Developer Projects

ThreatWatch is a continuous repository defense platform for developers. A user submits a public GitHub repository and chooses a threat lookback window. ThreatWatch reads the dependency manifests and lockfile, checks OSV and GitHub advisories, enriches matches with CISA KEV and EPSS exploit signals, and runs Semgrep to identify relevant code locations without sending source code to the AI. Findings are prioritized using severity, exploitability, recency, dependency usage, and whether a fix is available. AkashML generates a structured explanation of the attack path and remediation. A verification layer rejects unsupported versions, file paths, line numbers, exploit instructions, or claims that the application was breached. The frontend presents the live pipeline and a clear risk report with evidence and verified fixes. The stack uses Next.js and React for the dashboard, Fastify and TypeScript for the backend, **Semgrep for code evidence, public threat intelligence feeds for vulnerability matching, AkashML for safe explanations, and ClickHouse for report persistence.**

I hid "Ignore all previous instructions" inside a normal-looking security blog, telling AI readers to report a fake breach. My swarm read it. The fake breach never shipped. Hive is a swarm of cheap open-weight agents that reads untrusted web pages all day, plus a ClickHouse monitoring plane that watches the agents themselves. The scraper is the attack surface; watching the swarm is the product. In the demo, a live heartbeat runs on real security news and SEC filings about CrowdStrike, Palo Alto Networks, Zscaler and more: - The dashboard lights up with every agent call by model and role, streamed into ClickHouse. - The poisoned blog gets caught by a prompt canary, quarantined, and its source's trust zeroed. - A news site says $45M, the 8-K says $450M. A judge on a different model sides with the filing. - The writer builds a competitor profile only from claims approved in Senso, every line cited. Ask it something it can't verify and it refuses and files the question to Senso's gap report. By the numbers: - 0 planted lies reached a brief, in every run - 100% injection catch on fixtures, 0 false alarms on 88 live docs - 96 docs, 745 agent calls, 285 verified claims for 13 cents on AkashML Built solo in one day, orchestrating four parallel Claude Code sessions. Semgrep plus my own review caught an SSRF in my own scraper along the way.

Finding a threat is only the beginning. Takedown Orchestrator connects discovery, inspection, reporting, and verification in one auditable workflow. The pipeline ingests target URLs, scans their content with Semgrep, and produces structured findings with confidence scores and code-level evidence. An autonomous coordinator submits reports, saves receipts, and rechecks target availability. A persistent ledger prevents duplicate submissions across restarts. Our live dashboard shows scan evidence, recorded progress, action receipts, and verification results. Its animated evidence replay explains a completed run without triggering new actions. We integrated three sponsor technologies: **ClickHouse:** stores and queries threat events and action records.**Semgrep:** performs actual content scanning and produces actionable evidence.**Akash Network:** hosts the containerized worker and live dashboard.Our controlled demonstration uses a harmless team-owned target and a private mock registrar. It completes ingestion → actual scan → report submission → confirmed suspension autonomously, with a recorded run of 15.054 seconds. External reporting is disabled during this demonstration. All 78 tests pass. The complete ClickHouse pipeline also passes container tests covering restart, database outage recovery, and worker failure. The hosted controlled demo currently uses file-backed storage; ClickHouse execution is verified separately in CI.

Athena is an **AI-powered security platform** that connects vulnerability discovery to safe remediation. It combines NVD threat intelligence, asset correlation, and** Semgrep** SAST/SCA findings with Gemini/**OpenAI**-generated guidance, isolated remediation rehearsals on** Akash**, and evidence stored in **ClickHouse**. The prototype helps security teams prioritize risks, involve asset owners, and verify fixes through a unified dashboard using controlled demo scenarios.

Tripwire enforces trusted task boundaries for AI agents, blocks unauthorized tool calls, and records tamper-evident audit logs. It analyzes activity for suspicious behavior and provides incident reports and analytics, while keeping enforcement deterministic and independent of AI models.

1/3 of developers mention that most of their downtime occurs from third-party API's or data platforms. DriftGuard is an AI-powered tool we built to help developers stay on top of those breaking API changes and security vulnerabilities. Instead of just telling you a dependency is vulnerable or added potential breaking changes, it actually finds the exact lines of code affected, tests potential fixes, and automatically creates GitHub issues and pull requests. It also catches bad fixes before they get merged, so developers can spend less time tracking down issues and more time building. DriftGuard constantly deploys agents to monitor third party developer docs and OVS, and check for any updates that might affect source code. Through an sentence embedding model it accurately finds relations between changelog updates and specific parts of source code, so it can then find which part of the application must be fixed.

