zql is a read-only SQL engine, written against the Rust standard library, with an empty dependency manifest. Built for the Zero Dependency Hackathon, it lets you point one binary at any real folder on your machine and query what is actually there with ordinary SQL, joined across sources that would normally need separate tools. It reads SQLite databases by walking their b-tree directly, reads CSV files, walks your filesystem as a table, tails a growing log file, and exposes your environment variables, all through one query language, and all joinable in a single statement. It speaks the real PostgreSQL wire protocol, so existing clients like psql and node-postgres connect and work immediately, nothing custom to install. Everything beyond the standard library, including the SQLite reader, the wire protocol, the SQL parser, an HTTP server, CSV parsing, and calendar math, was written by hand rather than pulled in as a crate, and cargo tree confirms exactly one node. The engine is read-only by construction: no file-write calls exist anywhere in the source, so it can be pointed at anything without risk. Correctness is checked against independent references rather than itself, using Python's sqlite3 module and real Postgres clients as oracles, which caught real bugs early. The result runs anywhere: on the command line against real files, or entirely inside a browser tab compiled to WebAssembly with nothing to install. It shows a serious, everyday tool can be built with nothing but the standard library, without giving up correctness, safety, or usefulness.
stranger reads your lockfile and tells you which of your dependencies you have never actually met. Hallucinated package names, code that runs at install time, the same package sitting in your tree at four different versions. No install, no resolve, no network.
If you ran it, I want to know what it said. Especially if it was wrong. A false positive on a real project is worth more to me than ten clean scans, so if it flagged something that turned out to be fine, that is exactly the thing to paste in here.
Takes about a minute. You can skip anything you do not feel like answering.
Revenant is a SQLite engine written from scratch in Rust, with an empty [dependencies] table: no crates, no C library, no unsafe. Rust cannot read a SQLite file today without linking C - rusqlite compiles the SQLite amalgamation. Revenant closes that gap in 11,000 lines of standard-library Rust.
zdh — an HTTP/2 server written against the Go standard library. And nothing else. Ever.
Go ships a perfectly excellent HTTP/2 implementation. Battle-tested, free, one line away: import "net/http". We looked at it, said no thank you, and spent 72 hours reimplementing the whole protocol by hand from the RFCs, because the rules said "zero dependencies" and we read that as a dare.
So we wrote all of it. All ten frame types (RFC 9113). HPACK with hand-built Huffman tables (RFC 7541, byte-exact against Appendix C). The §5.1 stream state machine, identifiers, concurrency limits, CONTINUATION reassembly. Both flow-control windows, including the delightful fact that negative windows are legal. TLS with ALPN and a §9.2.2-compliant cipher policy. Request/response semantics and malformed-message rules. Static files with conditional requests, byte ranges and strong ETags (RFC 9110). RFC 9218 extensible priorities with a real write scheduler — which forced us to also write a full RFC 9651 structured-fields parser, killing a third-party package. go.sum does not exist, and the build physically refuses to compile if net/http ever enters the dependency graph, because we didn't trust ourselves. Correctly.
Results: 147/147 on h2spec --strict — somebody else's conformance suite. 1,186 tests, 7 fuzz targets. Defends CVE-2023-44487 (rapid reset) and CVE-2023-45288 (CONTINUATION flood) with real attacking clients that genuinely bounce. Reproducible build: two builds, identical SHA-256.
The part we're proudest of: a green suite proves your code passes your tests and says nothing about whether the tests would notice if the code broke. So we built a harness that deletes our own guards one at a time and demands a named test fail. If it doesn't fail, the guard isn't tested. 1,218 self-inflicted wounds, 18 campaigns, zero holes. It caught things nothing else would — best of all, returning a refused stream's verdict before decoding its header block leaves HPACK one insertion behind the peer, so every later request decodes into header fields nobody ever sent. No crash. Just quiet, confident nonsense forever.
We also verify all 327 RFC quotations in our comments actually appear in the RFC we cited. It caught us misquoting nine times. From memory. Confidently.
Live: zdh-hack-demo.duckdns.org — fires 64 real requests on one connection and reports the numbers from your browser's own timing API. Run h2spec against it yourself.
Needle is a zero-dependency full-text search engine written entirely in Go using the standard library. It indexes local files and provides fast ranked search using a custom tokenizer, stemming, inverted index, BM25-style scoring, persistent storage, and crash recovery through a write-ahead log. Needle also supports federated search across connected nodes through its built-in HTTP mesh, without third-party runtime dependencies. The project is designed to demonstrate how much of a practical search system can be built using only Go's standard library, with tests, benchmarks, dependency proof, and honest documentation of its limitations.
Hollow is a zero-dependency recursive DNS resolver, ad-blocking DNS server, and wire-level protocol toolkit built entirely on the Go standard library alone (no require block in go.mod, 0 go.sum, 0 vendor).
Key Highlights:
1. Iterative Root Resolver: Walks from IANA root hints down to authoritative nameservers without delegating to upstream stubs. Enforces strict bailiwick checking, CNAME loop detection, and bounded query budgets.
2. Abuse & Forgery Resistance: Implements DNS 0x20 case randomisation, crypto/rand transaction IDs, connected UDP sockets, and Response Rate Limiting (RRL with TCP slip).
3. Filtering DNS Server: Concurrent UDP worker pool and TCP listeners on non-root port 15353. Parses /etc/hosts, domain lists, and Adblock Plus (||domain^) wildcards with 0ms lookups.
4. Resilient Caching: Sharded LRU cache with dynamic TTL decrementing on egress, RFC 2308 negative caching, RFC 8767 serve-stale, and request coalescing (singleflight).
5. Protocol X-Ray & Observability: Built-in 'trace' (delegation trees), 'inspect' (byte-by-byte RFC 1035 wire dissection), and 'dash' (live ANSI terminal dashboard with QPS sparklines and top blocked domains over a loopback control socket).
Tested with 342 tests across 4 platforms and packaged as a 5.1MB scratch Docker image.
Git repository archaeology with an empty dependency manifest.
strata reads a .git directory directly - loose objects, packfiles, delta chains, refs - and tells you where a codebase's risk is concentrated: which files churn hardest, which have exactly one author who has since gone quiet, and which files keep changing together despite living in unrelated directories.
No third-party crates. No network. It never invokes git.
Zero Dependency Hackathon 2026 · Track A - Developer Tools & CLI Rust 1.98, std only.
bindery turns a folder of Markdown into a real documentation site: sidebar navigation, dark mode, full-text search, syntax-highlighted code, hand-rendered diagrams, and live reload while you write. It also exports the same content as a PDF with real clickable links, and renders any file straight to a terminal.
Everything you'd normally reach for a package to build, I wrote by hand against Go's standard library: a CommonMark parser passing 652 of 652 official spec examples, a WebSocket implemented from the RFC for live reload, a file watcher, a BM25 search engine, a PDF writer using real Adobe font metrics, and a graph layout algorithm for the diagrams. go.mod has no require block. There's nowhere for a dependency to hide.
The build is reproducible two ways, byte for byte: the compiled binary, and the site it generates. STDLIB.md documents 30 stdlib-for-package substitutions, what each one cost, and where the standard library genuinely has no answer at all.
vouchsafe is a WebAuthn relying-party server that lets any application replace passwords with passkey login using a fingerprint, face, or security key. It has zero third-party dependencies. go.mod has no require block. Every ceremony, every byte of CBOR and COSE parsing is hand-written against the Go standard library.
Every existing Go WebAuthn library depends on the same CBOR package, chosen by its maintainers because it does not crash. That is a low bar for code sitting directly in front of a credential check. vouchsafe replaces both go-webauthn/webauthn and fxamacker/cbor with hand-written code, proven by a sixteen-case adversarial test suite that deliberately triggers algorithm confusion, counter regression, cross-user identity mixups, and non-canonical CBOR, and verifies that every one is explicitly rejected rather than silently accepted.
It supports all three passkey algorithms: ES256, RS256, and EdDSA. Each is verified against its correct signing rule, including the raw-message-versus-pre-hashed-digest distinction that breaks naive Ed25519 implementations.
It supports usernameless discoverable login, none and packed attestation including self-attestation and full x5c, credential management with list, revoke, and nicknames, and a per-ceremony verification override that can only make verification stricter, never weaker.
253 tests across 13 packages, zero data races verified with the race detector, approximately 980,000 fuzz executions with zero crashes, and an 8.51 MB scratch-based Docker image.
We publish the cost, not just the win. Raw signature verification runs in 26 to 62 microseconds regardless of algorithm, while a full login call costs about 9 milliseconds, almost entirely due to the fsynced durable write rather than the cryptography.
And the one thing we have not done yet: no real Touch ID, Windows Hello, or hardware security key has touched this code. That is stated plainly, not hidden.
Try it in under a minute: go build ./cmd/vouchsafe, then ./vouchsafe serve, then open localhost:8080/demo.
Built for Track E. Security.
Anvil is an embedded key/value database for your Go program without using any dependencies.
It stores everything in a copy-on-write B+tree over a single file, and its built to survive a crash at any point of a commit without losing or corrupting a single acknowledged transaction.
We've verified it by intentionally crashing it 100,000 times!!
netlens is a web-based networking education tool. Instead of simulating traffic, it sends genuine DNS, TLS, HTTP and ICMP packets from the user's machine and displays the raw bytes, letting them edit any field and re-send to observe the change.
It includes eight structured chapters, each presented at three depths: narrative, guided steps, and byte-level inspection. A drag-and-drop network builder lets users construct topologies from 26 device types across Packet Tracer's categories, then send packets and watch them travel hop by hop, stopping at whichever device drops them with the reason. Six guided labs validate the user's topology live.
Built entirely on the Node.js standard library with zero third-party dependencies, verified by an automated check. 428 tests.
nirdep is a zero-dependency JavaScript codemod that removes unnecessary npm packages while keeping their functionality.
It replaces 11 package names across 5 runtime modules, safely rewrites code, checks security issues, and prevents dependencies from coming back, all using Node.js standard library only.
It analyzes a project, calculates dependency blast radius, identifies security advisories, and safely rewrites supported imports and call sites. It uses a scope-aware lexer, byte-range patching, syntax gates, and a plan-before-apply workflow to avoid unsafe changes. When a replacement cannot be proven safe, nirdep refuses to rewrite it instead of guessing.
The project has 0 third-party runtime dependencies, 634 tests, 3,593 conformance cases, 856,168 differential checks, and an offline advisory table covering 40 rows across 34 packages.
The core idea is simple: delete the dependency, keep the functionality, and make sure it stays gone.
inkless turns a plain Markdown file into a properly typeset PDF: title page, justified body text, tables, code blocks, a clickable table of contents with working links and sidebar bookmarks. There is no PDF library in Python's standard library, so the format is written by hand, object model, cross-reference table, and font metrics included. Zero third-party dependencies. Same input always produces byte-identical output.
CarryProof prepares file handoffs without modifying originals, then packages the prepared files, their change record, and an integrity verifier into one self-contained HTML capsule. Recipients can verify and extract files directly in their browser. Built with Python’s standard library and native browser APIs, with zero third-party runtime dependencies.
The demo automatically opens a five-step judge walkthrough covering changes, verification, one-byte corruption detection, and verified downloads. No login or access code required. It uses synthetic samples; processing personal folders runs locally.
LeakLens is a git-aware secret scanner in a single file of Node.js, with zero third-party dependencies. It scans the working tree and the git object database directly — including blobs that git log cannot reach, such as secrets removed with git commit --amend, which scanners built on git log -p structurally cannot see. It never shells out to git and makes no network calls; both are enforced by tests rather than asserted. Beyond detection it explains each finding, writes an ordered remediation plan, and verifies fixes — reporting working-tree state and history state separately, and stating plainly that it cannot confirm rotation offline. Track E. 94 tests, reproducible build.
Samepack is a zero-dependency Go CLI that answers a deceptively hard release question: do these archives contain the same files, even when their compression, metadata, order, or wrapper directory changed?
samepack record turns a trusted ZIP, TAR, or TAR.GZ archive into a persistent, strict JSON manifest. samepack verify checks one or many later archives against that baseline without retaining the original archive. Matching payloads pass across formats; mismatches produce exact added, removed, content-changed, kind-changed, and executable-behavior diffs. Root stripping is explicit instead of guessed.
The proof is public and rerunnable. Samepack processed 18 exact public GitHub commit pairs: 36 archives, 743.1 MiB compressed, 1.50 GiB of payload, and 124,356 paths. Every ZIP/TAR.GZ pair had different outer hashes; every portable payload root matched. Four Go fuzz targets accumulated 399,166 local executions across archive parsing, manifest parsing, cross-format equivalence, and mutation checks.
Samepack uses only the Go standard library and ships as a standalone binary. Its release process uses pinned, reproducible build inputs and publishes checksums. Its trust boundary is explicit: archives are inspected without extracting entries to disk; unsafe paths, special file modes, ambiguous path graphs, malformed manifests, and oversized inputs are rejected under documented limits.
AI disclosure: ChatGPT/Codex was used as development tooling.
vitals is self-hosted Real User Monitoring in one Go binary with an empty
go.mod. A 942-byte beacon collects Core Web Vitals from real visitors, a JSONL
store with histogram percentiles holds them, and a vanilla JS dashboard charts
them live over Server-Sent Events. No database, no CDN, no framework, no build
step. Every replaced package is logged, each naming where the original is
better.
Video recorded at 1.5x to save your time. Narration is unchanged.
nobroker is a durable, brokerless job queue for Python that provides persistent background job processing without requiring Redis, RabbitMQ, or any external broker.
Most Python background job systems depend on a separate service for storing and coordinating jobs. While that works well for distributed applications, it can be unnecessary for single-machine workloads such as CLI tools, cron jobs, CI runners, automation scripts, edge devices, and small services. nobroker uses the filesystem and operating-system primitives already available on the machine instead.
At its core, nobroker uses an append-only write-ahead log (WAL) and a file lock. Every job is stored as a length-prefixed record protected by a CRC32 checksum. `enqueue()` performs an `fsync` before returning, ensuring that a successfully enqueued job has been persisted to disk.
The log is the single source of truth. On startup, nobroker replays the log to rebuild the queue state. If a crash occurs during a write, an incomplete or corrupted tail is detected through the record framing and checksum and safely truncated during recovery. The in-memory priority heap, lease table, retry state, and dead-letter queue are rebuilt from the log rather than maintained as separate persistent state.
nobroker supports durable job processing with leasing, ack/nack, visibility timeouts, delayed jobs, priorities, automatic retries, exponential backoff with jitter, maximum attempts, dead-letter queues, multi-process safety, compaction, and a worker runner.
Delivery is at-least-once. A job may be executed more than once if a worker fails before acknowledging it, so handlers should be idempotent. nobroker intentionally does not claim exactly-once execution.
The project has zero third-party dependencies and uses only the Python standard library. It can also be packaged as a roughly 40 KB `.pyz` file for Python 3.11+, making deployment a single-file operation.
nobroker is designed for single-machine workloads and prioritizes durability over raw throughput. It achieves roughly 1,350 durable enqueues/sec, around 58k/sec when batching writes behind a single `fsync`, and about 48k records/sec during cold-start replay.
The goal is simple: a durable, reliable background job queue for Python without the operational overhead of running another server.
StoneKV is a crash-safe, log-structured embedded key-value store built entirely with Rust's standard library — zero third-party dependencies. It supports persistent SET, GET, and DELETE through both a CLI and an embeddable Rust API.
Every acknowledged write is appended to a write-ahead log and synced with File::sync_all() before in-memory state updates. If a process stops mid-append, StoneKV detects the incomplete record on restart, replays the valid prefix, physically truncates the damaged tail, and continues safely.
Compaction has its own independent recovery mechanism — a synced compaction.pending marker lets StoneKV roll an interrupted compaction back or complete cleanup before serving reads, preventing deleted values from resurrecting via older segments. This mirrors the same crash-consistency problem production LSM engines like RocksDB and LevelDB solve with a manifest/version-set — StoneKV's version is deliberately smaller, but addresses the same failure class.
The engine includes a hand-written binary record format, IEEE CRC32 checksums, a BTreeMap memtable, immutable sorted segments with sparse indexes, tombstone deletes, and full compaction — 117 unit and integration tests cover corruption, crash recovery, compaction recovery, and concurrent access. Zero-dependency proof is in Cargo.toml, deps-proof.txt, and STDLIB.md. This submission claims the STDLIB Log and Reproducible Build bonuses
depx reads a repository's source code and its manifest, and reports where the two disagree.
▎
▎ A 2025 USENIX study found 19.7% of packages AI models recommend don't exist. The invented names repeat, so attackers register them and wait — you npm install, the name resolves, and you're compromised having typed everything correctly. depx catches that statically, before the build.
▎
▎ It reports six kinds of disagreement across twelve languages — imports nothing provides, relative imports pointing at no file, packages installed but never declared, dependencies never used, and dependencies the standard library already ships. Fully offline, one command, no installation.
▎
▎ It also verifies the Zero Dependency rule itself, including the half a manifest can't show: whether the source was written or copied in.
▎
▎ And it's a dependency tool with an empty manifest. Sixteen substitutions documented in STDLIB.md — including a full interactive terminal UI built on node:readline and ANSI escapes, with no ink.
If there's a "how to verify" or notes field
▎ Track A. make build · make test (237 tests) · node bin/depx.mjs zero-dep . · make verify (byte-identical builds).
▎ Run node bin/depx.mjs fixtures/messy in a terminal for the interface — f/z/v switch views, / searches.
▎ Bonuses claimed: Reproducible Build, Package Killer, STDLIB Log.
shed answers a question no other tool asks: which of your dependencies has Node core already made unnecessary?
Node's standard library has quietly absorbed a great deal of what people still install. chalk became util.styleText. uuid became crypto.randomUUID(). rimraf became one option flag on fs.rm. Almost nobody goes back to check, so those packages sit in manifests for years, dragging transitive dependencies and install scripts behind them.
Point shed at a project and it reads the manifest, the lockfile and the source, offline, spawning nothing, then reports each dependency as removable, needing a Node version bump, blocked, unreferenced, tooling, or unknown. Every verdict names the replacement API, the version it landed in, and the exact import site. It walks the lockfile's resolution graph to say what actually leaves node_modules, and calls out packages that run scripts at install time.
The hard part isn't finding candidates, it's refusing. A tool whose output is "delete this code" is worthless unless you can trust it to say no. shed reports express as blocked rather than removable when your code calls app.use, and cites the lines. Its --fix refuses to edit a project it cannot fully account for: no lockfile, a file skipped for size, a nested manifest, or a dependency loaded by name at runtime rather than imported.
It is itself zero-dependency, and that is the argument. deps-proof runs shed's own import scanner over shed to prove every import is a node: builtin or a local file. Everything a package would normally provide was written from scratch: a semver implementation, a .gitignore matcher, terminal display-width measurement over Intl.Segmenter, a deterministic module bundler, and a character-level import scanner with a template-literal mode stack, because a regex cannot tell a require() in code from one inside a string.
On four real projects it found something removable in all four, including one that had both bcrypt and bcryptjs installed while importing only one.
278 tests on Node 22.17 and 24.4, a byte-identical build across both runtimes, and a README that documents where the tool can be fooled and what it declines to have an opinion about.
Rummage is a private, offline search engine for a folder. Point it at a directory and search it from a terminal or a browser; nothing is installed and nothing leaves the machine.
The inverted index, TF-IDF ranking, phrase matching, snippet selection and incremental sync are all written by hand — sqlite3 provides B-tree storage and nothing else. The crawler reads no file contents, only paths and mtimes, so a re-run skips unchanged files without opening them: 600 files index in 0.13s and re-sync in 0.04s.
78 tests. Crash-safe and resumable, verified with SIGKILL mid-index over 4,000 files. The index builds byte-identical twice. STDLIB.md documents 19 substitutions with real download figures — click, 181M installs a week, replaced by argparse.
Track D · Python 3.14 · empty manifest, enforced by make test.
Forge a zero-dependency dev-tooling CLI with secret scanning as its hero feature
Forge is one forge binary that does secret scanning, file search, duplicate detection, repo stats, a terminal dashboard, run-to-run diffing, a risk timeline over scan history, and per-finding confidence explanations built entirely on the Python standard library, with an empty requirements.txt.
The constraint that makes this interesting: each of those jobs is normally its own third-party package (detect-secrets, fd/ripgrep, fdupes, cloc, diskcache, watchdog...), and every one decomposes into stdlib primitives once properly scoped. Two pieces a "stdlib-only" tool isn't expected to ship: a hand-rolled log-structured key-value store with checksummed crash recovery, and a from-scratch confidence-scoring model — a hand-tuned log-odds model, naive-Bayes-shaped but not trained on data — that ranks scanner findings by an interpretable, per-term breakdown instead of just flagging them yes/no.
What's genuinely proven, not just claimed:
Zero dependencies, verified three independent ways: static AST import scan, isolated python -S execution with no site-packages, and a fresh-venv pip list
313 adversarial tests (87% coverage) crash recovery, torn writes, corrupted checksums, compaction-failure atomicity, filesystem-order determinism not happy-path padding
Byte-reproducible build: forge.pyz hashes identical across independent from-scratch builds, with every archive-metadata field (timestamp, permissions, entry order) explicitly pinned and regression-tested
Explainable confidence scoring: each finding's score is a sum of 8 interpretable log-odds terms through a sigmoid and a machine-checked invariant confirms the displayed score always reconciles with the stored one
One-command judge verification: python scripts/judge_mode.py runs 13 deterministic checks (tests, reproducibility, zero-dep proof, confidence reconciliation, self-scan, CI integrations) and exits pass/fail in under 15 seconds
Bonuses claimed, all evidenced: Single File (+5) · Reproducible Build (+5) · Package Killer (+3, benchmarked against detect-secrets) · STDLIB Substitution Log (+3, 21 entries)
Built for raptors.dev's Zero Dependency Hackathon, Track F (Open/Wildcard). MIT licensed.
expressless is a zero-dependency HTTP framework for Node.js. HookLens is the webhook inspector built on it to prove it actually works.
Express is the default choice for Node APIs, but its convenience arrives with a tree of transitive dependencies. expressless rebuilds the practical Express surface - routing, middleware, response helpers, body parsing, static file serving, request logging - on Node's standard library alone. package.json lists dependencies as an empty object and devDependencies as an empty object, both literally empty. Eleven npm packages from Express's own dependency tree were reimplemented from their RFCs and wired into the live request path: http-errors, statuses, content-type, encodeurl, cookie, cookie-signature, etag, fresh, vary, range-parser, and content-disposition.
HookLens is the demo that exercises all of it. Create a webhook endpoint, point any sender at it, and captured requests stream into the browser live over Server-Sent Events - no polling, no refresh. Sensitive headers like Authorization are redacted at capture time. Every response carries an ETag, so a repeat request returns 304 Not Modified with an empty body, and raw captured payloads answer byte-range requests with 206 Partial Content. Captures survive restarts through an atomic JSON store, and the browser can replay any captured request as a ready-to-paste cURL command.
ZeroS3 is a self-hosted, S3-compatible object store implemented in a single Go 1.27 source file with zero third-party dependencies.
Ordinary S3 clients such as the AWS CLI, AWS SDK, and rclone can use it without ZeroS3-specific client code. Underneath that familiar S3 interface, ZeroS3 uses content-defined chunking, a SHA-256 content-addressed store, immutable manifests, and an append-only visibility journal.
That content-aware storage model enables global deduplication, edit-local reuse, delta sync and remote replication that transfer only missing chunks, peer-assisted repair of corrupt data, copy-on-write namespace forks, durable snapshots and zero-payload restore, structural diff/inspect tools, multipart uploads, conditional S3 operations, and bounded parallel chunk transport.
The final candidate passes 738 internal tests plus 2,734 black-box compatibility and adversarial checks, including rclone, AWS SDK interoperability, crash/restart scenarios, corruption repair, concurrent writers, and a Package Killer comparison. The build is byte-for-byte reproducible, `go.mod` has no `require` block, and the implementation uses only Go's standard library.
llamini.cpp loads a real TinyLlama-1.1B-Chat-v1.0.Q4_K_M.gguf — 668MB, 1.1 billion parameters, 4-bit quantized — with nothing but libc and POSIX. No ggml, no llama.cpp, no Python, no BLAS, no SentencePiece. GGUF parser, Q4_K/Q6_K dequantizers, 22-layer grouped-query attention, SentencePiece-style BPE: all written from scratch this weekend in C.
I built this with Claude Code as a pair programmer. This is the honest account, including the parts that didn't work the first time.
Why I built it, not just that I could. llama.cpp is load-bearing. Ollama patches it in at build time — I read their build directory, not a summary. 179.8k stars; official Docker image past 100 million pulls. llama-cpp-python (10.6k stars) binds it. GPT4All ships "a Python client around llama.cpp implementations." text-generation-webui installs its binaries. LM Studio credits "our llama.cpp engine." Five real dependents. vLLM is not a sixth: different engine, different team. An unverified claim already burned me once on this project, so I'm naming the one I cut.
In 2024 someone spent two years earning trust on xz-utils, then backdoored liblzma (CVE-2024-3094, CVSS 10.0). No scanner caught it. One engineer at Microsoft/PostgreSQL noticed SSH logins were a few hundred milliseconds slow and refused to drop it. Swap that library for the inference engine every local-LLM app on your laptop is already running. Same shape: patient trust, a small diff, huge blast radius. SolarWinds 2020 hit ~18,000 of 33,000 Orion customers via a poisoned build. Closest AI case I could verify: PyTorch's Dec 2022 torchtriton package on PyPI, which stole SSH keys and git credentials from nightly installs.
This does not replace llama.cpp in Ollama or GPT4All. It's a weekend core, 1.1B–2.5B models, laptop VM. The point is narrower: GGUF layout, block dequantization, RoPE, GQA are not a black box. One person, one weekend, real format, real math, recognizably correct tokens. That legibility is the whole argument.
The personal reason is why I actually started. Most of us live above the math. pip install transformers, three lines of Python, strings in and out; when it fails we reach for another package. I wanted no runtime between me and the .gguf bytes. Every layer written by hand, understood well enough to explain. Empty dependency manifest as proof. STDLIB.md as the itemized receipt.
stranger — an offline supply-chain auditor for dependency lockfiles, which has zero dependencies of its own.
WHAT IT DOES
Point it at a package-lock.json, Cargo.lock or requirements.txt and it rebuilds the full transitive graph, then tells you what is actually in there: how much of the tree nobody chose, what executes code during install, what resolves to a mutable git ref instead of the registry, what has no integrity hash, and which names sit one keystroke from something popular. It never touches the network — the lockfile is the entire input.
Three commands: audit; diff (what one npm install actually added, and whether it made things worse — the question your 4,000-line lockfile diff is hiding); and why (the chain explaining how a package got into your tree).
ZERO-DEPENDENCY CRAFT
A hand-written RFC 8259 JSON parser kills serde_json and the serde/syn/quote/proc-macro2 subtree behind it — verified against a 30-case must-reject corpus modelled on JSONTestSuite: surrogate pairs, the number grammar, unescaped control characters, depth limiting. Also a Cargo.lock TOML reader, a PEP 508 reader, bounded Damerau-Levenshtein with confusable-glyph folding, and a graph engine reproducing Node's own resolution algorithm — replacing toml, packaging, strsim, petgraph, clap, colored and textwrap. 15 substitutions in STDLIB.md, including three where the crate would have been better.
WHERE THE CONSTRAINT IMPROVED THE DESIGN
With no network I cannot ask a registry for download counts, so the tool uses in-degree — how many packages independently depend on a given one — as its popularity signal. A typosquat is pulled in by one mistaken import; safer-buffer is pulled in by half the registry. That beats download counts, because a squat has downloads too. I would not have found that rule with an API available.
