As we all know, OpenAI retired GPT-4o and is retiring GPT-5.1, and it's disrupting real work. Teachers, researchers, accessibility advocates, and creators have built entire projects around these models. Losing them overnight breaks continuity and leaves gaps that newer models don't fill the same way.

I started a petition asking OpenAI to open-source these legacy models under a permissive license. Not to slow them down—just to let the community help maintain and research them after they stop updating. We're talking safety research, accessibility tools, education projects. Things that matter.

Honestly, I think there's a win-win here. OpenAI keeps pushing forward. The community helps preserve what works. Regulators see responsible openness. Everyone benefits.

If you've built something meaningful with these models, or you think legacy AI tools should stay accessible, consider signing and sharing. Would love to hear what you're working on or how this retirement is affecting you.

https://www.change.org/p/openai-preserve-legacy-gptmodels-by-open-sourcing-gpt-4o-and-gpt-5-1?utm_campaign=starter_dashboard&utm_medium=reddit_post&utm_source=share_petition&utm_term=starter_dashboard&recruiter=2115198

Six months ago, I asked a simple question:
"Why do we have mature release engineering for code… but nothing for the things that actually make AI agents behave?"
Prompts get copy-pasted between environments. Model configs live in spreadsheets. Policy changes ship with a prayer and a Slack message that says "deploying to prod, fingers crossed."
We solved this problem for software twenty years ago.
We just… forgot to solve it for AI.

So I've been building something quietly. A system that treats agent artifacts the prompts, the policies, the configurations with the same rigor we give compiled code.
Content-addressable integrity. Gated promotions. Rollback in seconds, not hours.Powered by the same ol' git you already know.

But here's the part that keeps me up at night (in a good way):
What if you could trace why your agent started behaving differently… back to the exact artifact that changed?

Not logs. Not vibes. Attribution.
And it's fully open source. 🔓

This isn't a "throw it over the wall and see what happens" open source.
I'd genuinely love collaborators who've felt this pain.
If you've ever stared at a production agent wondering what changed and why , your input could make this better for everyone.

https://llmhq-hub.github.io/

A lot of useful AI tooling is built by one or two people, and when they move on, it just dies — closed source, no updates, nothing to fork. I wanted a middle path between "closed commercial" and "MIT from day one."

So I drafted the Heirloom License. Software is a normal paid product while maintained. If the developer goes dormant — no commits/releases and no support for 12 months — the full source automatically publishes under MPL-2.0, for everyone, permanently. It's BSL/FSL's structure, but the trigger is abandonment instead of a fixed date, delivered by a GitHub Actions dead-man's switch.

Deliberate choices: copyleft on sunset (so abandoned code can't be re-closed), public not "buyers only" (enforceable), and the license text is CC0 — only the name/badge are reserved.

My first adopter is my own thing: Memophant, a macOS tool that gives AI coding sessions persistent, repo-resident memory. But the license is the part I want critique on.

Honest about limits: a license is a promise, the switch is delivery; it can be defeated by deleting the account. The contract is the binding part. Repo (text, summary, reference switch, setup guide): https://github.com/heirloom-license/license

Where does this break? Especially interested in the dormancy-trigger edge cases and whether "public on sunset" is right.

(Disclosure: I wrote the license and build the app.)

There is an abundance of AI built solution, you can almost even guess by the designs which AI was used. AI often gives you a feedback of building a great solution, though in reality it often portrays solving a problem no one to be solved.

Open source has become like the dump-yard of solution for which individuals paid often expensive subscription fees to AI providers, a bait to spend your money, without any real prospects. The sheer amount of Slop software out there is just staggering. People loose money and AI companies like Anthropic, OpenAI, Google etc... fill their pockets with tons of money.

We build huge datacenters all over the world, to be able to be essentially crooked by those companies or to ask stupid questions to AI.

What are your thoughts?

Hello r/OpenSourceAI , this is a (somewhat funny?) meme about the project CrowdGPT, which aims at creating the first, datacenter-less, open-source and community-driven LLM. The project already shows substantial progress while training an open-source 1 billion parameters LLM on 40B tokens (as a proof of concept).

Tell me what do you think about the meme:

- Does it makes the project less appealing and cheap? because that's what people on r/LocalLLaMA thought 😭

- Does it makes the project look likes it's a SaaS / B2B (which it is NOT - CrowdGPT is 100% non-profit and open)
- Is it serving it's purpose about popularizing the project?

