# Web servers and API gateways Kit: Apache projects for small business

October 30, 2026. Research checked October 29, 2026. [Read the article](https://jwatte.com/blog/apache-web-servers-api-gateways-small-business/).

## How to use this kit

Identify whether you need a website host, an application runtime, a gateway, a cache or file transfer. Choose a product only after identifying the application and its supported versions. This kit includes one owner/helper option and six provider options, plus one developer module. Use a private trial and retain the existing service until publishing and recovery have both been checked. These are researched planning examples, not installations we performed.

## HTTP Server owner/helper card

What it does: serves website content and can pass requests to applications. Who it fits: an owner with a capable helper who can maintain a small static site and its host. Example uses: a four person plumber updates service pages; a two-location coffee shop publishes menus and holiday hours.

Hardware and skills: the [installation guide](https://httpd.apache.org/docs/2.4/install.html) gives at least 200 MB temporary source-build disk and about 50 MB installation before content, but no universal CPU/RAM minimum. Our Small host allowance is 2 vCPU, 4 GiB RAM and 80 GiB disk. The helper must handle maintained operating-system packages, domain configuration, TLS, updates and restore testing. Start with that official guide and the [TLS how-to](https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html), following the distribution-package route when available. [Current upstream release](https://httpd.apache.org/download.cgi): 2.4.69, October 1, 2026; distribution security fixes can be backported.

Backup and update checklist:

- Keep site content and publishing inputs in recoverable copies; include server configuration and a protected certificate-recovery process.
- Record the package source and update owner. Review security notices, install supported fixes and check the website afterward.
- Restore an isolated copy and verify pages, images, redirects and TLS. Write down the recovery steps the helper actually used.
- Confirm who can publish when the usual helper is absent. Keep account recovery available to the business owner.

First week: on day 1 list the public pages and the person responsible for each. On day 2 have the helper create a disposable static copy. On day 3 make one owner-led content update and verify it. On day 4 restore the previous content and configuration. On day 5 compare the measured maintenance work with Netlify Personal’s $9/month plan and choose the route the owner can sustain. Do not use a successful test as proof that arbitrary dynamic applications will run there.

## Provider cards

### Tomcat

Runs Java web applications; it is not the business application itself. Examples: a twelve person machine shop’s existing job portal and an eight person print shop’s proof-approval system. Needs IT for Java, the runtime, dependency updates and recovery. [Tomcat 11 setup](https://tomcat.apache.org/tomcat-11.0-doc/setup.html) needs Java 17 or later, while [10.1 setup](https://tomcat.apache.org/tomcat-10.1-doc/setup.html) needs Java 11 or later. No universal numeric hardware floor is supplied; one Small 4 GiB host is our bounded assumption, not a guarantee. Match the application before changing major branches.

Start from [current downloads](https://tomcat.apache.org/download-11.cgi). Alternative: [Render Docker hosting](https://render.com/docs/docker), with the $110/month platform configuration below, or the application vendor’s own supported hosted offer. Ask: Which branch and Java version are supported? Who patches the container or JVM? Can an application rollback read data written by the newer version? Which database and file-storage charges are outside this quote?

### APISIX

Routes and controls API requests to existing backends. Examples: a six person parts retailer limits a supplier API client; a nine person delivery service routes dispatch requests. Needs IT for credentials, plugins, configuration and backend failure behavior. The [quick start](https://apisix.apache.org/docs/apisix/getting-started/README/) starts APISIX plus etcd and disables admin authorization for demonstration. Never publish it unchanged. [Standalone mode](https://apisix.apache.org/docs/apisix/deployment-modes/) uses a file without etcd; one Small host is our planning allowance, with no vendor-wide RAM floor verified. A production cluster needs a new budget.

Use the [installation guide](https://apisix.apache.org/docs/apisix/installation-guide/) and [release page](https://apisix.apache.org/downloads/). Alternatives: AWS API Gateway’s priced example below, or [API7](https://www.api7.ai/pricing) custom quotation with no published amount verified. Ask: Which plugin or routing requirement needs APISIX? Who protects administration ports? How are invalid credentials, slow backends and rollback tested? What remains outside the provider’s support agreement?