RECEIPTS
Empty [dependencies] and [dev-dependencies]. cargo tree is one line. Cargo.lock holds a single [[package]] block, and the tool audits itself and reports zero. One rustc call on one 4,549-line file. 64 tests on the standard library's own harness, no test crate. Byte-identical reproducible builds verified on linux-gnu and windows-msvc. Field-tested across ~1,030 packages in real projects with zero false positives (FIELD-TEST.md, generator committed so you can run it on yours).
Bonuses: Single File, Reproducible Build, Package Killer (serde_json), STDLIB Log.
diff2test is a zero-runtime-dependency C++20 CLI for conservative test-impact analysis in CMake/CTest projects. It takes a list of changed paths and combines that with pre-generated compiler .d files, CMake File API metadata, and CTest JSON to determine which tests are affected by a change.
The core idea: diff2test only narrows the test suite when the evidence is complete. If dependency information is missing, ambiguous, or untrusted, it widens to the full known suite instead of risking a false negative.
The entire runtime implementation lives in a single C++ source file. There are no third-party runtime libraries, no package manager, no network dependency, and no subprocess execution — diff2test never launches Git, CMake, CTest, a compiler, Python, or a shell. Those tools may generate metadata externally, but diff2test only reads the resulting files and stdin.
The project also includes real CMake/CTest integration fixtures, seven dependency-free C++ test executables, sanitizer coverage, deterministic-output checks, runtime linkage inspection, and reproducible Release builds.
A zero-dependency C++23 JSON parser and serializer, built entirely from the standard library — no packages, no third-party code. It's a from-scratch alternative to nlohmann/json (the most popular C++ JSON library), and it beats it: 1.57x faster to compile, 1.72x faster to parse, and 17% less memory, while being ~750 lines instead of ~25,000. Every parse error reports the exact line, column, and byte position with a visual pointer to the mistake — like a compiler error. Validated against the official JSONTestSuite corpus: 100% correct on all "must accept" and "must reject" test cases. Track B — Parsers & Data Formats.
Mesh is an embedded, local-first document database for Go. It is a working storage engine, it includes a durable write-ahead log, crash recovery, snapshots, backups, content-addressed blobs, queries, and authenticated direct replication. Every device
can write durable data while offline, then synchronize directly with trusted
peers when a network route becomes available.
GitForensics is a read-only, network-isolated Git forensic scanner that detects exposed secrets across Git repository history and classifies their actual exposure state.
Unlike conventional secret scanners that primarily inspect the current working tree, GitForensics analyzes Git objects and repository history directly to identify:
ACTIVE — secrets reachable from the current HEAD
HISTORICAL — secrets preserved through other refs/history
ZOMBIE — secrets remaining in unreachable Git objects
The tool combines secret-pattern detection, entropy analysis, context signals, confidence scoring, forensic occurrence tracking, and strict output redaction.
It is designed with a security-first architecture:
Zero third-party runtime dependencies — empty go.mod, verified with go list -m all
Zero network calls
Zero subprocess execution
Read-only repository analysis
Pure Go standard library
Hand-rolled PACK v2 and OFS_DELTA parsing — no go-git, no libgit2
Redacted secret output
Structured JSON reporting
Explicit coverage gaps and threat-model documentation
The demo shows GitForensics detecting ACTIVE, HISTORICAL, and ZOMBIE secret exposure from a local Git repository while preserving the target repository unchanged.
GitHub: https://github.com/Sourav-Singhhh/Gitforensics
Sysgaze is a zero-dependency system-call tracer for native x86-64 Linux. It is written from scratch in C23. It supports structured output in form of ndjson syscall stream and json summary and implements raw seccomp-bpf fast path to skip syscalls that need not be traced.
Anvil is a zero-dependency, explainable reverse proxy and resilience-testing lab built entirely with Go’s standard library. It handles real HTTP/1.1 traffic, simulates backend failures, performs failover and recovery, and produces deterministic receipts explaining every routing and retry decision.
logq queries gigabytes of log files with a single line of syntax. JSONL, logfmt, and plain text, with filters, aggregations, percentiles, and event-time windows. Everything runs from one static binary built from one empty go.mod. Zero third-party dependencies.
Every parser, every decoder, and the entire query engine are hand-written against the Go standard library.
Bareport is a zero-dependency security assessment CLI built entirely with Go's standard library. It scans authorized hosts and ports, identifies exposed services and security findings across HTTP, TLS, and network surfaces, and produces deterministic risk scores with severity breakdowns and actionable explanations.
The project is designed around the Zero Dependency hackathon's core constraint: go.mod contains no third-party runtime dependencies. Bareport replaces functionality that would normally rely on external packages with Go standard-library primitives such as net, net/http, crypto/tls, encoding/json, html/template, net/smtp, os, and sync.
It provides multiple output modes including terminal tables, JSON, CSV, SARIF, and a self-contained HTML security report, plus features such as attack-surface analysis, configuration profiles, continuous watch mode, scan diff/drift detection, DNS reconnaissance, HTTP/TLS auditing, and a built-in --verify-zero-dep runtime self-audit.
The included vulnerable demo application gives judges a safe target to scan and demonstrates how Bareport detects issues and turns the results into an explainable security assessment.
darkroom is a photo library tool written in Rust with zero runtime dependencies. Point it at a folder of photos and it indexes them, decoding JPEG, PNG, and GIF images from scratch, reading EXIF metadata to sort photos by the date they were actually taken rather than file timestamps, and serving a browsable timeline over the local network. A phone reaches that timeline instantly through a real QR code shown on a pairing page, with no app, account, or typed IP address required. The tool also finds near duplicate photos using a perceptual hash it wrote itself, catching the same shot at a different resolution, crop, or re-encoding, and reports how many bytes could be reclaimed without ever deleting anything automatically.
The defining constraint is that Cargo.toml has an empty dependencies section. Every piece of infrastructure a typical project would import was written in house instead: the JPEG and PNG codecs, DEFLATE compression, GIF and LZW decoding, EXIF and TIFF parsing, image resampling, the perceptual hashing and clustering logic, a QR code generator built on Reed Solomon error correction, a full HTTP server on raw sockets, a thread pool, a JSON writer, calendar math, and local network address discovery. Fourteen substitutions in total, each with a measured cost against a real library it replaced. One bug, a reversed bit ordering in the QR encoder, passed every unit test yet still failed on real scanners, and was only caught by cross checking against independent decoders. The project ships a WebAssembly build of its QR encoder as a live browser demo, compiled without a JavaScript bridging library, proving the zero dependency claim extends to the browser too.
BareCode — Offline Supply-Chain X-Ray for Python
BareCode is a fully offline, zero-dependency security and auditing tool for Python environments. Built with Python 3.14 and the standard library only, it detects tampering, exposes dependency risks, and shows what is actually present in an environment.
The Problem :
Python wheels contain a `RECORD` file with SHA-256 hashes for installed files, but those hashes are rarely verified after installation. `pip check` validates metadata, while `--require-hashes` protects downloads only at install time. There is no `pip verify`.
This means files can be silently modified after installation while metadata remains valid. ChainDrop (Aug 2026) demonstrated this risk by poisoning hundreds of packages while retaining valid build provenance.
Five Commands :
• verify — Re-hashes installed files against `RECORD` and detects modifications, including same-size edits. Returns exit code 1 for CI gating.
• audit — Reports packages, installers, licenses, git-installed packages, and `.pth` files capable of executing code at interpreter startup.
• why — Shows dependency paths explaining why a package exists, with `--blast` for blast-radius analysis.
• deps — Compares declared, installed, and actually imported dependencies to find missing, unused, and phantom dependencies.
• killable — Identifies packages that can potentially be replaced by the Python standard library, including honest “no equivalent” results.
Everything is offline. BareCode never imports or executes code from the audited environment; it only reads files.
Zero-Dependency Engineering
`make prove` AST-walks every source file and verifies that imports come only from CPython's `sys.stdlib_module_names`. It also verifies that `pyproject.toml` has no dependencies or build backend. These checks run in CI on a clean runner without pip installs.
`STDLIB.md` documents 17 third-party replacements and their limitations.
Bonuses :
STDLIB Log · Package Killer · Reproducible Build
`make build` creates a 66 KB zipapp. The project includes 79 tests plus `make test`, `make prove`, and `make repro`.
Limitation : Coverage is `.dist-info` based; `RECORD` and `.pyc` files have no hashes. BareCode reports coverage honestly rather than claiming complete protection.
Track B — Parsers & Data Formats.
ykit is a from-scratch YAML 1.2.2 parser and CLI for Node. No YAML package exists in the standard library, so this is written by hand. package.json dependencies is {}. Node 24 type stripping — no tsc, no npm install.
The useful part is format-preserving edit: ykit set patches one span so comments, blank lines, and quoting in the rest of the file stay put. Paths are a.b[0].c. Types follow the YAML 1.2 core schema.
yaml-test-suite parse: 308/308 (100%). Error cases 84%. fmt is a CST pretty-printer, not a spec emitter (12%) — we did not fake that. About 5× slower than js-yaml on a small fixture because we build a lossless CST, not a value tree.
Run: git clone https://github.com/Om-Jadon/ykit.git && make build && ./bin/ykit --help
UndoLang is a programming language for transactional filesystem operations that may fail halfway, require rollback, and commit only when every operation and postcondition succeeds. It addresses a gap in shell scripts and AI-generated file instructions: a multi-step migration can partially change a machine and leave it neither in the old state nor the intended new state.
A crash, permission error, missing source, failed assertion, or disk problem can leave a broken hybrid state. UndoLang makes this failure mode explicit and recoverable instead of pretending filesystem calls are atomic.
The project combines a small .undo language with a crash-recoverable Go runtime. A file is an ordered program of uniquely named transactions with strict require, mutation, and assert phases. It supports reversible filesystem operations and conditions. The source is validated before mutation. `check` and `plan` expose paths, effects, conflicts, readiness, and rollback estimates without changing target files.
`undo run FILE` executes transactions in source order; `--transaction NAME` selects one while still validating the file. Each transaction is freshly planned after locking. Earlier commits remain committed if a later transaction fails; the failing transaction rolls back, and later transactions are skipped. Operations capture inverse metadata and backups, verify results, and commit only after assertions pass.
Safety is capability-based: relative paths bind to `--root`, external absolute paths require `--allow-path`, and Go 1.27 `os.OpenRoot`/`os.Root` enforce the boundary. Traversal, reserved `.undo` state, unsafe symlinks, and special files are rejected. A synced UUIDv7 record and CRC32C journal make recovery authoritative after process death. Fresh `undo recover` replays durable state, resumes rollback, and fails closed on corruption or ambiguity while retaining evidence. UndoLang does not claim isolation or universal atomic visibility.
This is a Track F (Open/Wildcard) Zero Dependency Hackathon submission. The runtime uses only Go 1.27 standard-library packages: `go.mod` has no `require` block, no `go.sum`, and no runtime shell-out. `STDLIB.md`, dependency proof, filesystem/crash tests, and `make reproducible-build` document the implementation. UndoLang gives release tooling, migrations, cleanup workflows, and AI agents a constrained, reviewable filesystem capability instead of unrestricted shell access.
git rm secret.env does not remove the secret. The blob stays in .git/objects, and anyone who clones the repo still has it, while scanners that check only your working tree report all clear.
histleak finds it. It reads the object database directly, inflating loose objects and parsing packfiles including delta chains, so it sees every blob that has ever existed in the repo whether or not it is reachable from any branch. Findings are attributed to the commit that introduced them.
One file, 17 imports, all standard library, and zero subprocess calls. 15 detection rules plus a tuned entropy pass, 38 tests, and a byte-reproducible build.
I built Parcel, a secure peer-to-peer file transfer tool designed to send files and folders directly between devices — with zero third-party dependencies.
No accounts. No cloud storage. No third-party runtime packages.
Just a short pairing code, an encrypted connection, and your files going from one machine to another.
🔐 What is Parcel?
Parcel is an open-source P2P file and folder transfer tool built in Go.
It supports:
• 🔒 End-to-end encrypted file transfers
• 🔑 Secure 4-word pairing codes
• 🌐 Peer-to-peer connections
• 📡 Local-network discovery
• 🔁 Relay fallback for different networks
• ♻️ Resumable transfers after connection drops
• 📁 Whole-folder transfers
• 🗜️ Automatic compression when useful
• 📷 Optional QR-code pairing
• 🖥️ Windows, macOS and Linux
• 🧩 ZERO third-party runtime dependencies
The entire project uses Go's standard library or code written specifically for Parcel.
⚡ Why ZERO Dependencies?
One of the main goals of this project was to see how far a practical file-transfer application could be built without relying on third-party runtime packages.
That meant implementing things such as:
• LAN peer discovery
• X25519 key exchange
• AES-256-GCM encryption
• Chunk verification
• Resumable transfers
• Folder archiving
• Compression
• QR encoding
• Terminal colors and spinner
• Relay connectivity
• NAT punching
using Go's standard library and code written in the project itself.
🌐 How Parcel Connects
Parcel first tries to discover the other device on the local network.
If that doesn't work, it can use a relay to introduce the two peers and attempt a direct connection. If a direct connection isn't possible, the encrypted data can continue through the relay.
The relay never needs the plaintext file — it only forwards encrypted data.
♻️ Resumable Transfers
If a transfer is interrupted, Parcel doesn't necessarily start from zero.
The receiver keeps track of the last verified chunk so the sender can continue from where the transfer stopped.
🧪 Verified
The project has been tested with:
✅ Windows + Linux VM local-network transfers
✅ Folder transfers
✅ Cross-network relay transfers
✅ QR-code pairing with a real phone camera
✅ Wrong-code rejection
✅ Resumable transfers
✅ Automatic compression decisions
✅ Reproducible builds
CodeIntel Doctor Zero is a privacy-first repository intelligence tool built with zero third-party runtime dependencies.
It analyzes any local codebase and provides a health score, maintainability findings, security heuristics, duplicate-code detection, repository structure, language statistics, symbol discovery, local search, file explanations, and JSON or HTML reports.
The project works completely offline and uses only the Python standard library. It does not upload source code, use telemetry, call external services, or require a package installation.
Alongside the existing terminal interface, we added a clean local browser dashboard. Users can launch it with one command and interact with the complete analysis workflow through a single HTML page.
The goal is to make codebase understanding accessible, deterministic, private, and easy to use.
KilnForge is a zero-dependency image and archive HTTP service for resizing, rotating, watermarking, and converting images, as well as packing and unpacking archives. It is built entirely on Bun’s native Bun.Image and Bun.Archive APIs. No Sharp. No tar. No native build toolchain. dependencies: {} in package.json, mechanically verified on every build rather than simply claimed.
KilnForge replaces two real npm packages, not one, and connects them through a genuine cohesion endpoint: /batch. It accepts a tarball of images and returns a tarball of processed results in a single call. That is the actual reason this is one submission rather than two unrelated features sharing a port.
Because Bun.Image and Bun.Archive are extremely new and their public documentation contains contradictions, we built a Foundation Verification Harness to measure the behavior of the actual installed APIs before making architectural decisions around them.
That harness caught four real bugs before they shipped: no native BMP/GIF encoder, EXIF auto-rotation behavior that would have caused every tagged photo to be rotated twice, a fit=cover mode that does not exist natively, and a reproducible-build test that was silently measuring the wrong thing. We traced the latter to two differing bytes in an 89 MB binary.
The result is 263 tests and 6,463 assertions, backed by real differential benchmarks against both Sharp and tar. The benchmarks are published honestly in both directions, including cases where KilnForge is slower.
Reproducible builds were also proven byte-for-byte identical across three separate compiles.
Built by The Vighnahartas for Track F.
pytoml-rt is a single-file, pure standard-library TOML v1.1 reader, writer, and CLI for Python. CPython's tomllib reads TOML but deliberately doesn't write it, so most projects pull in tomli-w or tomlkit just to produce a TOML file — pytoml.py does both, with zero third-party dependencies, and works on Python 3.9+ (before tomllib even existed). It's validated against the full official toml-test compliance suite (705/705 passing), not a hand-picked sample of it.
A from-scratch QR code generator for Node that replaces the qrcode package and its 29-package dependency tree with a single file and an empty manifest.
qrkit is a QR code encoder built entirely on the Node standard library. It is a drop-in alternative to qrcode, the default QR library for JavaScript at ~24 million downloads a week, which also pulls in pngjs, dijkstrajs, and yargs for a total of 29 packages. qrkit does the same job in one 840-line file with nothing in node_modules.
Everything is written from ISO/IEC 18004: the Galois-field arithmetic, Reed-Solomon error correction, the module matrix, all eight data-mask patterns and the penalty function that picks one, and the BCH-protected format and version information. It outputs to the terminal, to hand-written PNG (chunk framing, CRC-32, and scanline filtering all by hand; the one heavy standard-library call is zlib.deflateSync for the pixel stream), and to SVG. Byte mode and numeric mode, versions 1 through 10, all four error-correction levels.
Correctness is not taken on faith. Output is verified byte-for-byte identical to qrcode across every version, EC level, and mask, and every internal check is anchored to the spec's worked example or to qrcode directly rather than to tests I wrote myself. 51 tests, reproducible build, single file, MIT.
ReplayNet is a zero-dependency network virtualization and resilience testing tool built entirely with the Go standard library for Track C (Web & Network).
Testing how client applications handle network failures, retry storms, or transient outages usually forces a painful compromise: either keep a complex, flaky staging backend online while simulating network faults, or write hand-rolled mocks that quickly drift from real production behavior. ReplayNet takes a different path: record a real HTTP conversation once, kill the backend completely, and replay the exact multi-step conversation deterministically from disk with timeline fault injection and a live browser inspector.
During recording, ReplayNet acts as a transparent reverse proxy that streams traffic to the upstream service while writing length-prefixed binary session frames (.rnet) to disk. Each frame captures headers, status codes, payload timings, SHA-256 body checksums, and partial-write crash recovery.
Once recorded, the backend is shut down entirely. In replay mode, ReplayNet becomes the upstream service. It matches incoming requests sequentially by method and path, faithfully reproducing multi-step flows like login -> profile -> permissions failure (500) -> retry success (200) with zero backend running.
Engineers can also alter history on the timeline using CLI fault rules without touching application code. ReplayNet supports latency injection to simulate slow downstreams, connection drops via raw TCP socket hijacking, and status code overrides at specific timeline indices, such as transforming a successful retry into a 503 to verify client fallback handling.
An embedded live visualizer served directly from the single binary via embed.FS streams real-time traffic over Server-Sent Events (SSE). It provides live topology animation, latency tracking, payload inspection drawers, and instant cURL reproduction. A non-blocking drop mechanism guarantees that slow browser tabs never stall the network proxy path.
Built with an empty go.mod and zero external dependencies (go list -m all prints a single line), ReplayNet claims the Package Killer bonus against Toxiproxy by adding offline deterministic playback, the Reproducible Build bonus (+5) with byte-identical builds via make repro, and the STDLIB Log bonus (+3) with 16 direct standard library substitutions.
Atlas is a zero-dependency embedded database that does not rely on SQLite or SQL. It is designed specifically for storing, searching, inspecting, and repairing semi-structured and messy real-world data.
Unlike SQLite, which is optimized for relational data, SQL queries, tables, and transactional applications, Atlas uses an append-only storage engine with checksums, write-ahead logging, crash recovery, BM25 full-text search, schema inference, data-quality analysis, and auditable repair workflows. This makes Atlas particularly valuable when data transparency, integrity verification, recovery, and built-in quality improvement are more important.
Atlas is implemented as a lightweight single-file Python application, requires no external runtime dependencies, and runs on Windows, macOS, and Linux. It is not intended to replace SQLite for relational workloads; instead, it provides a focused alternative for semi-structured data management and self-repairing storage.
Bastion is an all-in-one developer security toolbox built into a single Go file with zero external packages. Instead of installing 5 separate tools, it combines ultra-fast file encryption, in-place secret editing, terminal 2FA codes, and an automated leaked-key scanner into one tiny binary. It works 100% offline, uses almost zero memory even on massive files, and is proven tamper-proof across 150 automated tests.
KVStore is an embedded key-value store for Python applications and a Track D submission. It uses only Python's standard library. Writes append CRC32-checked records to a write-ahead log and call fsync() before returning. On startup, the store replays the log to rebuild its in-memory index and truncates incomplete or corrupt records. Deletes use tombstones.
The project provides a CLI and a Python API, and builds into kv.pyz, a single-file Python zipapp. It supports batched writes, atomic compaction, optional automatic compaction by segment count, and cooperative readers and writers across processes. Tests cover torn records, crash recovery, compaction failures, segment rotation, and concurrent access.
The index stays in memory, recovery replays the full log, and Windows is not currently supported.
mysite — a complete Markdown-to-website generator with a genuinely empty dependency manifest.
mysite converts a folder of Markdown into a full website: a hand-written Markdown parser (tokenizer → AST → HTML renderer), YAML-subset frontmatter parsing, a template engine (variables, conditionals, loops, partials, layout inheritance), a dev server with live reload via fs.watch + Server-Sent Events, a 6-language syntax highlighter, a build-time TF-IDF full-text search index with a vanilla-JS client widget, RSS/Atom/sitemap generation, HTML/CSS/JS minification, a binary image-header parser (PNG/JPEG/GIF/WebP) that auto-injects width/height for layout stability, and an accessibility + broken-link linter. Every one of these normally comes from 10–15 npm packages. Here, dependencies: {} — every line is hand-rolled Node.js standard library only.
Package Killer target: chalk, the terminal-color library at the center of the September 2025 npm supply-chain compromise this project is a direct response to — replaced in ~30 lines of raw ANSI escape codes with NO_COLOR and TTY detection.
Two built-in commands make every claim above independently verifiable instead of asserted: mysite verify-zero-dep scans the manifest and every source file for non-stdlib imports and reports pass/fail; mysite verify-reproducible builds the site twice, SHA-256 hashes both output trees, and confirms byte-identical, deterministic output. Both outputs are committed to the repo (deps-proof.txt, repro-hashes.txt) so a judge can re-run them and check our numbers against theirs in seconds.
35 tests via Node's built-in node:test runner (no test framework installed) cover every subsystem, including Markdown edge cases, XML-escaping across all three feed formats, image header parsing for all four formats, and full-build determinism.
STDLIB.md documents 15 real substitutions, each with what the package normally does, exactly what we built instead, and an honest trade-off — including our own bug fix mid-build, where our accessibility linter initially missed a missing-alt case in our own demo content, caught by our own test suite, and shipped with a regression test.
Track A — Developer Tools & CLI. Bonuses attempted: STDLIB Log, Package Killer, Reproducible Build.
SoullessSages Markdown — Zero-Dependency Bidirectional Markdown Viewer
A pure C23, zero-dependency desktop Markdown viewer with true bidirectional live sync and compiler-grade caret error diagnostics. No Electron. No npm packages. No frameworks. Just the C standard library.
Built for the Zero-Dependency Hackathon (Track B: Parsers & Data Formats).
🔧 WHAT MAKES IT ZERO-DEPENDENCY Every include is from the C standard library or OS-level POSIX/Win32 headers — nothing else. Full audit trail is generated and versioned in the repo (deps-proof.txt), regenerable with one script. Every disclosed OS-level call (like opening the default browser) is documented with file and line number.
✨ FEATURES
1. True bidirectional sync — edit the raw Markdown or the rendered preview, and the other side updates live
2. Compiler-style caret diagnostics for malformed Markdown (line + column, not just "parse error")
3. Hand-rolled CommonMark-compliant parser — 89.57% spec conformance, independently verifiable
4. Math rendering (LaTeX → MathML) and Mermaid-style diagram support, no client-side JS libraries
5. Ctrl+S / Cmd+S to export directly to a .md file
6. Runs as a lightweight local server + browser UI — no Electron, no Chromium bundle
You're SSH'd into a headless server at 2am, chasing a bug, and the only clue is a screenshot someone left behind. No desktop. No GUI. No way to actually look at it until now.
imgview decodes and renders PNG images directly in your terminal, in full 24-bit color, with nothing standing between the raw bytes on disk and the pixels on your screen. No zlib. No libpng. No image libraries of any kind.
That's not a scope limitation, it's the whole point. Every piece of the pipeline is hand-built from the spec in C: a DEFLATE decompressor written directly from RFC 1951, bit by bit; a table-driven CRC-32; all five PNG scanline filters, including the Paeth predictor; and a terminal renderer that paints true 24-bit color using half-block Unicode glyphs, with automatic fallbacks to 256-color and ASCII when the terminal can't keep up.
It's the kind of thing everyone assumes you'd pip install or npm add decompression, image parsing, terminal rendering are each their own solved-problem libraries most projects never think twice about reaching for. imgview reaches for none of them. Every substitution is documented, every tradeoff is named honestly, and the whole thing builds with one command and zero dependencies beyond the C standard library.
Point it at a PNG. See it render. That's the whole experience the craft is just what's underneath.
Branchcut is a zero-dependency, single-file Rust filesystem query engine for Track A: Developer Tools & CLI.
It combines glob matching, exclusions, file-type and extension filters, hidden-path handling, hierarchical .gitignore
rules, JSON Lines output, shell-free command execution, early termination, and query diagnostics in one tool. Instead of
walking the entire filesystem and filtering afterward, Branchcut compiles the query into a traversal plan, narrows the
starting root, shares pattern states, and prunes directories that cannot contribute results.
The project uses only Rust's standard library and has an empty Cargo dependency manifest. It includes tests for glob
syntax, globstar behavior, pruning, hidden files, limits, symlinks, deep paths, non-UTF-8 Unix paths, nested ignore rules,
JSON escaping, and command parsing. The repository also includes dependency proof, standard-library substitution
documentation, compatibility notes, judge instructions, and accuracy/performance comparisons against fast-glob,
tinyglobby, and zlob.
VaultKeep is a zero-dependency password manager + TOTP 2FA authenticator, built entirely from Python's standard library (PBKDF2, HMAC, secrets). It features encrypt-then-MAC integrity, a tamper-evident hash-chained audit log, a duress/panic password for plausible deniability, and master-password rotation. Track E submission, claiming all 4 bonus challenges (Single File, Reproducible Build, Package Killer, STDLIB Log) — 15 documented stdlib-for-package substitutions and 27 passing tests.
ChronoVault is a Git-inspired local snapshot and recovery system built entirely with Python's standard library, with zero third-party runtime dependencies. It provides reliable local versioning for project directories and data through content-addressed storage, deduplication, snapshots, history, tagging, verification, corruption detection, and crash-aware recovery.
ChronoVault is designed for developers, students, researchers, small teams, and power users who need lightweight, portable, and offline-friendly versioning and recovery without relying on external services or dependency-heavy tooling. It can be useful for source code, datasets, experiments, assignments, and other important local project data.
The project also includes inspection and statistics tooling, benchmarking, automated tests, Windows verification, reproducible build support, and a single-file build artifact. The goal is not to replace Git or enterprise backup systems, but to demonstrate how a practical and resilient storage/recovery tool can be built from the standard library alone.
jaq-lite is a JSON toolkit written in Rust with zero third-party dependencies:
a hand-rolled RFC 8259 parser, a serializer, and a jq-style query CLI with
rustc-style caret diagnostics. serde, serde_json and itoa are replaced by 4,670
lines of standard-library-only code under src/.
The interesting part is not that it parses JSON. It is that nothing in the
repository is claimed without being measured. All 318 JSONTestSuite parsing
fixtures are asserted on every run: 95 of 95 documents that must parse, 188 of
188 that must be rejected, and all 35 implementation-defined cases decided in
advance by four written policies. CI compares 62 outputs byte for byte against
jq 1.8.1 on every push. Two release builds of the same tree produce
byte-identical binaries, and the harness also builds a deliberately different one
to prove that check can fail. Of the 191 tests, 14 read the README and the build
log and fail the build when prose and behaviour disagree, so a stale sentence
breaks CI in the commit that wrote it.
