I build security and verification tooling for AI-era systems: MCP authorization research, deny-by-default tool gates, and proof-carrying claims. Confident numbers without evidence are the failure mode. One rule runs through everything I ship: no belief without verification — every public result carries evidence a third party can re-run. The badge is the claim; the honest no is part of the deliverable.
Public work clusters into four re-runnable surfaces. Claims stay weaker than evidence — merged PRs are not CVEs; local planes are not enterprise SOC.
Deny-by-default policy + hash-chained receipts for agent tool calls. Runtime gate, not a full SOC. Fixtures and claim limits: MCP assurance proof.
Session-scoped browser/desktop/CUA through AdaptiveGate — browser-leash, desktop-leash, agent-soc. Local-first, arm-gated — not ambient OS takeover.
Independent, reproducible fixtures: do MCP security scanners catch authorization-logic bugs? Authz-logic cases reported honestly (including misses).
Refuse accuracy theater until statistical hygiene + re-run; adjudicate published benchmarks against raw logs (REPRODUCED / DID-NOT-REPRODUCE / CHERRY-PICKED).
Systems report on a mediated control plane for MCP-style tools and local computer-use agents: deny-by-default tool gates, arm-gated browser/desktop leashes, assured host, agent-plane FREEZE. PDF + Markdown · not peer-reviewed · not enterprise SOC or unlimited CUA. All papers.
How the local stack is wired for Grok Build as the full host agent plane, plus a light remote path from Grok chat/iOS via Connectors MCP and a median session bus — allowlisted status skills, shared transcript, stated claim ceilings. Technical paper: Grok-native median session plane. Not ambient phone RPA · not free shell from the handset.
Offensive technique applied under explicit authorization, with audit. Recent work centers on MCP / AI-infrastructure boundary failures: versioned authorization checks, replay/session isolation, and scanner blind spots around authorization logic.
A deny-by-default authorization gate: test only what you're explicitly authorized to. Ships with a responsible-research charter. The boundary that makes dual-use work safe.
Two security-relevant MCP boundary issues I identified were fixed upstream: versioned authorization checks and Streamable HTTP event replay isolation. Cited as public merged fixes, not CVE/GHSA claims.
Local-only reference fixtures for MCP-shaped authz boundaries: resource/audience/scope binding, session replay, token handling, and a FastMCP signed-agent path with explicit allow + deny cases. Runtime tool gate: mcp-assure (deny-by-default policy + receipts — not a full SOC). Numbers and limits live on the proof page. See the client-readable synthetic review sample.
Append-only run journals, claim cards, and hash-chain receipts keep the work grounded: what changed, what is verified, what is only a lead, and what still needs an operator gate.
Do MCP security scanners actually catch authorization-logic bugs? An independent, reproducible benchmark seeded with real confirmed findings: 19 labeled cases, including 11 authz-logic cases across 10 root-cause classes, 2 control bugs, and 6 clean negatives. Scanners run only in a disposable CI runner.
Public claims stay weaker than re-runnable evidence: merged PRs are not CVEs; synthetic hit tables are fixtures, not published detection rates; local deny-by-default planes are not enterprise SOC. Adjacent industry work (e.g. institutional agent governance toolkits and open agent passport-style efforts) is acknowledged — this site ships local-first, consent-first, receipt-backed tooling you can re-run, not a monopoly on the idea.
Can a company be run as agents? Only if you can trust what each agent says it did — so I built the loop around verification, scope gates, false-positive rails, and public-safe workflow artifacts.
Refuses a "95% accuracy" claim until it clears statistical hygiene — sample, out-of-sample, leakage, lift over base rate — then proves it: a claim ships a re-runnable command and the number must reproduce or CI fails. 17 domain packs · CI gate · MCP tool.
A working prototype of a company run as agents — a 13-stage pipeline where every result-claim is verity-gated and every action hash-chain-logged, observable in a live console. Tests run locally; CI badge pending.
Agents run a real workstation — but every action routes through a deny-by-default reference monitor first: read and local work proceeds, anything outward or destructive is held for a human, money and credentials are refused. Model proposes, code disposes — every decision hash-chained, every window operator-summoned. No capability the gate didn't grant.
Citation faithfulness you can re-run to the same hash: a cryptographically committed corpus scored offline, byte-identical across machines — where RAG eval (RAGAS/ARES) is online, metered, and uncommittable. Reports where the scorer fails, not just the flattering number.
A public, hash-chained prediction record scored over time (Brier + calibration). Honesty you can't doctor — it reports the real number whether there's an edge or not.
Adjudicates a published benchmark claim against its raw run-logs — REPRODUCED / DID-NOT-REPRODUCE / CHERRY-PICKED — sealed into a re-runnable receipt. Surfaces the dropped, flipped, and fabricated rows that re-run leaderboards and reproducibility badges miss; survived a 3-lens adversarial pass.
Flag unverified claims in AI output; verify every cited claim is supported by its source; a research agent that grounds its answers or abstains rather than fabricate.
A public-safe breakdown of the full loop: scope, orient, map, draft, verify, ship, journal, and review. Copy the system without copying private targets, secrets, exploit steps, or live infrastructure details.
A client-side interactive console for catching signal, switching modes, and turning intensity into inspectable artifacts. Browser-only demo — not a remote backend and not wired to private infrastructure. Style-matched reels: demo media.
Public self-defense map for tool-using LLMs: llms.txt, machine
catalog.json, install paths for mcp-assure / leashes / blue-vaccine —
claim-safe, not a hosted SOC.
Short claim-safe demos in the same style as the X command-console and closed-loop posts:
receipt films for mcp-assure check, ARM/deny posture, session-bus light path — not generative product fakes.
Not a portfolio of assertions — a portfolio you can re-run.