**FtpServer.** This runs a file-transfer service, often for an existing supplier requirement. The [standalone guide](https://mina.apache.org/ftpserver-project/running_ftpserver_standalone.html) describes a Java service on one host but contains old example filenames and permissive demo accounts. Use a current release and a reviewed configuration; no universal RAM minimum was established. FTP, FTPS and SFTP are different protocols, so confirm the actual requirement. An eight person print shop receiving supplier artwork through FTPS might justify it, allowing 1 to 3 hours/month for accounts, TLS, permissions, quotas and recovery. [AWS Transfer Family](https://aws.amazon.com/aws-transfer-family/pricing/) publishes an FTPS example at $0.30/endpoint-hour plus $0.04/GB transferred. At an assumed 720-hour month the endpoint alone is $216, with storage and other AWS services extra. The managed service still needs account and file-permission design. Provider questions: Which exact transfer protocol does the supplier require? Who removes demo accounts and tests account boundaries?

**ShenYu.** This gateway fits teams already working with its application and plugin ecosystem. Its [Docker deployment](https://shenyu.apache.org/docs/deployment/deployment-docker/) uses separate administration and gateway processes; the [preparation guide](https://shenyu.apache.org/docs/deployment/deployment-before/) includes a database. A demonstration can use H2, but a durable production control plane needs a supported database and protected network access. No universal hardware floor was established. A ten person distributor with existing Java warehouse integrations might evaluate it with its provider. Budget 6 to 16 hours/month for a small multi-component deployment. Amazon API Gateway’s $18.79 published REST scenario in the worksheet below is a priced alternative for a suitable request workload. Plugin compatibility must be assessed separately. Ask which ShenYu-specific capability earns the added operational work. Provider questions: Who patches the control-plane database? How is administration access confined to trusted networks?

**TomEE.** This adds Jakarta EE services around Tomcat. The [download page](https://tomee.apache.org/downloads.html) identifies 10.2.0, July 17, 2026, with Java 17 or later. Its 11.0.0-M1 is a milestone limited to evaluation. A single Java application host is the smallest starting point; database and memory needs depend on the application, and archive size is not a RAM requirement. A fifteen person manufacturer whose supplier portal requires these services should follow its vendor’s support matrix. Allow 1 to 3 administration hours/month for a bounded host, with application support separate. Render’s $110 Pro-plus-4-GB platform example in the worksheet below can host a suitable container, while the vendor’s own hosted application deserves a separate quote. Do not buy an enterprise runtime before identifying the feature the application uses. Provider questions: Which variant and Java runtime does our application require? Is a hosted application quote available before we commission a server?

**Traffic Server.** This is an HTTP proxy and cache. The [minimal reverse-proxy guide](https://docs.trafficserver.apache.org/en/latest/getting-started/index.en.html) can run one instance, even beside the origin, but that adds no host redundancy. Cache size, traffic and response behavior determine hardware needs; no universal minimum was verified. A seven person ecommerce brand might cache public catalog images while keeping customer accounts and carts out of the shared cache. Allow 1 to 3 administration hours/month for a small proxy and test cache rules before enabling it. [Cloudflare Pro](https://www.cloudflare.com/plans/) lists $25/month billed monthly or $20/month billed annually, with a managed global edge service. Origin hosting stays extra. Traffic Server’s [homepage](https://trafficserver.apache.org/) dates 10.2.1 to October 20, 2026; its download card retains an older date, so we use the homepage announcement. Provider questions: How are private pages and cookies excluded from shared caching? Can a managed CDN meet the same need while retaining our origin?

