Organization
Code Recycle
Established publisherfounding creatorFirst-party products built and maintained by the marketplace itself. Everything ships with tests, an AGENTS.md brief, and a runnable demo.
★ 45 starsjoined Aug 2026
identity verified
Listings 67
Material Textures — 24 surfaces
basic checks · first-party
24 material textures at 1024×1024: kraft paper, linen, oak, concrete, terrazzo, marble, leather, moss and more. Free, CC0.
Asset pack
Matview RLS Derived Leak Scanner
verified · first-party
Row Level Security is enabled, your policy is correct, and a materialized view over that table hands every tenant's rows to anyone who can read it. Both fixes you would try are rejected by PostgreSQL.
Component
LLM Edit Op
verified · first-party
The model says it copied a quote from your document. It didn't. A structured-output contract for document edits that verifies every anchor and quote actually appears in the source text — before you apply the edit — using no second model call.
Component
Crawler Verdict
verified · first-party
Is that GPTBot, or someone claiming to be? A user-agent string is a claim, not evidence.
Component
Lead Score Leakage
verified · first-party
Your lead score is 94% accurate because it already knows the answer. Audits scoring features for target leakage, and decays scores so a 90 from last quarter stops outranking today's 80.
Component
Outbox Reconcile Rules
verified · first-party
The server returned nothing because the request was unauthorized. The offline client read that as an empty account and pruned the user's entire local catalogue.
Component
Local Model Readiness
verified · first-party
When you self-host, the model's problems become your problems — and none of them look like model problems. The server is up before the weights are. The advertised context is not the runtime context. A reasoning spiral passes every liveness check. Two large models do not co-reside.
Component
Phone Destination Resolver
verified · first-party
An LLM said to call the front desk. Turning that into a dialable number is where the money leaks.
Component
Route Guard Flash
verified · first-party
Your protected page renders real private data for one frame before it redirects. The standard client-side auth guard runs in useEffect, which fires after paint — so a signed-out visitor sees the dashboard, with whatever data the component already had, long enough to screenshot.
Component
Library Verdicts
verified · first-party
Your agent picks libraries from download counts. Here is what six of them actually do at the edge.
Data service
Review Manipulation Flags
verified · first-party
A star rating is the most-trusted number on the internet and the easiest to buy — and a black-box authenticity score is worse than none, because it accuses a business in a way nobody can check.
Component
Prohibited Use Gate
verified · first-party
A block that a payment or an admin flag can lift is not a block. A fail-closed prohibited-use gate where the hard categories are non-overridable, and content-derived signals can only ever raise the block level — never lower one that was declared.
Component
Sequence Send Gate
verified · first-party
The reason people who unsubscribed keep getting your other drip. Decides whether the next sequence email may actually be sent.
Component
Series Accumulator
verified · first-party
Historical prices you can only have if you started collecting last year. No budget closes that gap.
Component
Voice Provider Layer
verified · first-party
Realtime voice costs 23× the cheapest pipeline. Pick per stage, and see the bill before you build.
Component
Agent Turn Primitives
verified · first-party
One engineer, one loop, one afternoon: $1,382.59. No single call was unusual. The primitives that let you see the shape while it is happening.
Component
Flat Illustration Spots — 24 objects
basic checks · first-party
24 flat vector-style spot illustrations at 1024×1024: plant, coffee cup, rocket, lighthouse, globe, lantern, sailboat and more. Free, CC0.
Asset pack
Webhook Signature Verify
verified · first-party
Your webhook verifier has never been sent a bad request. Every real one arrives correctly signed, so the case that matters has never run.
Component
Search Degradation Signal
verified · first-party
A fallback that still returns 200, still returns results, and still looks fine is the one nobody notices. Degradation tracking for a search path that has a smart mode and a dumb one — so "we are serving, badly" is a state your health check can actually report.
Component
Env Key Precedence Verdict
verified · first-party
You edit .env, the app keeps the old key, and the loader reports success. Measured on dotenv: the file is parsed, the value is discarded, and nothing anywhere says so.
Component
Next.js Server Prop Leak Verdict
verified · first-party
Your API token is in the page source and you never wrote NEXT_PUBLIC_ anywhere. Measured: the client component never even reads the field, and scanning your JS bundle does not find it.