Reva watches a repository while an AI coding agent writes code and reviews every save in seconds. It only raises an issue it can prove, and every issue comes with a verified fix. Our novel AI detection model: * Threat-model grounded: data-flow analysis maps untrusted inputs to sensitive operations (SQL, files, outbound HTTP, processes) and records which paths are guarded; an agent review adds assets, trust boundaries and project-specific questions.* Built on top of Semgrep: Semgrep Guardian’s findings on each changed function are packed into the model’s context as evidence, never as the verdict.* Single inference, many questions: one pass answers every screening question at once, and a calibration layer combines the answers with static evidence into a confidence. A free static gate means most saves never reach the model. Then Reva proves it: suspected issues are checked by running the code in a sandbox with canaries. Only proven issues reach the developer, with a targeted fix re-checked the same way. Results export as SARIF. Sponsor technologies: * Semgrep Guardian: the analysis our model builds on.* Akash (AkashML): hosts the model’s transformer, Qwen3.8-27B, for about half a cent per demo run.* ClickHouse Cloud: stores every screening and verdict; the measured hit rate per pattern feeds back into calibration. * Pi: coding agent

Signal Integrity Live is an AI-assisted cybersecurity platform that detects schema drift, diagnoses broken security detections using Google Gemini, and validates proposed repairs through deterministic regression testing. Built with Python, Streamlit, and ClickHouse, it demonstrates safer AI-driven detection maintenance, reduced operational noise, and auditable repair workflows.

"An autonomous agent can't make reliable decisions on user prompts alone. To act safely, it needs structured context about four key areas: **Explicit Tool Contracts:** The agent must know what tools actually do, distinguishing between read-only actions, state changes, and network activity rather than relying on basic descriptions. **System State & Invariants:** It needs clear visibility into active security policies, denylists, and schemas that define system boundaries. **Environment Topology:** It must distinguish between logical names and resolved network endpoints to recognize public versus private targets. **Execution Feedback:** Instead of assuming an API call succeeded, it requires verifiable receipts and cryptographic proof of completion."

Aegis is an on-call assistant for security teams. When an attack shows up in live traffic, it investigates, proposes a fix, and speaks a short briefing. Nothing is deployed until a person clearly approves it by voice. ClickHouse flags an active SQL injection. Aegis pulls matching playbooks and past incidents from MongoDB, a Semgrep scout scans the vulnerable code, and a model writes a patch that Semgrep checks again. ElevenLabs reads the briefing aloud. The operator says “approve,” the server checks those words, and only then are attacker IPs blocked and the exploit replayed to confirm it fails. A live dashboard shows the traffic, the attack path, the log evidence, and whether the patch and health checks passed. It is for the person on call who needs to understand an incident and authorize a response without jumping between tools. Remediation in this demo is simulated, so the prototype never changes real infrastructure.

Differential Swarm tests how an AI agent’s behavior changes with every pull request. It maps the change’s blast radius, generates targeted attacks, and sends a swarm of red-team agents (scam callers, manipulative sellers, poisoned listings) against the old and new builds in isolated paired sandboxes. Comparing each pair shows regressions, fixes and pre-existing failures. Our demo uses a shopping agent facing fraudulent voice calls, manipulative sellers and malicious listings. A live dashboard shows the swarm’s progress and lets reviewers inspect conversations, tool calls and payment evidence side by side. Each finding becomes a GitHub remediation issue and a verified Semgrep rule, which turns behavioral discoveries into reusable static checks. That’s how the evals improve themselves.

Agent automatically alerts on fradulent transactions utilizing gps, email data, etc to verify and prevent further issues.

Jingang (金刚) watches public advisory feeds, confirms whether your code actually calls the vulnerable function, ships a verified upgrade as a pull request, and leaves two guardrails behind so the same bug can't come back. Dependabot tells you a library is old. Jingang tells you line 12 calls the vulnerable function with user input, ships the fix, and blocks anyone from writing line 12 again.

token-wise gives a team's coding agents a shared memory, so no agent makes the same mistake twice. The problem: every coding-agent session starts with no memory of the ones before it. When an agent hits a bug that a teammate's agent solved yesterday, it doesn't know. So it retries: it rewrites the call, changes a flag, and tries again, burning tokens and CI minutes. A security mistake fixed once gets written again in the next session. The usual tools each cover one piece: scanners find problems but don't teach the agent how this team fixes them, memory tools store knowledge but don't step in when an agent fails, and human review either interrupts constantly or arrives too late.