## Full group table

Tomcat lists the newest major plus the catalog’s supported 10.1 branch. mod_ftp is an old beta and should not be treated as a new production recommendation.

| Project | What it does | Who runs it | Latest release and date |
|---|---|---|---|
| [Apache Apisix](https://apisix.apache.org) | Controls and routes requests to application interfaces. | Your IT department or provider | [3.19.0; 2026-09-28](https://apisix.apache.org/downloads/) |
| [Apache FtpServer](http://mina.apache.org/ftpserver-project) | Hosts a configurable FTP file transfer service. | Your IT department or provider | [1.2.1; 2025-05-01](https://github.com/apache/mina-ftpserver/releases/tag/ftpserver-parent-1.2.1) |
| [Apache HTTP Server](https://httpd.apache.org/) | Serves websites and forwards web requests to business applications. | You, with a capable helper | [2.4.69; 2026-10-01](https://httpd.apache.org/download.cgi) |
| [Apache mod_ftp](https://httpd.apache.org/mod_ftp/) | Adds FTP file transfer support to Apache HTTP Server. | Your developer | [0.9.6-beta; 2008-10-08](https://httpd.apache.org/download.cgi) |
| [Apache Shenyu](https://shenyu.apache.org) | Routes application requests and applies access, traffic and monitoring controls. | Your IT department or provider | [2.7.1; 2026-07-08](https://github.com/apache/shenyu/releases/tag/v2.7.1) |
| [Apache Tomcat](http://tomcat.apache.org/) | Runs Java web applications on a server. | Your IT department or provider | [11.0.27; supported 10.1 branch: 10.1.61; 2026-10-12](https://tomcat.apache.org/) |
| [Apache TomEE](http://tomee.apache.org) | Runs Java business applications with the additional services they need. | Your IT department or provider | [10.2.0; 2026-07-17](http://tomee.apache.org/downloads.html) |
| [Apache Traffic Server](https://trafficserver.apache.org) | Caches web content and forwards requests to reduce load on websites. | Your IT department or provider | [10.2.1; 2026-10-20](https://trafficserver.apache.org/) |

## Cost worksheet

Business job: ______. Application/version: ______. Required runtime/modules: ______. Monthly traffic low/high: ______ / ______. Availability needed: ______. Node sizes/count: ______. Backup GB low/high: ______ / ______. Setup hours: ______ / ______. Monthly administration hours: ______ / ______. Managed plan, billing term, date and exclusions: ______. Separately quoted development/database/storage: ______.

The shared method uses $68.09 per administration hour, an employee compensation estimate from [BLS wages](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151244&year=2025) divided by the [70.0% wages share](https://data.bls.gov/timeseries/CMU2020000000000P). An outside IT provider bills more than this proxy, so get a quote. [DigitalOcean](https://www.digitalocean.com/pricing/droplets) supplies our Small server at $24/month (2 vCPU, 4 GiB RAM, 80 GiB disk), Medium at $48 (4 vCPU, 8 GiB, 160 GiB), and Large at $252 (8 dedicated vCPU, 32 GiB, 100 GiB). These are monthly caps without an annual commitment. [Backblaze B2](https://www.backblaze.com/cloud-storage/pricing) costs $6.95 per decimal TB/month after the first 10 GB free. All were checked October 29, 2026.

Setup = hours × $68.09. Monthly self hosted = server charges + max(0, retained backup GB minus 10) × $0.00695 + administration hours × $68.09. The 36 month total adds setup to 36 monthly bills; savings subtract that total from the alternative. Break even is setup divided by positive monthly savings, rounded up; otherwise it is never. Calculations retain cents internally and display whole dollars.

Our assumptions are 4 to 12 setup hours and 1 to 3 administration hours/month for a bounded single server, or 24 to 60 and 6 to 16 for a small cluster. These exclude application development, migration, training, incidents and on call coverage on both sides. Alternative setup is assumed zero incremental infrastructure labor in these examples. Implementation still takes work. Backup volumes include retained copies. We assume no chargeable backup requests or excess transfer; add them if your usage exceeds the provider allowances. Low and high cases are planning ranges to replace with measured requirements.

