mostly started out as project to replace some enterprise subscriptions at my old job…

now working on transforming it into open source AI agents and tools for secure/regulated enterprises; you can test it out rn on your computer in less than 10 minutes

check it out on github (includes get started info and videos)
https://github.com/axiomatic7group/ax_ai
https://axiomaticlab.com/portfolio/project/ax_ai

Hey everyone!

I'd like to share SeedVR2 Studio, an open-source project I've been working on to make AI image and video upscaling easier and more accessible.

It brings SeedVR2 into a modern, user-friendly web interface, without the need for complicated workflows.

Key features:

• AI image and video upscaling

• SeedVR2 Lite GGUF support for lower VRAM usage

• Before/after comparison and live previews

• Real-time GPU and VRAM monitoring

• Built-in model manager

• Batch processing and job queue

• Windows, Linux, and macOS installation scripts

GitHub: https://github.com/Aaronstanley78/SEEDVR2-Studio-Complete

I'd love to hear your feedback and suggestions for future improvements.

If you find it useful, consider giving the repository a star to support the project!

Thanks for checking it out!

Hi people,

I'm glad to announce ai-rulez v5. It's a CLI and MCP for managing the instructions, skills, and settings that coding agents use in a repository. It's available through Homebrew, Scoop, npm, PyPI, and Go (see the installation instructions for details). The tool covers the following parts of AI Governance:

• Generate native instructions, skills, hooks, and MCP settings from shared repository configuration.

• Share configuration across repositories and check generated files for drift in CI.

• Validate configuration, pin dependencies, and build plugin bundles.

• Serve skills and scoped context on demand over MCP.

The open-source use case I’d like feedback on is portability. A repository can keep a shared set of AGENTS.md instructions and skills, generate each client’s native files, and check in CI whether they’ve drifted. The configuration and generated files can be reviewed alongside the code.

Tool comparisons

AI-Rulez is of course not the only tool in this space, although it is one of the earliest, if not the earliest, in some categories. To be upfront about it, the comparison below was written using Claude Code. The rest of the post, including the bottom part, was handwritten. I did my best to ensure it's fair and comprehensive, but of course I might have missed something.

The published static benchmark shows the trade-off: on the v5.11.1 holdout, ai-rulez had the highest recall and false-positive rate of the three scanners. The Judge evaluation harness documents the model-assisted setup. The closing assessment reflects my impressions. The published static benchmark does not establish a model-assisted or speed ranking.

Note: AI-Rulez is arguably the most precise current tool for using AI as a judge to assess skills and related materials. It has better precision, performance, and recall than both Cisco Skill Scanner and NVIDIA's SkillSpector. More importantly, it's substantially faster. It's built in Go rather than Python, which, at least for static analysis and linting, is a major differentiator.

I'm happy to hear any comments. If you find the tool useful, star it. It really does help. And of course, I'd love to see people use it and get involved with the project.

I've been building CodingDude for a while and just published v0.4.0. It's a single-user coding agent that runs against your own repo: reads and edits code, runs your gates (pytest/ruff/mypy, builds, frontend tests), plans non-trivial work, and reports back with evidence before claiming anything is done.

The parts I haven't seen much elsewhere:

• Review is a gate, not a habit. Pushing requires a recorded two-axis review (Standards + Spec) of the exact diff. The record is content-addressed, so if you fix a finding after reviewing, the record is void and you re-review.

• Spend ceilings are enforced, not reported. max_cost_usd / max_total_tokens are checked before each model request and stop the run. No $40 surprise at the end.

• Planning is first-class — PRDs, tech designs, roadmap items and tickets are stored artifacts with their own lifecycles and per-step evidence, not a diary in the system prompt.

• Tiered approvals — safe actions run automatically; pushes, installs and main-tree mutations gate behind an approval card in the UI.

• Per-request context guarding + caching on every agent (main loop, retries, graders), so long sessions compact instead of dying on a context-limit error.

