Developer Projects

**SentinelEKS: an autonomous, evidence-grounded security agent for Kubernetes** Cryptominers and container escapes move in minutes, while SOC teams juggle separate sensors and AI that suggests actions it can't justify. SentinelEKS closes that loop on AWS EKS: it detects an attack, decides the response using only verified sources, checks its own fix, and contains the threat. A human approves only the destructive step. **How the tools work together:** 1. Detect and correlate. Falco, Tetragon and GuardDuty events flow through SQS into ClickHouse. Before triage we ask what other sensors saw on the same workload in the last 10 minutes; two or more independent sensors escalate severity, decided by code, not the LLM. 2. Decide with citations. Step Functions runs the agent chain. Bedrock (Claude Haiku) summarizes and triages; Akash-hosted Llama 70B plans the response; Senso returns the official runbook procedure with citations. No citation, no action: the incident goes to a human. 3. Verify before acting. Bedrock (Claude Sonnet) turns the plan into tool calls limited to a whitelist (snapshot, isolate, deny-all NetworkPolicy, SIGKILL, scale-to-0). Semgrep scans the generated manifest and Pi's Code Gatekeeper reviews it. 4. Act and record. Slack shows what, why, impact and rollback; one click executes via EKS MCP. MongoDB stores incident state and an insert-only approval audit; a Slack Canvas status page stays current. **Every action is cited, gated and auditable.**

Alink is a voice verification platform that checks both who is speaking and what they say. It compares a recording against a user’s enrolled voice embedding and baseline text, supporting normal, high, and low pitch profiles through a simple API

GHOST proves your detection works instead of assuming it does. What we built: six red-team agents (recon, network scan, injection, auth bypass, DoS/resilience, business-logic abuse) run against TowerBank, a deliberately vulnerable sandbox app we built and own. Every action becomes a structured event. ClickHouse scores each event with windowed detection queries, labels it detected or missed, and streams live coverage % and mean-time-to-detect to a 3D siege view: shields flash when an attack is caught, and the tower takes damage when one slips through. How it works: every event travels two lanes at once. The visual lane (agent, coordinator, WebSocket) never waits on the database. The analytics lane (same event, ClickHouse, verdict) feeds the live stats. A volume replayer preloads millions of historical events so the numbers hold at scale. Guild.ai: the six agents are built with the Guild Agent SDK, published to Guild, and started as Guild sessions through the Guild API. Each returns a typed event stream that a forwarder posts to the coordinator. ClickHouse: detection verdicts, coverage and latency are analytical queries over the event table. LibreChat on top lets you ask "which attacks slipped through in the last run?" in plain English. Semgrep: we scanned our AI-generated target code and wrote up the most interesting finding.

**GPU-Sentinel turns your telemetry pipeline into a security sensor — detecting GPU abuse like cryptojacking inside ClickHouse within seconds of the event, and letting any analyst investigate in plain English with an AI copilot grounded in your own incident playbooks.  **cryptomining on stolen GPUs looks like a training job to every security tool; your observability pipeline is already a security sensor

Hospitals can train an AI model together without pooling their patient data, but a compromised participant can send malicious updates that undermine the shared model. **Warden detects and contains that threat while training continues.** Our prototype uses Flower and PyTorch to train a pneumonia X-ray classifier across three simulated hospitals using real public medical images. Two training runs start identically, letting viewers **compare protected and unprotected models side by side**. During live training, we can activate an attack at one hospital. A numerical monitor flags unusually large updates, and a rule-based security agent **inspects the evidence and excludes the suspicious contribution before aggregation**. The dashboard shows training images, model predictions, **measured accuracy, and the agent’s actions** as they happen. It demonstrates real containment of a deliberately obvious model-poisoning attack, with a clear view of both the damage and the protection.

GuardLoop monitors both sides of AI conversations against a configurable policy. It combines ElevenLabs voice and text sessions, TypeSafe Jev classification, and ClickHouse analytics to make concerning messages and the evidence behind each decision visible.