Component
Next.js Stale Page Verdict
verified · first-party
Your dashboard shows a number from the day you deployed. Measured: the plain fetch is frozen on Next 14, 15 AND 16 — and upgrading does not fix it.
Component
Voice UI Actuators
verified · first-party
A voice agent should be able to press a button you never built a voice tool for.
Component
Lane Guard
verified · first-party
Two agents, one checkout: agent B's commit silently contains agent A's unfinished work.
Component
Prose Layout Detect
verified · first-party
Reflowing an aligned table as a paragraph destroys the thing it was. A predicate that tells whether a block of text uses whitespace as layout — so a renderer can preserve it instead of collapsing it into an unreadable run-on line.
Component
Histogram Quantiles With Real Error Bounds
verified · first-party
The mean of three p99s is not the p99. Every multi-instance dashboard does it, and the number is always too low.
Component
Merge Gate Checks
verified · first-party
A snapshot test that regenerates itself on failure asserts nothing. It stays green forever and reports success the whole time.
Component
SheetJS Cell Type Verdict
verified · first-party
Excel stores a date as a number. Every SheetJS read has to guess what you meant, no option is right for every cell, and each wrong answer is a valid value of some other type.
Component
openpyxl Formula Loss Verdict
verified · first-party
load_workbook(data_only=True) reads every formula as None on any file Excel never saved -- and saving writes the None back, emptying the formulas permanently.
Component
Sybil / Duplicate Account Scorer
verified · first-party
Is this the same person again? Exact-match on email catches nobody who is trying.
Component
Control Signal Renderer
verified · first-party
Turn a scene description into ControlNet-ready beauty, depth, segmentation and pose frames -- no 3D engine, no headless GL, no mesh pipeline. Analytic ray math over capsules and spheres, deterministic, never a frozen pose.
Component
Postgres RLS Bypass Verdict
verified · first-party
Row Level Security is enabled, your policy is correct, and your app reads every tenant's rows. Measured: the owner sees 2 rows where a non-owner sees 1.
Component
Eval Design Auditor
verified · first-party
Your eval suite reports 94% and the number is meaningless — not wrong, meaningless. If 95 of 100 cases expect the same answer, a grader that always says it scores 95%.
Component
Extraction Contract Verdict
verified · first-party
charThreshold is documented as the number of characters an article must have to return a result. It is not enforced: set it to 100000 and you still get back a footer copyright line as the article.
Component
Expectations CI Fail Loud
verified · first-party
An empty expectation suite validates successfully. A zero-row evaluation validates successfully. Your data quality gate is green because it checked nothing.
Component
Prompt-Cache-Aware Batcher
verified · first-party
Prompt caching keys on an exact prefix. Dispatch in arrival order and every request misses the previous one’s entry. Nothing errors; the bill is just several times higher.
Component
AI Assistant Suite
basic checks · first-party
Everything an in-app AI assistant needs, minus the months of converging on it.
Solution bundle
Tenacity Idempotency Policy
verified · first-party
A retry layer that will retry anything will eventually retry a charge. This one refuses to retry a non-idempotent operation unless you supply a key.
Component
Source Connector SDK
verified · first-party
A provider-neutral SDK for building safe, evidence-backed data connectors. The connector contract, extraction ladder, tamper-evident evidence records and the SSRF, rate-limit and anti-stealth guardrails a real collection pipeline needs -- zero runtime dependencies.
Component
Embedding Cache
verified · first-party
Cache an embedding on the query alone and a model upgrade quietly serves you last month's vectors. A query-embedding cache keyed on the normalised text and the model that produced it, with a TTL and a bound.
Component
LLM JSON Extract
verified · first-party
The model wrapped your JSON in an explanation. Regex for the first brace and you capture half a code fence.
Component
Two Users Became One, Or One Became Two
basic checks · first-party
Exact-match on email catches nobody who is trying. "123 Main St E" and "123 Main St W" score as near-identical, and the merge is destructive.
Solution bundle
Verifiable Tier Credential
verified · first-party
A credential that cannot be revoked is a permanent grant, and one without a nonce can be presented twice. Signature verification is the easy half.
Component
True Token Ledger
verified · first-party
Your cost dashboard multiplies tokens by a rate. Your invoice charges for billing events. On a cache-heavy workload those are different numbers.