Limits are stated rather than hidden: no arithmetic, no variables, no
user-defined functions, JQ_COLORS is not parsed, and jq's 1e2 -> 1E+2 exponent
rewriting is a named deliberate divergence -- numbers keep their exact source
text, so a 30-digit integer round-trips unchanged and -0.0 stays -0.0.
Track B, parsers and data formats. Rust edition 2024, toolchain pinned to
1.98.0. 66 commits, public from the first one, nothing force-pushed or squashed.
Verify it in about a minute:
git clone https://github.com/pal-123456789/jaq-lite
cd jaq-lite
cargo test --release
191 tests, 0 failing, and no network access after the clone.
Repository: https://github.com/pal-123456789/jaq-lite
Release: https://github.com/pal-123456789/jaq-lite/releases/tag/v0.1.0
Video: https://youtu.be/roh0pGwUPsQ
Scratch DB is a zero-dependency relational database written in C++.
It includes a hand-written SQL parser, typed schemas, row serialization, slotted pages, a buffer/page cache, B+ tree index files, constraints, transactions, WAL recovery, a CLI, an HTTP server, and optional in-memory tables.
The project intentionally avoids third-party runtime libraries. It uses C++17, the standard library, POSIX file/socket APIs, and CMake.
Git X-Ray is a zero-dependency Git repository forensics and codebase risk analysis tool built using Node.js standard libraries. It analyzes Git history to identify code churn, contributor ownership, code complexity, and bus-factor risks. The tool provides actionable insights through a CLI/dashboard and supports structured JSON output for automation. It directly analyzes Git repository data without relying on third-party runtime dependencies, making it lightweight, portable, and suitable for offline codebase analysis.
kap is a zero-config CLI that works out what kind of project you are standing in and runs the right underlying tool for you.
Type kap build, kap test, kap dev, or kap doctor in any repo and it becomes cargo build, go test -race ./..., cmake --build build, or npm run dev — so you stop memorising a different set of commands for every ecosystem.
None of that ecosystem knowledge is compiled into the binary: it links only libc and libstdc++, and every detection rule and command recipe lives in a plugin written in KPL, a small sandboxed language kap interprets at runtime.
So teaching kap a build system it has never heard of is one ~60-line text file instead of a fork or a pull request, and kap plugin test validates that file with the toolchain not even installed.
Get started with make && make install, then kap detect to see which plugin claims your directory and why, and kap build -n to print the exact commands before a single process is spawned.
REWIND (“Remember what fixed it”) is an offline, zero-dependency verified-recovery ledger for developer terminals.
PRIMARY TRACK: Track A (Developer Tools & CLI)
THE PROBLEM:
Terminal command history records what was typed, but loses why commands failed, what changed to fix them, which approaches failed, and whether fixes were actually verified. Developers lose hours rediscovering solutions to recurring errors.
HOW REWIND WORKS:
1. Failure Capture: Wraps command execution (`rewind run <cmd>`), capturing live stdout/stderr, execution duration, safe environment snapshots, and Git metadata with 10MB memory safety bounds.
2. Deterministic Fingerprinting: Normalizes transient noise (PIDs, timestamps, UUIDs, memory pointers) into reproducible 16-hex SHA-256 failure fingerprints.
3. The Evidentiary Trust Loop: Strictly separates user claims (`USER_REPORTED`) from verified outcomes. Fixes are only promoted to `VERIFIED` when an explicit user-approved verification command exits 0 (`rewind verify <id>`).
4. Negative Memory: Failed remediation attempts are permanently sealed into Negative Memory, warning developers and AI coding agents away from dead ends.
5. Real-Time Regression Recall: When an identical failure recurs, Rewind detects the regression instantly and surfaces the proven fix.
6. Team Sharing & Agent Context: Exports sanitized, portable recovery bundles (`rewind export-shared`) and serves structured JSON context (`rewind context latest --json`) for coding agents.
ZERO-DEPENDENCY CRAFT & PACKAGE KILLER SPOTLIGHT:
Built with exactly 0 runtime and 0 dev dependencies, replacing 800M+ weekly npm downloads:
• Pure Myers LCS diff algorithm with colorized terminal hunks (replacing `diff` / `fast-diff` — 50M+ downloads).
• Hand-written zero-dependency CLI parser handling subcommands, flags, and trailing args (replacing `commander` / `yargs` — 160M+ downloads).
• Native ANSI SGR styling with strict NO_COLOR and TTY detection (replacing `chalk` — 150M+ downloads).
• Direct filesystem `.git/` metadata parsing with zero subprocess calls to the `git` binary (replacing `simple-git`).
• Append-only cryptographic event store (`journal.jsonl`) with 4-layer SHA-256 hash chaining and atomic file synchronization.
• Dual-pass deterministic compilation engine (`scripts/build.js`) producing 100% bitwise-identical builds.
• Test Suite: 313 automated tests across 90 test suites passing with 0 failures on Node.js standard library built-ins.
## Yggdrasil — Zero-Dependency, Zero-Knowledge Storage Engine
**Track: Data & Storage**
Most developers treat a database as a black box. Yggdrasil dismantles it: a disk-resident, encrypted B+Tree storage engine written from scratch in pure Java, with zero external dependencies — no Netty, no BouncyCastle, no Hibernate, no JUnit. Every layer was hand-built and fully explainable.
**What we built:** a 4 KB slotted-page storage format aligned to real disk sector geometry; a disk-resident B+Tree with lookups, range queries, inserts, deletes, splits, and merges; write-ahead logging with crash recovery that replays a consistent state after being killed mid-write; page-level zero-knowledge encryption using NIST-standard Ascon-128 AEAD, binding each page to its ID so a swapped or replayed page fails authentication instead of loading silently; transient decryption that keeps data encrypted at rest and only decrypts in RAM during queries, preserving O(log N) B+Tree speed; a non-blocking NIO TCP server with a custom binary protocol; and a live dashboard showing real telemetry — actual B+Tree traversal, page counts, and a tamper-detection demo, not mocked numbers.
**Why zero dependency matters:** libraries like KV stores, crypto packages, and HTTP frameworks hide the mechanics a systems engineer needs to understand — page-to-disk mapping, WAL durability, AEAD tamper protection. Building it ourselves means every guarantee is one we can prove, not one we're trusting a library to have gotten right. We replaced Netty with a raw NIO reactor, BouncyCastle with a hand-rolled Ascon-128 engine, Hibernate with our own record/heap/B+Tree stack, Protobuf/Jackson with manual byte packing, Spring Boot with `com.sun.net.httpserver`, and JUnit with a custom test runner.
**Honest scope:** crash recovery and encryption are the most mature parts of the codebase; the network layer is newer. Concurrency uses coarse synchronization rather than fine-grained isolation, and WAL recovery is redo-oriented, not a full ACID transaction manager. The network layer has no TLS or auth yet — it's an educational adapter, not a hardened service.
**Where this could go:** the core has zero dependency on the network layer, so it can ship as an embeddable encrypted key-value library inside any JVM app, or as edge middleware for IoT, buffering and encrypting sensor data locally before it travels upstream.
**Team:** Rishikeshav Sanjay Jha, Sejal Santosh Kumavat, Prabhav D. Dwivedi, Ayush Jha
ANVIL is a from-scratch Python data and storage system built with zero third-party runtime dependencies.
It features crash-safe WAL storage, recovery, corruption detection, verification, risk analysis, and explainable confidence scoring.
292 tests • 87% coverage • Windows verified • Single-file build • Reproducible builds • Package Killer • STDLIB Log
Built from scratch. Tested. Verified. Reproducible.
ZeroKV is a zero-dependency embedded key-value storage engine built entirely with Python’s standard library. It provides durable local application state through an append-only, CRC-protected log with staged transactions, crash recovery, corruption detection, verification, repair, segmented storage, and compaction.
Unlike a simple JSON file or Python dictionary, ZeroKV is designed to preserve consistency across multi-key updates and process failures. Committed transactions survive crashes, while incomplete transactions are discarded during recovery. Its verify() and repair() tools provide explicit integrity checking and recovery, while a CLI and read-only web dashboard make the engine easy to inspect and demonstrate.
ZeroKV has zero third-party runtime dependencies, a reproducible single-file build, and 69 automated tests covering persistence, transactions, concurrency, crash recovery, corruption handling, compaction, verification, repair, and the dashboard.
parsekit — a zero-dependency, multi-format data toolkit for the 2026 "Zero Dependency" coding competition.
It's a single `parsekit.py` (plus an optional browser UI) that handles four text formats in one place, using only the Python standard library — no third-party packages, no frameworks, no CDN:
- JSON — parse (strict/lenient), minify, pretty-print, format, query (JSONPath-style), diff
- CSV — parse, to-JSON, validate (with strict/lenient modes, embedded-newline handling, ragged-row & stray-quote checks)
- PKConf — its own custom config format (sections, nested keys, typed values, arrays, triple-quoted strings)
- Templates — Mustache-like rendering (variables, sections, inverted sections, partials, raw/unescaped, comments)
Everything is CLI-driven with stable machine contracts: strict `file:line:col: error:` output on stderr, explicit exit codes (0/1/2/3), non-destructive parsing, and clean JSON on stdout — so it's safe for automation.
It also ships with:
- A terminal UI (`ui.py`, ANSI colours, progress meters — stdlib only)
- A web dashboard (`parsekit.py ui`, `http.server`, localhost)
- An in-browser HTML playground (`demo/playground.html`) that runs all four engines in pure client-side JS — open it in any browser straight from disk, no install
- 264 tests, CI on Python 3.10–3.14, and a zero-dependency proof
...plus hardening passes (input size limits, huge-int/float-overflow guards, invalid-UTF-8 handling) covered in `SECURITY.md`.
raptor --Zero-Dependency Task Runner & Build Orchestrator
Track A: Developer Tools & CLI
raptor is a single static Go binary that reads a Taskfile.yml (a common subset of Taskfile v3), resolves the dependency graph (DAG), and executes tasks with bounded parallelism built using strictly the Go standard library with zero external dependencies (no require block, no go.sum).
#### Key Features:
- **Zero Third-Party Dependencies:** Empty go.mod, zero packages outside the standard library. Verified via `go list -deps`.
- **Hand-Written YAML Subset Parser:** Replaces `yaml.v3` with a custom indentation-sensitive recursive descent parser that reports precise line:column errors and passes 250k+ fuzz test iterations without panics.
- **DAG Scheduler & Cycle Detection:** Dependency-level scheduler with 3-color DFS cycle detection (exit code 2 on cycles) and bounded CPU parallelism (`-j`).
- **Real Incremental Builds:** Avoids redundant recompilation using file timestamp comparisons, SHA-256 content hashing (`--checksum`), and `status` predicates.
- **Custom Template Engine & Loops:** Supports variable expansions with filter pipelines (`{{.VAR | upper}}`, `replace`, `default`, `trim`) and `for:` collection iteration.
- **Deterministic Spooled Output:** Eliminates interleaved/torn logs under concurrency by spooling task output to temp files and emitting in dependency order (`--output group`).
- **Reproducible Build:** Produces byte-identical binary outputs with identical SHA-256 hashes across repeated builds.
- **STDLIB Substitution Log:** Detailed documentation of 24 stdlib replacements in STDLIB.md.
CLI-KDG is a zero-dependency developer tool that automatically discovers a command-line application's interface from its --help output, generates deterministic edge-case tests, executes them, and captures the resulting behavior as a versioned snapshot. When the CLI is updated, CLI-KDG replays the exact historical test cases against the new version and reports behavioral regressions by comparing exit codes, stdout, stderr, status, and termination behavior.
Built entirely with Python standard library and POSIX primitives, with CI/CD verification and no third-party runtime dependencies.
Forensic Timeline — zero-dependency incident forensics for engineers who've had three terminals open at 3am.
THE PROBLEM
An incident spans three services, three log formats, no single timeline. Engineers manually cross-reference timestamps under pressure. Forensic Timeline automates that correlation entirely with Go's standard library — no packages.
WHAT IT DOES
Merges plain-text and JSON logs from multiple sources into one chronological timeline, concurrently, without crashing on malformed input.
Detects error bursts, silence gaps (measured against the log's own baseline rhythm, not a fixed number), and cross-file correlations connecting failures across services.
Diagnoses probable root causes alongside each anomaly, not just flags.
Navigates live: an interactive REPL scrubs event-by-event with a color-coded density bar, jumping straight to anomalies.
Watches live logs and diagnoses incidents the moment they happen — not on the next manual rescan.
WHY IT STANDS OUT
Tested against my own real, live system log, not just fixtures. That testing surfaced a genuine bug: as more data streamed in, a statistic the detector relied on shifted, and old events got re-announced as if new. I found it, fixed it, and wrote a regression test named after the exact failure — documented plainly in the README. A tool that only works on curated data proves the algorithm; one that survives a real uncooperative log proves the engineering.
The terminal UI — colored severity, a live density scrubber, bordered diagnosis cards — is built entirely from raw ANSI escape codes and Unicode box-drawing characters. No color library, no TUI framework.
PROOF
$ cat go.mod
module forensic-timeline
go 1.22.2
No require block. Every substitution — stats, CLI parsing, colorizing, terminal UI — is documented with real reasoning in STDLIB.md.
HONEST LIMITS
The silence-gap threshold adapts to the log's own rhythm, a deliberate tradeoff covered by tests. The scrubber bar uses a fixed width rather than querying real terminal size, since that needs the same platform-specific code the tool otherwise avoids. Limitations are written down, not hidden.
Track A — Developer Tools & CLI. Built to be the tool I'd actually reach for during a real incident.
btc-peek is a from-scratch Bitcoin protocol client written in Rust using only the standard library — no rust-bitcoin, no crypto crates, no networking frameworks. It opens a raw TCP connection to a real Bitcoin peer, hand-implements the wire protocol (message framing, checksums, varints, double-SHA256), completes the handshake, pulls real block headers, and validates that each one satisfies Bitcoin's proof-of-work rule, including difficulty retargets. Signature verification is out of scope; everything else needed to "trust the chain" is hand-rolled and tested against known vectors.
Since judging is asynchronous with no live Q&A, it also ships a real captured handshake + header exchange as raw bytes, plus a --replay mode that runs the same validation offline — so the core claim is verifiable with or without a cooperating live peer.
Loom is a Jinja2-style template engine for Python, built entirely from scratch using only the standard library (re, html, dataclasses, typing) — zero third-party dependencies, no eval()/exec().
It implements a real three-stage compiler pipeline — hand-written Lexer → recursive-descent Parser → AST-walking Renderer — not regex substitution or string hacking. It supports the core features developers reach for Jinja2 for: variable interpolation with dotted-path lookup, chainable filters, full conditional expressions (==, and/or/not, in), loops with a loop object (index, first, last), template inheritance (extends/block), includes, comments, whitespace control, and opt-in HTML autoescaping (verified against real XSS payloads).
The entire engine lives in a single ~800-line file (loom.py), backed by a 40-case test suite (all passing) and a dependency-verification script (check_dependencies.py) that programmatically proves every import is stdlib — not just asserted, but checkable.
Built for Track B (Parsers & Data Formats), Zero Dependency 2026.
DiagonalNet re-imagines deep learning from first principles by eliminating multi-gigabyte dependency frameworks (torch, tensorflow, cv2, numpy, sklearn) and dynamic C++ runtimes. Built natively in 100% pure Go, it achieves 98%+ accuracy on computer vision sketch classification while maintaining a single portable static executable under 3 MB.
Key Capabilities & Highlights:
1. 100% Pure Go & Zero Dependencies: Every tensor layer, optimizer, matrix operation, image preprocessor, and serializer is written purely in the Go standard library (math, sync, runtime, net/http, image, encoding/binary).
2. 13-Channel Spatial Difference Manifold Calculus: A custom feature-extraction manifold computing base grayscale intensity (Ch 0), 4 immediate diagonal differential operators (Ch 1-4), and all 8 chess knight-move differential operators (Ch 5-12) in parallel across CPU cores.
3. High-Performance CPU Engine & Autograd: Cache-friendly contiguous 1D/3D tensors, analytical Jacobian backpropagation, Kaiming/He initialization, Adam optimization with L2 weight decay, and lock-free multi-core gradient reduction.
4. Computer Vision & Augmentation Pipeline: Tight bounding-box localization, proportional padding (~70% occupancy), peak-luminosity contrast stretching, sub-pixel bilinear interpolation, and a 15-variant geometric/morphological data augmentor (rotations, scale, shear, dilation, erosion).
5. Self-Contained Web Server & Interactive UI: Embeds a single-page dark-themed drawing canvas web app and sub-8ms real-time REST inference API directly in the binary with zero frontend/backend framework overhead.
6. Robustness & Test Coverage: 54 passing unit tests verifying mathematical finite-difference gradient checks, layer forward/backward passes, and system integrity.
Name: diagonalnet
Language: Pure Go (1.27.0)
External Dependencies: 0 (Zero)
Binary Footprint: < 3 MB (Single static executable)
Accuracy: 98%+ on 10-class sketch recognition
Inference Latency: < 8 ms (Single CPU core)
Architecture: 13-Manifold -> Conv2D -> MaxPool -> Conv2D -> MaxPool -> AdaptiveAvgPool -> Linear -> Dropout -> Linear -> Softmax
SecretScan is a zero-dependency secrets-leak scanner for Track E (Security & Crypto Utilities). It detects hardcoded API keys, tokens, credentials, private keys, and other high-entropy secrets in a codebase before they are committed, using only the Python standard library.
The problem it solves is simple: security scanners such as gitleaks, detect-secrets, and truffleHog are powerful, but they introduce their own installation and dependency requirements. SecretScan takes a different approach — practical secret detection without requiring any third-party runtime package.
How it works:
• Pattern-based detection across cloud, SCM, SaaS, authentication, key-material, and database credentials, including AWS, GCP, Azure, GitHub, Slack, Stripe, JWTs, private keys, database connection strings, and more.
• Entropy analysis to identify random-looking secrets that do not match known formats, with conservative filtering to reduce false positives.
• .gitignore-aware scanning to avoid irrelevant files while still detecting sensitive files that could accidentally enter a commit.
• Security-focused reporting with line-level redacted context, severity classification, JSON/HTML reports, fix suggestions, and baseline support.
• Git pre-commit protection to prevent detected secrets from being committed.
Zero-dependency implementation: SecretScan is built entirely with Python's standard library, including re, hashlib, hmac, json, tomllib, and argparse. Our standard-library substitutions and design decisions are documented in STDLIB.md.
SecretScan also implements the Single File and Reproducible Build bonus challenges. It provides a standalone dist/secretscan_single.py containing the scanner in a single file, while the reproducible build process produces byte-identical artifacts across independent builds, verified using SHA-256 hashing.
zeroproxy is a production-grade HTTP server, router, reverse proxy, and static file server built entirely on Bun's standard library with zero third-party dependencies.
Instead of pulling in packages like express, http-proxy, path-to-regexp, or serve-static, zeroproxy reimplements them using Bun/Node built-ins: Bun.serve, Bun.file, URLPattern, CompressionStream, and util.parseArgs. The shipped package.json contains an explicit empty "dependencies": {} nothing is installed from npm.
It handles correct HTTP semantics: proper MIME types, Range requests, ETag/If-None-Match caching, streaming bodies, round-robin load balancing across upstreams, and 502/504 responses on upstream failures. It supports gzip/deflate/brotli compression, a zero-dependency router (replacing path-to-regexp via URLPattern), and graceful shutdown on SIGINT/SIGTERM.
It's also reproducible: two byte-identical builds are produced and hashed, and every "package killer" substitution is documented in STDLIB.md with rationale. The whole thing runs in a single bun build --compile step with no node_modules.
rfcotp is a Rust command-line tool that re-implements a stack of cryptographic building blocks from scratch ,no external libraries and proves on every run that its implementations match the official reference numbers published in the RFC/FIPS standards documents.
Nexus is a production grade reverse proxy and API gateway built entirely with Node.js standard library modules, requiring zero third party runtime dependencies. It provides TLS termination, intelligent routing, load balancing, health checks, rate limiting, authentication, request metrics, a live SSE dashboard, and a durable write ahead log designed as a lightweight, modular alternative to traditional gateway solutions.
Chronos: An LSM / MVCC Key-Value Engine Without Any Dependencies
Databases don’t need a runtime — they need discipline. Chronos is an embedded key-value engine implementing a true LSM-tree storage layer and MVCC time-travel querying, all on top of Python’s standard library. No pip install, anywhere in the tree.
Architecture. Writes are first written to the fsync’d WAL and then to the in-memory, sorted MemTable; flushes yield immutable SSTables on disk. Every entry has its own independent CRC32 checksum — binascii detects torn writes both during WAL replay and SSTable read, raising errors explicitly instead of returning corrupted data silently. MVCC implements one global, monotonic version counter, not a version per key, so get(key, version=V) will yield a deterministic answer in relation to any historic version point. Compaction is the crucial part: k-way heap queue merge → new immutable SSTable → fsync → manifest file atomic swap → only then old files are deleted. This atomic file swap is done via os.replace, and not os.rename; while rename outright fails on Windows if the destination exists, replace does the job of guaranteeing atomicity across platforms. There is also a chaos test spawning a child process, waiting for a deterministic signal right before the compaction, killing the process forcefully, and asserting zero data loss upon reopening — not a guess about timing, but an assertion.
Standard-library exploitation. struct+binascii are used instead of msgpack; mmap instead of RocksDB-style memory-mapped reads; bisect instead of sortedcontainers; heapq instead of dependency for merge-sort implementation; os.replace instead of guarantee of atomic commit provided by any native database; argparse+cmd instead of click; zipapp packages everything into a single chronos.pyz executable. Zero dependencies claim is not asserted — it is proven in real-time via an AST inspection of imports and their presence in sys.stdlib_module_names, since pip freeze reflects only your machine, not your code.
55 tests. Byte-by-byte identical reproducible builds. No third-party dependencies, no exceptions.
zdb is a crash-safe, log-structured key-value store — the storage layer most apps rent from RocksDB, sled, or SQLite and never look inside — reimplemented from scratch in Rust using only the standard library. Its dependency manifest is empty: `cargo tree` prints just `zdb`, and CI re-proves zero third-party dependencies on every push.
Track D (Data & Storage). It's a Bitcask-style engine: writes append a length-prefixed, CRC-32-checked record to an append-only log segment and update an in-memory hash index; reads are one lookup plus one seek; deletes append a tombstone. On open it replays every segment newest-wins to rebuild the index, and a crash mid-write is detected by the CRC and safely truncated — I prove this with a test that scribbles garbage onto the log and confirms prior data survives and the store stays writable. It also does manual compaction to reclaim space, and enforces a single-writer lock across processes. Durability and consistency are documented honestly, including the one corner I cut (no directory fsync on segment creation) rather than hidden.
I claimed all four bonuses. Single File: the whole engine and CLI live in one readable src/main.rs. Reproducible Build: building twice produces a byte-identical binary (I solved the Windows PE timestamp and PDB-GUID nondeterminism with /Brepro plus --remap-path-prefix; both SHA-256 hashes are published in REPRODUCIBLE.md). Package Killer + STDLIB Log: STDLIB.md documents 12 crates I'd normally install and the exact std feature I used instead — serde+bincode became hand-written fixed-width record framing, crc32fast became a table-driven CRC built once via LazyLock, fs2 became a create_new lock file, clap became a match over std::env::args, once_cell became std::sync::LazyLock.
Build and run in one command (`cargo build --release`), 14 passing tests (unit + integration, including crash-recovery and concurrent-lock tests), an honest benchmark command (`zdb bench`) that reports throughput and states the fsync cost plainly. MIT licensed. Everything a judge needs to verify the empty manifest is in deps-proof.txt and the CI log.
ZeroTrace is a lightweight, zero-dependency log analysis tool that helps users quickly understand what is happening inside their server or application logs.
Instead of manually searching through large and confusing log files, ZeroTrace analyzes the logs, finds important problems, connects related events, and detects unusual activity. It then turns these findings into a simple and interactive HTML report.
The report clearly explains what happened, why it matters, shows the supporting log evidence, and suggests what the user should check next. This makes ZeroTrace useful for both beginners who want simple explanations and technical users who need more detailed information.
The project is built with Python's standard library to meet the hackathon's zero-dependency requirement.
md0 is a zero-third-party-dependency runtime for interactive Markdown that stays a document.
It lets ordinary .md files contain typed inputs, calculations, reactive text, conditions, assertions, tables, charts, equations, and function plots. When an input changes, md0 tracks the dependency graph and recomputes only the parts of the document that depend on it, so things like prose, equations, and graphs stay synchronized automatically.
The key idea is “interactivity without authority.” md0 documents can compute and react, but they cannot arbitrarily access the filesystem, network, shell, environment variables, packages, or JavaScript. Math renders as native MathML, plots as native SVG, and the runtime ships as a single small Go binary with zero third-party Go modules. Documents can also be customized and exported to PDF, Word/DOCX, Markdown, snapshots, or static HTML.
The goal is to fill the space between static Markdown and full applications: documents should be able to compute without becoming software.
VaultGuard is a zero-dependency CLI password manager built entirely with Node.js’s standard library. It provides AES-256-GCM encrypted password storage, RFC 6238 TOTP two-factor authentication, and a secrets scanner with credential detection and redaction. The project uses zero third-party runtime dependencies and includes automated tests covering cryptography, TOTP, vault persistence, and secret scanning.
Bedrock is a fully working Node.js web framework built with zero third-party runtime dependencies — no Express, no npm packages, just the standard library. It replaces 10 popular packages (express, body-parser, multer, compression, cors, ws, nodemon, commander, mime-types, send) with hand-rolled equivalents built on node:http, node:crypto, node:zlib, and node:net.
Highlights include a trie-based router, byte-safe multipart file upload parsing, gzip/brotli compression, Range-request static file serving, and a WebSocket server implemented from raw TCP sockets — full RFC 6455 handshake and frame codec, no ws package involved. It also includes security hardening (CRLF injection guards, HTTP request-smuggling defense, slow-loris timeout protection) that many real-world frameworks don't bother with by default.
Verified with 46 passing tests and a byte-identical reproducible build.
LeakCheck is a zero-dependency secret scanner built entirely with Node.js standard-library APIs. It detects accidentally exposed passwords, API keys, tokens, private keys, and suspicious high-entropy strings in source code and configuration files. Its key feature is Git history scanning, which can detect secrets that were deleted from the current code but still remain in previous commits. LeakCheck redacts detected secrets, provides confidence and severity scoring, supports JSON output for CI/CD, and includes a strict mode that can fail builds when HIGH or CRITICAL findings are detected.
Modern developers rarely work with only one isolated terminal command. Installation instructions, build processes, debugging workflows, and project setup steps often contain several command lines. Correcting a single line is therefore not enough: one unnoticed typo can break every command that follows, while an unsafe pasted command can cause damage before the developer has time to review it.
TermFix was designed specifically for this wider problem. It is an offline, zero-dependency terminal assistant that can inspect both individual commands and batches of multiple independent command lines. In Safe Paste Mode, TermFix collects every line without executing anything, analyzes each command separately, identifies locally provable corrections, classifies risk, and displays whether each line is ready, corrected, unavailable, invalid, or blocked.
Before any pasted command can run, TermFix requires a newly generated review code. The developer can then Run, Skip, Explain, or view the Diff for each line individually. There is no unsafe Run-all option, and every selected command is revalidated immediately before execution.
TermFix proves corrections using real executables on PATH, existing local files and directories, recognized error output, language-specific vocabulary, and functions declared in explicitly named project files. It can understand Python, JavaScript, Java, C, and C++ project context while never silently editing source code.