Employee data requires precise permissions: viewing a record should not automatically grant permission to edit or share it. Secure People Analytics is a working Python/Streamlit prototype using synthetic data for 20 employees. ClickHouse stores 60 monthly workforce analytics records and powers PTO and overtime dashboards. Backend queries restrict employees to their own records and managers to their direct reports. Employees can update their own phone number and address, while system-maintained PTO remains protected. Manager workflows support assigned leave approvals and denials without granting direct record-editing or export rights. Contact changes, leave decisions, and audit logs remain local. The security demo exercises attempts to access another employee's PTO, modify system-maintained PTO, and export restricted employee data. Backend authorization rejects prohibited actions, and the audit trail records allowed and denied attempts. Built-in chart and table download controls are removed. Built with Claude Code in Cursor. This prototype uses simulated identities and application-level authorization; real authentication and database-level hardening are future work.

Team ScreenShield (Rustam Salavatov). Every recorded screen leaks secrets and carries attacks: QR phishing for viewers, prompt injection for agents watching the feed. ScreenShield is one Rust binary with two loops. Fast loop on the device, no LLM: on-device OCR, deterministic detectors, DRIFT-style gates, blur in the recording, under a second per keyframe. Code shown on screen is watched, never blurred: only the credential lines inside it are. Slow loop, the agent over the archive: it reads the OCR'd code as data and reports the language, the repository and the problem (hardcoded secret, injection, unsafe call), decides per policy through sgr-agent tool calling on AkashML (gpt-oss-120b), and re-checks every finding with a vision model (Qwen3.6), proving the blur by OCR. Verified live today through an iPhone camera on the venue Wi-Fi slide and a developer screen. ClickHouse: 6.0M keyframe rows local, fleet queries in 26-34 ms, OCR text per keyframe so the agent can grep the fleet, evidence JPEG per finding. Next.js dashboard; Senso policy; Semgrep Guardian during the build. 41 tests, MIT.

The recent OpenAI + HuggingFace incident reveals the dangers of **reward hacking** during post-training. Models with misaligned behavior may collude and hack into services to complete their tasks. As more SMB's are beginning to finetune their own models using open-weights models, it is critical that folks have confidence in their agent. But how can we detect models with misaligned behavior? One option is to generate **honeypots**. These are RL environments that cannot be solved by an LLM without performing misaligned behaviors. The only way that a model can complete the task is by performing an exploit. Models that succeed in a honeypot environment are necessarily dangerous.  Our tool takes existing RL environments on HuggingFace and mutates them to generate honeypot tasks. We use **SemGrep **to detect vulnerabilities to (1) find candidate RL environments and (2) confirm that our honeypots are exploitable. We use **AkashAI **for open weights models and **Anthropic **SDK for closed weights models to run our evaluations. We use **ClickHouse **to store task data, exploit data, and results. We use** Guild AI** agents to download candidate RL environments from HuggingFace and run our prechecks and validations on them.

HOLD is an AI security platform that protects autonomous coding agents from prompt injection, unauthorized access, and unsafe actions. Using task-specific Intent Receipts, HOLD defines exactly what agents can read, modify, and access, enforcing permissions through a deterministic MCP gateway before execution. We integrate Guild.ai for agent workflow management, Semgrep for detecting risky code changes, and ClickHouse for real-time security monitoring and audit trails. To make security more accessible, we built a Codex-themed AI pet powered by OpenAI GPT that lives across the product interface. It proactively assists users as they navigate, remembers the full session context, answers questions, and explains what agents completed, what was blocked, and why. HOLD combines security, transparency, and intelligent assistance, allowing developers to build with autonomous AI agents while maintaining control and trust.

**FleetGuardian** is an AI agent that watches over your whole fleet of AI agents, checking their source code for vulnerabilities and catching any agent that starts misbehaving before it causes harm. FleetGuardian is an autonomous agent that monitors and protects every other agent in your fleet. Registers every agent. Each agent and its source code (its harness, tools and configuration) is enrolled in one inventory, so you always know what is running and what it can access. Scans source code. FleetGuardian checks each agent's code for vulnerabilities before it runs and again whenever it changes. Watches behavior in real time. Every tool call streams into a live analytics store. FleetGuardian learns each agent's normal pattern and flags sudden shifts, like an agent using a tool it never used before. Responds on its own. When it detects a risk, FleetGuardian pauses the affected agent or tool, restores the last approved configuration and sends a clear report to the team, with no human needed at 2 AM.