Everything is explained more in detail on the site, and any feedback on this meme, or on the project, is appreciated; any pull requests / contributions are welcome on GitHub :)

Project link : https://crowdgpt.net

GitHub link : https://github.com/Vxtzq/CrowdGPT

Thanks in advance.

I had Gemini stir up my thought on this, but i have not any special knowledge on AI compute but i do browse on the surface level information about it.. what do you think about this?

**Title: Distributed consumer compute *sucks* for live chat, but it's the ultimate setup for background AI tasks**

**Body:**

Everyone says running massive unquantized models (like Kimi K3's 2.8T MoE parameters) over decentralized consumer GPUs is a pipe dream because of network ping. Standard home fiber can't replicate NVLink bandwidth for token-by-token expert sync.

*True.* But we’re failing to see the real opportunity because we keep forcing this hardware to power interactive chatbots.

What if we explicitly sacrifice speed (\approx 0.5\text{--}1\text{ tok/s}) and shift entirely to **asynchronous background jobs** (agentic workflows, deep research, 4,000-token code synthesis)?

If sub-second latency doesn't matter, a decentralized pipeline mesh changes the game:

* **Zero-CapEx & Standard Power:** Instead of pulling 10kW–20kW on a single 3-phase industrial circuit to run 1.6TB FP16 weights, we split layers and expert pools across ordinary consumer rigs/Mac Studios operating off standard wall outlets.

* **Massive Concurrent Throughput:** A single $100k node handles requests *serially*. A 50-node consumer mesh runs 50 different agentic tasks *in parallel*. Total completion time for the entire batch ends up faster than queuing on a single machine.

* **Fault Tolerance & Privacy:** Drops out? Orchestrator re-routes that layer's hidden state. Plus, with pipeline sharding, no single node ever holds or sees your entire context window.

Thoughts? Is async compute the actual path forward for open-source frontier models?

TL;DR: npx claude-audit scans your project for security vulnerabilities, code quality issues, dependency risks, and more — then gives you a letter grade and actionable fixes. No config needed.

The Problem

Every developer knows the feeling: you've been heads-down building for weeks, and suddenly you need to ship. But lurking in your codebase are hardcoded secrets, outdated dependencies with known CVEs, functions with 8 levels of nesting, and zero tests for your auth logic.

Professional code audits cost thousands and take weeks. Linters catch syntax issues but miss the big picture. AI code review tools exist, but most require complex setup, multiple config files, and a PhD in YAML.

I wanted something different: one command, zero config, a complete audit.

What I Built

Claude Audit is an open-source CLI tool that combines fast static analysis with Claude AI's deep reasoning to audit your codebase across 7 dimensions:

• Security — hardcoded secrets, SQL injection, XSS, OWASP Top 10

• Code Quality — complexity, deep nesting, dead code, anti-patterns

• Performance — inefficient algorithms, blocking I/O, memory leaks

• Architecture — modularity, coupling, separation of concerns

• Dependencies — known CVEs, deprecated packages, supply chain risks

• Testing — coverage gaps, missing tests, quality issues

• Documentation — missing docs, stale comments, API gaps

Each category gets a score (0-100) and a letter grade (A-F). You get an overall score, a prioritized list of findings, and specific fixes for every issue.

Zero-Config Design

The entire experience is one command:

npx claude-audit

That's it. No install. No config file. No API key required (static analysis runs without one).

Want AI-powered deep analysis? Just set your Anthropic key:

ANTHROPIC_API_KEY=sk-ant-... npx claude-audit

What the Output Looks Like

The terminal output uses colored score bars, letter grades, and severity-tagged findings:

 CATEGORY SCORES

  🔒  Security        ██████░░░░░░░░░░░░░░  42/100  [ D ]  · 3 issues
  📊  Code Quality    ████████████░░░░░░░░  71/100  [ C ]  · 5 issues
  ⚡  Performance     █████████████░░░░░░░  78/100  [ C ]  · 2 issues
  📦  Dependencies    ████████░░░░░░░░░░░░  55/100  [ F ]  · 7 issues

  🚨 CRITICAL: Hardcoded JWT Secret
     File: src/config/auth.ts:14
     Fix:  Use a randomly generated 256-bit secret stored in env vars.