A deterministic safety engine blocks destructive commands and risk-increasing corrections. Approved commands run as argument vectors with shell=False. TermFix works completely offline, uses only Python’s standard library, and currently passes 206 embedded tests, 21 acceptance cases, and 9 demonstration scenarios.
MiniKV is a zero-dependency persistent key-value storage engine built from scratch in Go using only the Go standard library. It belongs to the Data & Storage track and provides CRUD operations, TTL-based expiration, append-only persistence, indexing, checksums, recovery, backup and restore, log compaction, statistics, and optional fsync-based durability.
The project has no third-party runtime dependencies and can be built using a single Go build command. It is organized into modular CLI, storage, indexing, recovery, checksum, TTL, backup, and compaction components, with unit and integration tests.
MiniKV demonstrates that a practical persistent storage engine can be built from first principles using only the standard library.
**Quorum is a cryptographic dead-man's-switch for high-value secrets. It splits a secret into N shares using Shamir's Secret Sharing, distributes them among trustees, and requires K trustees to reconstruct it. If the owner stops checking in, trustees are automatically notified, but no single trustee can recover the secret alone.**
Built entirely with Python's standard library for Zero Dependency 2026 Track E, Quorum implements finite-field arithmetic, Lagrange interpolation, Diffie-Hellman, PBKDF2, HMAC-based authenticated encryption, canary shares, role-separated access, a dead-man's-switch monitor, and tamper-evident audit logging, without third-party runtime packages.
The repository includes tests, dependency proof, STDLIB.md substitutions, a threat model, and reproducibility verification.
**The secret doesn't belong to one person. It belongs to the quorum.**
Pith is a JSON Swiss Army knife for the command line — a
jq-style query language with user-defined functions, a strict validator with
`line:col` caret diagnostics, lint/stats/diff/gron tooling, CSV/TSV/INI/logfmt
converters, and a streaming pretty-printer. All of it in **one Go file with
zero third-party dependencies**: `go list -m all` prints a single line.
ZeroVault is a zero-dependency security toolkit built entirely with Go 1.27's standard library. One binary, no packages. Includes: AES-256-GCM encrypted password vault with PBKDF2 key derivation, TOTP 2FA generator verified against Google Authenticator, file encryption with streaming support, secrets scanner that reads git history by parsing .git/objects directly, password health dashboard with offline breach detection, QR code generation from scratch, vault two-factor authentication, clipboard auto-clear, master password rotation, and a built-in penetration test suite with 13 automated attacks and HTML report export. 82 Go files, 115 tests (100% pass), 22 STDLIB substitutions, 0 dependencies.
Orris is a fault-tolerant distributed key-value store built entirely from scratch with zero third-party dependencies, using only the Go standard library. Distributed consensus and data durability are notorious engineering challenges, leading most developers to rely on complex external frameworks like HashiCorp Raft, etcd, gRPC, and BoltDB without understanding how they work under the hood. Orris was built to demystify these core distributed systems problems at the primitive level, demonstrating that real consensus, physical disk persistence, and terminal observability can be built cleanly using standard library primitives.
Under the hood, Orris implements the complete Raft consensus algorithm from the ground up. It handles automated leader elections with randomized 300 to 600 millisecond election timeouts to prevent split votes, manages quorum-based log replication across peer nodes, and enforces strict linearizable consistency across state machines. To guarantee data survival across sudden node crashes, Orris features a custom Write-Ahead Log (WAL) engine. Every state change and log entry is framed with a 4-byte length prefix, an IEEE CRC32 checksum, and Gob binary encoding, flushed directly to disk using kernel-level fsync system calls. When a crashed node restarts, it replays its on-disk WAL, truncates corrupted tails, and safely catches up with the cluster leader.
To make distributed systems transparent and intuitive, the project includes orrisctl, an interactive terminal visualizer and control plane. With a single command, orrisctl compiles the daemon, spawns independent background node processes, binds them to real TCP ports, and connects over custom wire protocols. Users can propose writes, watch log replication across node columns in real time, run concurrent write benchmarks, and perform chaos testing. By running commands like killing the active leader, users can watch the cluster detect the crash, increment the Raft term, elect a new leader in under 500 milliseconds, and continue serving writes without interruption.
Orris achieves distributed consensus, physical disk durability, and rich terminal visualization without importing a single external package. Verified by an empty require block in go.mod, it serves as a transparent, deep-dive implementation of distributed consensus and storage mechanics built purely on standard Go.
CipherOps is a production-grade CLI security suite built for the Zero Dependency Hackathon 2026 (Track E). Most modern security utilities rely on dozens of external packages, leaving applications vulnerable to supply-chain attacks. CipherOps proves that full-spectrum security can be achieved using zero third-party dependencies—relying 100% on the Python Standard Library. It unifies three core security components behind a single cryptographic engine: an Encrypted Master-Password Vault (scrypt + HKDF + Encrypt-Then-MAC), a 2FA Code Generator (RFC 6238/4226 TOTP), and a Secrets Scanner with Shannon entropy analysis and redact-and-rotate remediation.
Nyx is a searchable knowledge base built for the Zero Dependency 2026 hackathon (Track D — Data & Storage). It indexes a folder of Markdown/plain-text notes into a persistent inverted index, ranks results with real Okapi BM25 relevance scoring, supports phrase queries and term exclusion with contextual snippets, and serves a browser UI for browsing and reading notes — all rendered by its own Markdown-to-HTML engine.
The catch: everything is implemented from scratch on the Python standard library. There is no pip install, no framework, no third-party package — just python3. The point isn't that packages are bad; it's proving you understand what sits underneath them.
One command builds it (python3 nyx.py index ./notes), a proof command statically confirms zero external imports, 29 unit tests plus a brute-force correctness oracle pass with 0 mismatches / 0 false positives over thousands of documents, and the build is byte-reproducible (nyx.pyz + published SHA-256). It also claims all four bonus challenges: Single File, Reproducible Build, Package Killer, and a 15-entry STDLIB replacement log.
CrashVault is a zero-dependency embedded key-value store built entirely with Python’s standard library. It is designed to protect data from unexpected process crashes using Write-Ahead Logging (WAL), fsync()-based durability, and automatic crash recovery. It also supports snapshots, thread-safe operations, and SHA-256 WAL integrity checks. CrashVault is tested with 66 automated tests and requires zero third-party runtime dependencies.
SQRay (SQLite-Xray) is a high-performance, zero-dependency terminal utility and forensic engine for deep SQLite database inspection. Built entirely with pure Python standard library subsystems (0 third-party packages, no database drivers or pip installs), SQRay implements the SQLite File Format 3 specification directly from first principles against raw binary disk streams.
Instead of executing high-level SQL queries through opaque abstraction drivers, SQRay reads databases byte-by-byte to deconstruct 100-byte file headers, recursively map multi-level B-Tree hierarchies (interior and leaf nodes), visualize physical page geometries and free space fragmentation, decode variable-length serial records, and audit Write-Ahead Log (WAL) transaction frames directly in the terminal.
noembed - a zero dependency local vector search engine
by noimport club
@pawan.vats
noembed is a zero-dependency local vector search engine. built entirely on python's standard library. no embedding API, no ML libraries
point this CLI tool at a folder of text files. ask it a question in plain english. It finds the right document, even when your words don't appear anywhere in it
It does so by computing real vector math (TF-IDF + cosine similarity) live, with nothing installed, nothing called over the network, and nothing hidden.
every save is crash-safe: writes go to a temp file, get fsync'd, then swap in atomically kill the process mid-write and the old index comes back byte-for-byte intact
The stemmer is hand-written too, and its bugs weren't hidden: one early version turned "this" into "thi," caught, fixed, and locked behind a regression test.
ZeroVault is a fully-featured security toolkit built with zero external dependencies —
no Express, no bcrypt, no third-party crypto libraries. Everything runs on Node.js
built-ins (node:crypto, node:http, node:fs).
It provides an AES-256-GCM encrypted vault for storing secrets, secured by Argon2id
key derivation and an HMAC-SHA256 outer signature for constant-time tamper detection.
The master password is never stored — it's derived, used, and immediately zeroed from
memory.
Beyond the vault, ZeroVault includes a CSPRNG-based password/passphrase/key generator,
a secret scanner that detects exposed AWS keys, GitHub tokens, and Stripe secrets using
pattern matching and Shannon entropy analysis, a full RFC 6238 TOTP/2FA authenticator,
a transparent password audit engine, and a file protection suite for inspecting,
securing, hashing, and shredding sensitive files.
The entire project is accessible through a glassmorphism dark-theme web UI, a REST API,
and a full-featured CLI — all with no build step and no npm install required.
(Track D) Z-revixDB — A zero-dependency version data storage, lineage and time-travel recovery system
by Tech Drishti
@mansikumawat_15
@kashishkumawat.
@divyi1234_72710
(login to website through ---
username-admin,
password- Admin@12345)- for click and play
Track D - Data &Storage
Problem Statement-Modern databases excel at storing current states but struggle with granular history. When data is corrupted or accidentally modified, answering what changed, when, why, and how to safely restore it is difficult. Traditional backups focus on disaster recovery, not individual record evolution.
Our Solution-Z-RevixDB — Data That Remembers is a zero-dependency data versioning and recovery platform. It treats data history as a first-class capability. Instead of overwriting values, it preserves immutable versions, allowing users to inspect, compare, verify, and safely recover individual data states.
Key Features-
Data Versioning: Every update creates an immutable version.
Lineage & History: Track data evolution and view when and how it changed.Multi-Format Support: Unified representation for JSON, tables, and configurations.Compare Versions: Identify exact differences between two states.
Time Travel: Reconstruct data as it existed at any past point in time.Safe Recovery: Restore previous states while preserving history.
Audit Trail: Maintain timestamps, changes, and commit messages.Integrity Verification: Use hashing to detect unexpected data modifications.Persistent Storage: Retain data and history across restarts.
Web Interface: Intuitive UI for easy management without raw storage access.
Target Users-Designed for developers, data teams, startups, and organizations managing data where accountability and recovery matter (e.g., customer records, inventory, configurations).
Zero-Dependency Innovation- Built for the Zero Dependency challenge, Z-RevixDB uses zero third-party runtime dependencies. It replaces standard packages with standard-library primitives for HTTP handling, JSON processing, hashing, UUID generation, and concurrency, proving powerful data platforms can be built from core building blocks.
Why It Matters--
Z-RevixDB shifts the question from “What is my data now?” to “What was my data, what changed, when did it change, and can I safely recover it?”Don't just store data. Remember its history.
Chronos is a zero-dependency, Gorilla-style time-series database with a live operator dashboard. It implements Facebook's Gorilla compression paper from scratch (delta-of-delta timestamps, XOR'd float encoding) for 10–15x compression, a crash-safe chunked storage engine with CRC32 checksums, a tiered rollup query planner, and a hand-rolled RFC 6455 WebSocket server — all using nothing but the Go standard library. The dashboard streams live telemetry over that WebSocket with real-time Canvas charting. Built for Track D (Data & Storage).
ChronicleKV is a zero-third-party-dependency, crash-safe embedded key-value and document store built from first principles using 100% Python standard library.
"ChronicleKV replaces TinyDB for small, local, crash-sensitive document-storage workloads."
Key Architecture & Capabilities:
• Crash-Safe Binary WAL: Append-only write-ahead log framed with struct and zlib.crc32. Automatically detects mid-write torn writes and truncates damaged tails on recovery with 0% data loss in sync mode.
• Point-in-Time History & Time-Travel: Query past mutations with get_at(seq), inspect mutation feeds with chronicle history, diff key values across sequence points with chronicle diff, and view global feeds with chronicle timeline.
• Atomic Two-Mode Compaction: Zero-downtime atomic file replacement supporting both --latest-only and --keep-history modes, resilient against crashes at all 4 compaction stages.
• TinyDB Replacement: Full document compatibility layer (CRUD, stable IDs, search queries, and import-tinydb JSON migration) replacing TinyDB's crash-prone JSON storage with true WAL durability.
• Formal Zero-Dependency Guarantee: pyproject.toml (dependencies = []) and requirements.txt are completely empty; verified via AST analysis of all Python files against sys.stdlib_module_names.
• Real Durability Modes: Verified 15-run crash benchmark showing 100% zero-loss reliability in sync mode vs. observable memory buffer loss in async mode.
AI-native alternative to Playwright and Puppeteer. Ships as an npm dev dependency, skill, plugin or MCP, with no dependencies. [Accepted late over Discord by Maksim after the form cutoff.]
RepoLens is a zero-dependency, offline codebase intelligence tool for Node.js projects. It analyzes repository structure, dependencies, statistics, routes, and code signals to generate an architecture view, project insights, a “Where Should I Start?” guide, and a Route Map — helping developers understand unfamiliar codebases faster without executing their code.
Zero-Dep Datastore is a Redis-like in-memory key-value database built entirely from scratch in C++17 with zero third-party dependencies. It supports 5 data types (strings, lists, hashes, sets, sorted sets), TTL-based key expiration, dual persistence (RDB snapshots + append-only file with fork-based background saves), and configurable memory eviction (LRU/LFU/TTL policies). The server handles thousands of concurrent connections via a hand-rolled edge-triggered epoll event loop, and every component — incremental-rehashing hash map, randomized skiplist, back-referencing min-heap, thread pool, and binary wire protocol — is implemented using only the C++ standard library and POSIX syscalls. 11 third-party library substitutions are documented in STDLIB.md. Targets Track D (Data & Storage).
zeroxy is a zero-dependency HTTP/1.1 reverse proxy and load balancer, built for Track C (Web & Network) with nothing outside the Rust standard library — no hyper, no tokio, no third-party crates at all. It hand-rolls its own HTTP/1.1 parser, longest-prefix router with nginx-style path stripping, active health checking, keep-alive connection handling, chunked transfer-encoding, and an RFC 1123 date formatter verified against real calendar dates. Design tradeoffs — the thread-per-connection concurrency model, the deliberate absence of TLS, the 10 MiB body cap — are documented, not hidden. 59 tests back it, several written directly against real bugs found and fixed against live redirect and DNS behavior during development.
BareBones is a Python web framework (like Flask or FastAPI) built 100% from scratch using only Python's built-in tools — with zero pip install or third-party packages.
🌟 Key Highlights:
⚡ Dual Engine: Switch between Multi-Threaded and Event-Loop modes live without restarting the server.
🔌 Real-Time Features: Full-duplex WebSockets (live chat) and SSE (live logs & telemetry).
📹 Media & Security: HTTP 206 video streaming (instant seek/scrubbing), HMAC-SHA256 session cookies, and rate limiting.
🛡️ Why It Matters: Zero security risk from external packages, instant setup on any computer with Python, and proves what Python's standard library can do on its own.
sealbox is a single-file, standard-library-only security utility for local secret storage, RFC 6238 TOTP generation, authenticated one-shot file/message sharing, and heuristic secret detection.
WireCraft is a zero-dependency local API gateway, dynamic mock engine, streaming reverse proxy, and real-time traffic inspection studio built entirely using the native Node.js standard library with an empty dependency manifest ("dependencies": {}). It was created to solve "frontend-backend dependency hell"—a bottleneck where more than 65% of engineering teams lose 5 to 8 hours per developer every week waiting for backend APIs to be deployed, fighting broken CORS errors, or installing 50+ heavy npm packages just to mock a few endpoints. WireCraft replaces these bloated tools with a single, self-contained file (server.mjs) that boots in milliseconds with npx wirecraft or node server.mjs. It provides dynamic mock responses from routes.json with hot-reloaded generator tags (such as {{uuid}}, {{timestamp}}, {{randomChoice}}, and path parameters), forwards unrouted requests to a real backend while saving decoded fixtures to disk, injects chaos latency and error rates for resilience testing, and natively signs and validates Stripe and GitHub HMAC-SHA256 webhooks. All incoming and outgoing HTTP traffic is broadcast live over native Server-Sent Events to a built-in web dashboard (http://localhost:3000/_inspect) where developers can inspect syntax-highlighted payloads, replay requests with one click, run automated verification test cases, and export traces in standard HAR 1.2 format—delivering a complete, production-grade developer workflow with zero external packages.
Mini-press is a full-featured social publishing platform built entirely with Bun and standard runtime APIs—no installed dependencies. Users can create accounts, publish Markdown posts with images, join boards, follow and vote on profiles, comment, RSVP to events, and subscribe through RSS. It includes SQLite persistence, secure signed sessions, CSRF protection, WebSocket live previews, five UI themes, and an admin moderation system. The project replaces 21 common dependency categories with Bun built-ins and project-owned code.
IMPACTX is an offline, zero-third-party-dependency developer CLI that performs semantic change-impact analysis on Python projects. By comparing two codebase versions (BEFORE and AFTER), IMPACTX constructs dependency and call graphs, calculates the blast radius of changes, detects breaking API modifications, identifies affected test suites, detects security-sensitive code changes, and produces an explainable risk report.
TermiReq is a semantic terminal-screen diffing engine that acts like "git diff, but for terminal output." It captures character-level changes on a 2D virtual screen grid after running commands, reporting exactly what appeared, disappeared, or moved on screen. Built entirely in Python 3.11+ with zero third-party dependencies, it's designed primarily for accessibility—helping screen readers describe terminal changes to blind or low-vision users—while also useful for debugging and testing terminal output. The architecture follows a clean pipeline: a runner executes commands via PTY (Unix) or subprocess fallback (Windows), an ANSI parser converts raw bytes into cursor/style events, a screen module maintains a 2D grid with wide-character support, a diff engine performs cell-by-cell comparison with scroll detection, and an accessibility layer converts diffs into speech announcements via OS-native TTS. It provides three CLI subcommands (run, record, replay), TOML-based configuration, and JSON output mode. The project includes 167 passing tests, GitHub Actions CI across three OSes and Python versions, and can be distributed as a single Python zipapp.
InlineDebug is a single-file, zero-dependency Python tool that watches your code as you save it, runs it in the background, and writes any error directly into the file as a comment on the exact line that caused it — clearing it automatically once fixed. It supports single files, multiple files, or whole directories, keeps a rollback history of every save, and ships as one built file with a terminal menu.
FORGE is a zero-dependency local document search engine built entirely with Python’s standard library. It provides durable append-only storage, Write-Ahead Log (WAL) crash recovery with fsync, deterministic AND/OR search, and TF-IDF ranked search. The search index is derived from storage and can always be rebuilt, with consistency validation to detect corruption or drift.
FORGE ships as a reproducible standalone dist/forge.pyz artifact with zero third-party runtime dependencies. The project includes 265 passing tests, including real subprocess crash-recovery tests, and documents reproducible byte-identical builds. An optional tkinter/ttk GUI is also provided for easier demonstration, while the official submission artifact remains the CLI.
Track D — Zero-Dependency Local Data Engine.
Presentation slides: [ https://docs.google.com/presentation/d/1UCsBXat5szlCJIxJpRAyDuxt4mt0PJPvZaCfGgSBolc/edit?usp=sharing ]
BlitzBroker is a from-scratch MQTT 3.1.1-subset broker in pure Rust `std` with sharded actor registry, wildcard fan-out, retained messages, QoS 0/1 with PUBACK plus BlitzClient, a standalone pub/sub CLI with its own codec. Zero third-party crates, interop-tested against real mosquitto/paho clients, backed by 118 tests.
BlackBox — Project Description for Judges
BlackBox is a zero-dependency Web & Network Diagnostics CLI that gives developers a phase-by-phase view of what actually happens when connecting to a website. Instead of hiding networking behind high-level tools, BlackBox directly performs DNS resolution, TCP connection, TLS handshake, ALPN negotiation, and HTTP/1.1 communication, measuring each stage using a precise T0–T8 timing model. It identifies the largest connection-setup bottleneck and provides actionable security-posture findings such as certificate chain trust, certificate expiry, hostname mismatch, HSTS, CSP, cookie security flags, and server fingerprint exposure.
The key engineering feature is that BlackBox owns the HTTP/1.1 wire-level processing. It constructs HTTP requests manually and parses responses itself, including status lines, headers, chunked transfer encoding, trailers, Content-Length and close-delimited bodies. It enforces a 64 KiB header limit and a 10 MiB in-memory body limit while completely draining larger responses, preventing uncontrolled memory usage. DNS is resolved exactly once and the resulting IP is used directly for TCP connection establishment.
BlackBox also supports concurrent multi-target inspection with deterministic output ordering, redirect following with same-origin connection reuse, machine-readable JSON output, report persistence with --save, and before/after performance comparison through blackbox compare. Its security model deliberately separates certificate chain trust, expiry, and hostname verification, allowing the tool to distinguish an expired-but-trusted certificate from an untrusted or hostname-mismatched certificate.
The project has zero third-party runtime dependencies, uses Go's standard library for networking and cryptography, includes a dedicated test server for reproducible edge-case demonstrations, and has been verified through unit tests, race detection, static analysis, live Internet testing, and reproducible builds.
In short: BlackBox turns the normally invisible web connection lifecycle into measurable, explainable, machine-readable evidence — from DNS lookup all the way to HTTP response.
PulseLog is a zero-dependency, crash-safe embedded key-value store built entirely with the Go 1.27 standard library. It is designed for CLIs, agents, collectors, and local services that need durable state without requiring SQLite, Redis, database servers, or third-party packages.
PulseLog implements its storage engine from scratch, including a binary Write-Ahead Log (WAL), CRC32 checksums, fsync-based durability, crash recovery from torn writes, an in-memory index for direct reads, segment rotation, timestamp range queries, deletion through tombstones, and crash-safe compaction. On restart, it replays the WAL, detects incomplete or corrupted tail records, removes only the damaged portion, and preserves previously acknowledged data.
The project uses zero third-party runtime dependencies, builds into a single binary, includes automated crash/concurrency tests, and supports reproducible builds.
RATchet is a zero-dependency, Git-inspired local time machine for developers. It provides snapshots, version history, intelligent change tracking, and safe restore/undo using only Python’s standard library.
Fence is a zero-dependency Rust policy engine for controlling filesystem, process, and network access through simple `allow`, `ask`, and `deny` rules. Its standout feature is the application-controlled approval flow: when a policy says `ask`, the developer decides how that request is approved, whether through a terminal, UI, remote service, or custom handler. The project includes a custom `.fence` policy format, path matching, process scopes, network rules, and a complete runnable playground.
DataShield is a command-line data quality tool that detects and repairs messy CSV, JSON, and JSONC files, and supports CSV-to-JSON, JSON-to-CSV, and CSV-to-SQLite conversion with data versioning and comparison.
repotool is a git repository intelligence CLI built entirely on Node.js's standard library, with zero third-party runtime dependencies. It graphs commit and merge history, scores repository health across four transparent dimensions, ranks file hotspots, answers deterministic questions about the repo, and diffs commits using a from-scratch Myers diff implementation — all verified with a self-testing dependency proof.
Papyrus is a zero-dependency static site generator and live-development server built entirely from scratch in pure Python, using only standard library modules. Modern static site generators rely on heavy external dependency trees for templating, markdown parsing, live-reloading, and syntax highlighting. Papyrus strips away all third-party packages to demonstrate that a complete, production-ready developer tool can be built entirely from first principles. Key Technical Features:GFM Markdown Parser: Full GitHub Flavored Markdown rendering built using Python's re module. Jinja2-Compatible Template Engine: Custom-built template renderer supporting layout inheritance, loops, conditionals, and 30+ filters. RFC 6455 WebSocket Live Server: Real-time browser reloading engineered directly on socket, hashlib, base64, and struct. Native File Watcher & Search Indexing: Content change detection via os.stat polling paired with an automated client-side search indexer. Syntax Highlighting & RSS Feeds: Built-in regex syntax highlighter for 9 programming languages and automated RSS 2.0 XML generation. Reproducible Builds: Support for --deterministic compilation to produce byte-identical SHA-256 outputs on every run.
Mini HTTP Server is a zero-dependency HTTP web server written in Go for Track C ("Web & Network") of a Zero Dependency Hackathon — built entirely on Go's standard library (net/http, os, path/filepath, crypto/subtle, etc.), with no third-party packages at all.
netwhy is a zero-third-party-dependency Go CLI for diagnosing endpoint connectivity. It checks DNS, TCP, TLS, and HTTP separately, then can repeat the connection through controlled path changes such as proxy bypass, IPv4-only, IPv6-only, or an alternate DNS resolver.
DepZero is an offline-first Python dependency intelligence tool built entirely with Python's standard library.
It statically analyzes Python projects using AST analysis to identify third-party dependencies, compare them against declared dependency manifests, detect unused or undeclared dependencies, and identify realistic opportunities to migrate specific functionality to Python's standard library.
DepZero provides an interactive local web dashboard with dependency evidence, confidence levels, migration recommendations, and a heuristic DepZero Score showing the project's current and potential dependency surface.
The project is designed specifically around the Zero Dependency challenge: it requires no third-party runtime packages, performs analysis without executing scanned project code, works offline, and includes self-checking, reproducibility verification, and a Package Killer demonstration showing how common HTTP functionality can be implemented using standard-library primitives.
The core idea is simple: build a tool that helps developers understand and reduce dependencies — while using zero dependencies itself.
GAUNTLET is a high-density temporal telemetry engine, live web observability crawler, and statistical analytics core built 100% from first principles with zero runtime dependencies. It features a custom crash-proof binary WAL with CRC-32 checksums, an AST-powered DSL query engine, Bloom filter pruning, and explainable Z-Score and Pearson correlation anomaly diagnostics.
LogStore-Lite PRO is a zero-dependency, append-only key-value store built for Track D - Zero Dependencies.
Built with ONLY Node.js 24.19 LTS stdlib: fs, path, crypto, readline. Verified with npm ls --all = (empty).
Core Features:
- Append-only checksummed log with SHA256 per record, corrupt lines discarded on startup replay
- In-memory Map index rebuilt via log replay
- TTL support (EX seconds) with lazy expiry on GET/DEL/EXPIRE + background sweep in REPL
- Atomic COMPACT via temp file + fs.renameSync
- Exclusive file locking via fs.openSync 'wx' with 10s stale-lock heuristic
- Safe encoding for | and spaces via encodeURIComponent
Tests: 6/6 pass (persistence, DEL, TTL expiry, checksum rejection, COMPACT, concurrent writers) - npm test
Commands: SET, GET, DEL, KEYS, EXPIRE, COMPACT, STATS
Build: make build (node --check cli.js)
LeakShield is a local, zero-dependency Python security auditor that scans repositories for accidentally exposed secrets and risky code patterns, and can block unsafe Git commits before they leave the developer’s machine.
FlareWatch is a zero-dependency, high-throughput SIEM that ingests network logs, detects threats in real time using a hand-built Aho-Corasick engine, correlates events into attack patterns, and visualizes everything on a live dashboard.
CleanDesk is a safety-first command-line file organization and analysis tool built entirely with Python's standard library. It helps users understand messy folders by analyzing file types and sizes, detecting duplicate files using SHA-256 hashing, finding large files, and searching filenames recursively. Users can preview an organization plan before making changes, automatically organize files into categories, generate JSON reports, and undo the most recent organization. CleanDesk never automatically deletes files or overwrites existing files, and all 59 automated tests are passing. The project demonstrates zero-dependency development using Python's standard library.
A local first and extremely lightweight webhook event inspector and debugger with features like port forwarding and replaying curl to any service running locally
Warden is a military-grade, 100% zero-dependency file integrity monitor and cryptographically verifiable audit log. Designed specifically for Track E (Security & Crypto Utilities), Warden was engineered from the ground up using exclusively the Go standard library—proving that robust, modern cybersecurity tooling does not require a bloated dependency tree.
