Günter Weber · Mainz, Germany · in IT since 1997

Cybersecurity & AI Consultant

I automate security operations — SOAR, SIEM, detection — and build AI agent systems you can run safely: on your own hardware, guarded against prompt injection, with MCP interfaces that do only what they should.

View portfolio Discuss a project

$ whoami
günter weber — cybersecurity & ai

$ ls ~/focus
soar/  siem/  detection/  ai-agents/  llm-security/  mcp/

$ cat ~/stack
SOAR · SIEM · EDR · Python · LLM agents
vLLM · LiteLLM · MCP · DGX Spark

$ status
● available for projects · remote or Rhine-Main
$

first IT project: 1997
projects in the portfolio: 25
public MCP servers: 6
open-source repos: 9

Services

Where I help

Security and AI are growing together: agents get tools, and tools get agents. I bring hands-on experience from both sides.

01SEC
Security Automation & SOAR
Analysis, design and delivery of playbooks and automation workflows — XSOAR/Cortex, Splunk SOAR or custom Python orchestration.
- XSOAR
- Splunk SOAR
- Python
02SEC
SIEM & Detection Engineering
EDR-to-SIEM integration, log ingestion, parsers, detections — and proof that they actually fire.
- Splunk
- Sentinel
- Elastic
03AI
AI agent systems
Architecture, build and operation of multi-agent systems: roles, memory, scheduled jobs, approvals and observability.
- Agents
- Memory
- Kanban loop
04AI
LLM security
Prompt injection, tool abuse, data exfiltration: threat models for agents, layers of defence and decoy servers that expose attackers.
- Prompt injection
- OWASP LLM
- Red teaming
05AI
Self-hosted AI & MCP
Local models on your own hardware, a gateway with cost per workload, and MCP servers that open your data to assistants — without handing it over.
- vLLM
- LiteLLM
- MCP
06SEC
Security Architecture & Compliance
Assessment of existing security stacks, vendor selection and compliance readiness for NIS2, ISO 27001, DORA and EAA accessibility.
- NIS2
- DORA
- EAA

Selected work

Built, run, live

Not a slide-deck portfolio: these projects run, most of them in public. They show how I bring security, AI and the web together.

LiveMCPSince 2026

SiteGuardian

Website monitoring for security, accessibility and EU compliance.

A SaaS hosted in Germany that checks websites around the clock: uptime, SSL, domains, e-mail authentication, security headers, cookie consent and WCAG 2.2 AA accessibility. A compliance engine maps controls to NIS2, DORA, CRA, GDPR, ISO 27001 and the EU AI Act.

Free instant scan, no account
EAA accessibility audits for clients
SPF/DKIM/DMARC, SSL and domain monitoring

Python
FastAPI
MongoDB
Redis
HTMX

Details siteguardian.io

LiveSince 2026

ebersheim.de

The village portal for Mainz-Ebersheim — new every morning, with a podcast.

A non-commercial village portal: daily overview, Ortsfunk podcast, event calendar, plain-language council summaries, live bus departures, business directory, property listings and more. 35 sources are read every morning; a 17-step chain stops completely if one step fails.

About 60 podcast episodes since August 2026
More than 20 automatic jobs, publicly visible
Fact check before every publication

WordPress
PHP
Python
local LLM
TTS

Details ebersheim.de

InternalSince 2026

Self-hosted AI platform

A multi-agent system on own hardware — models, memory, jobs.

Local open-weight models on an NVIDIA DGX Spark, a LiteLLM gateway with role aliases, long-term memory on Postgres/pgvector, scheduled agent jobs and a kanban loop of PM, worker and reviewer. It runs the editorial and data jobs behind the projects on this page.

Local inference: no data leaves the building
One API key per workload — load and cost attributable
Memory with grants, decay and contradiction checks

NVIDIA DGX Spark
vLLM
LiteLLM
Postgres + pgvector
MCP

Details

LiveMCPSince 1998

openwein.de

The open directory of German wineries — online since 1998.

13 wine regions, about 660 wine towns and some 5,900 wineries with addresses, opening hours and visitor comments, plus a calendar of wine festivals across every region. Automated data jobs keep dates and records current.

Wine-festival calendar for every region
Map of wine vending machines
“The sky over …” with sunset and moon days

Laravel
PHP 8.4
MCP

Details openwein.de

LiveMCPSince 2026

Morgenhimmel · Sky and Signs

Daily horoscope and night sky — the sky is computed, not invented.

Website, podcast and social formats about the sky: every planetary position is computed with ephem, the interpretations come from hand-written text blocks. Plus an interactive star map and skyandsigns.com as the localised English and Spanish edition.

Star map with compass, ISS, comets and eclipses
Weekly, monthly and yearly horoscopes to 2030
WordPress plugin for the daily horoscope

Python
ephem
Canvas
PHP
MCP

Details morgenhimmel.de skyandsigns.com

LiveSince 2026

NetVerdict

A deterministic network simulator that runs entirely in the browser.

Build topologies, type real CLI in the style of Cisco IOS, Junos or VyOS and follow packets hop by hop — no VMs, no backend. 15 vendor grammars, a Rust/WASM core and 89 guided labs; the same engine grades configuration changes in CI.

Byte-identical, deterministic simulation
Wireshark pcap export
89 labs, no telemetry

Rust
WebAssembly
TypeScript
Vue

netverdict.io

All 25 projects

Downloads & open source

Take it with you

WordPress plugins with checksums, open-source tools for AI agents, and public MCP servers you can connect right away.

Go to downloads

WordPress plugins

Abfahrtstafel
Rosis Morgenhimmel – Tageshoroskop
Estatequay

Open-source repos

hermes-injection-guard
mcp-decoy
kifu
hermes-run-lens
honcho-lens
agent-needs
decision-ab
metta
mockdr

MCP servers

openwein.de
xwords.de
morgenhimmel.de
skyandsigns.com
alcometer.de
SiteGuardian

Background

Almost 30 years in IT

2026–present
AI agent systems & LLM security
own platform · Self-hosted multi-agent platform, MCP servers, Injection Guard
2025–present
Founder & Developer
mockdr.io · Security engineering tools
2020–present
Senior Cyber Security Consultant
Remote/Freelance · SOAR/XSOAR development, SIEM/EDR integration, incident response
2012–2019
Senior Network Support Engineer
Remote/Freelance · Global L3 infrastructure, 100+ countries, EMEA escalation lead
2009–2011
Digital Forensics & Incident Specialist
Seed Forensics GmbH · Partner of German law enforcement agencies
2001–2006
Applied Computer Science
FH Bingen
1997–present
IT consulting & network administration
webersheim.de

Contact

Let’s talk.

A SOAR project, a SIEM integration, an AI agent that has to run safely, or a question about one of the projects: write to me — I answer personally.

info@webersheim.de

Günter Weber

Freelance Cybersecurity & AI Consultant

Mainz, Germany

E-mail: info@webersheim.de
Phone: +49 160 99488893
LinkedIn: linkedin.com/in/guenterweber
GitHub: github.com/gweber
mockdr.io: mockdr.io