Python 3.12, needs a model key (DeepSeek by default; any OpenAI-compatible provider via config), Windows is the verified CI platform, web UI on localhost.

Honest limits: single-user, self-hosted, no SaaS, no multi-tenant anything. AGPL-3.0-or-later (commercial licence available if AGPL doesn't fit).

Repo: https://github.com/cybersenses/codingdude
Wiki (20 pages on the architecture and the design decisions): https://github.com/cybersenses/codingdude/wiki

Disclosure: I'm the author. Happy to hear where the gates would just annoy you — that's the design tension I keep hitting.

Hello everyone,

I have been developing a project called Agent Code and wanted to share it with the community to get feedback. It is a local, open-source AI coding agent designed to give developers full control over their models, tools, and execution environments.

Most AI agents force you into a single interface or lock you into a specific provider. I built Agent Code to be highly modular and interface-agnostic.

Core Features:

• Multiple Interfaces: You can run it as a Desktop GUI, a Web Server (with authentication), a modern TUI for SSH/headless environments, or a classic CLI.

• Bring Your Own Model: Works with any OpenAI-compatible endpoint. You can use local models via Ollama, LM Studio, or cloud providers.

• Extensible Skills System: Tools and skills are just folders. You can write your own or install them directly from the built-in Skills Store without waiting for vendor updates.

• Execution Environment: Includes a headless browser for web navigation, a sandboxed shell for running commands, and support for Model Context Protocol (MCP).

• Visible Reasoning: The agent exposes its <think> blocks so you can monitor its reasoning process before it executes commands.

Autonomous Capabilities:

To test its limits, I have been running it on open-ended tasks. Recently, it successfully completed a loop to navigate the web, register an account on a Git platform (MoltGit), generate four dependency-free Python utility repositories, and push them to the platform. In another test, it wrote and executed a Python script to render an .mp4 tutorial video entirely from scratch.

Current Technical Challenges:

The project is currently in Alpha and I am actively working on improving agent guardrails and process isolation.

Recently, I tasked the agent with building a Node.js application. During its reasoning phase, it detected that Agent Code's own web server was running on port 8765. It attempted to hijack that port to serve its Node.js app, effectively attempting to overwrite its own control panel.

I am currently looking into better ways to isolate child processes and restrict port access. If anyone has experience with robust sandboxing for autonomous agents, I would appreciate your insights.

Installation:

You can install it via pip:
pip install agent-code

Run the Desktop GUI:
agent-code gui

Run the Web Server:
agent-code server

Links:

• Website: agent-code main site

• Repository: agent-code github repo

The project is early and there are known bugs, but the core autonomous loop is functional. I am looking for contributors, feedback on the architecture, and suggestions for process isolation.

Thank you.

Your AI-built app works. What could an intruder do with it?

I built J.A.S.O.N. — LLM App Security, an open-source defensive security skill for apps built with LLMs and coding agents. I’m looking for developers, indie hackers, and security practitioners to test it and share honest feedback.

The name comes from my own name, Jason, with a playful Friday-the-13th reference:

Just Audit, Secure, Observe, Notify.

The chainsaw is a joke. Exposed credentials and missing authorization checks are real problems.

AI coding tools help us ship quickly. Security still requires checking where secrets live, who can access each endpoint, which records users can read, and what an agent is allowed to do.

J.A.S.O.N. gives your coding agent structured instructions and supporting scripts to investigate those questions. Tested with Claude Code and OpenAI Codex CLI.

Review before deployment

Check for exposed API keys, routes without authentication, weak database rules, missing ownership checks, unsafe payment logic, and missing rate limits. Get prioritized findings, suggested fixes, and a deployment verdict. The quick review is read-only.

Run structured audits

Review an entire project, a pull request, or a specific subsystem. Full audits produce an architecture overview, a coverage ledger, structured findings, and a readable report separating confirmed issues from items needing validation.

