Cold storage that queries like hot storage. High-ratio JSONL compressor with block-level random access. Query cold storage in seconds — no restore, no full decompression. 5–13% ratio on JSONL logs, 25–57% smaller than gzip. 1-hour window via DuckDB in under 6s. Free for personal and open-source use.

Open-source security for AI agents: kernel-enforced egress control on macOS and Linux, keys only the operator holds, tamper-evident audit. One command protects Claude Code, Cursor, or any MCP harness. No vendor in the path.

Give the agent root in the cell, not on your host.

Open-source governance control plane for coding agents — per-run identity, brokered credentials, layered egress, approvals, and an append-only audit. Apache-2.0, self-hosted.

Local Docker Compose containment lab for safely experimenting with AI agent workloads behind explicit egress, filesystem, and credential controls.

Redact PII in the browser before a prompt ever leaves the machine, then rehydrate the reply locally: 11 entity types, Luhn/SSN/IBAN checksum validation, and a type-checked Egress Guard on the send path. TypeScript. 173 tests, 100% coverage.

A practical guide for building secure sandboxes using gVisor, JWT authentication, and network egress controls to isolate untrusted code.

Tamper proof enforcement for AI agents on K8s

Policy enforcement proxy for MCP tool calls: detect leaks, block risky actions, redact sensitive payloads, and log every decision.

Applying data-loss-prevention egress policy to an un-proxyable realtime audio transport by gating the one server-side choke point — ephemeral-key minting — with a fail-closed tracked-transport downgrade.

Reproducible Docker lab for default-deny AI agent egress and offline Playwright testing