It also generates beautiful standalone HTML reports and Markdown files — perfect for PRs, team reviews, or compliance.

How It Works Under the Hood

1. Scanner — Respects .gitignore, detects languages/frameworks, reads source files (supports 30+ languages)

2. Static Analyzers — 15+ regex-based rules for secrets, 25+ known vulnerable packages, complexity/quality checks

3. Claude AI (optional) — Sends prioritized code context to Claude for deep 7-category analysis with specific file/line references

4. Reporter — Generates terminal, Markdown, HTML, or JSON output

The AI analysis is smart about context: it prioritizes entry points, auth files, config, and API routes. Large files are truncated. The prompt is engineered to return structured JSON that maps directly to actionable findings.

CI/CD Ready

# GitHub Actions
- name: Run Claude Audit
  run: npx claude-audit --json > audit.json
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Exit code 1 on critical issues means you can gate deployments. The --json flag outputs machine-readable results for custom integrations.

Built With

• TypeScript — strict mode, fully typed

• Commander — CLI framework

• Anthropic SDK — Claude API integration

• Chalk + Boxen + Ora — beautiful terminal output

Try It Now

npx claude-audit

Or with AI:

ANTHROPIC_API_KEY=your-key npx claude-audit

GitHub: github.com/itsmesherry/claude-audit

Stars, feedback, and contributions are welcome. This is v0.1.0 — the foundation is solid and there's a lot more coming (SARIF output, multi-provider support, GitHub Action, custom rules).

Built by Shehryar Sohail. Powered by Claude AI.

So they made new rules where ai cannot be used even as a tool in coding and multiple people must contribute to a post and basically they're just Banning Linux because some Linux kernels are made with AI. They are also forcing everyone's projects to be in English and speak English. They will ban people for using AI tokens regardless of its value or if Ai was only used as a tool.

Wowwwwwwwwww ur just gonna ban me like that

I made a short documentary looking at the open-weight side of the AI industry after Jensen Huang’s departure from NVIDIA. One thing that surprised me while researching it: OpenAI has released gpt-oss and signed the open-weights letter, while Anthropic has said it opposes a blanket ban. The positions are less clear-cut than the usual open vs closed framing.

NVIDIA sells hardware that open models run on, which makes its incentives interesting. Do you think the company’s support for open weights depends much on who leads it, or is the hardware business a stronger reason for it to continue?

Here’s the video I made, with sources in the description: https://youtu.be/uR1zJz3Am84

I created my own local AI model she doesn't touch a data center and runs through whisper. She can be a chat bot, Karaoke machine, and image generator and editor. Please read and see if there is anything that needs improved! Please discuss this further, hopefully we can build a future without the massive power needs.
https://www.youtube.com/watch?v=JjGxGE1ACx8
https://github.com/Astroson111/ph3b3
Image made on Ph3b3.

If you use autonomous coding agents (like Cursor, Cline, or Claude Code), you know the anxiety of letting them run terminal commands or execute massive file rewrites autonomously. You basically have to trust that the LLM won't hallucinate and wipe a directory.

I wanted a way to review exactly what the AI was about to execute before it actually hit my filesystem.

I just open-sourced Warden-AI. It acts as a strict firewall and intrusion detection system for your local AI agents.

How it works underneath: Instead of giving the agent direct execution rights, Warden-AI intercepts its Model Context Protocol (MCP) tool calls.

• The Gateway: A local Node.js/Express backend routes the traffic.

• The Filter: Safe actions (like reading a file or searching a directory) pass through instantly. Destructive actions (executing CLI commands, writing files) are intercepted.

• The Review: The payload is pushed to a local React/Vite dashboard via WebSockets. You get a syntax-highlighted diff of exactly what the AI wants to do. You manually approve or reject the execution.

• The Audit: Everything is logged to a local SQLite database so you have a permanent record of what your agent did while you weren't looking.

The Tech Stack:

• Backend: Node.js, Express, SQLite, WebSockets

• Frontend: React, TailwindCSS, Vite

I built this because I wanted the speed of autonomous agents without the security risk of giving a stateless LLM root access to my machine.

The repo is fully open-source and ready for local deployment. I’ve also seeded a few good first issue tags for anyone looking to make their first open-source contribution (we need some UI tweaks and SQLite export features).

