Security tooling, mostly — autonomous analysis, offline review, and threat triage.
A full-stack, multi-agent autonomous pentesting platform covering web apps, codebases, binaries, and live Linux hosts over SSH. A strategic AgentBrain coordinates a tactical swarm for semantic code modeling, false-positive judging, severity scoring, and adversarial validation — surfacing 226 candidate findings in a real-world CLI codebase during testing. Five parallel agents feed a ChainDiscoveryAgent that synthesizes multi-step root-escalation paths through Neo4j graph traversal. Per-finding exploit intelligence, CI/CD gating, and a production LLM-orchestration layer with per-org budget caps and tier-based model routing. Shipped v1.0 across 290+ commits.
A reusable security-research skill that audits open-source C/C++ and Go codebases through a five-phase workflow — orient, discover, human-review, confirm, produce. Candidate discovery is driven by variant analysis on prior CVEs, a CWE-tagged pattern library, and source-to-sink taint inspection; memory-safety candidates are then confirmed with sanitizer-level proof (ASan/UBSan, plus Go fuzzing and the race detector) before generating upstream-ready patches and responsible-disclosure drafts. Bounded by design: proof stops at sanitizer-crash level — no weaponized exploits — and nothing is reported until it’s confirmed.
An AI-driven cyber-risk platform that ingests asset and vulnerability data into a Neo4j knowledge graph, then reasons over it to surface attack paths, coverage gaps, and remediation priorities. Split into microservices — a connector-based ingestion layer, a RAG reasoning pipeline (intent classification, graph traversal, LLM generation), an APT-persona service that simulates kill-chains, and a risk dashboard with heatmaps and report generation — behind a React SPA.
A CLI-native offensive-security research platform — Reverse Analysis & Vulnerability Exploitation Network — that chains multi-agent AI across the research lifecycle: semantic binary analysis, vulnerability discovery, exploit generation, and validation, with dedicated recon, analysis, exploitation, and validation agents. Supports local LLMs for sensitive work and a plugin architecture for custom agents and tools. In active development.
A CLI-first, defender-focused binary patch-diffing tool with LLM-assisted triage. Given before/after binaries, it runs a reproducible pipeline — ingest, normalize, diff via a Diaphora backend, rank the changed functions, decompile the top candidates, LLM-analyze, validate, and report — to pinpoint exactly what a security patch changed. Every stage emits hash-stamped, schema-checked artifacts with a per-job audit log for audit-grade reproducibility.
An offline, cross-platform security-analysis CLI running LLM-powered code review, fuzzing, and dependency scanning without sending data to external services — built for air-gapped and compliance-sensitive environments. Versioned data contracts with JSON Schema validation for reproducible, audit-grade runs, plus policy allowlists, human-in-the-loop gates, and capability tokens to enforce scoped, authorized workflows.
Patent pending. A Python desktop application that analyzes email threats with automated checks for URLs, attachments, and sender-reputation signals, backed by a private, isolated AWS sandbox for controlled detonation of suspicious content and analyst-friendly triage output.