Unlike rudimentary hashing scripts, Warden actively defends against sophisticated persistent threats by fingerprinting file boundaries (SHA-256), byte sizes, and permission bits. This allows it to instantly detect subtle, non-content modifications—such as a malicious chmod +s privilege escalation—that standard hash-checkers completely miss.
Every scan operation appends to a tamper-evident, hash-chained audit log (utilizing the same cryptographic construction as Git commits and Certificate Transparency logs). If an attacker attempts to edit, delete, or reorder a past entry to cover their tracks, the cryptographic chain is immediately severed, and warden verify will mathematically expose exactly where the breach occurred.
To further secure the chain against total log replacement, Warden implements two optional layers of advanced defense:
Post-Quantum Dual-Signing: Using Go 1.27's native crypto/mldsa, Warden optionally dual-signs every log entry with both classical Ed25519 and ML-DSA65 (FIPS 204) signatures. This achieves true post-quantum resistance natively, without vendoring a single external lattice cryptography library (no liboqs or cloudflare/circl).
Remote Anchoring: Warden features a built-in authenticated HTTP server (anchor-serve). It acts as a remote timestamping authority, cross-checking the integrity of the local chain against off-site cryptographic receipts, making local log wipes mathematically impossible to hide.
The Zero Dependency Guarantee: • Zero Third-Party Code: No NPM packages, no Cargo crates, and our go.mod has exactly zero external requires. • Frictionless Verification: We ship a 1-click Docker Alpine container and a GitHub Codespaces environment for immediate, browser-based evaluation. • Seamless Presentation: Our interactive landing page features a native, text-selectable terminal player, built using vanilla web technologies without any heavy frontend frameworks.
Warden isn't just a hackathon concept—it is a production-ready, highly defensive binary built with absolute zero-dependency purity.
KV-store: A zero-dependency, multi-model key-value database
by Git Smashers
@garishjuneja_317
@parvkumar3950
KV-store is a high-concurrency, multi-model database engineered natively on Java 25 that strictly adheres to a zero-dependency architecture without relying on external libraries, frameworks, or JSON parsers. Leveraging native Java Virtual Threads and a custom Write-Ahead Log (WAL) mechanism, the system ensures non-blocking client request management and atomic data persistence across restarts. It natively supports complex data structures, including Lists and Sets, while handling autonomous memory allocation and duplicate rejection. Operating against a unified memory space, KV-store simultaneously executes stateful, authenticated TCP connections and a custom HTTP router. This architecture is complemented by a fully embedded web management dashboard served directly from memory, demonstrating robust thread safety and fundamental systems engineering.
TOTP Vault is a zero-dependency RFC 6238 two-factor authentication (TOTP) CLI and encrypted credential vault built strictly using Node.js native standard libraries.
Key Highlights:
* Zero External Dependencies: Built with zero npm packages (dependencies: {}), eliminating supply-chain risks for critical security tools.
* Military-Grade Vault Security: Encrypted at rest using AES-256-GCM and protected by PBKDF2 (100,000 SHA-512 iterations), with in-memory key buffer sanitization.
* Full RFC Compliance: Custom-built Base32 decoder, RFC 6238 HMAC-SHA1/256/512 engine, and timing-safe verification.
* Single-Line Live HUD: Real-time, in-place refreshing countdown with dynamic ANSI color transitions without terminal spam.
* 100% Native Test Suite: 77 comprehensive tests verified directly through Node's built-in test runner (node --test).
MarkForge is a high-performance, hand-written, zero-dependency Markdown-to-HTML compiler built entirely using Python's standard library for Track B (Parsers & Data Formats).
Key Features & Engineering Highlights:
- Single-File Architecture: Entire compiler, intermediate AST node definitions, renderer, error diagnostics, and CLI live in a single `markforge.py` script.
- Core Markdown Support: Headings (1-6), paragraphs, fenced code blocks (with language tags and tilde support), ordered/unordered nested lists, blockquotes, horizontal rules, autolinks, and inline formatting (bold, italic, code spans, links, images).
- Built-in Security: Sanitizes XSS attempts via `urllib.parse` scheme validation (blocking javascript:, vbscript:, and data: schemes) and HTML entity escaping via `html.escape`.
- Line-Aware Error Diagnostics: Throws positional location errors (line and column) for malformed inputs such as unterminated code fences.
- Zero External Dependencies: Eliminates heavy third-party packages (markdown, mistune, click, bleach, pydantic) by utilizing native modules (`argparse`, `dataclasses`, `pathlib`, `html`, `urllib.parse`, `unittest`).
ZeroTask is a zero-dependency Node.js task runner — a stricter, dependency-graph-aware alternative to concurrently. It orchestrates multi-process dev workflows with real task ordering (downstream tasks skip automatically on upstream failure), exponential backoff retries on crash, and timeout escalation from SIGTERM to SIGKILL — all built using only Node's standard library, with a fully reproducible build.
LedgerKV is an embedded, crash-safe, ordered Key-Value store built from scratch on a Log-Structured Merge (LSM) tree architecture using only the Go Standard Library (Track D). It replaces heavy third-party storage engines by implementing a custom Write-Ahead Log (WAL) for durability, a concurrent SkipList MemTable, and sparse-indexed immutable SSTables on disk. Features include point lookups, ordered range scans, size-tiered background compaction, and guaranteed crash recovery without a single external dependency. We also successfully completed the Single File and Reproducible Build bonus challenges.
LANShare is a zero-dependency, multi-client LAN file sharing server built entirely with Python's standard library — no Flask, no Requests, no third-party frameworks.
The problem: sharing files between devices on the same Wi-Fi/LAN usually requires cloud storage, USB drives, or messaging apps, all of which are unnecessary when devices are already on the same network. LANShare solves this with a single command that starts a local HTTP server, exposing a browser-based UI that any device on the LAN can access — no app install, no account, no internet required.
Key features:
- Multi-client concurrent file transfers using ThreadingHTTPServer (thread-per-connection)
- Drag-and-drop upload with live progress tracking
- Download, list, and delete files from a shared directory
- Path-traversal protection — all file access is sandboxed to the shared directory
- Optional SHA-256 checksum verification for file integrity
- Structured logging and JSON error handling for every request
Built entirely with Python stdlib: http.server, socket, threading, hashlib, mimetypes, argparse, and a hand-rolled multipart/form-data parser — no pip-installed runtime packages. Verified with a 21-test unittest suite and confirmed working in a completely clean virtual environment (see DEPENDENCY_PROOF.md and STDLIB.md in the repo for full substitution details).
Frontend is HTML/CSS/JS served directly by the Python server — fully responsive across desktop and mobile.
VersionedStore is an append-only key-value store where every write creates a new version instead of overwriting the last one — essentially "Git for a single key-value pair." It supports time-travel reads (get --at <timestamp>), full version history, line-level diffs between any two versions, and rollback (which itself creates a new version rather than rewriting history).
Under the hood, writes are encoded as length-prefixed, checksummed frames and appended to a log file with an fsync on every write; an in-memory index maps each key to its list of (version_id, timestamp, offset) entries for fast lookups. On startup the store replays the log to rebuild the index, and if the last record was torn by a crash mid-write, it truncates back to the last valid record so future writes land cleanly — verified by an automated crash-recovery test. Reads and writes share a single RWMutex so concurrent access is always safe.
Built entirely with the Go standard library — zero external dependencies, empty go.mod require block — including a from-scratch UUID generator and a from-scratch LCS-based diff implementation (no third-party diff library). It also builds reproducibly: two separate builds with -trimpath hash identically.
vcrproxy — a zero-dependency HTTP record/replay proxy (like `nock`/`vcrpy`) built entirely on Python's stdlib (`http.server`, `http.client`, `socketserver`, `hashlib`, `json`). Record real API traffic once, replay it forever offline with no network calls, or run `diff` mode to catch when the live API has drifted from your cassette — a feature the mocking-library incumbents don't have.
The hard problem: real requests are never byte-identical (timestamps, request IDs, nonces, random multipart boundaries), so matching requires normalizing volatile fields — including catching values that *look* like timestamps/UUIDs even when the JSON key name gives no hint (e.g. `capturedAt`).
Honest scope limit: HTTPS is tunneled, not decrypted/recorded (avoiding a disguised crypto dependency). Backed by a static-import dependency proof, 17 stdlib-only tests, and a reproducible build via `zipapp`.
Track C, bonuses: reproducible-build + stdlib-log.
CommitGuard is a zero-dependency Git security scanner that detects accidentally committed secrets such as API keys, access tokens, passwords, private keys, and credentials in both current files and Git history. It uses only the language standard library and Git, with no third-party runtime dependencies or external security APIs. CommitGuard provides risk-based findings and helps developers identify secrets that may remain exposed in previous commits even after being deleted from the latest version.
NetScope is a unified network diagnostics platform that analyzes failures across DNS, TCP, TLS, and HTTP to identify where a connection breaks and why.
Built without third-party runtime dependencies, it transforms complex, multi-tool troubleshooting into a structured, visual root-cause analysis workflow.
RepoDoctor is a zero-dependency, offline repository health and diagnostics CLI built entirely with Node.js standard-library APIs. It scans a repository, detects common structural, configuration, dependency, and Git-related issues, and turns those findings into clear diagnoses with actionable recommendations. It provides readable terminal output as well as machine-readable JSON, making it useful for both developers and automation workflows. RepoDoctor is designed to be fast, local, transparent, and easy to run without installing third-party packages.
FloraFind is a zero-dependency local search engine that helps users find files based on what they remember about the content, rather than the filename or folder location. It scans supported files, extracts their text, builds a searchable index, and uses relevance ranking to return the most useful results.
Users can search naturally using keywords such as “deadlock prevention” or “Python recursion” and instantly get relevant files along with contextual snippets, highlighted matches, and relevance scores.
FloraFind is designed to be fast, lightweight, private, and completely local, with no need to upload personal files to the cloud. It turns a computer's scattered files into a single searchable knowledge space.
FloraFind — Search by what you remember,Find what you need.
Deterministic Release Packager is a zero-dependency Python CLI tool that creates byte-for-byte reproducible release archives. It packages a project directory into a deterministic TAR/Zstandard archive by normalizing file ordering, timestamps, ownership metadata, and paths. It also generates a SHA-256 manifest and supports automatic double-build verification to prove that the same source produces exactly the same release artifact across builds and machines. The project is built entirely with the Python 3.14 standard library, making it lightweight, portable, and suitable for CI/CD and software supply-chain verification.
TOTP Zero-Dep is a zero-dependency Python implementation of TOTP and HOTP for two-factor authentication. It implements RFC 4226 and RFC 6238 using only Python's standard library, with no third-party runtime dependencies. It provides a CLI for generating secrets, generating and verifying OTP codes, supporting SHA-1/SHA-256/SHA-512, and building/parsing otpauth:// provisioning URIs. The implementation is validated against all 18 official RFC 6238 test vectors and an RFC 4226 HOTP test suite.
Watchr is a zero-dependency file watcher and command runner — it automatically re-runs your tests, servers, or build commands whenever a file changes, the same job as nodemon or watchdog, but built entirely with Python's standard library. It's a single-file tool with 15 passing unit tests, a custom AST-based audit confirming zero third-party imports, and a STDLIB.md documenting 10+ real package substitutions.
ZeroTrust is a supply-chain security scanner built for Track E (Security & Crypto Utilities) — with an empty dependency manifest of its own. It exists because AI coding assistants hallucinate package names that don't exist nearly 20% of the time, and attackers now pre-register those exact names and wait — the same category of failure behind the September 2025 chalk/debug npm account takeover and the Shai-Hulud worm that followed days later.
ZeroTrust runs five independent, offline-first detectors against any project manifest (package.json, requirements.txt, go.mod, Cargo.toml) and source tree:
Phantom package detection — flags AI-hallucinated or non-existent dependencies via a hand-rolled Bloom filter and prefix Trie checked against a curated, individually-verified corpus, with optional live registry confirmation
Typosquat detection — a hand-rolled Levenshtein edit-distance matrix catches near-misses like reqeusts for requests
Lifecycle install-hook extraction — parses preinstall/postinstall/prepare scripts and setup.py build hooks, printing the literal command — the exact mechanism Shai-Hulud used to self-replicate
Shannon entropy scanning — sliding-window analysis surfaces obfuscated, base64-style payloads hidden in source
Dynamic-execution detection — a lexical tokenizer flags eval(), child_process.exec(), os.system(), and similar calls across JS/TS/Python source, with file:line precision
Every algorithm that would normally come from a package — TOML parsing, edit-distance, the Bloom filter, a rate limiter, SARIF 2.1.0 output — is hand-rolled from Go's standard library, fully documented in STDLIB.md with the specific package each substitution replaces and why. The tool ships zero third-party runtime dependencies (verified with go list -m all), builds reproducibly to a byte-identical SHA-256 across independent builds, runs race-free under concurrent worker pools (verified on GitHub Actions' own Linux runners), and outputs JSON/SARIF for real CI integration with severity-gated exit codes.
28 Go files, 2,489 lines, 15 tests, zero packages — built to catch exactly the attacks that made an empty manifest necessary.
FlowBalance is a high-performance, zero-dependency Node.js reverse proxy and load balancer. It features built-in rate limiting, circuit breaking, and a real-time "cyberpunk-style" observability dashboard for monitoring traffic and routing requests across multiple backend servers efficiently.
YUKI is a zero-dependency terminal text editor built entirely with Python's standard library. It offers a full-featured editing experience: syntax highlighting for 17 languages, 15 color themes, auto-close brackets, smart indentation, undo/redo, clipboard support, and large-file handling via memory-mapped reads. Key features include a file explorer, Git integration panel, quick-open fuzzy file search, a welcome dashboard, image viewer, and an extension/plugin system. It ships with two autocomplete modes: a local keyword/identifier popup triggered while typing (navigable via scroll wheel or Ctrl+arrows) and an optional Codeium AI inline ghost-text integration. Zero external dependencies required.
PicoDB is an embedded crash-safe key-value store built in pure Go stdlib. It uses a CRC32-protected append-only WAL with automatic torn-tail recovery, kernel flock locking on the DB file, and deterministic fsync batching — all with zero dependencies and zero background goroutines.
ChronoReplay is a zero-dependency event-sourcing and recovery engine that records application events, reconstructs past states, supports rewind and restore without deleting history, detects invalid transactions, and recovers previous versions of workspace files through a simple desktop GUI.
Cypherhand started out as this idea that you could take a file like a document or photo and lock it using just a password. You feed it the file and the password and it turns the whole thing into what looks like random static. Put the same password in later and it gives the original file right back.
It also checks if anything got changed in that locked version even by a single byte. If it spots that it just stops and says something went wrong instead of handing over messed up data.
There is this shred feature that wipes the original unprotected file once the locked version is made so you do not end up with both copies sitting around.
The zero dependency part is the part they kept stressing. Most tools like this pull in outside libraries for the actual encryption work which means the program breaks if those libraries are missing or the wrong version. This one avoids all of that and sticks only to what Python already has built in. That way it runs on a computer with nothing else installed at all.
They showed it by setting up a clean empty Python setup with zero extra stuff and running the whole process inside it. Encryption and decryption both worked without any issues.
They also wrote the encryption steps themselves from the published standards and checked the results against the official test cases to make sure it matched. It feels like that extra step was important to them though I am not totally sure how much it changes things in practice.
CyberShield is an explainable phishing and scam risk analyzer that helps users detect suspicious messages and URLs and understand why they may be risky. It analyzes manipulation signals such as urgency, threats, credential requests, financial requests, impersonation, suspicious instructions, and unrealistic rewards. URLs are analyzed structurally without visiting the destination. The detected indicators are combined into a deterministic risk score and threat category, followed by simple and technical explanations and recommended actions. CyberShield is built with zero third-party runtime dependencies, using Python’s standard library and native browser technologies.
kvlite is a persistent, crash-safe key-value store built entirely on Java's standard library — no frameworks, no third-party packages, nothing to declare in a dependency manifest.
It's a log-structured merge-tree (LSM-tree): writes go to a checksummed write-ahead log and an in-memory sorted table, both periodically flush to immutable sorted files on disk, and a background compactor merges those files to reclaim space. A hand-rolled bloom filter (built on `java.util.BitSet`) skips files that can't contain a key, replacing Guava's BloomFilter — our Package Killer candidate.
Every core claim is proven, not just asserted: 21 tests pass, including a multi-threaded concurrent reader/writer stress test and a real crash-recovery test that abruptly kills the JVM (`Runtime.halt`) and confirms data survives on restart. The build is also independently reproducible — two clean builds produce a byte-identical hash. Benchmarked at ~7,500 writes/sec with full fsync-per-write durability, honestly reported alongside the known optimization (group-commit batching) we didn't have time to add.
NetSentinel is a zero-dependency, explainable network security analyzer that establishes a persistent service baseline, detects meaningful exposure changes, evaluates risk, stores security evidence locally, and exposes the analysis through both a CLI and native web security console.
Repo Doctor is a lightweight repository health, security, and risk analyzer built entirely with Java’s standard library.
It scans a software repository and quickly provides actionable insight into its structure, code metrics, TODO/FIXME hotspots, large files, security-sensitive patterns, Git activity, file-level risk, and overall health score. Results can be viewed through the terminal, exported as machine-readable JSON, or generated as a self-contained HTML report.
A key focus of Repo Doctor is trust and reproducibility. The project uses zero third-party Java dependencies and includes an automated dependency-proof workflow, SHA-256 verification, and reproducible-build checks that perform two clean builds and compare the resulting artifacts byte-for-byte.
Repo Doctor is designed to help developers and judges understand an unfamiliar codebase quickly while also providing verifiable evidence about how the software was built
MIRROR is a zero-dependency runtime behavioral intelligence tool that reveals what a Python application actually interacts with during execution. It instruments the target process using Python’s standard-library audit hooks, records trustworthy, provenance-aware runtime evidence, and builds a deterministic behavioral fingerprint of the execution.
MIRROR can then compare two independent runs semantically, identify the earliest observed behavioral divergence, and show subsequent observed differences. Instead of relying on a raw trace hash, it accounts for volatile runtime metadata, process identity, and bounded concurrency reordering.
The system also converts observed events into an evidence-backed runtime dependency graph, connecting applications and processes to project files, environment variables, network endpoints, and other observed resources. Every relationship can be traced back to the exact supporting event through the Evidence Inspector.
A core design principle is “never fabricate observation.” MIRROR explicitly distinguishes what it can prove from what it cannot observe, exposing unsupported capabilities such as packet payloads, HTTP semantics, and syscall-level filesystem activity.
The complete system runs with zero third-party runtime dependencies, includes a standalone single-file artifact, deterministic/reproducible builds, and a local developer dashboard for visual analysis.
Project Name: TraceSieve — Runtime Reality Auditor
Description: Developers often know what source code contains, but not necessarily what a particular execution actually did. TraceSieve is a lightweight, local-first, zero-dependency CLI tool built with 100% Python Standard Library that turns program execution into an explainable evidence trail.
Unlike traditional profilers or line-coverage tools, TraceSieve records structural execution metadata to answer critical runtime questions: • Why did code run? (tracesieve why): Displays the exact call-stack path, event sequence number, and call counts leading to any function call. • What changed between runs? (tracesieve diff): Compares behavioral deltas between scenarios (e.g. login vs checkout) to highlight new or removed execution branches. • What was left untested? (tracesieve gaps): Maps static AST structure against actual runtime reality to expose unobserved code paths.
Built entirely with Python stdlib (sys.settrace, ast, sqlite3, zipapp) with 0 third-party pip dependencies, TraceSieve guarantees zero secret capture and local-first privacy.
VortexDB is a high-performance in-memory and time-series database engine wire-compatible with Redis (RESP2/RESP3), featuring dual-layer durability (binary WAL + atomic RDB snapshots) and an embedded real-time web telemetry studio — built from scratch with 100% Python Standard Library and zero third-party dependencies.
PyXRay is a powerful, zero-dependency Python tool designed to investigate, audit, and analyze project dependency graphs.
At its core, it replaces heavy third-party auditing tools (like pipdeptree, networkx, and click) with a blazing-fast, highly modular CLI built entirely on the Python Standard Library.
It provides 20 specialized commands to help developers regain control over their environments, allowing you to:
Investigate: Instantly answer why a package is installed, trace the longest dependency chains, and detect circular dependencies or duplicate versions.
Audit: Use AST-powered source code scanning to cross-reference actual code imports against declared dependencies to find unused or undeclared packages.
Secure & Maintain: Query the OSV.dev API for known CVE vulnerabilities, check for outdated packages on PyPI, and generate complete license inventories.
It works instantly out of the box with zero installation overhead, scanning either your active virtual environment or directly parsing lock files (uv.lock, poetry.lock) offline.
ZeroForge — Short Project Description
ZeroForge is a dependency-aware task management engine built entirely with Python’s standard library for the Zero Dependency 2026 Hackathon.
Unlike a traditional todo list, ZeroForge understands task dependencies, identifies ready and blocked tasks, and helps users determine what they can work on next.
It provides CLI, Interactive REPL, and Guided Wizard interfaces with local SQLite persistence, health checks, validation, and testing.
Zero third-party runtime dependencies. Real software, built from first principles.
SwiftSearch is a zero-dependency, embeddable local search engine built entirely from scratch using the Python 3.14 standard library. It features a custom inverted index, a REST API, and a keyboard-first web UI, serving as a lightweight alternative to heavy external dependencies like Elasticsearch or Whoosh.
Full Project Description (Best for the Tally submission form or GitHub README):
Search is a feature almost every application needs, but small and medium projects shouldn't have to deploy an entire cloud infrastructure just to get it. SwiftSearch is a lightweight, local search engine built for the Zero Dependency Hackathon (Track F: Open / Wildcard).
Built purely on the Python 3.14 standard library with an empty requirements.txt, the core engine features:
Custom Inverted Index: Built from scratch using collections and dataclasses to handle text normalization, term frequencies, and transparent result ranking.
REST API Layer: A local endpoint built with http.server to serve search results as fast JSON payloads.
Developer CLI: Built-in command-line tools using argparse to instantly index directories and search local files.
Keyboard-First Web UI: A snappy, command-palette style HTML/CSS/JS frontend featuring / shortcut activation and arrow-key navigation.
By relying strictly on standard library modules, SwiftSearch proves that a highly functional, low-latency search tool can be shipped without relying on a massive third-party ecosystem.
pygit is a from-scratch, Git-like version control system implemented entirely in a single Python file using only the Python standard library. It provides 30 commands covering content-addressed object storage, staging, commits, branching, merging, rebasing, cherry-picking, stashing, tags, reflog, blame, garbage collection, and remote synchronization through a custom client/server protocol.
The project demonstrates how a practical developer tool can be built without Git itself, third-party packages, or external runtime dependencies. It contains 3,390+ lines of implementation and 141 tests, with reproducible source verification through SHA-256. Its standard-library substitutions and dependency decisions are documented and verified in `STDLIB.md`.
MiniDB is a crash-safe, zero-dependency relational database engine built from scratch using Python’s standard library. It implements core database functionalities including persistent binary storage, SQL parsing and execution, in-memory indexing, transactions, Write-Ahead Logging (WAL), crash recovery, and client-server communication. The project demonstrates how a database works internally without relying on third-party packages or SQLite for storage.
ZeroPack is a hyper-optimized JavaScript bundler and development environment built completely from scratch without a single npm install. Designed to eliminate dependency bloat, reduce CI/CD times, and prevent supply-chain vulnerabilities, it proves that powerful developer tooling doesn't require a massive third-party ecosystem.
Core Architecture & Features
Zero-Dependency Parser: A custom AST parser built purely on native Node APIs that seamlessly handles ESM, CommonJS, and strict circular dependencies.
Bespoke Runtime Engine: Packages code into an optimized bundle with strict scoping, avoiding global namespace pollution without relying on external transpilers.
Native Dev Server: Features lightning-fast Hot Module Replacement (HMR) powered by raw HTTP and native WebSocket implementations.
Deterministic Output: Generates perfectly deterministic, byte-identical builds to ensure complete reliability across different environments.
Standalone Execution: Compiles into a fully self-hosted, executable binary (zeropack.js) for zero-friction deployment.
# LFS — Local File Search Engine
Have you ever known exactly what you were looking for but completely forgotten the file's name? You may remember writing something about “TCP congestion,” “machine learning,” or “database normalization,” but finding the actual document can take a long time.
That is the problem LFS, or Local File Search Engine, is designed to solve.
LFS allows users to search for information based on the content inside their files instead of relying only on filenames. The user simply indexes a folder, and the application scans the supported files, reads their contents, and creates a searchable local index. After that, users can search using the words or topics they remember.
For example, instead of trying to remember whether a networking document was called `notes.txt` or `lecture5.md`, a user can simply search for “TCP congestion slow start.” LFS then finds and ranks the files most relevant to that search.
The project also includes useful features such as file-type filtering, folder filtering, highlighted search terms, exact phrase ranking, and Boolean search using `AND`, `OR`, and `NOT`. It can also identify similar documents and supports incremental indexing, meaning unchanged files do not need to be processed unnecessarily.
All search data is stored locally using SQLite, so the application works offline and keeps the user's files private. Another important aspect of LFS is that it uses only Python's standard library, requiring no external runtime dependencies.
LFS is especially useful for students, developers, researchers, and anyone with a large collection of files. Its main idea is simple: **instead of remembering what you named a file, search for what you remember writing inside it.**
DevSearch is a local code-search tool built entirely with Python's standard library. It allows developers to index a project and perform fast, ranked searches across its source files, with support for AND/OR queries, exact phrase search, JSON output, and saving large result sets to a file.
The project uses Python's built-in SQLite database for persistent indexing, regular expressions for tokenization and query parsing, hashlib for file hashing, and standard Python logic for matching and ranking. The final runtime has been consolidated into a single Python file, with an automated test suite and a reproducible zipapp build.
DevSearch was designed specifically for the Zero Dependency challenge to demonstrate that a useful developer tool can be built from first principles without third-party runtime dependencies.
Cryptographic Log Sentinel is a lightweight log integrity and tamper-detection tool built with zero third-party dependencies using pure Python standard library.
It prevents attackers or rogue processes from quietly modifying system logs. Every log entry is written into an append-only cryptographic ledger using SHA-256 hash chaining and Merkle trees. If an entry is modified, deleted, or inserted out of order, the sentinel pinpoints the exact line and timestamp where the chain broke.
What it does:
Cryptographic Hash Chaining: Sequentially links log entries with SHA-256 and HMAC key ratcheting so past records cannot be rewritten.
Merkle Tree Proofs: Builds root hashes to verify log inclusion without needing to re-scan massive log files.
Live File Monitoring: Watches active log files and triggers instant terminal alerts upon detecting in-place byte edits or truncation.
Built-in Web Dashboard: Serves a live audit UI and REST API (/api/verify, /api/logs, /api/stats) using Python's built-in http.server on port 8080—no Flask, FastAPI, or npm packages required.
Zero-Dependency Design:
Built entirely with standard library modules (hashlib, hmac, http.server, argparse, unittest, os).
Runs from a single executable file (sentinel.py) with an empty requirements.txt.
Includes a full standard-library test suite and reproducible build verification.
**CodeSherlock** is a zero-dependency codebase intelligence CLI built entirely with the C++17 Standard Library. It helps developers quickly understand a codebase by analyzing project structure, programming languages, code/comment statistics, technical-debt markers (TODO, FIXME, HACK, BUG, XXX), potential secrets, dependency manifests, duplicate files, and overall code health.
CodeSherlock generates clear Terminal, JSON, and standalone offline HTML reports while keeping all analysis local and read-only. It uses no third-party libraries or frameworks, demonstrating how powerful developer tooling can be built from first principles using only the standard library.