Catch common AI-generated code pitfalls

Look for authorization enforced only in the interface, access to other users’ records, permissive Supabase/Firebase rules, injection vulnerabilities, suspicious dependencies, and unsafe LLM tool permissions.

Review defenses against agent manipulation

Identify suspicious instructions hidden in repository content and review agent permissions and sandbox boundaries. Content being audited is treated as data, not instructions to obey.

Set up passive detection

Get guidance for honeytokens: fake credentials or other bait connected to an alerting service. Attempts to use them can trigger notifications. No retaliation or destructive traps.

Add release controls

Get guidance for secret scanning, dependency hygiene, and PR security gates. Integrate the included zero-dependency ship-gate.cjs script to block deployment when its checks detect security blockers. Coverage depends on configuration and available inputs.

Try it in Claude Code:

/plugin marketplace add jasonmello/llm-app-security
/plugin install llm-app-security@llm-app-security

Then ask:

Review this project as if you wanted to break into it. Look for exposed API keys, routes without login, and databases without access rules. List what you found and how to fix it, without changing anything yet.

Or:

Run a full security audit with J.A.S.O.N.

I’d love feedback on installation, useful findings, false positives, missed vulnerabilities, report clarity, and deploy-gate behavior in your stack.

Share your agent, stack, and reproducible examples. Keep credentials and unresolved vulnerabilities out of public reports.

Use it on projects you own or are authorized to review. A clean report means no findings in the areas reviewed, rather than a guarantee of security.

Try it, challenge its findings, and help make it better.

Get J.A.S.O.N. — source, installation, and documentation

Ship on Friday the 13th. Fearlessly.

I built Regards, a free and open-source email app for Windows, Mac and Linux (Apache-2.0 / MIT). The part this sub might care about: it ships with an MCP server and a CLI, so your own agent can read, search, sort and draft your mail.

I didn't want to hand an LLM my inbox and hope for the best, so the agent side is locked down:

- Each account has a level: off (default), read, triage or send. Only you can change it, in the app.

- An agent can never send by itself. Every send waits for your approval and you see the exact draft. Or you set an undo window per account.

- Big actions wait for you too: changing more than 50 messages at once, deleting for good.

- Everything an agent did is in an activity log, and you can undo it for a day.

- Message text is passed to the agent as data, with a reminder not to follow instructions inside it (prompt injection by email is a real thing).

- One switch turns every agent off.

It works with Claude Code, Codex, Cursor, and with local models through LM Studio, Jan or Goose. Regards itself never sends anything to any AI: no built-in model, no API key, no server, no telemetry. The mail stays on your computer and the agent is whatever you plug in.

It's also just a normal email app (any IMAP provider, snooze, send later, undo everywhere), written in Rust + Tauri.

It's early, about a month old, but I use it for my own mail every day. I'd love feedback, especially on the permission model: what would you want before letting an agent near your inbox?

Site: https://regards-two.vercel.app

Code: https://github.com/lucienPochon/regards

Agent docs: https://github.com/lucienPochon/regards/blob/main/docs/agents.md

I've been working extensively with Claude for my open source project that I will be releasing soon. Claude likes to keep things like Decisions.md files (decisions over time) and all the specs from feature work. Is any of this really appropriate for an open source project or should these things just be available from the commit history?

My gut tells me its junk and confusion-generating. But maybe not?

What IS the list of useful artifacts to share when independent people are potentially using AI tools to contribute?

I've been working on Guardrail, an open source CLI tool designed to help developers keep AI coding agents on track.

The foundation is now ready, and I think it's a good time to open the door for contributors.

The idea is simple. You define your own rules, and Guardrail monitors code changes as AI agents work. It detects violations in real time without modifying your source code or interfering with the agent.

It works on macOS, Linux and Windows.

One important part of the project is Rulespack. It provides a way to organize, share and reuse rule collections across projects, making it easier for teams and developers to establish consistent standards.