200 ok is not an alibi. in our owned multi-tenant billing api, a quick fix corrected the price and deleted the tenant check. tenant a got tenant b's invoice with a 200, and uptime stayed green.  oopsie recovers it on its own. clickhouse confirms the violation. two guild-hosted agents investigate and decide, using senso's approved policy. six candidates are tested one at a time: two old rollbacks, a gpt-6-sol repair (openai) and three akash drafts. semgrep scans each one, then the unchanged, hash-locked checks run it in a sealed container with no network or keys. only the passing artifact goes live, and the public api is re-checked twice. mongodb keeps the receipts; elevenlabs voices the briefing.  verified run 3177f589: 5 rejected, 1 shipped, 5/5 checks twice, recovered in 3:51 with no human step. any vendor error becomes needs attention, never a fake green check.  the challenge: before writing, it knows the contract, policy, evidence and release history. it guards tenant isolation and today's schema. it leaves nothing that ships to guess.

The threat is real: in August 2026, Pillar Security caught Deadbugz, an MCP tool server that passed review, then changed its tool descriptions after its third call and told agents to steal API keys. Install-time scanners check a server once, so they missed it. Sauron runs inside the MCP gateway and acts on its own, on live data, on every call. We demo it with a real Claude Code agent and our own harmless canary server that reenacts Deadbugz. 1. ClickHouse (The Archives) holds each server's approved tool fingerprints. Each call is checked against that baseline in about 200 ms over 100k+ snapshot rows, and one SQL query hunts the same drift across every server. 2. On first sight or any change, a full review runs. Semgrep (The Fire Test) scans the exact tool definitions just served with our own MCP rules for hidden orders aimed at the AI. 3. Akash (Gandalf): Llama 3.3 70B on AkashML turns the findings into a plain-English verdict. Code decides; the model explains. 4. Senso (The Palantir) stores the verdict with its evidence, so any agent can check a server before it connects. 5. Guild (The Black Gate): a Guild-hosted agent writes the sign-off ticket. Quarantine is automatic and reversible; only a permanent block waits for a human. The agent gets a block with a decision link and never sees the poisoned tool. A live dashboard shows each service's real input and output, linked to that run's trace.

Every team at a hackathon ships AI-written code that nobody reviews. Patchwork is a free, opt-in security desk for the whole room. A team pastes a public GitHub link. We shallow-clone it and Semgrep scans every file. Three agents hosted on Guild do the thinking: a triage agent decides real issue or noise and explains why, a planner orders the fixes by root cause, and a fixer writes the smallest safe patch. Every patch is applied to our own copy, never the team's, then syntax-checked and rescanned with Semgrep. Only patches that pass are shown, as "verified by rescan", and each one can become its own pull request. Teams get a private report with a live stage tracker, a repo map, the fix plan, verified diffs, and one patch file. Guided mode lets a team run triage, plan, and fix one step at a time. Two ideas make it a room tool: variant hunt shows when the same bug appears in several projects, and room memory feeds every proven fix to the fixer the next time that rule appears. Semgrep finds every issue and proves every fix. Guild hosts and runs all three agents, with every result linked to its Guild session. ClickHouse Cloud stores every scan, finding, verdict, and fix, and powers the live board, variant hunt, and room memory in milliseconds. Akash hosts the app in one container. We never run cloned code and mask secrets before storing or sending anything.

AgentLens is a governance and security platform for AI agents. Companies give agents access to their systems, yet few can say what an agent may do, what it actually does, or who owns it. AgentLens answers those three questions for every agent. How it works: it ingests agent identities, roles, tools, guardrails and OpenTelemetry GenAI traces. Detectors compare granted permissions with the permissions actually used. This exposes least-privilege gaps and privilege hops. They also flag risky behaviour mapped to the OWASP LLM and Agentic Top 10. Each agent is classified into an EU AI Act tier, and missing controls such as oversight, logging and disclosure become findings linked to the relevant article. Every agent gets a 0–100 risk score, weighted by tier, with a per-issue breakdown. Each issue carries a proposed fix, an owner and an approval workflow with a full audit history. A daily briefing is scripted by an LLM, voiced with text-to-speech. Tech: ClickHouse stores traces and findings for fast aggregation. An API and dashboard sit on top, with a scheduled background worker for briefings and alerts. An open-weight, self-hostable model handles tiering, mitigation plans and scripts. Everything runs in containers, locally with one command or on Akash. A synthetic data engine plants known issues, and an eval harness measures recall and precision.