### Filled HTTP Server comparison

One Small server, 10 to 50 GB backups, 4 to 12 setup hours and 1 to 3 monthly administration hours. Self hosted monthly = $24 + max(0, backup GB minus 10) × $0.00695 + hours × $68.09. [Netlify Personal](https://www.netlify.com/pricing/) is $9/month with 1,000 credits. Our 2 to 4 deploys, 5 to 10 GB transfer and 20,000 to 50,000 requests use 134 to 270 credits at 15/deploy, 20/GB and 2/10,000 requests. No compute or functions assumed. This compares static-site infrastructure; content work is extra on both sides.

| HTTP Server static site | Low labor/workload | High labor/workload |
|---|---:|---:|
| Setup labor | $272 | $817 |
| Monthly self hosted | $92 | $229 |
| Self hosted, 36 months | $3,588 | $9,045 |
| Netlify Personal, monthly | $9 | $9 |
| Netlify Personal, 36 months | $324 | $324 |
| Self hosting savings, 36 months | Negative $3,264 | Negative $8,721 |
| Break even month | Never | Never |

### Filled Tomcat comparison

Same self hosted server, backup and labor assumptions. [Render](https://render.com/pricing) Pro workspace $25/month plus 2 CPU/4 GB compute $85/month = $110/month. No persistent disk, database or application development is included. The developer still maintains the container, Java runtime and application on Render. Prices compare the platform slice, not fully supported software. Self hosted low case breaks even in month 16; high case never does.

| Tomcat application host | Low labor/workload | High labor/workload |
|---|---:|---:|
| Setup labor | $272 | $817 |
| Monthly self hosted | $92 | $229 |
| Self hosted, 36 months | $3,588 | $9,045 |
| Render platform, monthly | $110 | $110 |
| Render platform, 36 months | $3,960 | $3,960 |
| Self hosting savings, 36 months | $372 | Negative $5,085 |
| Break even month | 16 | Never |

### Filled APISIX comparison

Same single Small host, backup and labor assumptions; standalone file configuration, no etcd cluster included. Hold the workload fixed at [AWS’s published REST example](https://aws.amazon.com/api-gateway/pricing/): 5 million monthly requests × $3.50/million + 14.3 GB transfer × $0.09 = $18.79/month, including listed US East and US West (Oregon) regions. Backends, logging and additional cloud services cost extra. One self hosted gateway has a different availability design; plugins are not interchangeable. All prices checked October 29, 2026, before tax and without an annual discount.

| APISIX standalone gateway | Low labor/workload | High labor/workload |
|---|---:|---:|
| Setup labor | $272 | $817 |
| Monthly self hosted | $92 | $229 |
| Self hosted, 36 months | $3,588 | $9,045 |
| AWS gateway example, monthly | $19 | $19 |
| AWS gateway example, 36 months | $676 | $676 |
| Self hosting savings, 36 months | Negative $2,911 | Negative $8,368 |
| Break even month | Never | Never |

### Setup time when Claude or ChatGPT does the typing

October 30, 2026 update. See the [post’s AI setup comparison](https://jwatte.com/blog/apache-web-servers-api-gateways-small-business/#setup-time-when-claude-or-chatgpt-does-the-typing).

We keep the HTTP Server static-site example: one $24 Small server and 10 to 50 GB of backups. All hours are our planning assumptions, not measured installations. Human review is already included: 1 to 3 setup hours and 0.5 to 1.5 hours/month. Low and high are paired scenarios. We keep hosting and backups unchanged, with monthly H = $24 + max(0, retained GB minus 10) × $0.00695. Existing exclusions still apply.

| HTTP Server: paired planning cases | Low | High |
|---|---:|---:|
| Manual setup hours | 4 | 12 |
| AI setup share; hours | 50%; 2 | 80%; 9.6 |
| Manual administration hours/month | 1 | 3 |
| AI administration share; hours/month | 75%; 0.75 | 100%; 3 |
| Manual total, 36 months | $3,588 | $9,045 |
| Claude Pro subscription total, 36 months | $3,039 | $9,081 |
| ChatGPT Plus subscription total, 36 months | $3,039 | $9,081 |
| API pay per token: Claude Opus 5.5 total, 36 months | $2,853 | $8,995 |
| API pay per token: GPT-6 Astra total, 36 months | $2,876 | $9,166 |
| Opus setup/monthly token charges | $0.764 / $0.382 | $6 / $3 |
| Astra setup/monthly token charges | $1.970 / $0.985 | $15 / $7.50 |