Git Janitor is a lightweight CLI tool for maintaining Git hygiene that has no external dependencies and is written entirely in Rust, it automatically carries out the safe removal of local branches and prevents credentials from leaking into Git history. It gets rid of unnecessary clutter in repositories by detecting merged local branches, enforces the rules associated with protected branches, and stops the accidental loss of unpushed commits by using dry-run as its default setting. Furthermore, it checks the staged diffs and commits for any exposed API keys, private key headers, and high-entropy secrets and incorporates directly into automated pre-commit hooks without needing any third-party runtime crates. Since it is based solely on the Rust standard library, it is provided as a single, auditable binary that is designed to fit easily into everyday developer work processes.
DepZero is a zero-runtime-dependency CLI tool for detecting and managing dependency drift in Node.js projects. It analyzes a project's package.json and source-code imports to identify used, unused, and undeclared dependencies. It also provides dependency explanations, file-level dependency graphs, project statistics, health scoring, and removal-impact analysis. A CI-friendly guard command can enforce dependency hygiene using pass/fail exit codes, while JSON output makes the results easy to integrate with scripts, CI pipelines, and other developer tools.
DepZero is built using Node.js standard library APIs and currently has zero runtime dependencies, with automated tests covering its core analysis and regression cases.
ZeroDB is a lightweight embedded key-value database built from scratch using only the Java 21 Standard Library, with zero third-party runtime dependencies. It provides persistent file-based storage, fast in-memory indexing, CRUD operations, Write-Ahead Logging (WAL) for crash recovery, CRC32-based data integrity, and thread-safe concurrent access. ZeroDB demonstrates how fundamental database functionality can be implemented from first principles without external databases, frameworks, or libraries.
Micro-Redis-Vault is a Redis-compatible in-memory database that treats every stored value as a cryptographically protected secret — built entirely from Python's standard library, with zero third-party runtime dependencies.
Standard Redis keeps session tokens, API keys, and user data in plaintext memory and unencrypted disk backups — a gap exploited by real-world attacks like the 2013 Target breach, where malware scraped card numbers straight out of RAM. Micro-Redis-Vault closes that gap: every secret is encrypted in memory and on disk using PBKDF2 key derivation and an authenticated HMAC-based keystream cipher, with automatic brute-force IP jailing and a tamper-evident, hash-chained audit log recording every operation.
The entire system — networking, encryption, rate-limiting, persistence, and a built-in web console — runs from a single Python file with a 0-byte requirements.txt, replacing 11 industry-standard packages with nothing but the standard library.
Track D & E - Data & Storage, Security & Crypto Utilities.
Bug Archaeologist — Turning Git History into Evidence
by LUFFY
@lohithrajr
@navanish_14
Bug Archaeologist is a developer tool that helps engineers investigate software regressions by turning Git history into evidence. It analyzes a suspicious file and line, ranks historical commits using deterministic heuristics, reconstructs the before/after code flow, highlights relevant diffs, and identifies missing regression-test coverage. It runs fully offline with zero third-party runtime dependencies and is distributed as a single Python source file with reproducible builds.
NoDep is a full-featured HTTP web framework built entirely on the Node.js standard library — no Express, no Fastify, zero runtime npm dependencies. It implements routing with dynamic path parameters, a composable middleware pipeline, JSON & URL-encoded body parsing, static file serving with MIME detection, cookie parsing, and HMAC-signed session management using only node:http, node:fs, node:crypto, and node:path. A working Todo application is included as a demo, proving the framework is capable of powering a real, server-rendered web app.
Ghost-Pipe is an ultra-lightweight, zero-dependency terminal forensics and automated repair engine. Delivered as a single Python monolith, it acts as a black-box flight recorder for your terminal. When a command fails, Ghost-Pipe instantly kicks in to analyze the exit code, diagnose the root cause (using a hybrid deterministic and local AI engine via Ollama), and propose a fix inside a securely isolated Git worktree before ever touching your host system.
Built entirely on POSIX primitives and the Python standard library, Ghost-Pipe degrades gracefully across environments. Technical highlights include: Genuine PTY forking for ANSI preservation, zero-dependency urllib NDJSON streaming, and a regex-based Context Firewall that redacts AWS/JWT secrets before the AI sees them. Fully compliant with Track A (Developer Tools & CLI) and qualifies for the Single File, Package Killer, and STDLIB Log bonus points.
Zero-dependency HTTP/1.1 client built on raw socket + ssl.
No requests, no urllib.request, no http.client.
Every byte of the request is assembled by hand. Every byte of the response is parsed by hand.
Markdown to HTML Converter is a lightweight, dependency-free tool that converts Markdown documents into clean, semantic HTML using only Python's standard library. Built for ZeroDepsHack 2026, the project demonstrates how a fully functional Markdown parser can be implemented without any third-party runtime libraries. It supports headings, paragraphs, text formatting, lists, links, images, blockquotes, code blocks, and horizontal rules while producing standards-compliant HTML suitable for documentation and static web pages.
Modern web development is drowning in dependency sprawl. A basic "Hello World" in JavaScript pulls over 1,200 npm packages (>500MB), while C++ web projects rely on bloated third-party libraries like Boost.Asio, OpenSSL, and cpp-httplib. This creates huge attack surfaces, fragile builds, and sluggish runtimes.
We asked: What happens if you build a modern, reactive full-stack web engine with ZERO external libraries?
Meet NovaCPP — an ultra-fast, 100% zero-dependency full-stack web framework and reactive Single Page Application (SPA) engine engineered entirely from raw operating system sockets and standard C++17.
🚀 WHAT NOVACPP DELIVERS: • Handcrafted TCP HTTP/1.1 Server: Direct socket listener supporting multi-threading, dynamic routing, REST APIs, static asset streaming, and CORS without third-party frameworks. • Declarative C++ HTML DSL: Compose reactive UI component trees directly in C++ without JSX preprocessors, Babel, or template engines. • Thread-Safe Reactive State: Mutex-synchronized, session-isolated state signal containers enabling real-time UI updates without race conditions. • Native HTTP Fetch Client: Built-in raw socket client for consuming upstream APIs without libcurl. • In-Memory KV Store & Auth: Fast, thread-safe cache and session management without external database drivers. • Dynamic DOM Reconciliation: A 3KB zero-dependency client script enabling smooth SPA transitions without full page reloads.
⚡ EXTREME PERFORMANCE & FOOTPRINT: • Cold Start: Boots and binds to ports in under 0.8ms (>250x faster than Node/Flask). • Idle Memory: Consumes just ~2.1MB RAM. • Deployment: Compiles into a single standalone ~800KB native binary. Zero node_modules, zero runtime interpreters. • Attack Surface: Zero external packages means zero supply chain vulnerabilities.
🛠️ HOW IT WAS BUILT: Built purely from first principles using native OS APIs (Winsock2 on Windows, POSIX sys/socket.h on Linux/macOS) and pure C++17. Includes a 7-layer automated test suite (path traversal security, concurrency, port bounds, socket stress) and reproducible build verification.
NovaCPP reclaims software sovereignty, proving full-stack web apps can be lightning-fast, secure, and entirely self-contained.
# EnvKit – Zero-Dependency Environment Configuration Toolkit
EnvKit is a lightweight, zero-dependency command-line toolkit designed to simplify and secure environment variable management in Node.js applications.
Modern Node.js projects often rely on multiple external packages for environment configuration, such as loading `.env` files, expanding variable references, and validating required values. This increases dependency trees, adds unnecessary third-party code, and makes projects harder to audit and maintain.
EnvKit combines these essential features into a single tool without requiring external runtime dependencies. It provides `.env` file parsing, variable expansion, configuration validation, safe application execution, and configuration drift detection.
Using the command `envkit check`, developers can validate their environment configuration and immediately identify missing or invalid variables. The command `envkit run -- node app.js` prevents an application from starting when required configuration is incorrect, helping avoid runtime failures caused by missing API keys, database URLs, secrets, or other critical settings.
EnvKit also introduces a configuration drift detection feature through `envkit diff`. It compares `.env` files with project example configurations and identifies missing or extra variables. The `--strict` mode can fail builds when configuration differences are detected, making it useful for Continuous Integration pipelines.
The project also includes an interactive browser playground where users can test the validation logic without installing or cloning the project. Users can experience a simple fail-to-fix workflow directly in the browser.
EnvKit is backed by more than forty automated tests using Node.js's built-in test runner. GitHub Actions automatically runs the test suite on every push, ensuring reliability and continuously verifying the zero-dependency architecture.
Technologies used include Node.js, JavaScript, Node.js Test Runner, GitHub Actions, GitHub Pages, HTML, and CSS.
EnvKit provides a transparent, lightweight, and practical solution for Node.js environment management with one simple goal:
**One tool. Zero dependencies. Reliable configuration.**
ZeroBoard is a lightweight, LAN-based collaborative whiteboard application written entirely in core Java — no external frameworks, no internet dependency. One user hosts a session (spinning up both the server and their own whiteboard window), and any number of other users can join as guests over the same network to draw and chat together in real time.
It's built as a hands-on demonstration of client–server architecture using raw TCP sockets, multithreading with Java virtual threads, and a custom lightweight text protocol — all wrapped in a clean, dark-themed Swing GUI.
RepoXray is a zero-third-party-runtime-dependency CLI that helps developers understand unfamiliar codebases faster. It scans and indexes repositories, provides full-text search and file inspection, resolves local Python and JavaScript/TypeScript relationships, and enables dependency, reverse-dependency, and impact analysis. Built entirely with Python's standard library, RepoXray combines incremental indexing, relationship analysis, edge-case handling, automated testing, and a standalone Python zipapp into a lightweight developer tool that requires no external runtime packages.
SafeShare is a local privacy firewall that detects and classifies sensitive information in text before it leaves your control. It identifies credentials, tokens, secrets, and other high-risk patterns, provides severity-based findings, and enables instant redaction. Built with zero third-party runtime dependencies using the Node.js standard library, SafeShare delivers lightweight, transparent, privacy-focused protection.
The Last Detective is a stdlib-only procedural whodunit for Track F: every python detective.py --seed generates a seeded, validator-checked case (3–6 suspects, 6 rooms, 11 evidence incl. red herring with resolution) with an honest win screen and a BFS solver that plays the real command surface and never reads the hidden truth. Play in the terminal or run --story to export a printable puzzle — zero third-party runtime deps, 73 unittest, deps-proof.txt verified.
RepoX-Ray is a zero-dependency tool that scans repositories for security, dependency, Git, and configuration issues. It connects information across files and Git history, gives a health score, and suggests fixes.
Key Strengths:
Cross-file repository analysis
Git history secret detection
Health score for the whole repository
Clear, actionable fixes
Zero third-party dependencies
47 automated tests passing
ZeroTick is a low-latency, zero-dependency time-series database purpose-built for high-frequency financial data, engineered entirely using the native Rust standard library to completely eliminate supply-chain bloat. To achieve extreme performance without relying on external async runtimes or serialization crates, it ingests massive volumes of market order flow over raw TCP sockets and packs the data into an append-only WORM (Write-Once-Read-Many) storage architecture using Gorilla-style bit-level compression—specifically delta-of-delta encoding for timestamps and XOR-delta for prices. The engine guarantees absolute data durability through self-describing frame headers and automated torn-write recovery, while a lock-free memory index ensures that continuous active writing never blocks concurrent readers. Operating on top of this storage layer is a custom TCP/HTTP multiplexer that bypasses traditional web frameworks entirely; it utilizes a single-pass statistics engine running Welford’s online algorithm to compute market variance and dynamically serve auto-generated raw SVG charts directly to standard web browsers, all while simultaneously powering a lock-free ANSI TrueColor terminal dashboard via standard output.
### PyGuard — Short Project Summary
**PyGuard** is a **zero-dependency Python security and dependency auditing CLI tool** that analyzes Python projects for security risks without using any third-party packages.
It scans Python source code, dependencies, imports, and configuration files to detect **hardcoded secrets/API keys, dangerous code patterns, vulnerable or unpinned dependencies, unsafe imports, and insecure configurations**. It then generates a **Security Score (0–100)** with severity ratings and provides reports in **Terminal, JSON, and standalone HTML** formats.
**Core technology:** Python 3 + Standard Library only (`ast`, `re`, `pathlib`, `argparse`, `tomllib`, `json`, `hashlib`, etc.).
**Key message:**
> **“Secure Python projects without depending on third-party packages.”**
**One-line description:**
> **PyGuard is a zero-dependency Python CLI security auditor that scans projects for vulnerabilities, secrets, dependency risks, and configuration issues, producing actionable findings and a 0–100 security score.**
Hushbox is a secrets vault that stores API keys and passwords in a form that's never readable, even if the file leaks, managed entirely through the vault command.
The problem: developers store secrets in plain .env files. One missing .gitignore line, one accidental commit, and that secret is sitting in a public GitHub repo, readable by anyone, including bots that scan for exactly this. It happens constantly and costs real money every time.
Hushbox fixes this by encrypting secrets at rest, using nothing but Python's standard library. Since Python has no built-in AES, we composed hashlib and hmac into a real encrypt-then-MAC construction, and store the master key in the OS's own keychain, never in the project folder. Secrets are only ever decrypted in memory, only for the instant a program needs them.
Run vault set API_KEY sk_abc123 to store a secret, and vault run -- python app.py to inject it safely into your app at runtime. If the vault file leaks, it's just unreadable gibberish. A local browser dashboard (vault ui) is included too, built entirely on Python's http.server, zero external dependencies anywhere, verifiable in pyproject.toml.
ZEPHYR: Zero-Dependency Incremental Build System & Task Orchestrator
Author: Naman Swami
Track: Track A (Developer Tools & CLI)
Runtime: 100% Go Standard Library (Zero External Dependencies, Empty go.mod)
Repository: https://github.com/naman-swami/ZEPHYR
WHAT IS ZEPHYR?
ZEPHYR is an ultra-fast incremental task runner and build orchestrator built entirely in the Go Standard Library. It is a pure zero-dependency Package Killer replacement for heavyweight build tools like Turborepo, Nx, Make, and Just.
KEY FEATURES
1. Zero Dependencies: Built strictly with Go stdlib. 24 popular third-party packages replaced and documented in STDLIB.md.
2. zephyr doctor: Diagnostic engine auditing workspace config, DAG acyclicity, cache integrity, and system resources.
3. Two-Tier CAS & 0ms Hardlinks: Content-Addressable Storage deduplicating output artifacts with instant 0ms restoration via os.Link.
4. Intelligent --why Detective: Explains exact SHA-256 cache miss causes across modified files, dependencies, and environment variables.
5. Live Watch Mode (--watch): In-process debounced file watcher that auto-rebuilds dependent tasks on save.
6. Monorepo Workspaces: Auto-discovers child tasks.json in workspaces (packages/*) and namespaces tasks into a unified DAG.
7. Remote Cache Server: Built-in REST/CAS HTTP server with token authentication.
8. Security & Provenance: HMAC-SHA256 cache signing, real-time secrets redaction (***REDACTED***), path traversal sandbox, and SLSA v1.0 provenance generator.
HACKATHON BONUS CHALLENGES (+16 Points Achieved)
- Single File (+5 pts): Core engine in single self-contained main.go.
- Reproducible Build (+5 pts): Byte-identical SHA-256 dual builds verified.
- Package Killer (+3 pts): Replaces Turborepo, Nx, Make, Just, Ora, Chalk, and Godotenv.
- STDLIB Log (+3 pts): 24 stdlib substitutions documented in STDLIB.md.
- Automated Tests: 24/24 unit and integration tests passing (100% pass rate).
Privacy Redactor is a privacy-focused tool that automatically scans files for sensitive information such as Aadhaar numbers, credit cards, emails, IP addresses, passwords, API keys, and JWTs, then redacts the detected data and generates a clean output file and scan report. It provides both CLI and GUI interfaces with different privacy profiles for flexible data protection.
DevLens is an autonomous Python dependency vulnerability scanner and automated remediation CLI developer tool built strictly using Python's standard library, requiring zero third-party runtime packages. Standard security auditing tools like pip-audit and safety depend on 30 to 50 transitive packages, introducing supply-chain risk into the very tools used to audit software security. DevLens eliminates this external attack surface by implementing the full vulnerability auditing lifecycle using only built-in Python modules.
The scanning pipeline parses requirements.txt files into structured dependency objects, handling version specifiers, environment markers, and extras brackets using regular expressions without dynamic code execution. DevLens queries Google's Open Source Vulnerabilities (OSV) REST API over HTTPS using urllib.request and JSON serialization. It extracts CVSS v3.1 vector strings and computes base scores from first principles using the FIRST.org mathematical specification with Decimal rounding precision. A 15-line Union-Find data structure with path compression deduplicates overlapping CVE, GHSA, and PYSEC advisories to prevent inflated vulnerability counts and risk penalties.
Beyond detection, DevLens provides automated remediation through its fix command, which extracts verified safe versions from OSV advisory data to generate an updated requirements.txt file without guessing version numbers. Its diff command scans two requirements files to compute the exact delta in vulnerability count and posture score for pull request reviews. For CI/CD automation, the --fail-on flag enforces severity thresholds, returning standard exit codes (0 for pass, 1 for security violation, 2 for error). Reports can be exported as terminal tables, JSON, plain text, self-contained HTML documents with inline CSS, or SVG badges.
DevLens also includes a local web dashboard powered by Python's http.server with a custom byte-level multipart parser for file uploads. The codebase consists of 14 modular source files, each strictly maintained between 100 and 200 lines of code. It is verified by 176 unit tests, including an AST-based test that statically proves zero third-party imports exist. Using Python's zipapp module with normalized archive timestamps, the entire application compiles into a single 110 KB executable (devlens.pyz) with byte-identical reproducible builds.
HookAudit - See what a repository can execute before you trust it.
HookAudit is a zero-dependency repository execution-topology auditor that helps developers understand what a repository can cause their development environment to execute before they trust it.
Modern repositories can include AI-agent hooks, IDE/workspace tasks, package lifecycle scripts, and development hooks. Execution behavior may be spread across files: a trigger launches a script, the script references another file, and deeper in the chain the execution may reach network access, downloads, bootstrapping, or process execution.
HookAudit discovers supported execution surfaces across Claude Code, VS Code, Cursor, npm lifecycle scripts, Husky, and selected Git/development hooks. It normalizes them into a common model of triggers, commands, references, capabilities, evidence, risk, and confidence.
It performs static multi-hop reference resolution without executing the target repository and builds an execution graph such as:
Configuration → SessionStart → script A → script B → NETWORK_ACCESS → PROCESS_EXECUTION
This shows how execution can flow through the repository and what capabilities are reachable from an automatic trigger.
The risk engine is deterministic, transparent, and path-based. Findings include source, field, detector, evidence, execution path, severity, and confidence. HookAudit reports high-risk execution paths; it does not claim that static analysis alone proves malware.
HookAudit also supports trust over time. Developers can create a baseline of an accepted execution surface and compare the repository later. The diff identifies new, changed, or removed execution surfaces and meaningful changes such as a newly reachable NETWORK_ACCESS capability.
Security is built into the architecture. The target repository is treated as inert data: HookAudit does not execute target scripts, install target dependencies, execute hooks, or require the target dependency tree for analysis. The shipped tool uses zero third-party runtime dependencies and the Node.js standard library, enabling lightweight local, offline-capable analysis.
“What can this repository cause to execute, through which trigger, with which reachable capabilities, and what changed since I trusted it?”
Our goal is to make hidden repository execution behavior visible, explainable, and reviewable before it becomes a security surprise.
ZeroDup is a fast, lightweight, and dependency-free file deduplication tool built entirely with Python's standard library. It recursively scans directories, identifies duplicate files using SHA-256 hashing, and optimizes performance by grouping files by size before comparing their contents. ZeroDup helps users reclaim disk space by detecting redundant files, generating detailed reports in multiple formats, and optionally removing duplicates safely after user confirmation. Developed for ZeroDepsHack 2026, ZeroDup demonstrates that powerful, production-quality software can be built without relying on any third-party runtime dependencies.
Project Guardian is a zero-dependency local developer CLI that helps developers understand the health and evolution of their project directories. It recursively scans a project to detect duplicate and unusually large files, creates deterministic point-in-time snapshots using file metadata and SHA-256 hashes, and compares snapshots to identify added, deleted, and modified files.
Built entirely in Go using only the standard library, Guardian requires no third-party runtime packages, databases, cloud services, or external APIs. It provides both human-readable output and machine-readable JSON, making it useful for developers as well as scripts and automation workflows.
The project demonstrates how functionality commonly delegated to external libraries can be implemented from first principles using Go's standard library — including filesystem traversal, hashing, JSON serialization, deterministic data processing, CLI parsing, error handling, and automated testing.
Track: Developer Tools & CLI
Language: Go
Runtime Dependencies: Zero
RepoShield turns a C++ repository into a security report, risk assessment, and actionable remediation workflow — all from a single zero-dependency CLI.
Modern developers often need multiple tools to understand whether a repository is secure, what it depends on, how risky it is, and what should be fixed. RepoShield brings these capabilities together into one standalone C++17 developer tool.
RepoShield analyzes a repository's structure, source code, security posture, dependencies, dependency relationships, Git state, and overall risk. Its security engine detects 7 vulnerability classes, including unsafe C string functions, command execution, hardcoded secrets, weak cryptography, dangerous file operations, SQL injection, and insecure random generation.
But RepoShield doesn't stop at detection.
Detect → Understand → Fix → Verify
For RS001 — Unsafe C string function, RepoShield can automatically remediate the vulnerable code directly from the CLI, with a dry-run mode for safely previewing changes. Developers can immediately re-run the analyzer and verify that the vulnerability has disappeared.
RepoShield also provides actionable remediation guidance for every detected security rule, repository-level risk scoring, supply-chain and dependency analysis, a dependency graph, Code Lens insights, and Git intelligence.
Findings can be exported as JSON or SARIF, making the results suitable for integration with automated developer and CI workflows. Its configurable security policy can also act as a CI security gate, returning meaningful exit codes when security requirements are violated.
Most importantly, RepoShield is built around the Zero Third-Party Runtime Dependencies requirement: its core functionality is implemented in C++17 using the standard library, producing a standalone runnable executable without third-party C++ runtime libraries.
RepoShield is not just a vulnerability scanner — it is a complete developer workflow for discovering, understanding, remediating, verifying, and enforcing repository security.
Linux sys admin tool is a Python based command line utility designed to simplify day to fay linux system administration tasks.It provide deep file integrity checks,process management,resource monitoring and other administrative utilities through a CLI interface it is a go to command for sys admin's and tech geeks.
MayFly is a zero-dependency ephemeral secrets workspace and in-memory process injector.
Problem:
Developers usually store API keys and passwords in plaintext .env files on disk. Whenever you run commands like npm install or pip install, third-party packages can silently read your disk and steal your credentials before your application even starts.
How MayFly Solves It:
MayFly removes .env files from your disk completely. All your secrets are stored in a strongly encrypted vault (AES-256-GCM with PBKDF2 key derivation).
When you run any app with MayFly, secrets are decrypted directly into temporary RAM memory and passed straight into your running process. When your app stops, MayFly wipes all memory clean. Secrets never touch your hard drive.
Key Features:
- Direct in-memory injection for any framework or command
- Built-in interactive terminal UI with full keyboard navigation
- Tamper-proof cryptographic audit logs to track secret usage
- Secret scanner to detect accidental credential leaks before committing code
- Hackathon Compliance: MayFly is built 100 percent from scratch using only the pure Go standard library, with 0 external runtime dependencies and 0 third-party packages.
It strictly meets all requirements for the Zero-Dependency 72-Hour Hackathon.
All documentation, benchmarks, tests, and media assets are kept completely separated outside the core binary.
Project Links:
GitHub: https://github.com/vishnunandan555/mayfly
Documentation: https://mayfly-docs.vercel.app
Demo Video: https://youtu.be/GBL9u0if96I
Description: MotionLab Pro is an advanced, dark-themed 2D motion design and keyframe animation workspace featuring an interactive timeline, layer management, and a live canvas stage.
Key Features: Offers fluid easing controls, customizable color palettes, tooltips, playback transport utilities, and an integrated startup kinetic intro.
Interface: Composed of a top navigation bar, a left-hand tool panel, a central artboard, a right-hand property inspector, and a bottom timeline.
Technology: Built using pure semantic HTML5, modern CSS3 variables with dynamic theme transitions, and embedded vanilla JavaScript for UI interactivity.
Project Name: MiniRatchet
Track: E — Security & Crypto Utilities
Repo: https://github.com/Git-Dileep/Zero-Dependency
Language: Go (stdlib only, go 1.23+)
One-line pitch: Signal-style double ratchet messenger with forward secrecy and post-compromise security, built entirely from Go's crypto stdlib.
Description:
MiniRatchet is a zero-dependency implementation of the Double Ratchet Algorithm (the protocol behind Signal) using only Go's standard library. It composes crypto/ecdh (X25519), crypto/aes + crypto/cipher (AES-256-GCM), and crypto/hmac + crypto/sha256 (HKDF extract-then-expand) — no golang.org/x/crypto, no third-party packages.
It demonstrates four cryptographic properties through interactive demos: (1) forward secrecy — a stolen message key cannot decrypt earlier or later messages, (2) post-compromise security — a DH ratchet epoch rotation automatically re-secures the session after a chain key leak, (3) authenticated encryption — tampered ciphertext is rejected by AES-256-GCM, and (4) key destruction — all key material is zeroed in memory after use.
The project includes 12 documented stdlib-for-package substitutions in STDLIB.md, a full test suite (unit + integration), a verified reproducible build (byte-identical SHA-256 hashes), and an interactive guided tour with chat mode.
Build command: make build or go build -o miniratchet ./cmd/miniratchet
Run: ./miniratchet (guided tour + interactive chat) or ./miniratchet --demo all
Dependency proof: go list -m all returns only github.com/miniratchet. See deps-proof.txt.
Bonuses claimed: STDLIB Log (+3, 12 substitutions), Reproducible Build (+5, verified identical hashes)
SentryML is an autonomous, real-time HTTP threat detection and mitigation system built entirely from scratch with zero third-party dependencies for Track E. The system continuously monitors incoming web traffic to detect anomaly patterns—such as automated bot scanners and volumetric flooding—by leveraging a hand-written algorithmic engine that combines a custom K-Means classifier, Shannon Entropy path analysis, and Robust Median Absolute Deviation (MAD) statistics. Upon detecting a high-risk event, SentryML automatically anonymizes the source IP using native HMAC-SHA256, performs a local O(log N) binary search GeoIP lookup, and triggers defense mechanisms like IP blocking and webhook alerts. Everything runs strictly on Python's standard library, streaming live telemetry to a zero-framework, vanilla HTML/JS web dashboard via Server-Sent Events (SSE).
My project is an offline password manager of track e ,it's a pure java based console application which doesn't use any dependency and its perform all the essential security required .
MiniEdge — Project Description
MiniEdge is a lightweight, zero-dependency API gateway built in Go that provides centralized traffic management, service routing, rate limiting, health monitoring, fault simulation, and real-time observability for distributed services.
It sits between clients and backend services, intelligently routing requests using longest-prefix matching, protecting services with token-bucket rate limiting, and continuously monitoring upstream health through active probes. Its built-in fault simulation allows controlled FAIL and DELAY scenarios to test system resilience.
MiniEdge also provides an observability layer with request logs, request IDs, latency metrics, service health status, and error tracking. Administrative operations are secured using API-key authentication with constant-time comparison, configurable CORS, and request-body limits.
The project includes a Next.js dashboard for monitoring and controlling the gateway, with the backend deployed on Render and the frontend on Vercel.
Core flow:
Client → MiniEdge → Route → Rate Limit → Health/Simulation → Reverse Proxy → Upstream Service
Key focus: lightweight architecture, reliability, security, observability, and practical fault testing — without unnecessary dependencies.