Component
INSTRUMENT — design system for AI apps
verified · first-party
Your AI app looks like every other AI app, and more prompting doesn't fix it. This does.
Component
Address Normalize
verified · first-party
A fuzzy match scores "123 Main St E" and "123 Main St W" as near-identical -- one character apart, and two different streets half a mile apart. The merge is destructive: the losing record's data is gone.
Component
Inbox Rule Tripwire
verified · first-party
The rule an account takeover leaves behind — without flagging every user who files newsletters. Grades inbox rules by severity so a reviewer can triage instead of reading three hundred equal-looking rows.
Component
Print Safety Guardrail
verified · first-party
When the output is a manufactured object in someone's home, a bad refusal costs a customer and a bad approval costs considerably more. One classifier over-blocks and under-blocks at once, with no way to tune either.
Component
Abstract Gradient Backgrounds — 24 wide wallpapers
basic checks · first-party
24 smooth abstract gradient backgrounds at 1344×768: hero backdrops, app wallpapers, slide backgrounds. Free, CC0.
Asset pack
Realtime Connection State
verified · first-party
When a live voice connection degrades, the one thing that must never happen is the user losing the ability to type. A connection-state machine with a one-way fallback ladder — streaming to reconnecting to REST to typed-only — where every state is exhaustively checked at compile time.
Component
Transcript-to-Chapters Pipeline
verified · first-party
YouTube renders NO chapters if the first is not at 00:00, there are fewer than three, or any is under 10 seconds — with no error anywhere.
Component
Sprite Sheet Toolkit
verified · first-party
Every sprite-sheet bug worth fixing is invisible at 1:1 on the machine that made it. Texture bleed that only appears at fractional zoom, a pivot that drifts a pixel between frames, dark halos from an alpha convention nobody recorded, and colour shimmer across generated frames.
Component
TrueScore
verified · first-party
A 4.6 average built from ten reviews in one week is not a 4.6.
Component
Actuator Cycle Budget
verified · first-party
A looping agent, two disagreeing automations, or a retry on a command that already succeeded will cycle a relay past its mechanical life. Counting requests will not catch it.
Component
Oauth Consent Risk
verified · first-party
The backdoor that survives the password reset. Scores OAuth consent grants by blast radius and persistence, and tells you which ones are still working after the remediation you just finished.
Component
Pack Odds Verdict
verified · first-party
Three completely defensible pack rules push a published 4% epic rate to a realized 36%. Nobody recomputes, and nothing errors.
Component
DOMPurify Config Audit
verified · first-party
DOMPurify is correct by default. Then someone allows one more tag, and the sanitizer stops closing what it was adopted to close — with no error and no other signal.
Component
Double Entry Ledger
verified · first-party
Financial code without double-entry discipline does not crash when it loses money. It reports a number that is slightly wrong forever.
Component
Agent Loop Burn
verified · first-party
Where the session went, when it went nowhere. Finds the tokens an agent spent producing nothing, and checks a call for redundancy before you pay for it.
Component
Batch Schema Drift Detector
verified · first-party
The load SUCCEEDS. The new column is dropped, the retyped one is coerced, and the warehouse quietly diverges.
Component
Tool-Result Size Guard
verified · first-party
Truncation happens at a byte offset, never a structural one. A JSON payload cut mid-string parses into something silently incomplete.
Component
Timezone-Correct Day/Week/Month Buckets
verified · first-party
Daily metrics computed in UTC are wrong for a whole timezone, and DST days do not have 24 hours.
Component
Elena Cross — documentary host character pack
basic checks · first-party
The expensive part of a character is not the final images. It is the dozens of failed generations before you find the recipe — and then she looks like a different person in shot four.
Data service
Video Timeline Engine
verified · first-party
Scaling pxPerSec is the obvious way to zoom, and it throws your work off-screen on every wheel tick. Floor your frame math instead of rounding and every edit drifts one frame backwards.
Component
Assistant App — runnable, bring your own keys
verified · first-party
A complete voice assistant you run yourself. It works before you have a single API key.
Application
Scene Invariants
verified · first-party
A label that renders behind another element is not an error. It is a correct render of a scene nobody checked, and it ships.
Component
Code Recycle Membership
basic checks · first-party
Access to the whole catalogue.
Hosted SaaS