Every tool here passed the same four gates: [B]alance · [O]wnership · [T]ransparency · [S]ecurity. Gate scorecard shown per tool.
Does it return more time than it takes?
Can you export, migrate, delete freely?
Can you audit what it does?
Does it strengthen or weaken your posture?
A ⚠ MARK IS SHOWN WHERE IT EXISTS. NOTHING IS PERFECT — IT IS VERIFIABLE.
> FULL METHODOLOGY → /framework
Run LLMs locally — with a cloud tier for when your GPU is not enough.
Core of the 80% cost-cut case: open models, no per-seat fees, nothing leaves the machine. The cloud tier enforces zero-retention when local compute runs out.
[B]✓ · [O]✓ · [T]✓ · [S]✓
Local model runtime with a friendly UI.
Interface is proprietary; the models it runs are open — marked honestly. Runs instructor demos with Wi-Fi visibly off.
[B]✓ · [O]✓ · [T]⚠ · [S]✓
Self-hosted ChatGPT-style interface over local, cloud, or frontier models.
One frontend, three routes: local Ollama, cloud tiers, API gaps. The routing layer that carried the SME cost cut.
[B]✓ · [O]✓ · [T]✓ · [S]✓
Your paid ChatGPT / Claude subscriptions, exposed as OpenAI-compatible endpoints.
Lets agents and OpenWebUI use the subscriptions you already pay for. Sensitive prompts stay local; the rest ride the existing plan — mind the ToS.
[B]✓ · [O]✓ · [T]✓ · [S]⚠
Cloud routing to frontier models when open weights are not the right tool.
The $50/month reserve in the cost-cut case — intentional spending, never the default. Training opt-out configured at account level.
[B]✓ · [O]⚠ · [T]⚠ · [S]⚠
Self-hosted agent that runs the operator day in the background.
07:00 morning brief, 21:00 evening wrap, weekly review — delivered to Telegram. 17 background tasks routed across six local and cloud models, under approval hooks.
[B]✓ · [O]✓ · [T]✓ · [S]✓
Open source agentic coding assistant in the terminal — 75+ model providers.
Reads the project, runs language servers, feeds compiler diagnostics back to the model for self-correction. Terminal-native and provider-free.
> REPLACED: CLAUDE CODE
[B]✓ · [O]✓ · [T]✓ · [S]✓
Self-hosted automation across your own services.
Source-available and self-hostable — the workflow layer in my own tool map. Keep every credential scoped: workflow shells are a favorite target.
> REPLACED: ZAPIER
[B]✓ · [O]✓ · [T]⚠ · [S]✓
The connective tissue that gives agents real capabilities.
Open protocol, auditable tool surface — and mine is live, not a demo:
> LIVE SURFACE: OBSIDIAN · PLAYWRIGHT · BRAVE SEARCH · TAVILY · YOUTUBE · GMAIL · GOOGLE CALENDAR · ZOHO CRM · ZOHO MAIL · MANGOOLS SEO · HIGGSFIELD · ODOO ERP ×4 (CLIENT DEPLOYMENTS)
> PLUS: CUSTOM SERVERS BUILT IN-HOUSE · OPENCODE BRIDGE INSIDE HERMES
[B]✓ · [O]✓ · [T]✓ · [S]✓
Markdown-defined skills that extend coding agents.
My kit: humanizer + humanizer-ar (writing cleanup, EN and AR), media-transcription, graphify (docs to knowledge graphs), officecli (real Office files). Audit before you install — skills run with your agent permissions.
[B]✓ · [O]✓ · [T]✓ · [S]✓
The plugin layer upgrades the agent session itself.
Magic Context keeps sessions persistent and context managed across runs; custom hooks cover the rest. Plugins execute with agent permissions — read the source first.
[B]✓ · [O]✓ · [T]✓ · [S]✓
Local-first markdown knowledge base.
Proprietary but local-first and free — marked honestly. Plain .md files that outlive any SaaS.
> REPLACED: NOTION
[B]✓ · [O]✓ · [T]⚠ · [S]✓
Device-to-device sync without cloud intermediaries.
Peer-to-peer file sync across the fleet — no storage tiers, no intermediary that reads your files.
> REPLACED: DROPBOX
[B]✓ · [O]✓ · [T]✓ · [S]✓
WireGuard-based mesh VPN — your devices, one private network, zero port forwarding.
The client is open; the control plane is proprietary — marked honestly. Headscale is the self-hosted path.