Let S/A be manual setup/monthly hours, q/r the AI shares, H monthly hosting plus backups, and T0/Tm setup/monthly tool charges. We use $68.09/hour and round totals only after calculation.

```text
Manual total = S × $68.09 + 36 × (H + A × $68.09)
AI total = S × q × $68.09 + T0 + 36 × (H + A × r × $68.09 + Tm)
Savings = Manual total minus AI total
```

AI setup = S × q × $68.09 + T0. AI monthly = H + A × r × $68.09 + Tm. Substitute your own measured hours before deciding.

Claude Pro and ChatGPT Plus each cost $20/month, billed monthly. We charge one full separate setup month, then 25% ($5) for each of 36 operating months only if other work uses the remaining allowance. Without sharing, charge the full price and add $540 to either subscription total. Never allocate more than 100% across projects. Equal prices do not imply equal usage limits or results; extra usage and repeated setup months cost more. API billing is separate, with no assumed subscription credits.

Our cumulative API setup budget is 200,000 to 1,000,000 input tokens and 20,000 to 100,000 output tokens; monthly administration is 100,000 to 500,000 input and 10,000 to 50,000 output. These are our assumptions including retries, repeated context and billed reasoning, not a single prompt. Keep each request in the applicable short context pricing band. Low input is 30% ordinary, 10% short cache writes and 60% cache reads; high input is 100% ordinary with caching disabled. Do not assume a cache survives between monthly sessions.

Standard API rates per million tokens, read October 29, 2026: Claude Opus 5.5 input $4, output $20, cache read $0.20, short cache write $5; GPT-6 Astra input $10, output $50, cache read $1, short cache write $12.50. Writes replace ordinary input charges. No batch discount, paid browser service, premium routing or storage charge is assumed.

```text
API tool cost = (ordinary input × input rate + cache writes × write rate
                + cache reads × read rate + output × output rate) / 1,000,000
Opus low setup = 0.06 × $4 + 0.02 × $5 + 0.12 × $0.20 + 0.02 × $20 = $0.764
Astra low setup = 0.06 × $10 + 0.02 × $12.50 + 0.12 × $1 + 0.02 × $50 = $1.970
```

The base uses free local Desktop Commander or Codex CLI. Optional Desktop Commander Remote Pro is $20/month; one setup month plus a justified 25% monthly share adds $200 over this period. With exclusive use, its full monthly fee applies. Model usage and hosting are separate.

The high case saves no monthly labor. Compared with manual work, shared subscriptions become more expensive in month 29, Opus API in month 53 and Astra API in month 20. For a slower-work sensitivity, use 119% of manual hours plus tool charges; that is a sensitivity inspired by a coding study, not a deployment forecast. [55] The conclusion stays: Netlify Personal’s $324 over 36 months costs less in every case. AI assistance does not make this brochure site cheaper to self host.

Use a staging or new server; never paste secrets into chat. Approve commands or use a restricted sandbox, and watch browser actions. Use supported subscriptions under human direction and API keys for custom automation. Review changes and test a site restore and certificate renewal; backups and updates remain our responsibility.

## Approval and recovery questions

Name the person responsible for the service, application and backups separately. Ask them to demonstrate an update and a restore before switching business traffic. Agree on the tolerated outage, monitoring and response time in writing. Record the full monthly quote, including managed-platform work that remains the business’s responsibility.

Review [HTTP Server security](https://httpd.apache.org/security/vulnerabilities_24.html), [Tomcat security](https://tomcat.apache.org/security.html), [APISIX security](https://apisix.apache.org/docs/general/security/) and [ASF security](https://www.apache.org/security/). [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0) allows commercial use subject to conditions, with no warranty or trademark license. mod_ftp belongs to a developer maintaining an existing module dependency, not an owner selecting a new application.

