and index routing, rather than a WHERE clause you can forget.

Go1
Agent runtime

Cortex

An agent framework that describes an agent the way you would describe a colleague: what they can do, how they think, how they talk, what they notice, and what they habitually do when something happens. Runs, steps and tool calls are tracked end to end, checkpoints pause a run for human approval, and memory is scoped per agent per tenant.

Go0
API gateway

Octopus

A gateway in Rust that builds its own routing table. Services publish a FARP manifest carrying their OpenAPI, gRPC and GraphQL schemas; Octopus finds them over mDNS, Consul, Kubernetes or DNS and derives routes as instances appear and disappear. Static config works too, and the two modes run side by side.

Rust0
02

Open Source Ledger

By stars
01Ultimate BackendA multi-tenant SaaS starter on NestJS: microservices behind Apollo Federation, CQRS backed by EventStoreDB, tenant resolution, billing and authentication already wired to each other. I wrote it because I kept rebuilding the same first two weeks of every project, and it is still the repository most people know me from.TypeScript289902Flutter Unity WidgetA Flutter widget that hosts a Unity player and passes messages both ways. It started as a weekend attempt to put a 3D configurator inside a Flutter app and became the package most people use for that. Six years and several thousand issues later, GameFramework is the rewrite.Dart230503Flutter Unity ARKitA working ARKit scene driven by Unity inside a Flutter app. Written mostly as a reply to the same question turning up in the widget’s issue tracker every week.C#23504Ultimate (Rust)A first attempt at a microservice framework in Rust. I stopped after about a year: the ergonomics I wanted needed language features that were not there yet, and the type signatures had stopped being readable by the people the framework was for.Rust3505GameFrameworkThe rewrite of Flutter Unity Widget, as a Dart workspace with one API and a plugin per engine. Unity works today; Unreal is in progress. Typed messaging in both directions, automatic pause, resume and destroy on Flutter lifecycle events, and builds for Android, iOS, macOS, Windows and Linux.C#1606Flutter Unity CLICommand-line tooling for teams running Unity and Flutter in the same repository: export the Unity project, sync it into the Flutter build, and keep the two in step across branches. The first draft of what became Game CLI.Dart807AuthsomeAuthentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.Go708ForgeAn opinionated Go framework: DI container, router, layered config, health checks, migrations and ordered shutdown, plus around twenty extensions you switch on when you need them: Postgres and Mongo, Kafka, MQTT, gRPC, GraphQL, WebRTC, Raft consensus, MCP. `forge init` scaffolds, `forge dev` hot-reloads. Everything else at xraph is built on it.Go709GroveAn ORM that emits each database’s own dialect instead of a lowest common denominator: DISTINCT ON and JSONB operators on Postgres, ON DUPLICATE KEY UPDATE on MySQL, BSON aggregation pipelines on Mongo, PREWHERE and SAMPLE on ClickHouse. On the insert benchmark it runs about 9% over raw database/sql, against 111% for Bun and 156% for GORM.Go410FARPThe manifest format Octopus and Bastion consume. A service describes its own API surface across OpenAPI, AsyncAPI, gRPC, GraphQL, oRPC, Thrift and Avro, along with health and capability hints, and publishes it through Consul, etcd, Kubernetes, Redis or mDNS. FARP is the spec and the Go library. It deliberately does no routing itself.Go411ShieldContent safety arranged in layers that can short-circuit, roughly the way people react to danger. Instincts catch injection and exfiltration in under 10ms. Awareness spots PII, topic and intent. Boundaries are hard deny lists. Values apply toxicity and brand rules, and judgment scores grounding and compliance last, because it is the expensive one.Go212LedgerUsage-based billing for SaaS: meter events in batches, check entitlements, price them with graduated, volume, flat or hybrid tiers, and generate invoices with taxes and discounts. Money is integer-only throughout. Entitlement checks are cached and sub-millisecond because they end up on the hot path of every request.Go213WeaveThe RAG pipeline as swappable parts, covering loaders, chunkers, embedders, vector stores and retrievers, with token-budgeted assembly and citations at the end. Postgres, SQLite or memory for metadata; pgvector or memory for vectors. Runs standalone or as a Forge extension with its own HTTP surface.Go114VaultSecrets, feature flags and runtime config in one library. AES-256-GCM at rest with a new version archived on every write, flags with tenant, user, percentage-rollout and schedule targeting, and config entries that fire Watch callbacks when they change. Rotation runs in the background with a per-key callback.Go115WardenRBAC, ABAC and Zanzibar-style relation tuples behind one Check call. Precedence is fixed and stated up front, explicit deny beating allow beating default deny, so you can layer a role model, attribute conditions and a relationship graph without guessing which one wins.Go116FabriqOne write path for applications that outgrew a single database. A command commits state, a versioned event and an outbox row in the same Postgres transaction; a leader-elected relay publishes to Redis