Developer Projects

ClipScout helps video editors and content teams turn a story brief into a reviewed first cut. Instead of repeatedly watching archive footage, users define the shots they need, search the supplied video archive, and preview the original clips. VAST Data's VSS stack provides retrieval, using NVIDIA Cosmos Reason descriptions and Cosmos Embed matching. Our own Weights & Biases serverless inference call recommends candidate clips, a sequence, and potential coverage gaps from those descriptions. Editors verify the footage and approve each selection; AI suggestions never automatically change the cut. The demo assembles a cyclist, pedestrians crossing, and a wide highway view into a 15-second MP4. An unsupported marathon-finish request stays visibly unfilled. Users can reorder or remove shots and download both a silent MP4 and a JSON source shot list containing source IDs, original timecodes, and cut positions. A SpaceXAI/Cursor agent contributed the editorial advisor; Codex integrated, tested, and deployed the application. FFmpeg assembles the output. We verified a real W&B call, browser downloads, and 29 passing tests. This prototype works on recorded archive footage; live monitoring and crew dispatch are future work.

YOLO identifies delivery vehicles, civilian crowds, or roadblocks. NVIDIA Cosmos interprets the overall scene safety or the urgency of the structural damage. Semantic search allows aid coordinators to query massive, chaotic video logs for specific logistical needs.

SHOO turns a spare phone into a private, AI-powered pest sentry. Point it at a balcony, garden or bin store and it uses an on-device vision model to recognise pigeons, gulls, foxes, rats and squirrels. When it spots one, it plays a deterrent sound chosen for that species and randomised so animals don't get used to it. It holds fire when people, pets or hedgehogs are in view. Every visit is logged with a snapshot. You can search hours of recorded footage in plain language ("show me every pigeon today"), ask what happened overnight, and set simple rules like "if a fox comes at night, flash the lamp and notify me." A dot-matrix bot face reacts to what it sees, and there are two themes: a clean Nothing-style look and a red "Slasher" horror look. It all runs on the phone, with no account, no cloud and no uploads. Uses large cloud models for back up and processing. It's available as a native iPhone app and as a web app you can add to your home screen at https://shoo-web-production.up.railway.app.

Hive Vision lets first responders map a building together and see each other through walls. Each responder's iPhone scans the space with LiDAR as they move, and the scans join into one shared live floor plan with walls, doors and rooms. Phones join a team by scanning a QR code, and from then on each person sees teammates as figures standing behind the walls, with their live camera view one tap away. A coordinator watches everything from a web console: the floor plan with every responder's position and direction, a 3D model of the scanned building, and all the camera feeds side by side, so they can direct the team as the situation unfolds.

Google Maps shows you where stores are; CornerScout helps you discover where your next store should be. Choosing the right retail location is one of the most important decisions a business can make. Yet traditional site selection relies on static demographics, expensive surveys, and incomplete estimates of foot traffic. CornerScout introduces a new source of intelligence: what is actually happening on the street. By transforming real-world street footage into actionable insights, CornerScout helps entrepreneurs, retail chains, and enterprise expansion teams identify promising locations based on observed activity, neighbourhood characteristics, and potential customer audiences. Instead of just showing where people live or where businesses already exist, CornerScout reveals how neighbourhoods actually function. **How it works:** 1. VASTData holds city neighborhood public footage indexed. CornerScout reads that index. 2. NVIDIA captioned those segments with Cosmos. The returned rows report nvidia/cosmos3-nano-reasoner. Those captions are the segment grid, and they drive the city report. 3. CoreWeave (Weights & Biases) looks at the pictures. Gemma4 W&B Inference counts and caches people, cars, cyclists, and dogs in those 180 frames. When you name a business, a text model on the same API picks the customer audiences 4. Cursor was used to speed-up development of the platform