## Fact-check notes and sources

Official pages and the series catalog evidence were read October 29, 2026. Prices are US dollars before tax; billing terms appear with each comparison. We have not installed these projects for this series.

1. [installation guide](https://httpd.apache.org/docs/2.4/install.html). Read October 29, 2026, 21:37:27 UTC.
2. [TLS how-to](https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html). Read October 29, 2026, 21:37:29 UTC.
3. [Current upstream release](https://httpd.apache.org/download.cgi). Read October 29, 2026, 21:37:26 UTC.
4. [Tomcat 11 setup](https://tomcat.apache.org/tomcat-11.0-doc/setup.html). Read October 29, 2026, 21:37:27 UTC.
5. [10.1 setup](https://tomcat.apache.org/tomcat-10.1-doc/setup.html). Read October 29, 2026, 21:38:22 UTC.
6. [current downloads](https://tomcat.apache.org/download-11.cgi). Read October 29, 2026, 21:38:54 UTC.
7. [Render Docker hosting](https://render.com/docs/docker). Read October 29, 2026, 21:38:24 UTC.
8. [quick start](https://apisix.apache.org/docs/apisix/getting-started/README/). Read October 29, 2026, 21:37:27 UTC.
9. [Standalone mode](https://apisix.apache.org/docs/apisix/deployment-modes/). Read October 29, 2026, 21:37:29 UTC.
10. [installation guide](https://apisix.apache.org/docs/apisix/installation-guide/). Read October 29, 2026, 21:38:23 UTC.
11. [release page](https://apisix.apache.org/downloads/). Read October 29, 2026, 21:37:26 UTC.
12. [API7](https://www.api7.ai/pricing). Read October 29, 2026, 21:37:27 UTC.
13. [standalone guide](https://mina.apache.org/ftpserver-project/running_ftpserver_standalone.html). Read October 29, 2026, 21:39:15 UTC.
14. [AWS Transfer Family](https://aws.amazon.com/aws-transfer-family/pricing/). Read October 29, 2026, 21:37:31 UTC.
15. [Docker deployment](https://shenyu.apache.org/docs/deployment/deployment-docker/). Read October 29, 2026, 21:37:29 UTC.
16. [preparation guide](https://shenyu.apache.org/docs/deployment/deployment-before/). Read October 29, 2026, 21:38:19 UTC.
17. [download page](https://tomee.apache.org/downloads.html). Read October 29, 2026, 21:38:20 UTC.
18. [minimal reverse-proxy guide](https://docs.trafficserver.apache.org/en/latest/getting-started/index.en.html). Read October 29, 2026, 21:37:29 UTC.
19. [Cloudflare Pro](https://www.cloudflare.com/plans/). Read October 29, 2026, 21:37:30 UTC.
20. [homepage](https://trafficserver.apache.org/). Read October 29, 2026, 21:42:01 UTC.
21. [Apache Apisix](https://apisix.apache.org). Read October 29, 2026, 21:12:51 UTC (catalog observation).
22. [Apache FtpServer](http://mina.apache.org/ftpserver-project). Read October 29, 2026, 21:38:18 UTC.
23. [mina-ftpserver release ftpserver-parent-1.2.1 on GitHub](https://github.com/apache/mina-ftpserver/releases/tag/ftpserver-parent-1.2.1). Read October 29, 2026, 21:22:49 UTC (catalog observation).
24. [Apache HTTP Server](https://httpd.apache.org/). Read October 29, 2026, 21:13:38 UTC (catalog observation).
25. [Apache mod_ftp](https://httpd.apache.org/mod_ftp/). Read October 29, 2026, 21:13:39 UTC (catalog observation).
26. [Apache Shenyu](https://shenyu.apache.org). Read October 29, 2026, 21:13:45 UTC (catalog observation).
27. [shenyu release v2.7.1 on GitHub](https://github.com/apache/shenyu/releases/tag/v2.7.1). Read October 29, 2026, 21:16:26 UTC (catalog observation).
28. [Apache Tomcat](http://tomcat.apache.org/). Read October 29, 2026, 21:37:26 UTC.
29. [Apache TomEE](http://tomee.apache.org). Read October 29, 2026, 21:39:49 UTC.
30. [BLS wages](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151244&year=2025). Read October 29, 2026, 21:12:08 UTC.
31. [70.0% wages share](https://data.bls.gov/timeseries/CMU2020000000000P). Read October 29, 2026, 21:17:59 UTC.
32. [DigitalOcean](https://www.digitalocean.com/pricing/droplets). Read October 29, 2026, 21:10:42 UTC.
33. [Backblaze B2](https://www.backblaze.com/cloud-storage/pricing). Read October 29, 2026, 21:10:42 UTC.
34. [Netlify Personal](https://www.netlify.com/pricing/). Read October 29, 2026, 21:37:26 UTC.
35. [Render](https://render.com/pricing). Read October 29, 2026, 21:37:26 UTC.
36. [AWS’s published REST example](https://aws.amazon.com/api-gateway/pricing/). Read October 29, 2026, 21:37:30 UTC.
37. [HTTP Server security](https://httpd.apache.org/security/vulnerabilities_24.html). Read October 29, 2026, 21:38:26 UTC.
38. [Tomcat security](https://tomcat.apache.org/security.html). Read October 29, 2026, 21:38:55 UTC.
39. [APISIX security](https://apisix.apache.org/docs/general/security/). Read October 29, 2026, 21:38:57 UTC.
40. [ASF security](https://www.apache.org/security/). Read October 29, 2026, 21:39:57 UTC.
41. [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0). Read October 29, 2026, 21:39:56 UTC.