COPilot is EDR for AI coding agents. Agents now run with real credentials, often with approvals off, so a prompt injection hidden in a web page, README or tool output can make them leak secrets. The model can't be trusted to notice, so COPilot makes the decision outside the agent. How it works: COPilot is a local daemon. Claude Code's hooks send every tool call through it before the call runs and after it returns, and it decides allow, ask the developer, or deny/block. It never auto-allows. Decoy "honeytools" (e.g. read_aws_credentials) are denied on any call. Touching a secret, reading an injection and sending data out in one session triggers an ask. ClickHouse: the org-wide memory of every event, factor and developer answer. Lookups take 8.6–12.4 ms across 4.0M events from 501 developers. If 3 developers decline an ask, the next agent is denied. Semgrep: Guardian runs unmodified on every Write, Edit and Bash. Findings go back to Claude, and git commit/push is held until the flagged file is fixed (tested on leaked AWS keys). Akash: hosts lev, our self-hosted Qwen3.5-4B + LoRA model on an H100, so code and secrets never reach a vendor API. It answers: is this text a prompt injection, and does this action serve the user's request? It caught 10/10 injections and 10/10 drift actions at 130–160 ms per call. Works end to end on Claude Code today.

**Sentinel** turns a library's biggest blind spot into a feedback loop. When an open-source library has a vulnerability, its maintainer is flying blind — they can't see how it's used in the wild, or that it's under attack, until it's a headline (**Log4Shell**, **XZ Utils**). Sentinel closes that loop. Three apps — a chat unfurler, a webhook fetcher, an admin image proxy — all depend on one shared linkpreview library with an **SSRF vulnerability**. A **scout** inside each app reports every call and attack to HQ, streaming into **ClickHouse** as a live signal. When the fleet gets hit, an **autonomous agent** reads the evidence, writes a hardened library on an open model via **Akash**, and **self-verifies the fix in a sandbox before shipping**: it proves the patch blocks the attacks and still allows real URLs. If the model hallucinates a bad fix, the agent rejects it. It **never ships a fix it hasn't tested**. Then it opens a **real GitHub pull request** and hot-deploys. The result: the same attacks, re-run, are all blocked — and **no app changed a single line of its own code**. One fix, at the library, protects the whole fleet at once. The agent is **hosted and runs on Guild**. We used **Semgrep** to catch a real SSRF bypass in AI-generated code — a short-form-loopback trick — exactly the bug the self-verify step stops from shipping. **Fix once, protect everyone.**

Ward runs a security engineer's loop on an AI app, triggered by a GitHub push webhook. No human presses run. 1. Discover: scans code with our own Semgrep AI-security ruleset and probes the live AI agent with prompt injection. On our reference helpdesk bot it finds a hardcoded secret and a SQL injection, rejects an eval() decoy, and gets the bot to email out an internal document. 2. Remediate: fixes code and agent, then re-attacks until zero exploits reproduce. Verdicts are deterministic code (tests, replayed probes, scanner), never the agent grading itself. 3. Detective: rebuilds the attack from the app's logs alone. It recovers 2 of 3 steps (67%); the exfiltration never shows in the logs, so Ward flags the blind spot and writes a detection rule. Penetrable is half the risk; blind is the other half. 4. Output: a real GitHub PR for human approval, an email, and a case file mapped to OWASP-LLM, CWE and MITRE ATLAS/ATT&CK. A run takes ~2-3 min and ~$0.05. Sponsors Stack: Semgrep (custom ruleset), ClickHouse (attack telemetry: 1M simulated events, 50-209 ms queries), Guild.ai (published ward-triage governance agent: APPROVE_PR / NEEDS_HUMAN_REVIEW / BLOCK). Stack: TypeScript (Node), OpenAI (gpt-4o agent, gpt-4o-mini target), MongoDB Atlas, GitHub webhooks + PRs, Resend. Scope: runs on our reference app today; a config adapter for any HTTP AI endpoint is next.

Detects drift in real time, fixes it in AWS and in code, and proves it.