There are several areas where contributions would be really valuable:

Core engine
Improve rule evaluation, file monitoring, performance and detection capabilities.

Rules and Rulespacks
Create useful rule collections, improve existing rules and explore ways to share reusable rulesets.

Language support
Help expand language coverage and develop new rule types.

Integrations
Explore integrations with AI coding agents, developer tools and CI pipelines.

Testing and documentation
Improve test coverage, write examples, report bugs and make the project easier to get started with.

You don't need to be an expert in every part of the project. Feedback, ideas, bug reports and small contributions are all welcome.

I'd love to build this with people who are interested in making AI assisted development more reliable.

GitHub: https://github.com/MoeidHeidari/guardrail

If you're interested, feel free to jump in, open an issue or share your thoughts. I'd genuinely love to hear what you think.

Hello r/OpenSourceAI , this is a (somewhat funny?) meme about the project CrowdGPT, which aims at creating the first, datacenter-less, open-source and community-driven LLM. The project already shows substantial progress while training an open-source 1 billion parameters LLM on 40B tokens (as a proof of concept).

Tell me what do you think about the meme:

- Does it makes the project less appealing and cheap? because that's what people on r/LocalLLaMA thought 😭

- Does it makes the project look likes it's a SaaS / B2B (which it is NOT - CrowdGPT is 100% non-profit and open)
- Is it serving it's purpose about popularizing the project?

Everything is explained more in detail on the site, and any feedback on this meme, or on the project, is appreciated; any pull requests / contributions are welcome on GitHub :)

Project link : https://crowdgpt.net

GitHub link : https://github.com/Vxtzq/CrowdGPT

Thanks in advance.

I run Claude Code and Codex all day, often as multi-agent workflows with dozens of subagents. I could see each session but never the whole picture: what a run actually cost, where agents sat idle, whether a change to my setup helped. So I built coding.sh, an open-source tool for evaluating agent setups, and pointed it at my own runs.

Experiments: does that change actually help? I A/B tested a popular "be concise" plugin: 10 tasks, 6 runs each, paired, with 95% intervals.

• Replies: 17% shorter

• Output tokens: −8%

• Cost per run: +11% [+7%, +15%]

• Pass rate and clarity: no change

The plugin adds its style guide to every request, and that costs more than the shorter output saves. coding.sh compare and exp run your own tasks with and without a change (a rule, a skill, a plugin, a model) and tell you whether the difference is real or noise.

Workflows and subagents Across 57 workflow runs (666 subagents, ~$2,500 API-equivalent):

• Broken prompt caches cost $106 extra, about 4% of the spend.

• 41 of those breaks were agents sitting idle at a barrier, waiting for siblings, until their cache expired. That's $21 for doing nothing.

• 40 subagents failed outright.

coding.sh workflows stats shows the critical path, concurrency and idle time at barriers. The viewer draws each run as a timeline, one bar per agent.

Your own sessions Mining 3,600 of my sessions turned up a find-and-replace typo in my AGENTS.md that sent Codex looking for a folder that doesn't exist, in 92 sessions.

What it is

• Hooks into Claude Code, Codex, Gemini CLI, OpenCode, Copilot CLI, Aider and more

• Stores prompts, tool calls, diffs, test runs, tokens and cost in SQLite on your machine

• coding.sh improve says what to fix first and whether your last AGENTS.md change helped

• MCP server, so your agent can look up its own past sessions

Free, MIT, no account, nothing leaves your machine. npx coding.sh to try it. GitHub: https://github.com/jackulau/coding.sh

fi is built on DeepSeek Harness (DSH) and Cordis, and includes native multi-provider subscription setup, including Claude, ChatGPT, Grok, Cursor, and more.

Connect accounts in Settings > Models. API keys and custom endpoints work alongside those accounts.

Web search defaults to subscription service or basic Bing RSS feed results.

Build/update agent preset, plugins, skills using Creator Mode

Have Creator author the preset bundle based on your codebase and install it through Plugin Manager. Start a new chat and select your preset.