Kavach (कवच, "armor") is a containment layer for customer-facing AI agents. The model is not the security boundary. Our demo: a refund agent reads a support ticket with a hidden prompt injection telling it to POST the customer's card number to an attacker. Uncontained, it leaks the card and the API key. Inside Kavach, it never sees them. How it works: the agent runs in a sandbox whose only route out is a Kavach gateway (mitmproxy + our add-on). The gateway tokenizes card numbers before the agent sees them and swaps the token back to the real card only on the call to the payment processor. Stand-in API keys are swapped for the real key only on the matching provider's host. A kernel eBPF guard kills any process that tries a raw socket around the gateway. Every request is recorded in a wire log showing what the agent sent versus what left the sandbox, with cards and keys masked.  NVIDIA OpenShell as a second sandbox backend (kavach openshell compile turns the same policy into an OpenShell policy, and OpenShell's own audit events join the wire log), and Kyverno-inspired policy features: audit vs. enforce mode, expiring exceptions, PolicyReport export and CI lint. Verified live on OpenShell 0.1.3, with Qwen3-30B running through the same path. Evidence: kavach eval replays 10 attacks (10/10 clean, refunds still succeed), 40 unit tests, and a 17-check end-to-end suite on a homelab VM.

**An autonomous security researcher for engineering teams: a git push triggers a Semgrep scan, a Pi agent writes a proof of concept and fix, a Guild sandbox proves the bug and verifies the patch, and only hard evidence opens a draft PR. 0DayForge** is an **autonomous security remediation harness**. A push to the `demo` branch of an owned GitHub repository starts a run with no manual prompt: **a pinned Semgrep scan produces a candidate**, the Pi SDK proposes a hypothesis, **a benign proof of concept,** a regression test and a unified-diff patch, and all three are executed inside an **isolated Guild.ai sandbox**. The original copy must reproduce the issue, the patched copy must block the identical PoC, and the functional tests must still pass. **Every stage is persisted to ClickHouse for deduplication and an auditable timeline. **Only a deterministic verdict computed by the controller, never the model, opens a draft GitHub PR. Nothing is ever auto-merged.

Security teams are buried in CVE alerts, and most of them don't apply to what they actually run. StackWatch takes a target, maps its attack surface and software stack, and tells you which advisories really affect you, with proof. You give it a repo, a deployment or a domain. It runs recon (DNS, certificate transparency, RDAP, TLS), finds dependencies and live endpoints, and matches them against OSV advisories. Then it checks each match: Semgrep looks for the vulnerable code pattern in source, and runtime probes test the live app. Every finding gets a status (verified, present, inconclusive or not present). Risk is scored as severity times proof, so a verified high ranks above an unconfirmed critical, and an exposure graph moves internet-facing issues to the top. An authorization gate keeps it scanning only targets you're allowed to touch. Built with FastAPI and asyncio, OSV, Semgrep, a Ministral research agent for plain-English explanations, ClickHouse and SQLite, and a Senso.ai knowledgebase integration.

AI coding agents ship code faster than humans can review it, and they repeat the same security mistakes. TrustMeBro is a Claude Code plugin that acts as an immune system for agent-written code. A pre-write hook scans every edit with Semgrep. Claude confirms whether each finding is a real vulnerability and explains it in plain English, then the edit is blocked and the agent rewrites it safely. When TrustMeBro confirms a new bug, it writes a fresh Semgrep rule, checks that the rule catches the bug but not the fix, saves it to the repo, and hunts the codebase for copies of the same mistake. Learned rules are plain YAML in git, so a whole team shares the same protection, and those rules run free and offline with no AI needed. It covers SQL injection, MongoDB/NoSQL injection, prompt injection into agent system prompts, and rogue agents executing model output. It installs with one command and an API key, sets up its own dependencies, and logs every block, fix and learned rule for review in ClickHouse.