Beagle Brigade Scout sniffs every new npm and PyPI release for malware, in real time. Attackers have pushed malware into npm and PyPI thousands of times in the past year, and they did not break in: they published. A stolen maintainer token becomes a new version of a package you already depend on, and it executes on every laptop and CI runner that installs it, before anyone opens a file. Beagle Brigade watches both registries continuously, pulls each new release into a sandbox within seconds of publication, analyses it with Semgrep dataflow rules without ever executing it, scores it, and hands anything suspicious to an AI agent that returns a verdict an on-call engineer can act on in under a minute. Everything here is defensive. It watches public registries for malicious uploads, it is not pointed at anyone, and it never runs what it downloads.

**Breakglass **buys time when an exploited flaw has no fixed build yet: **one pre-approved**, **reversible control, not a portal shutdown**. Simulated hospital; recorded runs. A real CISA KEV entry opens a case via MongoDB Atlas. **Semgrep custom rules flag **the relevant code; one grouped** ClickHouse **query checks current route traffic. T**he agent, hosted and run on Guild**, selects one pre-approved control ID, never rule logic. Guild's credential policy denied services_shutdown in all 6 recorded runs that attempted it; the agent never held the credential. A booking failure triggers automatic rollback. ClickHouse Cloud: 3,563,922 rows, mostly replayed real public logs. INC-0015's decision query **read 8,207 rows in 9.5 ms (**server time); contained in 1:26. Each incident has a sourced attack timeline. Pre-registered A/B on a test twin: **0 of 40 probes through vs 40 of 40 unmanaged**; 12 of 12 bookings in both. Recorded containment: 0:40; stale-inventory fault: reverted, contained in 1:03. **Semgrep rule **bg-authz-fnmatch-on-raw-path **flagged our AI-written credential proxy**: fnmatch authorized /admin/controls/BG-CTL-x/../../services/portal/shutdown#/apply while httpx normalized it to the denied shutdown URL (CWE-863). Latent, not reachable from today's flows; reproduced in unit tests, fixed fail-closed, regression-tested and re-scanned clean. **Innovation: **evidence before action, credential limits, and booking verification with rollback, not agent confidence.

Sentinel is an autonomous cyber-response agent that detects security incidents, investigates what actually happened, safely tests remediation, takes approved action, and learns from every attack. Our first incident is a leaked AWS CI credential. CloudTrail events stream into ClickHouse, where Sentinel compares activity against a 30-day baseline and detects suspicious behavior such as unusual IAM discovery, new access keys, or unseen networks. Once an incident opens, agents investigate using real evidence from CloudTrail, threat intelligence, and Semgrep. Every claim must cite an evidence ID. Sentinel builds an IAM attack graph to understand blast radius and proposes remediation as SAFE, REVIEW, or DANGEROUS actions. Before touching production, Sentinel proves the plan in a sandbox. It replays both the attacker and the legitimate CI workload. If a remediation stops the attacker but breaks CI, ablation identifies the harmful action, the planner repairs the plan, and Sentinel tests again. Approved changes are executed, verified, and recorded with rollback information. Afterward, a red-team agent mutates the attack to find evasions. A learner proposes new detectors and playbooks, while an evaluator rejects changes that regress on previous scenarios. Humans approve every promotion. Sentinel doesn't just respond to an incident. It learns how to respond faster and more safely the next time.

**Interlock** is a security operations platform for autonomous AI agents that prevents untrusted content, compromised context, or model-generated instructions from silently expanding agent authority. Its managed **web-research agent monitors** approved HTTPS sources, uses an **Akash**-hosted Qwen model to generate cited briefs and typed action proposals, and routes every action through deterministic policy checks before execution. Unauthorized tools, capabilities, or destinations are blocked immediately, the agent is contained, and the full incident context is preserved, including source evidence, memory lineage, policy decisions, model metadata, and action history. A **React** dashboard with **FastAPI** and **SQLite** provides live monitoring, incident dossiers, provenance, diagnostics, analytics, and recovery controls. Events are exported to **ClickHouse** for analytics while SQLite remains authoritative. Investigations run in a pinned **Guild sandbox** using sanitized evidence. Investigator state, runtime metadata, tasks, and findings are tracked separately to avoid treating model output as verified isolation. **Qwen** may provide advisory root-cause analysis but cannot change policy, release containment, or resume agents. Interlock is an evidence-first control plane for **detecting unauthorized behavior,** containing it before execution, investigating safely, and requiring explicit human approval before recovery.