Octoscope is a native terminal dashboard that pulls your GitHub profile, activity, repo health, and network from the GraphQL API — and keeps everything auto-refreshed every 60 seconds. See PRs, issues, commits, languages, stars, followers, and org memberships at a glance. Works for your own account or any public profile: octoscope torvalds. Built in Go with BubbleTea. Open source, MIT-licensed. Install via Homebrew or go install.
octoscope 0.27.0 the integrity scan stops describing a repo and starts noticing things about it.
Before this release the supply-chain scan could only talk in the present tense: here is what auto-executes right now, here is a commit tip that looks forged. Useful if you happen to scan while the implant is sitting there. Useless for the two questions you actually have when a worm is circulating did something change, and what could whoever got in reach?
octoscope 0.28.0 is out, and the integrity scan can now see an attack that lives in two files instead of one.
Here's the shape it used to miss. You read a workflow, it triggers on pull_request_target so anyone can start it, and it holds nothing worth stealing. Fine. Except the last line is uses: ./.github/workflows/build.yml with secrets: inherit and that file reads your deploy token. Neither file is a finding on its own. Together they're a stranger's pull request opening a path to your secrets.
The big one first: octoscope has a real guide now. Ten pages at its own address Getting started, Authentication, The tabs, Drill-ins & scan, Live & reliable, Themes, Configuration, Scripting, plus a reference pair for every CLI flag and every keybind. https://gfazioli.github.io/octos...
Hey Product Hunt! 👋 I'm Giovambattista, and I built Octoscope because I kept switching between terminal and browser just to check basic GitHub stats — my PRs, open issues, stars, which repos needed attention.
I wanted a single view that stayed open in a tmux pane and updated itself. So I built a TUI in Go with BubbleTea that pulls everything from the GitHub GraphQL API and auto-refreshes every 60 seconds.
A few things I'm proud of:
• Works for any profile — run octoscope torvalds or octoscope dhh to see anyone's public stats
• Zero config — reads your existing GITHUB_TOKEN or gh auth token
• Real data, no scraping — everything comes from the official API
It's open source (MIT), installs in one line via Homebrew, and runs on macOS, Linux, and Windows.
I'd love your feedback — what would you want to see on a GitHub dashboard that you can't easily find today? 🙏
@fmerian Thanks! Glad you like it — if you ever try it on your GitHub profile, let me know what you think 🙏
Report
60 second refresh on the GraphQL API gets tight fast once you're watching an active profile, especially with the 2000 points per minute secondary limit kicking in alongside the 5000 per hour primary. Are multiple octoscope windows pooling requests across a single token, or does each panel hit the API on its own schedule, and does the dashboard surface anything when the token gets throttled so the data doesn't go silently stale?
@myultidev Thanks for the depth on this one — walked through the code to make sure I'm giving you accurate answers, not hand-waving.
Request schedule — one GraphQL query per refresh cycle, not per panel. Every section on the dashboard (Social, Activity, Operational, Network, plus the Activity-tab heatmap since v0.6.0) is populated from the same round-trip. That's a hard design rule for octoscope, baked into our internal principles.
Pooling across instances — no pooling today. Each running instance consumes the token's budget independently. The good news: with 5000 primary points/hour and a measured cost of ~1–2 points per refresh, you can run ~40 instances in parallel at the 60s cadence before the primary ceiling becomes the bottleneck. Secondary limits would show up sooner if you had many instances with unluckily aligned refresh ticks, but at 60s that's unlikely in steady state.
Throttle visibility — partial, and you're right that it could be better. The footer flips to stale — last refresh errored (in red) the moment a refresh fails, and the last-good numbers stay on screen so nothing goes silently stale. But we don't distinguish a 429 from a DNS blip yet — a specific "rate-limited, retry at HH:MM" readout would be much more actionable. Opening an issue for it right after this.
Planned follow-ups off the back of your feedback:
(a) query + render the rateLimit block GitHub exposes in the GraphQL response, so the footer can show remaining budget in real time;
(b) classify refresh errors so rate-limit / auth / network each get a specific recovery hint.
Probably v0.7.x once the tabbed-layout work on main settles.
Thanks again 🙏 — this is exactly the kind of feedback that keeps the roadmap honest.
Netfox
Kilo Code
@gfazioli neat product - keep up the great work!
Netfox
@fmerian Thanks! Glad you like it — if you ever try it on your GitHub profile, let me know what you think 🙏
60 second refresh on the GraphQL API gets tight fast once you're watching an active profile, especially with the 2000 points per minute secondary limit kicking in alongside the 5000 per hour primary. Are multiple octoscope windows pooling requests across a single token, or does each panel hit the API on its own schedule, and does the dashboard surface anything when the token gets throttled so the data doesn't go silently stale?
Netfox
@myultidev Thanks for the depth on this one — walked through the code to make sure I'm giving you accurate answers, not hand-waving.
Request schedule — one GraphQL query per refresh cycle, not per panel. Every section on the dashboard (Social, Activity, Operational, Network, plus the Activity-tab heatmap since v0.6.0) is populated from the same round-trip. That's a hard design rule for octoscope, baked into our internal principles.
Pooling across instances — no pooling today. Each running instance consumes the token's budget independently. The good news: with 5000 primary points/hour and a measured cost of ~1–2 points per refresh, you can run ~40 instances in parallel at the 60s cadence before the primary ceiling becomes the bottleneck. Secondary limits would show up sooner if you had many instances with unluckily aligned refresh ticks, but at 60s that's unlikely in steady state.
Throttle visibility — partial, and you're right that it could be better. The footer flips to stale — last refresh errored (in red) the moment a refresh fails, and the last-good numbers stay on screen so nothing goes silently stale. But we don't distinguish a 429 from a DNS blip yet — a specific "rate-limited, retry at HH:MM" readout would be much more actionable. Opening an issue for it right after this.
Planned follow-ups off the back of your feedback:
(a) query + render the rateLimit block GitHub exposes in the GraphQL response, so the footer can show remaining budget in real time;
(b) classify refresh errors so rate-limit / auth / network each get a specific recovery hint.
Probably v0.7.x once the tabbed-layout work on main settles.
Thanks again 🙏 — this is exactly the kind of feedback that keeps the roadmap honest.