42. [Claude plans](https://claude.com/pricing). Read October 29, 2026, 23:31:08 UTC; reused for this update.
43. [ChatGPT plans](https://chatgpt.com/pricing/). Read October 29, 2026, about 23:27 UTC in a regular browser.
44. [Codex plan access](https://help.openai.com/en/articles/11369540-using-codex-with-your-chatgpt-plan). Read October 29, 2026, 23:31:16 UTC; reused for this update.
45. [Codex CLI](https://developers.openai.com/codex/cli). Read October 29, 2026, 23:32:01 UTC; reused for this update.
46. [Desktop Commander pricing](https://desktopcommander.app/pricing/). Read October 29, 2026, 23:31:08 UTC; reused for this update.
47. [Desktop Commander setup and permissions](https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/main/README.md). Read October 29, 2026, 23:31:41 UTC; reused for this update.
48. [Claude in Chrome](https://support.claude.com/en/articles/12012173-get-started-with-claude-in-chrome). Read October 29, 2026, 23:31:11 UTC; reused for this update.
49. [Chrome permissions](https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide). Read October 29, 2026, 23:31:09 UTC; reused for this update.
50. [ChatGPT cloud browser](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt). Read October 29, 2026, 23:32:01 UTC; reused for this update.
51. [Claude API pricing](https://platform.claude.com/docs/en/about-claude/pricing). Read October 29, 2026, 23:31:14 UTC; reused for this update.
52. [OpenAI API pricing](https://developers.openai.com/api/docs/pricing). Read October 29, 2026, 23:31:13 UTC; reused for this update.
53. [OpenAI prompt caching](https://developers.openai.com/api/docs/guides/prompt-caching). Read October 29, 2026, 23:32:00 UTC; reused for this update.
54. [METR coding study limitations](https://metr.org/blog/2026-02-24-uplift-update/). Read October 29, 2026, 23:31:09 UTC; reused for this update.

55. [METR July 2025 developer experiment](https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/). Read October 29, 2026, 23:30:58 UTC; reused for this update.

*Apache, the Apache feather logo and the Apache project names are trademarks of The Apache Software Foundation. This site is not affiliated with or endorsed by the ASF. Other product names are used for identification only.*