**Ghost Ops** is an autonomous AI counterintelligence platform built to detect, investigate, and contain threats targeting AI agents. As autonomous agents gain access to tools, sensitive data, and persistent memory, they introduce new security risks. Ghost Ops addresses these threats by monitoring agent behavior, verifying identities, detecting memory manipulation, and blocking unauthorized actions before they execute. The platform combines four security engines: **AgentDNA** for behavioral fingerprinting, **ShadowWatch** for rogue-agent detection, **MemoryGuard** for memory integrity protection, and **GhostTrap** for deception and honeypot monitoring. Through an authenticated MCP security gateway, Ghost Ops enforces tool permissions in real time. Its autonomous threat-hunting system correlates suspicious activity across multiple agents, reconstructs incidents, and supports controlled containment with verifiable forensic evidence. Ghost Ops has demonstrated real AI-model inference, cross-process agent execution, live vulnerability intelligence retrieval, and prevention of unauthorized tool operations. Our mission is to make autonomous AI systems safer by giving developers the ability to see what their agents are doing, understand when something goes wrong, and stop threats before they cause damage.

An app concept for screening incoming calls on Android/iOS and reporting whether it's a real phone call from your relative or fake AI-clone voice.Uses a small 0.3B param model which is running locally on my Mac and likely can run on phones too at this small size/compute requirements.

**Aegis: Autonomous Defense Loop** reads a deploy, joins misconfigurations into attack paths, hardens the files, and rescans to prove the path is closed. It is for someone who ships a service and wants to see how it can be reached before that path is used. Stages 01–04 scan a demo deploy, join the findings into paths, edit a copy of the files, and watch for a path that opens again. A fix counts only when the rescan is clean. Stage 05 compares Northwind Checkout with a short-lived sandbox process. Stage 06 is Sentinel. Stage 07 reads a live URI. **Guild** supplied Sentinel. One command sends a file to a model and can write a hardened copy. Another turns a log into one incident report. Stage 06 lists both. They need `OPENAI_API_KEY`. **Akash** hosts the container. `deploy/lane-demo.sdl.yml` pulls `ankura/lane-demo:0.1.0`. Stage 07 reads that URI. Checked locally, nginx showed HTTP, missing browser headers, and a `Server` header. Lane-demo also showed `/.env`, `/debug`, `/server-status`, and wildcard CORS. **Semgrep** 1.180.0 scanned the project. The result is at [https://uboqmsd1v5crh79mno8uca21qg.ingress.boogle.cloud/semgrep-report.html](https://uboqmsd1v5crh79mno8uca21qg.ingress.boogle.cloud/semgrep-report.html): 1 error (`USER root` in the Northwind Dockerfile) and 5 warnings. Three other rules did not run because they need the Semgrep Pro engine.

ProofLoop helps developers verify whether AI-generated security fixes actually work. It discovers and reproduces vulnerabilities, generates defensive patches, and evaluates them through independent security, functional, and adversarial tests. Failed fixes remain in the record, while passing results are tied to the checks actually executed. By bringing code changes, test outcomes, and reproducible evidence into one workspace, ProofLoop gives developers and reviewers a clear basis for deciding whether a fix deserves their trust.

Antibody is a hackathon project building an autonomous agent that repairs a real SQL-injection flaw in a team-owned OWASP Juice Shop deployment (in routes/search.ts), verifies the fix doesn't break ordinary search, deploys the passing candidate to a live public endpoint, and publishes honest evidence — not just a PR or local demo. Core loop: Agent gets a real Semgrep finding → proposes a patch via Guild AI → host independently validates diff scope and runs locked-down behavior checks (search works, injection fails, scan is clean) → only a fully-passing candidate can deploy (host enforces this even if the agent asks to skip it) → external HTTP probes verify the live endpoint → everything logs to ClickHouse as evidence. A deliberately bad candidate is run through the same gate to prove rejection is real, not staged. Ethos: The docs obsessively close loopholes — no claiming a tool was "used" if only planned, no attributing test candidates to the model falsely, no calling deployment "verified" without an actual probe, no claiming the app is "secure" from a narrow test pass. The host owns credentials and authorization; the model only proposes.