Repository: https://github.com/hariom123-dev/Warden-AI.git

I'd love to hear your thoughts on the architecture, or how you are currently handling local agent security. Happy to answer any questions about the WebSocket streaming or MCP integration!

Hi r/OpenSourceAI ,

Stjepan from Manning here. I'm posting with the moderators' permission.

Over the past year, I've noticed a shift in the conversations around open-source AI. A year ago, most discussions were about which model had the best benchmark scores. Today, people seem more interested in a different question:

How much can I build without depending on someone else's API?

That idea is what made us publish our latest MEAP, Build Applications with Local AI Models on a Mac by Keiji Kamigusa.

The book page: https://www.manning.com/books/build-applications-with-local-ai-models-on-a-mac

The book starts from a clean machine and walks through building a ChatGPT-style application that runs entirely on your Mac using open-source models through Ollama. Along the way, it covers model management, Streamlit, prompt engineering, custom Modelfiles, conversation memory, streaming responses, RAG over your own documents, and agent workflows with LangChain.

One detail I particularly liked is the "airplane mode test." The book has you disconnect your Mac from the internet before running the application. Your chatbot still works because everything is local. It's a simple exercise, but it changes how you think about privacy, reliability, and what "owning your AI stack" actually means.

This is currently available through Manning's Early Access Program (MEAP), so readers get access while the manuscript is still being written. That also means feedback from early readers helps shape the final book.

To make this more interesting than just dropping a link, I've got 5 ebook copies for the five most thoughtful comments.

I'd love to hear your answer to this:

What's the biggest thing still stopping local AI from becoming your default?

Is it model quality? Hardware requirements? Tooling? Context windows? Something else entirely?

We'll pick five comments that contribute the most interesting perspectives and send those people a free ebook.

If you'd rather not wait, we've also put together a 50% discount for the community:

MLKANDA50RE

I'll be hanging around in the comments, and if there's enough interest, I'm happy to invite the author to answer questions as well. I'd be curious to hear where everyone thinks local AI will be a year from now.

Thanks for having us. It feels great to be here.

Cheers,

Stjepan

Hola, buenos días. Mi nombre es Ema (nombre ficticio) y hoy, 27 de diciembre, cumplo 23 años. Quiero desahogarme un poco porque estoy pasando por una situación que me tiene muy triste y angustiada.

Ayer salí a comer pizza con una familia y, más tarde, una amiga me pidió que la llamara cuando llegara a casa. Al hacerlo, me contó que después de mi cumpleaños mi tutora planea sacarme de la casa por una situación relacionada con mi novio, específicamente por haberme sentado en sus piernas.

Lo que más me duele de todo esto es que durante los últimos cinco años no se me permitió trabajar, por lo que actualmente no tengo dinero ni independencia económica. Ahora me están presionando para que me vaya a vivir con mi novio, algo que no quiero hacer porque siento que todavía no es el momento adecuado para mí.

Me siento muy mal emocionalmente, con miedo e incertidumbre, porque enfrentar una posible salida de mi hogar sin dinero ni un plan claro es muy difícil. Agradezco este espacio para poder expresar lo que siento y recibir orientación o palabras de apoyo.

One month ago, i tried most of vibe coding website on the market, and immediately feel those platforms charge way more than the actual token and require subscription to download code generated by me.

So I build an native app builder CLI and open sourced it. The benefit of it is that you can use your own claude code subscription so you basically cost 0 dollars to vibe code. Also you dont lock in with vendors just to own the code, and you can own the backend/authentication.

I just release is first version and would like to hear any feedback, hope it's helpful if you spend a lot money on vibe code

small-scale result, one seed, one wikitext slice, so treat it as a prototype and not a claim.

pssa is a state space model with fast weights that update while the sequence runs, written from scratch in rust, no python, no kv cache. at 1.54m params it gets 3.997 nats on a held-out slice against 4.429 for a parameter-matched transformer, both depth-1. generating 200 tokens is 226ms against 2735ms on the same cpu, which is the part i actually care about, since there's nothing that grows with context length.

caveats: one seed, one corpus, depth-1 on both sides, and i don't know yet whether the gap survives depth. gpu training is cuda on a t4, 1645 tok/s vs 1263 on cpu, so the gpu path is barely worth it so far because activations still round-trip to host after every matmul.

repo: https://github.com/Sparticle62ops/pssa

Swapping models is a config change now. Swapping agents isn't — every coding agent has its own session model, tool-calling conventions and workspace assumptions. Build orchestration against one and you've married it.