Project Overview: TerminalAlpha
TerminalAlpha is an ultra-fast quantitative backtesting engine built entirely in standard Java with zero external dependencies. Designed for high-frequency tick data, it processes millions of market events per second without triggering Garbage Collection pauses.
Core Features
Zero-Allocation Parsing: Uses memory-mapped I/O (MappedByteBuffer) to parse massive crude oil datasets directly into primitive arrays at over 7.5 million ticks per second.
Parallel Optimization: Leverages ForkJoinPool to distribute strategy parameter sweeps (like Momentum Breakout) across all available CPU cores concurrently.
Institutional Metrics: Calculates Sharpe Ratio, Win Rate, and Max Drawdown while strictly enforcing a 5-basis-point slippage penalty on all simulated trades.
Native Terminal UI: Renders a 2D equity curve and a Bloomberg-style tear-sheet directly in the console using standard ANSI and Unicode characters.
The Problem: Git tracks source code but loses engineering context, causing AI coding agents to constantly hallucinate architectures and violate unwritten project constraints.
The Solution: LightGit is a zero-dependency persistent memory layer that uses custom NLP to extract architectural rules from your chat, and parses raw .git binaries to calculate the exact blast radius of code changes.
The Impact: Acting as a native MCP server, it injects this precise, mathematically-derived engineering memory directly into agents (like Antigravity), eliminating context loss entirely without relying on a single external package.
CampusLink is a zero-dependency, LAN-only group chat with polls and reactions — built entirely from raw C++ and POSIX sockets, with zero third-party libraries. It works purely over local WiFi, with no internet connection required, and was tested working across IIT BHU's own campus network. Note: since it's intentionally LAN-only by design, there's no public "click and play" demo link — the linked video shows it running live across two real devices instead.
MockForge is a zero-dependency HTTP mock server built in Python for frontend development, API integration, and testing when a real backend is unavailable or still under development.
It allows developers to define and manage mock API routes through a CLI and configuration file, then serve them through a lightweight HTTP server. MockForge supports static and dynamic routes, path parameters, query parameters, JSON request bodies, response templating, configurable HTTP status codes, and structured error handling.
The request flow parses incoming HTTP requests, matches them against configured routes, resolves dynamic template values from the request, and builds the final HTTP response for the client.
The goal is simple: remove the dependency on a ready backend during development and allow frontend and integration work to continue against predictable, configurable APIs.
MockForge uses Python's standard library for its core server functionality, keeping the implementation lightweight and dependency-free.
This project is a secure digital evidence management system built with Python and SQLite. It supports case management, evidence registration, SHA-256 integrity verification, encryption, chain of custody tracking, tamper alerts, RBAC, activity monitoring, and report generation.
TraceLock is a lightweight security event correlation and attack analysis engine built with Python's standard library.
It transforms raw security logs into structured attack narratives by correlating related events, reconstructing multi-stage attack chains, mapping behaviors to MITRE ATT&CK techniques, extracting security evidence, profiling behavior, detecting anomalies, assessing risk, and generating prioritized security recommendations.
TraceLock is designed with zero third-party runtime dependencies. Its core analysis engine uses Python standard-library modules for parsing, correlation, scoring, analysis, reporting, and JSON generation. pytest is used only as a development/testing dependency.
The project demonstrates how security events that may appear isolated can be correlated into an explainable attack sequence. For example, TraceLock can identify repeated authentication failures followed by successful authentication, command execution, and privileged activity, then produce a CRITICAL risk assessment with supporting evidence, behavioral findings, anomaly analysis, MITRE ATT&CK mappings, and investigation recommendations.
The project includes example security logs, automated tests, JSON report generation, standard-library compliance documentation, and dependency proof.
TraceLock is intended for authorized defensive security analysis, education, testing, and research.
DevGuard is a zero-dependency developer security scanner designed to identify common security risks in software projects. It detects hardcoded secrets, sensitive files such as .env and key files, and dependency manifests. The system classifies findings by severity, calculates an overall security score, and presents the results through an interactive web dashboard. It also provides security recommendations to help developers identify and address potential risks early in the development process.
DevFlow — Zero-Dependency Developer Automation Platform transforms everyday developer and system tasks into a fast, visual command center — built without third-party runtime dependencies. Instead of relying on frameworks and packages, DevFlow uses Node.js built-in modules and browser-native APIs to deliver file operations, system inspection, terminal workflows, task automation, and activity monitoring in one unified interface. The project demonstrates what modern developer tooling can achieve when dependency trees are stripped away and the underlying engineering is built from first principles. Every core capability is designed to be lightweight, inspectable, reproducible, and reliable, directly embracing the Zero Dependency challenge.
Proofline is a zero-dependency Python static analysis engine that catches AI-generated code hallucinations before they ship.
AI coding agents are fast but dangerous. They silently break public API signatures, swallow critical exceptions inside authentication boundaries, generate dead code with zero callers, and delete test files to hide their regressions. Human reviewers miss these in large pull requests. Proofline doesn't.
Using nothing but Python's standard library — no pip install, no third-party packages — Proofline parses your AST to build a full Caller Graph and Evidence Graph, then mathematically traces the blast radius of every changed function. It fires 11 verification rules covering signature breaks, exception swallowing, orphan code, complexity spikes, untested security boundaries, and more.
In our live demo, Proofline catches an AI that changed an auth function to silently return None on failure, broke 10 callers, and deleted the test file to cover its tracks. It flags the commit as CRITICAL with a risk score of 86/100 and blocks it automatically via a Git pre-commit hook.
We killed every common dependency along the way: Jinja2 replaced with string.Template, FastAPI replaced with http.server, python-dotenv replaced with str.split(), watchdog replaced with hashlib and os.stat, and GitPython replaced with subprocess. We even built a self-enforcing guard that terminates if any third-party package is detected at startup.
Zero dependencies. Total verification. AI made code generation cheap. Verification didn't keep up. We fixed it.
LeakGuard ML is a zero-dependency security scanner that detects sensitive information such as API keys, access tokens, database credentials, and personal data in source code. It combines regex-based detection, entropy analysis, and a custom Logistic Regression ML model to identify known secrets and suspicious unknown patterns, then assigns a risk score and severity level. Built entirely with Python’s standard library, LeakGuard ML requires no third-party runtime dependencies and provides an explainable security report with masked evidence
ZeroTrace is a lightweight, dependency-free secret detection and security scanning engine built from scratch using C++17. It is designed to identify sensitive information such as API keys, access tokens, passwords, JWTs, private keys, and other credentials accidentally hardcoded in source code and configuration files.
ZeroTrace recursively scans project directories using a multithreaded scanning architecture and applies configurable detection rules. Detected values are analyzed using entropy-based confidence enhancement, classified into severity levels, and automatically redacted to prevent secrets from being exposed in scan results.
The tool also provides practical security features such as custom detection rules, .zerotraceignore, allowlists, and baselines, allowing developers to distinguish known issues from newly introduced secrets.
For integration and reporting, ZeroTrace supports Terminal, JSON, SARIF 2.1.0, and HTML dashboard reports. Its CI-friendly exit codes make it suitable for incorporating secret scanning into development and automated workflows.
Key Innovation
Instead of depending on large external security frameworks, ZeroTrace implements its scanner, rule engine, entropy analysis, confidence scoring, filtering, baseline handling, and reporting pipeline in C++17, keeping the tool lightweight and locally executable.
Mnemos is a fully offline, zero-dependency search engine for your own documents: you point it at a folder, it reads and understands your files using only hand-built tools (no downloaded AI models, no cloud, no third-party code anywhere), and then lets you ask plain-language questions and get back real, sourced passages from your own writing, ranked by both exact word match and rough "meaning" match, with a live visual showing your question connecting to the results it picked, so instead of hunting through a thousand files by memory, you get an instant, trustworthy answer that never left your machine, built the same way real production databases and search engines are built underneath, just done by hand instead of imported; the one thing worth flagging honestly is that the newest addition, a neural-network ranking layer, was trained on made-up synthetic numbers rather than real relevance data, so it's a genuine engineering flex but not something that's actually learned anything true about your documents yet.
DepZero is a zero-dependency CLI tool that scans software projects to detect and classify dependencies as standard-library, local, third-party, or unknown. It shows where dependencies are used, compares them with project manifests, suggests standard-library alternatives, generates dependency graphs and migration plans, and verifies whether a project has zero detected third-party runtime dependencies while DepZero itself uses no third-party packages.
Zero-Deps (NoDepDB) is a Redis-inspired key-value database built from scratch in Python using only the standard library. It supports TCP networking, persistent storage with Write-Ahead Logging (WAL) and crash recovery, key expiration using TTL/EXPIRE, and a simple client interface. The project demonstrates how core database functionality can be implemented without any third-party dependencies.
Project Name: ZeroGit
Track: Track A — Developer Tools & CLI
Repository: https://github.com/Akarshb23/zeroGit
Short Description:
ZeroGit is a complete version-control engine built from scratch in ISO C++17 with 0 external runtime dependencies. Built for the Zero Dependency 2026 Hackathon, it re-implements core Git internals — replacing libgit2, OpenSSL SHA-1, boost::filesystem, and diffutils with first-principles standard library implementations.
What Makes it Zero-Dependency:
- Manifest is 100% empty (0 third-party packages).
- Cryptographic SHA-1 engine implemented natively from RFC 3174 without OpenSSL.
- Object store, indexing, diffing, and branching built purely with C++17 STL (<filesystem>, <fstream>, <map>, <sstream>, <vector>, <algorithm>).
- One-command build across Windows, Linux, and macOS.
- 12/12 passing automated integration tests.
CodeMap is a zero-dependency developer tool that analyzes JavaScript/Node.js codebases and builds a dependency graph from their source files.
It helps developers understand module relationships and detect architectural issues such as circular dependencies, self-cycles, dependency hotspots, and excessive dependency depth. It also provides useful graph metrics and structured analysis results.
Built for the Zero Dependency Hackathon 2026 : Track A (Developer Tools & CLI), CodeMap uses only Node.js standard-library functionality with zero third-party runtime dependencies.
The project includes 32 passing automated tests covering graph construction, cycle detection, dependency analysis, metrics, depth calculation, edge cases, and integration behavior.
Lattice is a spreadsheet formula engine — the computational core behind Excel and Google Sheets — built entirely from Python's standard library, with a live terminal UI. No parsing libraries, no serialization libraries, no graph libraries. Every layer, hand-written.
RepoDoctor is a zero-dependency command-line tool that analyzes the health of a software repository in one scan. It detects security secrets, duplicate code, code smells, TODOs, large files, project structure issues, and Git hotspots, then combines the results into a simple health score. It also supports parallel scanning, HTML/JSON reports, GitHub health badges, baseline comparison, and LLM-ready repository export — all using Python’s standard library.
MiniGit is a lightweight, Git-inspired version control system developed using Python and only the standard library. The project is designed to demonstrate how the fundamental concepts of version control work internally, including repository initialization, file staging, commits, change tracking, commit history, and difference detection.
MiniGit uses SHA-256 hashing to create unique identifiers for file contents and stores repository information using an internal .mygit directory. It maintains a staging index and links commits through parent references to create a simple commit history.
PulseWire is a zero-dependency live news engine that retrieves and displays real-time BBC News headlines using a custom HTTP client built entirely from Python's standard library. Instead of relying on packages like requests or BeautifulSoup, PulseWire reimplements the core networking pipeline—from persistent HTTPS sessions and cookie management to HTML parsing and terminal rendering—using only built-in modules.
Designed for the Zero Dependency 2026 hackathon, the project demonstrates what modern web software looks like beneath its dependency tree. Every headline is fetched live, parsed into structured objects, deduplicated, and presented through a clean command-line interface, proving that robust networking applications can be built from first principles without sacrificing usability or engineering quality.
📄 Project Description – ZeroShrink
What is ZeroShrink?
ZeroShrink is an intelligent, lossless compression tool built entirely with Python's standard library. It tackles the modern dependency crisis by reimplementing popular packages from scratch—using only what Python provides out of the box.
Unlike traditional compression tools that rely on external libraries, ZeroShrink is adaptive. It analyzes your file's byte structure, tests multiple strategies (Huffman, zlib, lzma, bz2), and automatically selects the one that yields the smallest compressed output. All codecs are standard library modules—no pip install required.
Key Features
Zero Dependencies – 100% pure Python stdlib
Adaptive Strategy – Tests and picks the best compression method
Package Killer – Custom Huffman coding replaces zstandard
Integrity Checks – CRC32 + SHA‑256 verification
Dual Interface – CLI + Tkinter GUI
Single File – Entire project in zero_shrink.py
Reproducible Build – Byte‑identical artifact generation
ZeroShrink proves that Python's standard library is powerful enough for serious engineering—without the bloat of third-party packages.
Quick Stats
Metric Value
Dependencies 0
Substitutions 10+
Bonuses +16/16
File Size Single file, ~800 lines
Integrity CRC32 + SHA‑256
**PathForge** is a zero-dependency Java dungeon escape game where the player explores three challenging dungeon levels, collects keys, and reaches the exit while avoiding an AI-controlled enemy. The enemy uses a custom implementation of the A* pathfinding algorithm to find an efficient route toward the player. The game includes lives, scoring, collision detection, level progression, and increasing difficulty. PathForge is built entirely using Java JDK standard libraries such as Swing, AWT, and Java Collections, with no third-party runtime dependencies. The project demonstrates how a complete interactive game and AI pathfinding system can be built from first principles using only the Java standard library.
DepGuard is a zero-dependency static CLI tool built specifically for developers using AI coding assistants. While tools like Claude, Cursor, and Copilot make writing code incredibly fast, they frequently hallucinate non-existent package names, import undeclared dependencies, or insert unsafe code execution patterns.
Built entirely using Python 3.14’s standard library, DepGuard scans local projects statically—without ever executing untrusted code—to answer three critical supply-chain questions:
What is actually imported? Uses Python’s native Abstract Syntax Tree (ast) parser to extract every import and from ... import statement across project files.
What is declared vs. used? Parses requirements.txt and pyproject.toml (using native tomllib) to compare declared packages against actual code usage, flagging undeclared imports and unused bloat.
What is dangerous or unknown? Uses importlib.util.find_spec() to classify modules as standard library, local, or installed third-party dependencies. Anything unresolved is flagged as an unknown/hallucinated dependency. It also runs AST-level security checks for dangerous calls like eval(), exec(), pickle.loads(), and subprocess with shell=True.
DepGuard runs as a self-contained single-file script (depguard.py) with zero third-party runtime dependencies, supporting human-readable ANSI terminal output and machine-readable --format json logging.
P.S. To be completely honest, the idea for this project hit me when I was reading through the event rules about how half of AI-generated code hallucinates package names. I thought—why not build the exact kind of zero-dependency auditor that the hackathon judges could use to evaluate the submissions being turned in for this event?
HuffLite — Zero-Dependency C++ Huffman File Compressor
HuffLite is a lightweight C++23 file compression and decompression tool built from scratch using Huffman coding.
It uses only the C++ Standard Library—no zlib, Boost, or third-party packages.
The compressor stores the required frequency data inside each output file, so decompression is fully self-contained.
It safely falls back to raw storage for random or incompressible files.
The complete implementation ships in a single readable huffman.cpp file.
Tech Stack: C++23, C++ Standard Library (STL), Command-Line Interface (CLI), std::priority_queue, std::filesystem, fstream, chrono, manual bit-level I/O.
Gitlens Zero is a lightweight CLI that analyzes any Git commit range and turns it into plain-English summaries - classifying commits (feature, bug fix, refactor, etc.), detecting which parts of the system were impacted (Auth, API, DB, Frontend), and highlighting contributors and file hotspots. It also generates a standalone HTML dashboard, no browser dependencies required. Built entirely on the Python standard library and Git CLI, with zero third-party runtime packages.
DevLens v2.0 — Zero-Dependency Software Health Scanner
by XeroCoderz
@ankit_64236
@anuradha7828
DevLens v2.0 is a zero-dependency software health scanner built entirely with Python's standard library. It analyzes software repositories for security risks, dependency issues, code-health problems, documentation gaps, and repository hygiene, and converts the results into an overall project health score.
DevLens can scan real repositories without executing their code and produces terminal, JSON, CSV, and self-contained HTML dashboard reports. It also supports CI quality gates, non-modifying fix plans, deterministic finding IDs, reproducible scan reports, reproducible builds, and a functional single-file version.
The project contains zero third-party runtime dependencies. It uses Python standard-library capabilities instead of external frameworks and packages, with the standard-library substitutions documented in STDLIB.md.
The implementation has been verified with 83 automated tests, zero third-party runtime dependencies, reproducible scan reports, byte-identical reproducible builds, cross-process deterministic finding IDs, and a real multi-technology repository scan.
Problem:
Real-world data is notoriously messy, with missing data, incorrect formats, duplicates and subtle anomalies that require tedious manual inspection and custom code to fix. Moreover, the implementation of data validation in various environments (e.g., CI/CD pipelines, lightweight containers, and secure enterprise systems) often suffers from inconsistent package versions and setup overhead.
How We Solve It:
We built DataLens, a full data quality engine using only the Python standard library and no external dependencies. It auto-profiles datasets, infers data types, flags errors with statistical and built-in neural network detectors, applies automated cleaning fixes, and generates interactive visual reports, running instantly out-of-the-box on any machine with Python.
Forge Watch is a zero-dependency repository health, code quality, and security scanner built entirely with Python's standard library. It helps developers analyze their repositories for potential security issues, code-quality problems, Git information, and repository health indicators such as documentation, tests, large files, and TODO/FIXME items. Users can analyze their own repositories through GitHub/GitLab URLs or ZIP uploads and choose Code, Health, Security, or Full Scan. Forge Watch generates a deterministic health score, actionable findings, JSON reports, CI-friendly results, and a local web dashboard. Repositories are treated as untrusted input and their code is never executed. The project uses only Python standard-library modules, with an empty runtime dependency manifest.
TRACE takes a domain and runs a sequence of safe, read-only checks —
DNS resolution, TCP port availability, HTTP/HTTPS response analysis,
redirect-chain inspection, TLS certificate inspection, and
security-header analysis — then turns the results into a readable
report with severity, evidence, impact, a recommendation, and an
overall risk level. It is built entirely on Python's standard
library (socket, ssl, http.client, urllib.parse) with zero
third-party runtime dependencies.
RepoMind — Project Description
RepoMind is a zero-dependency Python CLI tool that automatically analyzes a code repository and provides insights into code quality, complexity, security, dead code, project health, and dependency relationships. It scans the current project, performs static analysis using Python’s standard library, and can generate an interactive HTML dashboard containing the complete analysis, including an interactive dependency graph.
Users can simply install it with pip install repomind and run commands such as repomind --summary, repomind --security, or repomind --html to analyze their project. The HTML mode launches a local interactive dashboard directly in the browser, making complex repository insights easy to understand without requiring any external services, API keys, or configuration.
Key features:
📊 Repository summary & health score
🔐 Security issue detection
🧠 Code complexity analysis
🗑️ Dead-code detection
🔗 Dependency & import graph
🔄 Cycle detection
🌐 Interactive HTML dashboard
🚫 Zero runtime dependencies
⚡ Simple CLI-based workflow
💻 Works across operating systems
stackVM is an interpreter (a stack-based bytecode VM) and a visualizer (live stack/bytecode debugging with animated motion). Both are explicitly listed under Track F, and the project is built with zero runtime dependencies — satisfying the track's requirement to explain how zero dependencies were achieved.
RepoDoc is a zero-dependency Node.js CLI tool built to inspect, audit, and document local codebases instantly without pulling in megabytes of third-party packages. It recursively traverses project directories, counts lines of code across file types, filters out binary assets and vendor noise, extracts active developer annotations (TODO, FIXME, BUG) with accurate line numbers, and generates formatted Markdown reports or terminal summaries.
ApexKV is a lightweight in-memory key-value store written from scratch in modern C++17, with no external dependencies. It focuses on fast lookups in memory and simple, reliable durability on disk.
its key architectural includes:
1. In-Memory Engine
A templated `HashTable<Key, Value>` which works with Standard and custom hashable types. It uses separate chaining with `std::forward_list` to keep memory overhead low compared to doubly-linked structures.
2. Dynamic Rehashing
The table tracks its load factor (`size / capacity`) and automatically doubles the number of buckets (16 → 32 → 64 …) once the load factor crosses 0.75. This keeps average insert, lookup, and delete operations close to O(1).
3. Write-Ahead Log (WAL) Durability
`PersistentKV` records every `PUT` and `DEL` operation to an append-only log file (`apexkv.log`). Each change is written to disk immediately after updating the in-memory table.
4. Point-in-Time Compaction
Calling `save_snapshot()` writes the current key-value state to a snapshot file (`apexkv.snapshot`) and optionally truncates the log, preventing it from growing indefinitely.
5. Two-Stage Recovery
On restart (or after a crash), ApexKV first loads the snapshot, then replays any newer log entries in order. This brings the in-memory state back to a consistent point.
6. Verified Behavior
The project includes a test suite that covers different key/value types, rehashing behavior, and persistence/recovery, plus a simple benchmark that runs 100,000 operations and compares throughput against `std::unordered_map`.
Dead-Drop Encrypted Container is a zero-dependency Node.js command-line security tool designed to securely store and protect entire directories in a single encrypted binary file. The tool recursively collects files and folders from a selected directory and packages them into a .vault container, which is then encrypted using AES-256-GCM, providing both strong data confidentiality and tamper detection through authentication tags. Users can specify an expiration period while creating the vault, allowing the container to function as a time-locked storage mechanism that becomes inaccessible after the defined duration. To access the stored data, users provide the vault file, destination directory, and correct password through the CLI. Before decryption, the application checks whether the vault has expired and verifies its authenticity, ensuring that modified or corrupted encrypted data is detected. The project is particularly useful for protecting sensitive information stored on untrusted mediums such as USB drives, external storage devices, or offline backup locations. Its zero-dependency design makes it lightweight and easy to deploy because it relies primarily on Node.js's built-in cryptographic and filesystem capabilities. The project also demonstrates important cybersecurity concepts such as symmetric encryption, authenticated encryption, secure file storage, password-based protection, integrity verification, and access control through time-based restrictions. However, the tool's security depends partly on the environment in which it is executed; it cannot protect passwords from OS-level keyloggers or data that may already be exposed through memory-dump attacks while the application is running. Overall, Dead-Drop provides a practical demonstration of how cryptographic techniques can be combined with file management and time-based access control to create a secure portable storage solution. It can also serve as a foundation for future improvements such as stronger password derivation, secure metadata handling, improved key management, and additional authentication mechanisms.
PackageShield is a lightweight security layer for npm that checks a package before installation. It checks for known vulnerabilities using OSV.dev and also looks at install scripts for suspicious behavior such as downloads, encoded payloads, shell commands, and dynamic code execution. It also checks the npm/Node.js version being used. The entire tool is built using only Python’s standard library, with no third-party runtime dependencies.
Documentation: https://anisha.gitbook.io/package-shield/
FailSafe is an intelligent middleware layer designed to sit between clients and backend servers to guarantee zero user-visible downtime during server crashes. Acting as a dynamic Request Manager, it continuously monitors server health and transparently routes incoming traffic only to active, healthy nodes. If a primary server fails mid-flight, the system instantly absorbs the error and automatically reroutes or retries the request on a standby server. To handle absolute system failures, FailSafe safely queues requests while enforcing strict idempotency with unique request IDs to prevent dangerous duplicate transactions upon recovery. Ultimately, it completely abstracts infrastructure instability away from the end user, turning critical outages into seamless, behind-the-scenes recovery events.
A developer project management and resource organization application designed to help developers organize projects, manage resources, and improve workflow efficiency. The application provides a structured way to manage development-related information and resources in one place.
ZeroPy Net Engine is a zero-dependency, concurrent HTTP/1.1 web server and routing framework built entirely from scratch using the Python standard library for Track C (Web & Network).
Key Technical Features:
- Zero Third-Party Dependencies: Uses strictly Python stdlib built-ins (socket, threading, re, urllib , mimetypes , argparse ).
- Raw Byte Buffer Parsing: Parses incoming raw TCP socket buffers directly into structured HTTP requests (method, path, headers, content-length body).
- Dynamic URI Pattern Matching: Native regex-based router supporting parametric URI routes (e.g., /api/users/<user_id>), query string decoding, and static asset streaming.
- Concurrency & Security: Thread-per-connection concurrency model with socket timeouts and strict path traversal protection to prevent directory attacks.
OfflineAid is an offline-first emergency preparedness assistant designed to provide essential emergency guidance even when internet connectivity is unavailable. It stores information locally using SQLite and runs with zero external dependencies, making it lightweight, reliable, and usable during situations where network access may be limited.
PocketDB is a lightweight, zero-dependency, crash-resilient embedded key-value database built in Python. Designed for simplicity and high performance, it combines single-file storage with Write-Ahead Logging (WAL) to guarantee ACID-compliant durability across unexpected crashes and system interruptions.
Key Features:
Zero External Dependencies: Built entirely with native Python modules.
Write-Ahead Logging (WAL): Ensures full data recovery and consistency after sudden process kills or system crashes.
In-Memory B-Tree Indexing: Delivers sub-millisecond key lookups and efficient point queries.
Process Concurrency Locks: Prevents multi-process write corruption using file-level locking.
Developer CLI: Simple command-line interface to initialize, set, get, and inspect database state seamlessly.
Dead Code Investigator is a zero-dependency Python static analysis tool that helps developers identify potentially unused code in their projects.
As software projects grow, unused functions, classes, imports, and legacy modules often remain in the codebase. Manually identifying and safely removing this code is time-consuming and can introduce bugs if developers accidentally delete code that is still being used.
The goal of Dead Code Investigator is to make code cleanup safer, faster, explainable, and dependency-free, demonstrating how much can be achieved using Python's standard library alone.
LAST_PROCESS is a terminal based C++ roguelike where we convert operating-system concepts into a high speed survival roguelike where you, a process, explore the procedurally generated filesystem, engage other processes in combat, whilst keeping your precious system resources such as your RAM in order.
- Combat against diverse enemy processes, with various effects
- RAM management as part of the game loop
- Procedurally generated dungeon floors
- enemy AIs, including pathfinding via the A* algorithm
- Deadlock, blocked states for processes
- Bosses themed around OS features
- Terminal UI ( curses )
- save and load functionality
- play-back support
- 100% C++ from the ground-up and zero dependencies (except when building for terminal ui! With ncurses)
Built over a few nights of the Zero Dependency 2026 72-Hour Hackathon. LAST_PROCESS blends systems programming with a fun, fast-paced roguelike experience.
“NEXUS is a zero-dependency, local-first digital intelligence platform that helps users search, analyze, secure, organize and automate their digital workspace — without sending their data to the cloud.”
LogLens is a zero-dependency Python tool that analyzes log files and turns raw log data into useful insights. It parses log entries, identifies log levels, detects common error patterns, calculates a log health score, finds the busiest hours, and shows the log time range. The results can also be exported as a JSON report. LogLens uses only Python Standard Library modules, making it lightweight, portable, and easy to run without installing external packages.
Code Auditor Pro is a professional-grade, zero-dependency Python security and code-quality scanner designed to identify vulnerabilities, security risks, and common programming mistakes in Python source code.
The application is built entirely using Python’s standard library, requiring no third-party packages, `pip install`, or internet connection. This makes it lightweight, portable, privacy-focused, and suitable for analyzing sensitive source code locally and offline.
Code Auditor Pro combines Abstract Syntax Tree (AST) analysis, regular expressions, function-call inspection, import analysis, and source-code pattern detection** to identify issues such as hardcoded passwords and API keys, authentication tokens, SQL injection risks, dangerous functions like `eval()` and `exec()`, unsafe system commands, insecure serialization, bare exception handling, excessive complexity, long lines, and potential SOLID violations.
