A working portfolio of apps, automation scripts, and tooling I built with the help of Claude Code, OpenAI Codex, ChatGPT, and GitHub Copilot while working across customer-facing security architecture, technical marketing, network security, security telemetry, and AI-assisted engineering.
The point of this repo is to show what I actually ship day-to-day — Python, a bit of HTML/JS, Splunk content, lab automation, and document generation — not to be a polished open-source product. Most of these were built to solve a real problem for myself or my team, then cleaned up here so others can read and reuse.
Note on sanitization. This code originally targeted internal labs and named customers. All customer names, internal hostnames, lab passwords, HEC tokens, and personal absolute paths have been replaced with
example.com/REPLACE_WITH_*/<PLACEHOLDER>style markers. None of the code will run unmodified — you have to plug in your own endpoints and credentials. See each app's README for details.
| App | What it does | Stack |
|---|---|---|
| monthly-ai-usage-report-app | Local browser and desktop app that combines personal Claude Code/AWS Bedrock, OpenAI Codex, and Cisco Circuit usage into daily, weekly, monthly, or custom-range token, cost, and evidence reports. Version 1.4.1. | Python, HTML, CSS, JavaScript, GitHub Actions |
| file-search-app | Single-page HTML + Python CLI to index and search a workspace for filenames and content. Built to cut research time for a small team. | Python, HTML, JS |
| splunk-hec-live-detect | Two pieces: a CLI that posts NDJSON detections into Splunk via HTTP Event Collector, and a small Flask-style web UI for the same workflow. Includes a sample lab attack-chain runner that drives an SSH scenario across two NX-OS switches. | Python, Splunk HEC, Paramiko |
| splunk-dashboards | Splunk SimpleXML / Dashboard Studio exports for an NDR-style "Live Detect" view and a generic security operations view. | Splunk SimpleXML |
| n9kv-ova-tools | Document generators that produce step-by-step guides for repackaging and troubleshooting Cisco Nexus 9300v OVA images. | Python, python-docx |
| weekly-good-bad-ugly | Friday-afternoon automation: pulls notes from OneNote (via Microsoft Graph) or a local markdown file, sends them to Claude, and emails back a three-line Good / Bad / Ugly weekly status. Runs from launchd. |
Python, Anthropic API, MS Graph, SMTP |
| onenote-summary | Pulls pages from a OneNote section over MS Graph and renders a consolidated markdown summary for review. | Python, MS Graph |
| cns-skills | A reusable "skills" manifest plus commands and context files that I use to route requests to the right specialized prompt with Claude / Copilot. | Markdown, YAML |
| sna-mcp-server | A Model Context Protocol (MCP) server scaffold for querying network-analytics data (flows, hosts, alarms, detections) from an LLM client. | Python, MCP |
| flow-per-second-estimator | An Excel-based sizing tool used by sales engineers and TMEs for NDR flow-collector sizing. | Excel |
| cisco-automation-scripts | Sixty-plus utility scripts grouped into document-generators/ (Word, Excel, PowerPoint, Markdown), lab-automation/ (Cat8000v / N9Kv / flat-L2 build-out, connectivity tests), and notes/. |
Python, python-docx, openpyxl, python-pptx |
Almost every app in here was scaffolded in a conversation with Claude or Copilot, then iterated against a real internal need:
- Document generators were built to replace hours of manual Word / Excel formatting with a
python script.pyinvocation. - The AI Usage Report app was built to turn fragmented personal usage evidence from Claude Code/AWS Bedrock, OpenAI Codex, and Cisco Circuit into consistent time-windowed reports with explicit source caveats.
- The Splunk HEC pipeline and dashboards were built to turn ad-hoc detection JSON into something a SOC engineer would actually open in Splunk.
- The weekly Good / Bad / Ugly script was built because writing a Friday status email by hand is exactly the kind of thing a TME shouldn't be doing manually.
- The N9Kv OVA tooling was built after the third time I had to walk a colleague through the same repackaging procedure.
The common thread is short, single-purpose scripts; readable Python (no clever metaprogramming); and outputs that are easy for a non-author to inspect (markdown, .docx, .xlsx, .json, .spl).
Each app has its own README with prerequisites. The general pattern:
cd <app-folder>
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt # if present
python3 <entry_point>.py --helpFor anything that talks to an external service (Splunk HEC, Anthropic API, MS Graph, SMTP), look for REPLACE_WITH_* placeholders or env-var reads — none of those values ship with real credentials.
I wanted a single place to point people to when they ask "show me code you've actually written." None of these are huge — they're the kind of small, sharp tools a working engineer ships when they're trying to make their team faster.
MIT — see LICENSE.