A free OCR model that reads whole PDFs in one pass, plus 3 tools worth your time
The models get the headlines. The tooling around them is where the real work is happening right now, and this week made that obvious. Baidu dropped an OCR model under an MIT license that reads an entire PDF in one pass, no page-by-page babysitting, free even for commercial use. That's the featured pick. The fact that you can run document extraction like that for nothing still gets me. The catch is the GPU, but the ceiling on what's free keeps climbing. The other three live in that same layer. vLLM is the engine a lot of people are quietly using to serve open models. oh-my-openagent splits coding work across a crew of sub-agents instead of betting everything on one. And Cloudflare shipped a security skill that turns your coding agent into an auditor that only reports what it can actually exploit, which is the discipline this space has been missing. Four tools, one theme: the plumbing is getting really good.
Unlimited OCR Works: Welcome the Era of One-shot Long-horizon Parsing.
The Lens
Unlimited-OCR is Baidu's open model for reading documents. Point it at a scan, a screenshot or a long PDF and it returns the text with layout tags in one pass instead of stitching pages together. It builds on DeepSeek-OCR, and code and weights are both MIT, so commercial use is free.
Running it yourself means an NVIDIA GPU. It's a 3.3-billion-parameter model (about 6.7GB of weights), served through Hugging Face transformers, vLLM's prebuilt Docker image, or a custom SGLang wheel the repo ships. There's no app or UI: you write the script that feeds it pages.
Baidu Cloud now hosts it as an API, free for a limited time (200 test pages for verified individuals, 1,000 for companies), but signup means real-name verification on a Chinese cloud. Solo: free on a rented GPU, or the Hugging Face demo. Small teams: one GPU box behind vLLM. Larger teams: add a queue, or stay on AWS Textract if you need forms and tables pre-extracted.
The catch: loading it runs Baidu's own model code (trust_remote_code=True), and the hosted API sends your files to Baidu. Self-host sensitive documents, pin a model revision, and test on your own messy scans, since the benchmarks are Baidu's.
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
The Lens
Cloudflare's security-audit skill turns a coding agent into a code auditor. A skill is a packaged set of instructions an AI agent loads for one job. This one maps your app's trust boundaries, sends isolated hunter agents through a coverage plan, then hands every candidate to a fresh agent that tries to disprove it before anything gets reported. It's the seed of Cloudflare's own fleet scanner, MIT licensed and free.
Install is one command, npx skills add, then ask your agent to audit the repo. You need an agent that runs parallel sub-agents, plus Node for the bundled validators. It only executes the target's code inside a network-off sandbox. Without one, leads stay marked needs_validation.
There's no paid tier. The bill is model tokens, and a full run spawns a lot of agents. Solo devs and small teams: free and a strong first pass. Larger teams: one input next to a human review.
The catch: one run isn't enough. Cloudflare says a single run finds about half of what repeated runs catch, skewed toward simpler bugs. And its prompts don't tell agents to ignore instructions planted in the code they read, so a hostile repo could steer the audit.
High-throughput LLM inference and serving engine
The Lens
vLLM is the open source server teams use to serve language models to lots of users at once. Its PagedAttention memory management and continuous batching squeeze far more requests out of a GPU than a naive setup: the original benchmarks showed 14 to 24 times the throughput of plain Hugging Face Transformers and 2.2 to 3.5 times an optimized server like TGI. Apache 2.0, and a PyTorch Foundation project. It exposes an OpenAI-compatible API and runs on NVIDIA, AMD ROCm (with prebuilt wheels), Intel XPU, Google TPUs and Apple Silicon through a plugin. Getting the best out of it means matching CUDA versions, sizing GPU memory and tuning batch settings. A 70B model at full precision needs several data-center GPUs; quantized models shrink that. The software is free; your bill is GPUs. On-demand A100s run roughly $1.59 to $2.79 an hour on RunPod and Lambda, and an 8-GPU AWS p4d instance is about $22 an hour. Solo devs running one model for themselves should use Ollama (ollama/ollama) or llama.cpp instead. Teams serving real traffic: this is the default choice. The catch: it's a big, fast-moving codebase with a matching security record. 33 advisories landed between August and early October 2026, including remote code execution through request parameters, patched in 0.31.0. Pin versions, upgrade deliberately, and keep a gateway in front of it. Its creators also founded Inferact in January 2026, so watch for a commercial layer.
omo; the best agent harness - previously oh-my-opencode
The Lens
OmO (Oh My OpenAgent) started as a plugin that supercharged OpenCode and Codex CLI and is now its own coding agent: one omo binary built on senpi, the team's fork of the pi agent. Add ultrawork to a prompt and it plans, routes subtasks to different models and keeps going until the job is done; mass ulw turns a job into a graph of agents.
Install with a curl script or bun add -g omo-ai (the unrelated omo package on npm belongs to someone else). It runs a shared background daemon and keeps config in ~/.omo. It can sign in with Claude, ChatGPT, Kimi or GLM subscriptions and ships built-in web search, docs lookup and a browser. The old OpenCode and Codex plugins still work but get degraded support from here on.
There's no paid tier; you pay for the models. But it isn't open source. The Sustainable Use License allows only internal business, non-commercial or personal use and bars commercial distribution or hosting. Solo devs experimenting with multi-model agents: fine. Companies building a product on it: no.
The catch: telemetry is on by default and reports token counts, cost and which models ran. Releases ship several times a day, and the marketing leans hard on grand claims. Anthropic's terms also bar third-party apps from offering Claude.ai login, which is what OmO's subscription sign-in does, so check before you rely on it.
Get the next issue in your inbox
Free. No spam. Unsubscribe anytime.