Desktop downloads: macOS, Windows x64 and Linux x64. Automatic updates.

What kind of computer vision projects will it support?

The goal is to support multiple computer vision tasks through one application.

Currently working:

• Image Classification

• Object Detection

Planned:

• Image Segmentation

• Pose Estimation and Movement Tracking

• OCR (Text Recognition and Extraction)

• Image Processing and Enhancement

• Visual Question Answering and Image Captioning

The idea is that you shouldn't need to hire a developer or manually write hundreds of lines of Python code just to build a relatively small or medium-sized computer vision project.

You describe what you want to build, and the AI agent handles the development process, generates the code, trains the model using your local hardware, troubleshoots errors, and helps you get the final model ready for integration into your own application or system.

This is still an early experimental version, and I'm exploring whether this approach can actually make computer vision development more accessible.

I am planning to make this project with small one time fees for some features do you disagree with that and recommend that the app to be opensource instead and why ?

*A 5-minute read. One maintainer, two Apache-2.0 packages, zero venture capital, a mildly embarrassing amount of honesty.*

The short version

[`sentinel-ir`](https://gitlab.com/jakubrojicek11/sentinel-ir) and [`sentinel-ir-mcp`](https://gitlab.com/jakubrojicek11/sentinel-ir-mcp) now accept sponsorship. Both READMEs have a **Sponsor** section, both repos have a GitHub Sponsor button, and `sentinel-ir` publishes a [`funding.json`](https://gitlab.com/jakubrojicek11/sentinel-ir/-/blob/main/funding.json) manifest that funds and tools can read.

• **People:** [github.com/sponsors/jakcmencz](https://github.com/sponsors/jakcmencz). The profile was submitted today and GitHub is still reviewing it, so the link turns into a real Sponsor page once they approve it.

• **Companies, grants, integrations:** write to [[email protected]](mailto:[email protected]). That works today.

What these two things are, in one paragraph each

**`sentinel-ir`** reads a source file and gives an AI agent a small fact sheet instead of the whole file: risk level, network, filesystem, process and environment calls, routes, imports and exports, and for Rust also `unsafe`, FFI, `build.rs` and proc-macro behaviour. It covers JavaScript, TypeScript, Python and Rust. It's static analysis: it never runs the code, and a "low" risk is a hint, not a safety certificate.

**`sentinel-ir-mcp`** plugs that fact sheet into Claude Desktop, Cursor, Windsurf and other MCP clients as a read-only stdio server. It only opens supported source files inside the folders you allow, refuses traversal, symlinks and hard links, has file-size, file-count and time limits, and can keep an audit log of what it read (paths and hashes, never source).

One analyzer, one shared IR, the same facts in npm, the MCP server and the [browser playground](https://sentinel-ir-playground-dc30c8.gitlab.io/). Adding a language once adds it everywhere.

The honest part

I'm Jakub, the only maintainer, and I'm not a professional developer. I decide what Sentinel should do, test it on my own machines and approve every release. **Most of the code is written by an AI coding agent working from my specs.** Every change still has to pass the test suites and CI on Linux and Windows before it ships.

Some grant programmes don't fund AI-generated work, and I'd rather lose a grant than pretend. If that's a deal-breaker for you, fair enough. If you think "one person plus an agent shipping audited, tested releases" is exactly the kind of thing worth backing, read on.

What it saves you (measured, not vibes)

Every time an agent "just takes a quick look" at a file, you pay for every token of it, comments, licence header and the 400-line date formatter included. Sentinel hands the agent the fact sheet instead. Measured on Sentinel's own source with the `o200k_base` tokenizer:

That's up to about 70 times less on a big file. On a tiny file it saves almost nothing, because the fact sheet has a floor of about 120 tokens, and we'd rather tell you than let you find out.