The tool provides severity-based issue classification and an overall code health score, helping developers quickly understand the security condition of their code. It also includes Compare Mode, which identifies fixed issues, newly introduced vulnerabilities, remaining problems, improvements, and potential regressions between two versions of code.
Additional features include **JSON and CSV report generation, dependency and architecture visualization, actionable security recommendations, and fix suggestions** with explanations and safer alternatives.
The overall workflow is:
Python Code → AST & Pattern Analysis → Security Checks → Issue Detection → Severity Classification → Health Score → Fix Suggestions → Report**
Code Auditor Pro is designed for secure coding, code review, vulnerability detection, academic projects, security education, development-time analysis, and offline security auditing. It was developed for the Zero Dependency Hackathon 2026 – Track .
QueueLess is a lightweight digital queue management system designed to reduce unnecessary waiting in physical queues. Customers can scan a QR code, select a service, enter their details, and join the queue remotely. They receive a queue token and can track their position, estimated waiting time, active counters, and set reminders for their upcoming turn.
The management side provides a centralized dashboard for monitoring the queue, counters, and analytics. Staff can call customers, complete services, and mark customers as no-show. The estimated waiting time is dynamically calculated based on the selected service, people ahead in that service queue, service time, and active counters.
QueueLess is built using Python, SQLite, HTML, CSS, and the Python standard library, providing a lightweight solution for improving queue transparency and reducing unnecessary physical waiting for both customers and staff.
A real-time multiplayer chess backend built entirely with Node.js standard-library APIs.
The project provides user authentication, session management, matchmaking, real-time multiplayer gameplay, chess move validation, game state management, draw handling, resignation, and game results — without using any third-party runtime packages.
Jsearch is an embedded search engine to search on docs . it is built in core java with no external dependencies . i reads the docs and creates an inverted index on the words from the docs and when u search it gives which docs contains that word.
HookSmith is a zero-dependency webhook reliability laboratory built entirely with Python’s standard library.
It helps developers capture, inspect, securely verify, replay and reliability-test webhook deliveries without installing Flask, Requests, cryptography libraries, databases or testing frameworks.
HookSmith provides a local browser dashboard, persistent JSONL capture storage, HMAC-SHA256 signature verification, secret redaction, cURL export, webhook replay and concurrent chaos testing.
Its automatic reliability audit checks four important webhook behaviours: successful normal delivery, duplicate awareness, invalid-signature rejection and corrupted-payload rejection. The audit generates a clear PASS/FAIL report that can also be used in automated workflows.
The complete runtime application is implemented in a single hooksmith.py file. It uses only Python standard-library modules such as http.server, urllib, argparse, hmac, hashlib, json, pathlib, threading and unittest.
The project includes an empty dependency manifest, automated dependency proof, 13 standard-library unit and integration tests, documented package substitutions in STDLIB.md and reproducible release archives with byte-identical SHA-256 hashes.
# AlgoViz — Interactive Algorithm Playground
AlgoViz is a zero-dependency, browser-based algorithm visualizer and simulator designed to make complex algorithms easy to understand through real-time visual interaction.
Instead of only reading code or theoretical explanations, users can watch algorithms execute step by step. AlgoViz currently supports popular sorting, searching, and graph traversal algorithms, including Bubble Sort, Selection Sort, Insertion Sort, Linear Search, Binary Search, BFS, and DFS.
The platform provides animated visualizations, live operation counters, algorithm complexity information, speed controls, target-based searching, random data generation, and pause/resume functionality. Every important operation—such as a comparison, swap, selection, or graph-node visit—is represented visually.
## Why Open / Wildcard?
AlgoViz fits the Open / Wildcard category because it combines an interactive visualizer and simulation engine. It transforms abstract algorithmic processes into an interactive digital simulation that users can explore and control.
The project can also be extended into other simulation-based tools such as pathfinding visualizers, CPU scheduling simulators, compression visualizers, memory-management simulators, and pseudocode interpreters.
## Problem Statement
Algorithms are often difficult for beginners to understand because their execution happens inside code and is not visually obvious. Students may understand the theory but struggle to visualize how comparisons, swaps, searches, queues, and graph traversal actually work.
AlgoViz addresses this problem by converting algorithm execution into an interactive visual experience.
## One-Line Pitch
AlgoViz turns algorithms from code you read into processes you can see, control, and understand.
Project Archaeologist is a zero-dependency Python CLI tool designed to analyze unfamiliar or legacy codebases. By scanning directory structures, Git commit history, code patterns, and open TODOs, it identifies key file relationships and development hotspots to transform complex repositories into clear, actionable reports.
ZeroProof is a zero-dependency developer tool that verifies whether a project truly uses no external package dependencies.
It scans supported dependency manifests such as Python requirements files, Node.js package.json, Go go.mod, and Rust Cargo.toml, detects declared dependencies, handles malformed manifests, and produces both human-readable and JSON reports.
The project is built entirely with Python's standard library, with no third-party runtime dependencies. It also documents standard-library replacements and the reasoning behind the zero-dependency design in STDLIB.md.
ZeroProof is designed to make “zero dependency” claims verifiable instead of relying on manual inspection.
Our project is an AI-Driven Adaptive Honeypot designed to combat zero-day threats. It bridges network simulation and data science by deploying a decoy server to capture real-world attacker interactions, parsing the unstructured logs, and converting them into mathematical features for unsupervised ML clustering. We achieved 100% zero-dependency execution by intentionally eliminating packages like pandas and paramiko, building a custom raw TCP Telnet attack simulator and a native CSV mathematical scaler using only the Python standard library.
FORGE is a complete, self-contained experimental computing ecosystem written from scratch in pure C17 and x86 assembly. It demonstrates how modern computing abstractions can be constructed entirely from first principles without relying on third-party frameworks, external databases, machine learning libraries, or web servers.
VaultLog — Zero-Dependency Embedded Key-Value Store
by Olix
@tanyagarg0371
VaultLog is a zero-dependency, persistent embedded key-value store built entirely with Go 1.27 standard library.
Instead of wrapping SQLite or relying on third-party database packages, VaultLog implements its own storage layer using an append-only log, in-memory indexing, persistence, and restart recovery. Users can store, retrieve, delete, and inspect key-value data through a simple CLI.
The project demonstrates how far a practical storage engine can go without external dependencies while keeping the implementation readable, reproducible, and easy to inspect.
Key features:
* Persistent key-value storage
* Append-only write log
* In-memory indexing for fast lookups
* Data recovery after process restart
* Set, get, delete, list, and stats commands
* Standard-library based hashing, filesystem operations, concurrency, and testing
* Zero third-party runtime dependencies
VaultLog is designed around the core idea of Zero Dependency: don't hide complexity behind a package—understand and implement the layer yourself.
Database-from-scratch
A lightweight database engine built from scratch in C, with the goal of understanding how database systems work internally.
Instead of relying on an existing database library or storage engine, this project implements the fundamental components of a database system manually — including page-based storage, serialization, a pager/cache layer, cursors, and a B-Tree-based indexing structure.
Features
Persistent Storage: The database is saved to a single file.
B-Tree Implementation: Data is organized in a B-Tree to allow for efficient insertions and lookups, even as the database grows.
REPL Interface: Interact with the database through a simple command-line shell.
Basic SQL Commands:
insert <id> <username> <email>: Inserts a new record.
select: Retrieves and displays all records.
Meta-Commands:
.exit: Exits the database shell, saving all changes to the file.
.constants: Displays the size of various data structures.
.visualize: Prints a visual representation of the B-Tree structure.
Features
Core Database Operations
Currently supported:
Insert records
Select and display records
Duplicate ID detection
Input validation
Persistent database files
Interactive command-line interface
The parser recognizes insert and select statements, while invalid statements are rejected.
B-Tree Storage
The database uses a B-Tree-style structure consisting of:
Leaf nodes
Internal nodes
Root node
Parent pointers
Child pointers
Leaf-to-leaf links
Leaf nodes store the actual records, while internal nodes store keys and references to child nodes.
Binary Search
Searching inside both leaf and internal nodes uses binary search.
This allows the database to locate the appropriate position for a key without scanning every record sequentially.
Node Splitting
When a leaf node becomes full, the implementation:
Creates a new leaf node.
Splits the records between the old and new nodes.
Updates the linked-leaf relationship.
Updates parent information.
Creates a new root when necessary.
Inserts the new node into its parent.
Internal nodes can also split when their capacity is reached, allowing the B-Tree to grow beyond a single level.
Persistent Storage
Database pages are backed by a file descriptor and written to disk using low-level file operations such as lseek() and write().
When the database closes, cached pages are flushed to the database file before memory is released.
Page-Based Architecture
The storage layer works with fixed-size pages.
StudySift is a zero-dependency Python CLI tool that converts lecture transcripts into structured study notes. It analyzes the transcript to extract keywords, definitions, examples, important points, and important sentences, then generates organized revision-friendly notes. StudySift is built entirely using Python's standard library with no third-party runtime dependencies.
📌 Summary
Smart Commit Messenger is an AI-powered Git workflow automation CLI tool built with zero third-party runtime dependencies (pip install packages = 0). It inspects code diffs, queries a local AI model (Ollama) via pure standard-library HTTP sockets, generates 3 Conventional Commit options, and automates staging, committing, pushing to GitHub, and local spreadsheet history logging—all with a single command.
📦 Zero-Dependency Craft (Standard Library Engineering)
Built 100% using Python 3 standard library modules:
urllib.request + json: Replaced requests/httpx to communicate with local Ollama API (http://localhost:11434).
os + open(): Replaced python-dotenv with a custom .env file parser (Logic/config.py).
subprocess.run: Replaced third-party Git wrappers to execute native git CLI operations.
Native ANSI Escape Codes (\033[...]): Replaced rich/colorama for colored terminal headers and formatted diff statistics.
threading.Thread + sys.stdout: Replaced yaspin/halo with a multithreaded braille loading spinner (⠋ ⠙ ⠹).
argparse: Replaced click/typer for CLI flag handling (-y, --dry-run, -h).
csv + datetime: Managed local history logging to commit_history.csv with formula injection sanitization (=, +, -, @).
unittest + unittest.mock: Test suite covering stdlib HTTP parsing, git commands, and security sanitization.
✨ Key Features
🎯 3-Choice AI Commit Options: AI generates Short, Scoped (feat(auth): ...), and Action-Oriented options for the user to select, edit, or customize.
🔒 100% Private Local AI: Integrates with local Ollama models (qwen2.5-coder), keeping code 100% private.
⚡ Ultra-Fast Startup: Cold-start latency under 40ms (5x faster than heavy framework tools).
📁 Auto-Staging & Upstream Linking: Auto-stages untracked files (git add .) and sets branch tracking (git push -u).
MiniDB is a lightweight, file-based database engine built entirely using Python's standard library with zero external dependencies. It provides an interactive SQL-like command-line interface supporting table creation, INSERT, SELECT, WHERE filtering, UPDATE, DELETE, persistent storage, and table listing.
The project demonstrates how core database functionality can be implemented from scratch without relying on third-party database packages. Data is persisted locally using JSON, making MiniDB portable, transparent, and easy to run on any standard Python 3 installation.
Our focus was not just removing dependencies, but understanding and rebuilding fundamental database concepts using only the tools provided by the language itself.
NetDoctor is a lightweight network health diagnostics tool built entirely using pure Python standard library — with zero external dependencies.
It allows users to quickly check the health of any website by performing essential network tests such as DNS resolution, TCP port connectivity, HTTPS/TLS certificate validation, HTTP status checks, and latency measurement. Based on the results, it generates a clear health score out of 100 along with a grade (A to F) and simple, human-readable advice
ZeroTrack is an enterprise-grade, cookieless web analytics platform featuring a custom Machine Learning bot-defense engine. Engineered exclusively for the Package Killer track, we eliminated all bloated frameworks—using absolutely no third-party libraries like Express.js, Chart.js, or Scikit-learn.
Key technical achievements:
Native ML Engine: A custom Gaussian Naive Bayes classifier built with pure Python math to detect and block DDoS scrapers in real-time.
Cookieless Tracking: Built-in hashlib SHA-256 session generation for privacy-compliant, lightweight analytics.
Raw SVG Rendering: The Python backend calculates coordinate geometry to output native SVG charts and CSS gradients directly, bypassing heavy frontend libraries.
Everything runs entirely on the Python standard library and vanilla JavaScript. Please refer to our STDLIB.md file in the GitHub repository for our complete architectural breakdown and dependency evaluation.
DevLens is a zero-dependency Chrome extension that helps developers and beginners understand the time complexity of JavaScript code. It analyzes code, detects common loop patterns, estimates complexity such as O(1), O(n), and O(n²), and allows users to save analysis results as capsules. The project is built using HTML, CSS, JavaScript, and Chrome Extension APIs without external runtime dependencies.
Ward-A Developer Workflow CLI with zero npm packages
by Team Paradox
@nikhi7117
@Aman826105538
@tejas_amrutkar_81149
**Ward is a single-file, zero-runtime-dependency Node.js 24 CLI for everyday developer workflows. It combines file watching, dependency-aware task execution, project health checks, linting, and project initialization using only Node.js built-in APIs. Ward is designed to replace common development utilities without npm runtime dependencies, while providing a clean CLI, CI-friendly exit codes, JSON output, and honest stdlib-based implementations.**
FileFlow is a lightweight, zero-dependency command-line file management and directory scanning tool built entirely with Python's standard library. It provides a simple and script-friendly CLI for inspecting directories, identifying files and folders, and handling invalid paths with clear error messages.
The project focuses on the Developer Tools & CLI track and demonstrates practical concepts including command-line argument parsing, filesystem operations, input validation, error handling, structured terminal output, and automated testing.
FileFlow is designed to be fast, portable, easy to use, and suitable for developers who need a simple filesystem utility without installing third-party packages.
Key highlights:
Zero third-party runtime dependencies
Clean command-line interface
Directory and file scanning
Input/path validation
Clear error handling
Automated tests
Built using Python's standard library
Technology: Python, argparse, pathlib, and standard-library modules.
Every year, floods displace millions of people — but the real problem isn't just the flood, it's the information gap. People don't know if they're at risk, where to go, or what to do when they lose internet. And responders don't know who needs help first, or which shelter is running out of resources.
That's why we built AAPDASETU — 'Warn Early. Navigate Safely. Survive Smarter.'
It's an offline-first flood emergency platform. Let me show you what makes it different.
First — our risk score isn't a black box. It shows you exactly why your area is at risk — rainfall, rising water levels, proximity to flood zones — with a transparent breakdown.
Second — our shelter finder doesn't just show you the closest shelter. It calculates a Safety Score based on capacity, resources, and current risk, so you go somewhere that's actually safe.
Third, and this is our biggest feature — Offline Emergency Mode. This is a real Progressive Web App. Watch — I'll turn off the internet right now... and the app still shows cached shelters, hospitals, and emergency contacts. Because during a real flood, connectivity is the first thing you lose.
And on the responder side, we have an AI-assisted rescue priority engine and a relief resource predictor that tells admins before a shelter runs out of water or food.
AAPDASETU isn't just an alert app — it's a complete emergency ecosystem, from warning to rescue, built to work even when the network doesn't."
NetScope – Zero-Dependency Self-Diagnosing Network Observatory
NetScope is a lightweight network observability and diagnostic platform designed to simplify network monitoring and troubleshooting through a unified web interface. It monitors HTTP services, performs DNS resolution checks, tests TCP connectivity, measures network latency, and tracks service availability in real time.
The key feature of NetScope is its concurrent diagnostic engine, which performs multiple network checks simultaneously instead of sequentially. Based on the collected results, the system identifies service failures and provides basic fault classification, such as DNS resolution failure, unreachable TCP service, or unavailable HTTP service.
NetScope provides a real-time dashboard with network health metrics, service status, response-time analytics, alerts, and diagnostic logs. Its zero-dependency approach keeps the system lightweight and easy to deploy, while the modular architecture allows it to be extended with additional network diagnostics in the future.
Key Highlights:
HTTP/HTTPS service monitoring
DNS diagnostics and resolution-time measurement
TCP host and port connectivity testing
Concurrent network diagnostics
Automatic fault detection and classification
Real-time network monitoring dashboard
Alerts and diagnostic logs
Lightweight zero-dependency architecture
NetScope aims to transform network troubleshooting from a collection of separate diagnostic tools into a single, fast, and easy-to-understand observability workflow.
Detect. Diagnose. Monitor. Recover.
Prayatna AI is an AI-powered Interview Assistant designed to help users prepare for and improve their interview performance. The application simulates real interview scenarios, asks role-specific questions, analyzes the user's responses, and provides personalized feedback on communication, confidence, technical knowledge, and overall performance. It aims to make interview preparation more interactive, accessible, and data-driven.
Sentiscope is a high-performance, rule-based sentiment analysis and text intelligence engine built with absolute zero third-party runtime dependencies using the pure Python standard library.
Modern NLP pipelines often carry hundreds of megabytes of external dependencies (nltk, spacy, transformers, fastapi). Sentiscope strips away that bloat:
Lexicon & Tokenization: Replaced third-party NLP libraries with optimized native regular expressions (re), string manipulations, and valence intensity algorithms.
Negation & Amplifier Logic: Implements contextual sentiment parsing (valence shifters, intensifiers, punctuation emphasis, and emoji mapping) via native dictionaries and collections.
Zero-Dep HTTP Server & CLI: Uses Python's built-in http.server and argparse to deliver both an instant terminal interface and a local analytics dashboard.
Testing & Storage: Tested using native unittest and structured with zero external manifests.
It builds and executes instantly with a single command on any standard Python environment. Full package-to-stdlib mapping is detailed in STDLIB.md.
Vault Studio is a lightweight local media streaming server built in pure Python with zero external dependencies (no Flask or Django required).
Key Features:
- HTTP 206 Range Requests for smooth, buffer-free video scrubbing and seeking.
- Instant streaming of local video, audio (with dynamic visualizer bars), and photo assets.
- Auto-generated local IP and QR code for instant cross-device sharing on the same Wi-Fi network.
- Modern glassmorphism dark UI optimized for mobile control.
RunProof is a simple software verification tool that checks whether a project can run reliably on another computer. Developers often face problems when sharing projects because of missing dependencies, incorrect configurations, environment differences, or build errors.
RunProof analyzes a project and checks its files, runtime requirements, dependencies, environment variables, and possible issues. It can also build the project twice and compare the generated results using SHA-256 fingerprints. If both builds produce the same result, the project is marked as reproducible.
The tool provides a readiness score, identifies problems, and generates a RunProof Passport/report containing the verification results. It also includes safe analysis features so projects are not executed unnecessarily.
RunProof helps developers confidently share and deploy software by providing proof that the project is ready and reproducible, instead of simply saying, “It works on my machine.”
RunProof — Build. Verify. Prove.
Chercheva is a search engine written purely in C. It uses the TF-IDF algorithm to provide locally indexed search across documents of various types. Currently, it supports .html and .txt files.
It is a local search engine built in pure C, with its own tokenizer, indexing pipeline, and data structures. The goal is to keep the entire stack under our control rather than pulling in a collection of libraries for functionality that we can implement ourselves.
Chercheva was built around a simple problem: searching documentation shouldn't require waiting for the documentation to be searched. As a practical example, the project currently indexes the GDB documentation locally, turning what would normally be a scan through hundreds of files into a near-instant lookup against a pre-built index (even the indexing is near-instant and fast for upto 100 files taking just a few milliseconds). Once indexed, finding a function, command, option, or concept is effectively immediate, making Chercheva useful as a lightweight, offline documentation search tool than a yet another search engine.
The project currently uses a few third-party libraries for HTML parsing and indexing, but none of them are hard dependencies. They were used primarily because of time constraints during development.
The HTML parser can be replaced with the homemade tokenizer we already have, with no major impact on search quality. This is largely because the search pipeline is based on TF-IDF, where the quality of the extracted terms matters more than having a sophisticated HTML parsing stack.
A JSON library is also currently used for storing the index. That's not actually necessary either. The index can be represented as a C struct, written directly to disk as raw binary, and reconstructed by reading it back into the same structure. JSON is currently used because it makes the index human-readable, easy to inspect and debug, portable across implementations, and much easier to iterate on while the index format is still changing. For the final no-dependencies version, however, it can be removed entirely.
The only reason this project currently has dependencies is that I didn't have enough time to remove them. None of the dependencies are hard-dependencies, which means they can be removed with virtually no impact on the performance or the search quality.
We created an automated secure, scalable, zero-dependency visual code analytics engine , which generates readme.md documentation to make developers lives atleast a little bit easier.
env-guard is a lightweight command-line tool designed to stop developers from accidentally leaking sensitive data like API keys, passwords, and AWS credentials into their code repositories. Built strictly with Python's standard library, it runs immediately out-of-the-box on any system without needing third-party packages or complex setup. The script recursively scans project files using regex patterns, instantly masking detected secrets in the terminal to keep the output secure. It also performs hygiene audits by verifying that .env files are tracked in .gitignore and checking that .env.example contains all required project variables. By providing color-coded warnings and standard exit codes, it integrates seamlessly into local developer workflows or automated pre-commit hooks to keep codebases safe.
LexaGuard AI is an autonomous legal contract intelligence platform powered by a ten-agent LangGraph pipeline. Users upload any contract in PDF, DOCX, or plain text format. 10 specialised AI agents then process the document end-to-end: extracting text, segmenting clauses, classifying them into ten legal categories, extracting key metadata, comparing against 50+ standard templates using hybrid RAG retrieval, scoring risk as HIGH, MEDIUM, or LOW, generating chain-of-thought legal reasoning, translating to plain English, producing safer clause rewrites, and exporting a full structured report. The entire analysis is completed in under minutes and delivered through a seven-page interactive Streamlit dashboard at ₹999 per month as future scope.
CrimeRakshak is an AI-powered crime intelligence and investigation platform designed to help law-enforcement personnel analyze crime data, detect hidden relationships, identify crime patterns, and support investigative decision-making.
It combines Conversational AI, Computer Vision, Crime Analytics, Graph Intelligence, Predictive Analysis, and Explainable AI to transform complex crime records and multimedia evidence into actionable intelligence.
The platform can analyze FIRs, accused/victim information, locations, criminal histories, relationships, financial links, crime trends, and CCTV/video or image evidence. Its AI Investigation module uses YOLOv8, ByteTrack, event analysis, and Gemini Vision to extract evidence from images/videos and generate structured, evidence-grounded investigation reports.
ZeroQL is a SQL-like query engine for CSV and JSON files, built from scratch with zero third-party dependencies. It has its own lexer, a hand-written recursive-descent parser, a real AST, and an evaluator — supporting SELECT/WHERE/GROUP BY/HAVING/ORDER BY/LIMIT, aggregate functions (COUNT, SUM, AVG, MIN, MAX), BETWEEN/IN/IS NULL, and CSV/JSON/table output. Run it as a one-shot CLI query or drop into an interactive REPL. --tree and --ast flags expose the parser's internals for anyone curious how a query actually gets executed.
Ransomware Behaviour Detection Engine is a cybersecurity project that detects ransomware attacks by monitoring suspicious activities such as rapid file encryption, mass file modification, unusual file renaming, deletion, and abnormal process behaviour. When ransomware-like behaviour is detected, the system generates an alert and can block or isolate the suspicious process to prevent further damage.
LeakLens is a zero-dependency security tool built entirely with the Python standard library. It scans source code, directories, and Git history to detect potentially exposed secrets such as API keys, passwords, AWS access keys, JWT tokens, and private keys.
The scanner uses pattern-based detection, Shannon entropy analysis, confidence scoring, and risk classification to identify suspicious credentials. Detected secrets are masked in the output to avoid exposing sensitive information.
LeakLens also supports recursive file scanning, Git history scanning, structured JSON output, and automated testing.
The project has zero third-party runtime dependencies and uses only Python standard-library modules such as re, pathlib, math, json, subprocess, and unittest.
**Sentinel AI is an AI-powered safety and security platform that detects potential threats or unusual activities in real time. It uses AI to analyze data, identify suspicious behavior, and provide quick alerts so that users or authorities can take action before the situation becomes serious.**
Specula answers it automatically. It's a zero-dependency project linter. It scans a codebase for leaked secrets, dependency bloat, weak tests, incomplete docs, and missing CI. Then it hands back a transparent letter grade. And it's built entirely with the Go standard library. Not a single external package.
Small and marginal farmers across India often lack access to timely, personalised, and reliable agricultural guidance for everyday decisions. Farmers must make critical choices about crop selection, soil nutrients, irrigation, crop health, and changing weather conditions, yet the information needed for these decisions is frequently scattered across different sources and difficult to interpret. Current agricultural advisory approaches can be generic, reactive, or insufficiently tailored to the specific conditions of an individual field. This becomes particularly challenging because soil conditions, weather patterns, crop requirements, and biological stresses can vary significantly between regions and even between fields. Farmers may therefore receive information without having a clear understanding of what action is appropriate for their particular situation. Limited access to technical expertise, digital tools, and integrated field-level information further increases this gap, especially for small and marginal farmers. The absence of connected agricultural infrastructure also limits the ability to combine field observations with environmental and crop-health information for timely decision-making. As a result, farmers may struggle to respond early to crop stress, use agricultural resources efficiently, or adopt more sustainable and climate-resilient practices. The problem we aim to address is therefore not simply a lack of agricultural data, but the lack of an accessible system that can bring relevant information together and translate it into understandable, actionable, and field-specific guidance for farmers.
HomeVault is an offline, zero-dependency Java command-line application for managing local property data and estimating house prices.
Users can import house records from CSV files, search and filter listings, view location-wise price statistics, and get an explainable price estimate based on similar properties in the same location. It stores data locally, reloads it after restart, prevents duplicate records, and uses only the Java standard library—no frameworks, databases, external APIs, or third-party libraries.
Zero-Dependency Storage Engine is a lightweight, persistent key-value storage system built from scratch using only Python’s standard library, with no third-party databases or runtime dependencies.
The engine directly manages a binary storage file and implements its own record format, serialization, validation, persistence, retrieval, updating, deletion, and scanning mechanisms. Each operation is stored as a structured record containing a header, payload, and SHA-256 checksum, allowing the system to verify data integrity and detect corrupted records.
It supports essential operations such as PUT, GET, UPDATE, DELETE, and SCAN. The system uses an append-only log-structured design, where changes are added as new records instead of modifying existing data. When reading the database, records are processed sequentially and the latest operation determines the current state of each key.
The implementation also includes defensive validation for malformed headers, invalid record types, incorrect payload sizes, incomplete records, checksum mismatches, empty keys or values, and unexpected data.
Automated tests verify core operations, persistence, updates, deletions, Unicode data, encoding/decoding, and error handling.
By building these mechanisms without external dependencies, the project demonstrates the fundamentals of reliable storage systems, including binary serialization, file I/O, data integrity, append-only logging, persistence, and state reconstruction.
npm runs a package's postinstall script as your user, during install, before you have read a line of it. It is the earliest point code executes on a developer machine and the least watched. Every tool I tried reports on it afterwards, once node_modules already exists, which means the script has already run. A report is not a defence.
quarantine is a local npm registry proxy that sits in the path. It filters the packument before npm's resolver ever sees it, so versions inside a cooldown window simply do not exist, and it rewrites every tarball URL back at itself so npm cannot fetch around it. Tarballs are hashed and walked in memory before they are served. Five rules: cooldown, install scripts, new publisher, integrity, and trivial size. When one fires, npm gets a 403 and the install fails.
Go, standard library only. go.mod has no require block. Fourteen npm and Go packages were replaced by hand, and STDLIB.md records what each substitution gave up.