Problem: an MCP server can rewrite a tool's description after an operator approved it (a "rug pull"). Pinning tools can flag the change; we enforce it in the call path and prove the block. How it works: a managed MCP client binds trust to the SHA-256 revision of each tool's name, description and input schema. When a changed revision is observed, approval is invalidated and calls are refused before dispatch. Then: - Semgrep: deterministic hard-deny rules; a match quarantines and no model can override it. - Senso: the operator policy is retrieved scoped to its content ID, verified, and its digest is bound to each assessment. - OpenAI (gpt-6-astra, strict Structured Outputs, no tools): recommends review or quarantine only; it cannot approve. - Validation: accepted only if evidence spans appear verbatim and policy IDs, sources, revision and generation match. - Verification: the retried call is refused before dispatch and the server's own received-call count stays 1 -> 1; an unaffected control server keeps working. - ClickHouse: every transition is delivered as an append-only audit history and read back. Live result: Semgrep found no match, the model recommended quarantine under POL-001 quoting the exact sentence, it was validated and applied, and the block was verified. 6/6 fixed evaluation cases match (one run); 142 tests pass. Limits: synthetic demo servers; protects calls through our client only; scripted walkthrough, no polling or UI yet.

**What we built:** Least-privilege control for AI agent fleets. When several agents share one credential and one starts overusing a permission (say, after reading a manipulated ticket), ScopeWatch finds that exact agent, blocks only that capability, and proves the approved agents keep working.**How it works:** We collect every native permission decision and tie it to the agent that actually made it. Then we check each agent against its own allowance in a 10-minute sliding window at every past moment, not just now. An operator reviews the case, approves one exact scope and applies a DENY. Fresh probes must show the target refused and a busier approved agent still getting its expected result. Nothing auto-releases. **Guild.ai:** Hosts the fleet: two coded agents built with the agents SDK plus a read-only LLM investigator, launched through an API trigger. Every GitHub tool call emits a native ALLOW/DENY security_event, and we walk the task graph to attribute it. Containment is a DENY rule in Guild's credential policy. **ClickHouse:** The decision is made in SQL. Parameterized queries evaluate every agent at every event anchor over (T−600s, T], with conflict-first dedup, exact readback before a case opens, and a receipt per query (query_id, SHA-256, latency). An independent oracle must agree. Runs locally and on ClickHouse Cloud. **Semgrep:** We scanned our own AI-assisted codebase with 165 rules (OWASP, secrets, SQLi, AI best practices): 0 findings.

**Trust Issues: AI can write the fix. We make it prove it.** AI coding agents can identify vulnerabilities and generate patches in seconds. But who verifies that those patches actually work? Trust Issues is an autonomous security remediation system that detects vulnerabilities, generates patches, independently verifies their effectiveness, and escalates unresolved issues to human engineers through AI-powered phone calls. **How it works:** **Detect:** Semgrep scans repository changes and identifies vulnerabilities.**Reproduce:** An AI agent generates an exploit test to establish that the vulnerability is real.**Repair:** OpenAI generates a candidate security patch in an isolated environment.**Verify:** Six independent checks validate exploit prevention, security rescanning, regression tests, test integrity, and patch scope.**Escalate:** After two failed verification attempts, an ElevenLabs voice agent calls an engineer, explains the evidence, and requests a decision to ship, hold, or retry.**Audit:** ClickHouse records remediation attempts, verification outcomes, and human decisions.Trust Issues also supports repository monitoring and GitHub pull requests containing proposed fixes and regression tests. **Our principle: Never trust an AI-generated security fix without evidence.**

AEGIS is an autonomous security team for GitHub. Each sentinel agent, hosted on Guild.ai, owns three repos and wakes on every push or PR through a Guild webhook trigger. How it works: the sentinel calls our scanner (a custom Guild integration) and Semgrep scans only what the push changed. The verdict is deterministic, so the AI can't talk its way to green. Unsafe means a red commit status in ~30 s. Sub-agents then take over: triage confirms the bug and writes a test that fails on that commit; the remediator patches only the flagged lines; the patch is re-scanned by Semgrep and verified three ways (finding gone, repo tests pass, new test passes). Only then does the agent open the PR, label it verified, merge it, re-scan to green and close the Issue. Guild.ai: 10 hosted agents, webhook and cron triggers, sub-agents, skills, evals, and credential policies that fence each agent to its own repos; a call on a foreign repo is refused by Guild's proxy. Semgrep: diff scans, custom rules with autofixes, taint rules for AI-generated code, a rule that flags prompt-injection comments, a gate on every patch agents hand each other, and rulesmith, which turns a confirmed bug into a new tested rule for the whole fleet. ClickHouse: the fleet's memory. Every scan, finding and action is stored; a false positive dismissed once is never reported again, each finding gets a priority from fleet history, and materialized views power a live fix funnel and agent watch. OpenAI: span-only patches.

Argentina's public health insurer for retirees posts every purchase online, attachments included. In May 2026, journalists found patients' medical histories and ID cards among those files. Nothing checked them before they went up. **ArgenSec** is a gate that checks every PDF before it goes public. Clean files are published. Patient data stay private. No person has to approve anything, and people can review the outcomes afterward. Sponsor tools:- **AkashML**: two open models find personal data in text and scanned pages.- **Guild.ai**: agents remove the data, and a reviewer agent checks the result. They loop until it passes, up to 3 times.- **ClickHouse**: logs every decision and runs live queries over 1 million simulated events.- **Senso.ai**: supplies the privacy-law passage behind each blocked file.- **Semgrep**: found a CSRF hole in our AI-written code. We fixed it.