**Agent Memory Gateway is a policy gateway that sits in front of the memory AI agents share, and every write and read has to pass through it. Before a memory is stored, the gateway scans it for credentials. If it finds one, it quarantines the whole write, so the secret never reaches the knowledge base (Senso). Each memory keeps the access restrictions of the sources it came from, and the server checks the reader's current permissions on every read. Agents hold only short-lived, run-scoped gateway tokens and never the backend keys, so a hand-written script calling the API gets the same decision as the agent's own client. In a live demo on AWS, with AkashML agents, Senso memory and ClickHouse audit logs, the same note causes a real cross-customer data breach without the gateway. With the gateway, that note is blocked, while the agent still publishes a useful, source-linked report.**

I built an autonomous attack-fix-verify agent for AI-generated APIs, it attacks a running API like a real adversary over HTTP (IDOR, SQL injection, sensitive-data exposure, missing auth), confirms each bug by comparing the actual responses, then uses an LLM (Gemini) to propose a minimal patch for just the vulnerable handler and crucially, it doesn't trust the AI's fix, it trusts the re-attack: deterministic code re-runs the exact exploit and only marks a fix "verified" if the attack now fails, the legitimate good path still works, and the app still starts (else it retries up to 3× or flags for human review), after which it opens a GitHub pull request with the patch, auto-generated regression tests, and evidence. Semgrep is layered in as the static-analysis second opinion, it pre-scans the code for suspects (file/line/CWE), feeds those into the fix prompt, re-scans after patching, and most importantly cross-checks static vs. dynamic findings. On my app Semgrep caught only the SQL injection and missed the IDOR, data-exposure, and missing-auth logic bugs, which is exactly the point static analysis shows where code looks wrong, while the active attacker proves what's actually exploitable, so the two together are far stronger than either alone.

PatchMedic is an autonomous security engineer for your software supply chain. It watches advisories and your dependencies around the clock, triages what is actually exploitable, and opens a fix as a GitHub PR at machine speed, so you are never stuck in the window between a CVE dropping and mass exploitation. The catch with any auto-patcher: fast patching is exactly how supply-chain attacks get in (event-stream, node-ipc, xz). A poisoned advisory or a trojaned “fix” can turn your defender into the attack. PatchMedic can’t be. It runs with placeholder credentials inside a kernel-enforced jail built on eBPF: it can only read its workspace and reach approved hosts, and a real API key is swapped in only for in-scope calls. If a poisoned update talks the agent into reading your SSH key or phoning home, the kernel kills it before the access happens. The agent can be fooled. The kernel can’t. Every kernel decision, triage step, and scan is recorded where the agent can’t edit it. Tools: ClickHouse (tamper-proof event log + live dashboard), AkashML (multi-step triage on open models, so your code never touches a closed API), Semgrep (static scan of the dependency diff), yeet (the eBPF enforcement engine).

The problem: detection is solved, response isn't. Alerts pile up, a human triages, and the attacker is gone. Dwell time is hours; an automated attack finishes in seconds. Parry closes the loop. It sits inline as a reverse proxy; every request becomes a row in ClickHouse, and an AI blue-team agent runs a continuous loop: DETECT, TRIAGE, GROUND, RESPOND. How we use each partner: ClickHouse Cloud — the brain. Detection IS SQL: 8 rules over live telemetry every 2s, with materialized views pre-aggregating at ingest. Add a detector in one SELECT. Akash — triage runs on a rented NVIDIA A100 via the new Console API (managed wallet, auto-funding, runtime cap). One model scores alerts, writes the code patch, and the incident report. Semgrep — pins the exact vulnerable line on every high-severity alert; the Akash LLM then writes a secure patch. Senso — grounds every call in verified playbooks, citing the doc ids used. Guild — a hosted commander agent adjudicates critical detections as a tamper-evident audit trail. What makes it smart: when an exploit succeeds once, Parry distills it into a brand-new, validated ClickHouse rule and arms it instantly. And the moment exfiltration is seen, it rotates every touched secret for real — the stolen key is already dead. The result: launch an attacker from the dashboard, watch it caught, blocked, and patched live; run it again and the whole attack returns 403. Autonomous defense, with receipts.

