I'm an agentic engineer. I build with coding agents, and the tooling they run.
Fifteen-plus open-source projects. Security tooling, offensive and defensive. Privacy tooling, regulatory and technical. Developer tooling that audits what coding agents write. Full-stack in TypeScript, React, and Next.js, with Python and FastAPI. Research on AI security and safety — whether frontier model monitors can detect payloads hidden in ordinary text.
I find the gaps in modern tooling, then write the code to close them.
Measurement-first work on what models and infrastructure disclose.
| Project | Description | Stack |
|---|---|---|
| Credence | Exposure intelligence for the AI-infrastructure layer · live credential verification across 16 providers, MCP/agent posture scoring, git-metadata secrets, exploitability-ranked SCA, CycloneDX AI-BOM, OWASP LLM + MITRE ATLAS tagging, SARIF dedup | Python |
| covert-semantic | Black-box detectability of LLM semantic steganography, mapped along two axes — what a monitor knows, and what form the payload arrives in. n=150 cross-model monitor panel, distributional stego-detector, and the image-modality vision-analytic gap (an informed monitor goes soft when the payload is rendered as an image, even with perfect OCR). Reproducible: offline test suite + cached-judgment receipts + pre-registered verdicts. | Python |
Tools for authorized penetration testing, vulnerability research, and red team operations.
| Tool | Description | Stack |
|---|---|---|
| Stiletto | SQL injection scanner with CVE sync from 23k+ Trickest repo, AI-generated payloads, and WAF bypass engine | Python |
| ClaimJumper | JWT toolkit · 15 vulnerability checks, algorithm confusion (CVE-2022-39227), kid injection, null signature bypass, 100k wordlist crack | Python |
| Dockyard | Async port scanner · 1000+ ports/sec, 17 protocol probes, 500+ CVE signatures, QUIC detection, LLM-hardened summary | Python |
| Specter | Subdomain takeover scanner across 40+ cloud providers with behavioral anomaly detection and YAML-based detection rules | Python |
| Restless | REST and GraphQL API scanner covering OWASP API Top 10 · SSRF, BOLA, auth bypass, rate limit evasion, CVE-sourced payloads | Python |
| Argus | Default credential scanner across SSH, HTTP, FTP, Telnet, Redis, MongoDB, MySQL, and SNMP with CVE enrichment and CISA KEV integration | Python |
Tools for threat detection, DFIR, and defensive monitoring.
| Tool | Description | Stack |
|---|---|---|
| Lure | Browser phishing defense platform · 49 detectors across 25 implementation waves, AiTM proxy detection, deepfake track injection, and email analysis CLI | JS / Python |
| Vigil | Browser-native Windows event log DFIR · 31 Sigma rules, Shannon entropy scoring, ScriptBlock reassembly, process lineage, and ATT&CK technique heatmap | React |
| Shrike | PCAP forensics via behavioral analysis · C2 beaconing, DNS tunneling, NTLM relay, OT/ICS attacks, WebSocket C2, DGA scoring, and 26-tab HTML report | Python |
| Corsair | HTTP security header scanner · 60+ checks, CVE correlation, 1200+ fingerprinting signatures, SARIF output for GitHub Code Scanning | Python |
| ShadowHunter | Dark web threat intelligence platform · credential monitoring, ransomware leak tracking, IAB marketplace intelligence, stealer log analysis | Python |
| Prizm | Browser client-side secret scanner · 157 patterns across 7 storage types plus WebSocket traffic, ML classification, and live API verification | Chrome MV3 |
Statutory analysis on one end, defences that run in the browser on the other.
| Tool | Description | Stack |
|---|---|---|
| Subrosa | Privacy-engineering suite · nine Claude Code skills over a citation-backed taxonomy of 29 jurisdictional and sectoral records, bridged by a statutory dissolution map. Compliance is a floor; selective disclosure is the ceiling | Rust |
| Kala | Behavioral fingerprinting protection · randomizes typing cadence, mouse dynamics, and touch patterns to defeat analytics-layer deanonymization | TypeScript |
Cryptographic tooling for the Solana ecosystem — air-gapped key custody and cross-chain asset migration.
| Tool | Description | Stack |
|---|---|---|
| Kyma | Sound as a hardware security module for Solana · cold signing and seed recovery over audio, ggwave FSK modulation, LSB music steganography, AES-256-GCM, Android Keystore | Kotlin |
| Kiln | Teleburn protocol for permanently migrating Solana NFTs to Bitcoin Ordinals · atomic burn-plus-memo, on-chain cryptographic proof, public verification | TypeScript |
Product work, front-end engineering, and tooling for coding agents.
| Project | Description | Stack |
|---|---|---|
| Hogwash | Claude Skills suite for stripping AI defaults from writing, code, and design · two-pass manual audit rather than find-and-replace, evidence-tiered from 20+ sources and weighted so structural patterns outrank vocabulary | Python |
| North-Bay | Accessible bilingual municipal site redesign · task-oriented IA over the org chart, focus-trapped dialogs, real document-level language switching, persistent theme. Unofficial concept, not affiliated with the City | TypeScript |
| Joule | Web-first Flutter SaaS for electricians · quotes, PDFs, job templates, invoices, and contract workflows with a minimal, product-first UI | Dart / Flutter |
| First-Peasant-View | First-person-view plugin for Old School RuneScape (RuneLite) | Java |
Python TypeScript JavaScript Rust Kotlin Dart Java React
MITRE ATT&CK Sigma SARIF STIX 2.1 CycloneDX
All security tools are for authorized testing only. See individual repositories for legal notices.