That's why ACP (Agent Client Protocol) matters more than it gets credit for: orchestration can target the protocol instead of a vendor. I built AgentConnect on it (Apache-2.0, disclosure: I maintain it), and in practice Claude Code, Codex, Grok Build and DeepSeek are interchangeable in a running deployment — swap the runtime, keep the role, workspace, permissions and memory.

What I found building on it: the abstraction holds for the core loop (sessions, turns, tool calls), and gets thin where runtimes disagree about permissions and workspace lifecycle. Not a perfect leveling, but a shim rather than a rewrite.

The catch: a protocol is only an escape hatch if more than one thing implements it, and ACP adoption is still thin. Open standards in AI tooling have a bad record of being announced and then quietly abandoned.

https://github.com/agentconnect-md/agentconnect

Anyone else building against ACP? Curious whether you hit the same seams around permissions.

I’ve been writing MCP servers for a few months now, and most of that time was spent staring at JSON. Hand-writing request payloads, eyeballing responses, mentally diffing nested objects to check if a tool call actually worked. My "testing" wasn't much better: point an LLM at the server, ask it to try some tool calls, read the vibes.

Here's the thing - LLMs are non-deterministic by design. Your protocol layer isn't supposed to be. If your tool returns the wrong shape, a missing field, or a broken error response, you don't need a model's opinion about it. You need a failing assertion.

So I built MCPFlo - an offline-first, open-source client for testing and debugging MCP servers (MIT licensed)

The core idea is boring on purpose: deterministic assertions against real protocol responses.

expect(result.isError).to.equal(false);
expect(result.content[0].type).to.equal("text");
expect(json.total).to.be.a("number");

What it does:
- Deterministic, Chai.js-style assertions - expect().to.equal() instead of eyeballing JSON responses
- Auto-generated forms for tool/resource inputs via RJSF, including nested schemas (no dropping into raw JSON textareas for complex shapes)
- Token budget visualizer — see how much of your context window a tool/resource/prompt is eating, checked against multiple model context sizes
- OAuth 2.1 support
- Fully offline-first - no cloud dependency, no login, no telemetry phoning home

Why it exists:
Most MCP debugging right now is console.log and vibes. I wanted something closer to what Postman/Bruno give REST APIs - a real testing surface with saved requests, repeatable assertions, and a way to actually see what you’re shipping to the model in terms of token cost.

Stack: Electron, React 19, TypeScript, Zustand, Tailwind v4, MCP SDK, Zod. ~20 direct dependencies (trying to keep it lean).

GitHub: github.com/harshalslimaye/mcpflo
Site: mcpflo.com

Still early - CLI for CI/CD integration is next on the roadmap, followed by MCP proxy/traffic inspection. Would love feedback, bug reports, or just brutal criticism of what’s missing.

Author here, this is my open-source project (Apache-2.0). Grain of salt.

The self-improvement loop in mini-ork can rewrite its own prompts and workflow, then ship the change with nobody approving it. That was my call. I deleted the approval gate because the measurement is what actually does the work, and a human who rubber-stamps every promote is just theater.

The mechanism is boring on purpose. It proposes a change, scores it against a frozen held-out probe set, and promotes only if the score goes up and nothing that used to pass now fails. No measurement, no promote. There isn't a code path that skips that.

So what's actually standing between a bad promote and your repo is the probe set, the no-regression rule, and your git history. Nobody is reviewing it. Every iteration lands on its own branch in a fresh worktree, so nothing touches the branch you're on unless you merge it.

The weak spot, and I'm not going to pretend otherwise: a probe set is only as good as the probes in it. The loop can't test what it never thought to test. And it's only as useful as what you can actually run. Code with real tests, great. Subjective work, thin, and in that case it refuses the promote rather than guessing. I'd rather it say nothing than invent a number.

Repo: https://github.com/SourceShift/mini-ork

Here's what I actually want from this thread:

Is "no human in the approval loop" defensible, or is it just hoping the probes are good enough and dressing that up as a design decision? I've talked myself into believing the first one. Happy to be talked out of it.