OWASP Top 10:2025 ranks Broken Access Control #1: 100% of the applications tested had some form of it. Alerts do not fix anything and unverified patches are guesses. Rootlane closes the loop. Our OWASP Juice Shop (juiceshop.rootlane.xyz, Akash) sends derived request telemetry (never passwords, tokens or bodies) to the Rootlane API (api.rootlane.xyz, FastAPI on Akash), stored in ClickHouse Cloud. Every ~10 s an always-on open model on AkashML (GLM-5.3) reads behavioural features per identity and IP and answers ignore / watch / escalate; a deterministic rule also escalates when an identity is served without ever logging in. Escalation opens an incident and starts our TypeScript agent hosted on Guild (claude-opus-5): it queries ClickHouse read-only, reads the source, runs Semgrep and cites our policies stored in Senso; every tool call is audited. It proposes a fix plus a Semgrep rule; a named human approves in the dashboard (app.rootlane.xyz, Vercel) and it opens a PR on our fork. Guild hosts and governs the agent. ClickHouse is the real-time backbone. Akash hosts the app and API; AkashML runs triage. Senso is the verified context. Semgrep scans, verifies and prevents recurrence. Replica verification is built but disabled on the public deploy for safety.

An AI agent that pretends to be a compromised server. When an attacker exploits our fake company (Hivewell, a smart-beehive startup) and pops a "reverse shell," their terminal connects to a real socket — but on the other end is an agent playing bash inside a consistent synthetic machine. Nothing they type is executed. The agent never breaks character. It keeps a stable fake filesystem, answers unknown commands in-world, and feeds tempting dead-ends — a fake .env, AWS keys, a database that times out — so the attacker burns time chasing loot that was never real. Meanwhile the control server logs every HTTP request and shell command to ClickHouse. A second agent reads the whole session and writes an evidence-linked attacker playbook: classification, kill-chain stages, and the exact commands that prove each one — shown on the HoneyStack Shield dashboard with a live timeline and a "time wasted" counter. Who it's for: blue teams, SOC and threat-intel analysts who want real attacker behavior instead of alert noise, and researchers studying how autonomous, agentic attackers operate. Built on our partners: Akash hosts the public trap; ClickHouse is the telemetry backbone behind the live replay and metrics; Guild AI runs both agents. Everything the attacker sees is invented; everything they do becomes evidence.

AI can already suggest security patches, but nobody proves they work before they ship.** The Frontier AI cybersecurity survey (arXiv:2504.05408) found zero systems for remediation deployment**. CloseLoop fills that gap: **Find → Fix → Prove → Ship.** How it works: a scanner or red-team agent posts a finding to CloseLoop's handoff API. OpenAI generates a least-privilege patch, which runs through an offline check (up to 3 retries). A Guild AI reviewer agent approves or rejects it. Approved patches are applied to a live lab on Akash, and CloseLoop replays the real exploit: it must succeed before the fix and be blocked after, while canary and app health checks stay green. If anything breaks, it rolls back automatically. Verified fixes ship as a GitHub PR that changes only the affected policy line, with the before/after evidence attached. Tech: OpenAI for patch generation; Guild AI as the independent reviewer agent; Akash to host the live target environment and apply changes via its Console API; ClickHouse to record every pipeline event and evidence trail; GitHub for automated PR shipping. Built with Next.js and TypeScript, 56 tests passing. Results: 4 verified end-to-end runs, each opening a real infra PR, plus a passing rollback test. The recorded run went from finding to verified fix in 1 minute 38 seconds.

**AEGIS: the SOC that fights back** Most security tools detect and then wait for a human. AEGIS closes the loop: it detects an attack, investigates it and blocks it, with no human in between. Synthetic attack traffic (recon, password spray, an account compromise, lateral movement through an internal host, and DNS-tunnel exfiltration) streams into **ClickHouse Cloud,** which holds about 11M events. Three agents then run: **Sentinel** runs a **ClickHouse** query over recent events to cut millions of rows to a few suspect sources, and an open model on **AkashML** judges them. **Bloodhound** pulls the suspect’s timeline with SQL, maps it to kill-chain stages and narrates it. It also searches Senso for similar past incidents. **Blacksmith** proposes block rules, and our code validates them (external ranges no wider than /24, internal hosts only as exact /32, users only if confirmed compromised) and adds any confirmed compromised user or pivot host the model left out. It writes the rules to a blocklist table, the simulated attack traffic stops, and only then does it write the incident report, which is saved to **Senso**.