> REPLACED: VPN SUBSCRIPTION
[B]✓ · [O]⚠ · [T]⚠ · [S]✓
Remote desktop you can self-host.
Self-host the relay and your remote sessions never touch someone else’s cloud. Support from anywhere on the mesh.
> REPLACED: TEAMVIEWER
[B]✓ · [O]✓ · [T]✓ · [S]✓
The desktop Linux I recommend first — familiar layout, zero drama.
Reproducible environments, free OS, full control of updates. Staged dual-boot migration — honest about where the switch stands.
> REPLACED: WINDOWS
[B]✓ · [O]✓ · [T]✓ · [S]✓
Microsoft’s open source power layer for Windows.
FancyZones manages four monitors; Keyboard Manager is reserved for deck-driven shortcuts. Open source from Redmond.
[B]✓ · [O]✓ · [T]✓ · [S]✓
One-command delivery for the whole stack.
OpenWebUI, n8n, this site build — everything ships in containers. Engine is Apache-2.0; Desktop carries commercial license tiers.
[B]✓ · [O]✓ · [T]✓ · [S]✓
Software sovereignty needs a physical cockpit. The deck layer drives the stack as code — profiles are files, not GUI clicks.
15-key LCD deck driving the operator cockpit (SS-550).
Mirabox StreamDock engine; profiles are plain JSON, plugins run on an open Python SDK. Customized by code, never through the vendor GUI — at a fifth of the Stream Deck price.
> OWNED HARDWARE
An old phone becomes a second macro deck.
Phone surface for media, OBS, and comms controls — configs live on the device, no cloud account.
> OWNED HARDWARE
RTX 4060 Ti 16GB · four monitors · Windows + Zorin dual-boot.
Where local inference, the deck, and the editing bay live. Consumer-grade on purpose — the stack runs on hardware you already own.
> OWNED HARDWARE
Prompt-to-design, local-first: decks, pages, collateral.
Your coding agent is the design engine. Exports HTML, PDF, PPTX, MP4. The output is yours — no design subscription.
> REPLACED: CLAUDE DESIGN / FIGMA AI
[B]✓ · [O]✓ · [T]✓ · [S]✓
Scenes, recording, streaming — the studio control room.
Free, open source, and wired into the physical deck: record, stream, scene, mixer, and virtual camera from Stream Station keys.
[B]✓ · [O]✓ · [T]✓ · [S]✓
The engine under every recording, clip, and conversion.
Edit, compress, caption, batch — command line, zero licensing, scriptable forever.
[B]✓ · [O]✓ · [T]✓ · [S]✓
Daily browser.
The last independent rendering engine in the mainstream. Containers keep identities apart.
> REPLACED: CHROME
[B]✓ · [O]✓ · [T]✓ · [S]✓
Pillar 3 says open source first — not open source only. These proprietary tools earn their place by passing the other gates; marked honestly so you can decide.
Classroom-vetted research assistant.
Free-tier friendly; fails Ownership and Transparency by definition.
[B]✓ · [O]⚠ · [T]⚠ · [S]⚠
Deck generation.
Course-tested for learners; cloud-locked output.
[B]✓ · [O]⚠ · [T]⚠ · [S]⚠
Voice generation.
Course-tested for learners; cloud-locked output.
[B]✓ · [O]⚠ · [T]⚠ · [S]⚠
Image generation for course material.
Instructor-tested for learners; cloud-locked output.
[B]✓ · [O]⚠ · [T]⚠ · [S]⚠
Video generation for course demos — now wired in via MCP.
Instructor-tested for learners; cloud-locked output.
[B]✓ · [O]⚠ · [T]⚠ · [S]⚠
> THIS LIST IS AN AUDIT TRAIL, NOT A BEST-OF LIST.
The Sovereign Tech Toolkit — a curated open source AI and tooling list — covers local AI (Ollama, OpenWebUI, LM Studio), agent systems (OpenCode, Hermes, MCP, skills, plugins), sync and mesh (Syncthing, Tailscale, RustDesk), operating systems and delivery (Zorin OS, Docker, PowerToys), studio production (Open Design, OBS Studio, FFmpeg), and the physical deck layer (Redragon Stream Station, Deckboard). It is curated by Islam Ashraf, a cybersecurity and AI consultant in Egypt, and every entry is filtered through the Sovereign Tech Life Framework's four gates: balance, ownership, transparency, and security.