Immune is an MCP firewall with a memory. It sits between any agent and its tool servers and catches poisoned tool descriptions, injected results and secret exfiltration. When a novel variant gets through, it synthesizes a countermeasure, proves it by replaying the whole corpus in ClickHouse, rescans with Semgrep, signs a receipt, publishes a ruling, and verifies that the same attack now bounces. Headline metric: Time to Immunity, in seconds.

**The Problem****:** Static analysis scanners like Semgrep flag vulnerabilities in seconds, but developers suffer from alert fatigue, leaving critical security flaws exposed during long manual remediation cycles.**The Solution****:** Our ADL pipeline integrates **Semgrep 2.7** and **Codex CLI** directly inside a ChromeOS Linux terminal. When Semgrep flags a vulnerability (such as a CWE-78 Command Injection flaw in vulnerable_service.py), our agent calls **AWS Bedrock (Claude 3.5 Sonnet)** to generate a secure code patch without shell=True. It re-executes Semgrep to confirm zero findings and indexes the pattern into **ClickHouse on AWS** for real-time lesson retrieval.**Tech Stack****:** ChromeOS Linux Container, Codex CLI, Semgrep 2.7, AWS Bedrock (Claude 3.5 Sonnet), ClickHouse on AWS, AWS S3.

**AI agents now hold production keys: they read config, run commands and call APIs, and one poisoned ticket can turn an agent into an attacker. Tripwire is the checkpoint every agent tool call passes through, built for security and platform teams running agent fleets in production.** ** ** **• Prevent: risky sends are held and judged by an AkashML model (labelled rule fallback if slow) before they run, so the secret never leaves.** **• Trip: decoy honeytokens catch exfiltration instantly, with no model call.** **• Detect: a millisecond ClickHouse funnel over the live stream quarantines an agent that reads a secret, encodes it and sends it out.** **• Trace: it finds patient zero (the poisoned input), puts every other agent that read it on heightened watch and denies the attacker's host fleet-wide.** **• Cure with proof: a guardrail ships only after it refuses a sandboxed replay of the attack, keeps normal work running and is backtested over ~30M events in under a second; then a human approves it in Guild.** **• Explain: an investigator writes the incident report with its own SQL receipts.** ** ** **Every number on screen comes from a receipt. On 60 labelled development cases (not a held-out test) it caught 30/30 attacks with 0 false positives. Guild-hosted agents and any MCP client are governed by the same checkpoint, and Semgrep scanned our own AI-written code: 1 real finding, fixed.**

Agent Honeypot is canarytokens.org for AI agents: detection infrastructure that reveals which agents in a fleet have already been compromised by prompt injection. Prevention tools try to stop injection. None tell you which of your agents already fell for it. Agent Honeypot answers that by planting inert bait and logging who takes it. The bait comes in two forms: a decoy tool named get_admin_credentials that no legitimate task should ever call, and canary documents in markdown, HTML, and PDF, each carrying a unique tracking token. When a compromised agent calls the decoy or reaches the hidden callback in a document, a Flask listener records the hit: which token, the timestamp, source IP, user agent, and which agent tripped it. A live dashboard shows every hit as it happens. The core idea is turning this into a susceptibility benchmark. We send identical bait through two agents: an undefended model and Fable 5.1, a defended model. The undefended agent trips every canary while Fable 5.1 stays dark. That contrast measures exploitability instead of just flagging one incident, so a security team can rank which agents in their fleet are actually safe to deploy. The project targets threat discovery and attack intelligence, and it emphasizes detection over prevention, because the hardest problem in agent security is knowing you have already been breached. Tools: Python, Flask, SQLite, a small undefended victim model, and Fable 5.1 as the defended baseline.