Open source

MIT licensed, and small enough to read

Analytics is a category where "trust us" is doing a lot of work. The alternative is a repository you can read, run and verify, and a features document that says what is not built as plainly as what is.

Unit tests101core, ingest, queries, worker
Browser tests41every dashboard route
Queries32verified on live ClickHouse
UI components32ported, not rewritten
Layout

What is in the repository

A pnpm and Turborepo monorepo, TypeScript strict throughout.

packages/core
Wire format, event schema, and the parsers for user agents, referrers and URLs.
packages/tracker
The browser script. 2,943 bytes gzipped, zero dependencies, with a size gate that fails the build over 3 KB.
packages/db
Drizzle schema and migrations for Postgres, the ClickHouse DDL and its migration runner, API keys and the canonical role model.
packages/queries
32 parameterized ClickHouse query builders behind a filter AST that compiles through a map-based allow-list.
packages/ui
The Falorb design system: 32 components, both themes, kept in sync with its source by a script that fails CI on drift.
packages/auth
The better-auth configuration, shared so the API and the dashboard cannot disagree about a session.
packages/sdk-node
Server-side SDK. Non-blocking, never throws into your request path, batches by identity.
packages/sdk-react
Provider and hooks for pageviews and identification in a React app.
apps/ingest
The collector. Validates, enriches, hashes the IP, publishes to Redis, and answers in single-digit milliseconds.
apps/worker
The stream writer plus 11 scheduled jobs, behind a scheduler with Redis locks, watermarks and an overlap guard.
apps/web
The dashboard. 24 routes, React 19 server components calling the query layer directly with no HTTP hop.
apps/mcp
The MCP server: 25 tools, 2 resources and 3 prompts over stdio or streamable HTTP.
apps/api
Accounts, workspaces, projects and keys: the self-serve control plane.
Verification

Claims with commands attached

Every figure quoted on this site corresponds to something you can run. That is deliberate: an analytics tool asking to be trusted with visitor data should be checkable.

Against real servicesCI runs typecheck, unit tests and the tracker size gate, then migrations, the query smoke suite, the job verifier, a load test and the MCP smoke suite against actual Postgres, Redis and ClickHouse instances, not mocks.
Including the unglamorous onesThe injection-safety suite covers prototype pollution, wildcard leakage and parameter binding. The load test asserts that every acknowledged event actually reached ClickHouse, which is the claim a collector is most tempted to fudge.
Honesty

What is not built

FEATURES.md carries a status table with four states, including “designed only, deliberately not implemented”. A few of the current gaps:

IntegrationsStripe, HubSpot, Shopify and the rest are designed (schema, direction, identity-resolution strategy) and not written. The design is recorded so it is settled before any code exists.
Session replayDeliberately deferred. The schema and the tracker leave the extension point open, but recording a visitor's screen is a much larger privacy commitment than counting their clicks.
Backend without a UIGDPR data requests, saved segments, webhook management and the audit and consent logs all work in the backend and have no dashboard surface yet. Each is listed with the cost of the gap.

Those are also the best places to start if you want to contribute: there is a table or a worker already waiting on an interface, so the work is bounded and immediately useful.

See what is built
Questions

Licence, contributions and trust

What does the MIT licence let me do?

Use it, modify it, redistribute it, sell services built on it, and run it commercially, with no obligation to publish your changes and no requirement to tell anyone. The only condition is that the copyright notice travels with the code.

Is it production software or a demonstration?

The collection pipeline, storage layer, identity graph, query layer, workers, MCP server, account system and dashboard are built and verified running, each with a command in the README that checks it. What is not built is stated plainly in FEATURES.md rather than implied to exist: the integrations layer is design-only, and several backend capabilities do not have a dashboard surface yet.

How do I know the numbers on this site are real?

Run the commands. The tracker's size, the 32 queries against live ClickHouse, the 11 background jobs, the MCP smoke suite and the 41 browser tests are all single commands in the README, and CI runs them against real services rather than mocks.

How can I contribute?

Issues and pull requests on GitHub. The most useful contributions right now are the gaps FEATURES.md already names: a UI for GDPR data requests, saved segments, webhook management, and the audit and consent log viewers. Each has a table or a worker already waiting on an interface.

Found something wrong on this page? Open an issue. This website lives outside the product repository: Falorb is MIT licensed and meant to be forked, and the marketing around it is not part of that offer.

Read it, then run it

The quickstart is five commands. The source is the same repository this website is built from.