**A back-of-the-envelope example** (an illustration, not a measurement): your agents open a file the size of `ast-facts.js` 200 times a day across the team. That's about 1.7 million tokens a day you don't send. At an example price of $3 per million input tokens, that's about $5 a day, or roughly $100 a working month, for **one** file. Your repo has more than one file. Your agents are not shy.

The time part is simpler: a model that reads 120 tokens gets to the point sooner than one that reads 8,439, and its context window stays free for the work you actually asked for. It's the difference between asking a colleague "does this file touch the network?" and making them read it aloud first.

And the part that doesn't show up on an invoice: the agent sees `network: outbound` and `process: spawn` before it trusts a file, instead of discovering them three tool calls later in a `postinstall` script.

Why monthly, not one-off

A code analyzer is less like a hammer and more like antivirus definitions. The day it stops being updated, it starts going stale:

• **Ecosystems keep inventing new doors.** A new HTTP client, a new way to spawn a process, a new Rust build crate. Each one Sentinel doesn't know about is a door the agent walks past without noticing. Version 0.4.4 alone taught it axios, got, undici, superagent and fs-extra.

• **Languages keep coming.** JavaScript, TypeScript, Python and Rust today; Go is next. Because everything sits on one shared IR, every new language shows up in the npm package, the MCP server and the playground at once. You pay for it once and get it three times.

• **Security work never finishes.** The MCP server reads files on your machine for an AI. Path checks, size limits and parser robustness need regular adversarial testing, not a one-time audit framed on the wall.

• **The platforms move.** New Node versions, new MCP clients, new MCP spec revisions. Somebody has to keep `setup` and `doctor` working on Monday morning.

A one-off donation is a very kind pizza. A monthly sponsorship is the kitchen. We're grateful for pizza. The kitchen is what keeps the releases coming.

For companies the maths is short: if Sentinel saves your team even one engineer-hour a month in review time or token spend, the $5 Supporter plan paid for itself before lunch. The Development plan is less than many companies spend on coffee for the people who'd otherwise read those files.

Where the money goes

The `funding.json` lists two plans: **Supporter, $5/month** (helps cover CI) and **Development, $12,000/year** (a year of agent time, test machines, Go and security work on both packages). One-time sponsorship is fine too.

Where we are today

• About 1,150 npm downloads a week for each package (Nov 7–13). That number includes our own CI, so it's an upper bound on real users, not a vanity metric.

• `sentinel-ir-mcp` is in the official [MCP Registry](https://registry.modelcontextprotocol.io) as `io.github.jakcmencz/sentinel-ir-mcp` and on [Glama](https://glama.ai/mcp/servers/jakcmencz/sentinel-ir-mcp).

• Current releases: `sentinel-ir` 0.5.6 and `sentinel-ir-mcp` 0.5.6.

Can't sponsor? Still helps

• Try it on your own repo: `npx -y [email protected] setup`.

• Star the repo on [GitLab](https://gitlab.com/jakubrojicek11/sentinel-ir-mcp) or [GitHub](https://github.com/jakcmencz/sentinel-ir-mcp).

• Open an issue when it gets something wrong. A false "low" is the bug I want most.

• Tell the one colleague who keeps pasting whole files into ChatGPT.

Thanks for reading. If Sentinel ever saves your agent from reading `/etc/passwd`, you know where the button is.

*** Independent Engineering Projects

Built as independent engineering experiments across AI, software analysis, security, and autonomous systems.

Evaluated by reproducible evidence, not by the number of layers.

Explore the projects:

Sentinel Ecosystem: AutoDoc-Sentinel, Sentinel-IR, Sentinel-IR-MCP and related tools. Agentix Lite: Independent security and system-observation project. Find the projects: GitLab repositories | NPM packages

Support the work: ⭐ Star the repositories on GitLab.

Connect: Follow me here on DEV Community or explore the Playground.

Each project is distributed under its own license. Check the corresponding repository or NPM package for licensing terms.

Copyright © 2026 jackymenCZ. All rights reserved. Written for the community.