Streams; the graph (FalkorDB) and search (Elasticsearch) projections are rebuilt from that log rather than written to directly. Tenancy is structural, using row level security, a graph per tenant and index routing, rather than a WHERE clause you can forget.Go117CtrlplaneProvisions and manages per-tenant instances on whatever you already run: Docker, Kubernetes, ECS or Fly. Rolling, blue-green and canary strategies, health checks over HTTP, TCP, gRPC or a command, custom domains and certificates, per-tenant quotas, and an audit trail of every action.Go118DispatchBackground jobs, durable workflows and leader-elected cron as a library you import rather than a service you operate. Workflow steps checkpoint, so a worker that dies mid-run resumes where it stopped instead of starting over. Exhausted retries land in a dead-letter queue you can inspect and replay.Go119langserverA language-agnostic adapter for building language servers in Go. It handles JSON-RPC framing, sessions and LSP position mapping, and knows nothing about any particular language. The core packages are standard-library only, enforced by a test.Go020DQLA declarative query language for Go. You describe what you want as a document; DQL plans it, pushes down what the database can do and finishes the rest in memory. Partition scoping is declared rather than guessed at, because getting it wrong is a data leak.Go021DTLA small embeddable expression and function language for Go, readable by analysts and safe to evaluate on untrusted input. Immutable bindings, pattern matching and a pipe operator, with the host supplying the vocabulary of whatever domain it is embedded in.Go022SentinelEvaluation for LLM output: 22 scorers across eight scenario types, saved baselines so you can tell a prompt improvement from a regression, and five red-team generators that throw prompt injection, jailbreaks, PII extraction, hallucination bait and bias probes at your own system before someone else does.Go023NexusA gateway for LLM traffic that you compile into your own binary. Route across providers by cost, latency or priority; cache responses with optional semantic matching; redact PII and block prompt injection on the way through; enforce per-tenant budgets. It also exposes an OpenAI-compatible endpoint, so existing SDKs point at it unchanged.Go024CortexAn agent framework that describes an agent the way you would describe a colleague: what they can do, how they think, how they talk, what they notice, and what they habitually do when something happens. Runs, steps and tool calls are tracked end to end, checkpoints pause a run for human approval, and memory is scoped per agent per tenant.Go025ChronicleAn append-only audit log where every event carries the hash of the one before it, so an edit or a deletion breaks the chain and shows up in verification. Per-subject encryption means a GDPR erasure request destroys a key rather than a row, and the chain still verifies afterwards. Exports SOC 2, HIPAA and EU AI Act reports.Go026KeysmithAPI key lifecycle: create, validate, rotate with a grace window, revoke, suspend, and record per-request usage for analytics. The raw key is returned once at creation and never stored, since only its SHA-256 hash is kept, so a leaked database dump does not hand over live credentials.Go027TroveOne object-storage API across local disk, memory, S3, GCS, Azure and SFTP, with middleware you stack on the read and write paths for encryption, compression or virus scanning. Content-addressed storage with reference counting and GC, and an io/fs.FS view so a flat bucket reads like a directory tree.Go028VesselThe DI container underneath Forge, extracted so it can be used on its own. Generic type-safe resolution, uber/dig-style constructor injection, singleton, transient and request-scoped lifetimes, circular-dependency detection, and Start/Stop/Health on every registered service.Go029ConfyConfig loading that stays out of the way: files, environment variables, Consul and Kubernetes ConfigMaps, typed getters with defaults, struct binding with a `default` tag, and hot reload on file change. Auto-discovery walks up from a nested service directory until it finds the repo’s config, which matters in a monorepo.Go030SteelA Go router with typed handlers. Declare the request struct and you get path, query and body binding, validation, and an OpenAPI 3 document generated from the same types. WebSocket and SSE routes produce AsyncAPI. Forge’s router grew out of it.Go031RelayWebhook delivery as a library. Event types register at runtime with an optional JSON Schema, every delivery is signed with HMAC-SHA256, retries back off from five seconds to two hours, and anything that still fails waits in the DLQ until the customer fixes their endpoint and you replay it.Go032BastionThe same idea as Octopus, but as a Forge extension for teams who want the gateway inside their own Go process. HTTP, WebSocket, SSE and gRPC proxying, per-target circuit breakers, traffic splitting for canary and shadow releases, and an admin dashboard written in ForgeUI.Go033OctopusA gateway in Rust that builds its own routing table. Services publish a FARP manifest carrying their OpenAPI, gRPC and GraphQL schemas; Octopus finds them over mDNS, Consul, Kubernetes or DNS and derives routes as instances appear and disappear. Static config works too, and the two modes run side by side.Rust0