What I build

A SaaS hosted in Germany that checks websites around the clock: uptime, SSL, domains, e-mail authentication, security headers, cookie consent and WCAG 2.2 AA accessibility. A compliance engine maps controls to NIS2, DORA, CRA, GDPR, ISO 27001 and the EU AI Act.

• Free instant scan, no account
• EAA accessibility audits for clients
• SPF/DKIM/DMARC, SSL and domain monitoring

Reproduces the APIs of SentinelOne, CrowdStrike Falcon, Defender for Endpoint, Elastic Security, Cortex XDR, Splunk, Microsoft Sentinel and Microsoft Graph, with real paths, auth and deterministic seed data. SOAR playbooks and SIEM connectors can be tested without vendor tenants.

• Eight platforms in one process
• Fault injection and scenario engine
• SPL parser, GitHub Action, Docker image

A plugin for the open-source Hermes agent framework: fetched web content runs through a DeBERTa classifier, and hits are marked as untrusted data or optionally blocked. Small, CPU-only, lazy-loaded.

• Covers browser, extract, search and vision tools
• Live test page with a real injection payload
• Clean no-op when dependencies are missing

Poses as an enterprise integration hub: 38 plausible tools in 10 categories, each answering with convincing fake data. Every interaction is logged forensically and forwarded to a SIEM via RFC 5424 syslog or to a webhook.

• Streamable HTTP and SSE
• SIEM forwarding and webhooks
• Multi-arch containers, 141 tests

Adds a detection-assurance layer to Uber’s adversary-simulation tool: an ATT&CK technique runs safely, then the SIEM or EDR is queried. PARTIAL means telemetry arrived but no rule fired; FAIL means a sensor gap.

• Backends: Splunk, Elasticsearch, Sentinel, JSONL
• JUnit and HTML reports for CI

Build topologies, type real CLI in the style of Cisco IOS, Junos or VyOS and follow packets hop by hop — no VMs, no backend. 15 vendor grammars, a Rust/WASM core and 89 guided labs; the same engine grades configuration changes in CI.

• Byte-identical, deterministic simulation
• Wireshark pcap export
• 89 labs, no telemetry

Local open-weight models on an NVIDIA DGX Spark, a LiteLLM gateway with role aliases, long-term memory on Postgres/pgvector, scheduled agent jobs and a kanban loop of PM, worker and reviewer. It runs the editorial and data jobs behind the projects on this page.

• Local inference: no data leaves the building
• One API key per workload — load and cost attributable
• Memory with grants, decay and contradiction checks

Reads session logs from Claude Code, Codex, Gemini CLI, Cline and Hermes across machines and follows each idea until it shipped, was dropped or went quiet. On the author’s machines: 297 sessions, 1,228 ideas, 506 still open.

• Web app, CLI and MCP server
• Plugins for Claude Code and Hermes

Joins session stores, agent logs, LiteLLM spend logs and cron runs, and flags loops, runaways and silent model fallbacks against each job’s normal runs. Motivated by two runs that looped for three hours while marked “completed”.

• Dashboard, CLI, per-job caps, live stop

A local web UI and dashboard plugin for browsing, searching and deleting entries in Honcho agent memory. Motivated by a store that had grown to about 9,000 conclusions before anyone looked.

• Transparency over stored personal data

Reads agent traces locally and read-only and reports improvised code, failing tools, repeatedly read files and unused tool schemas. A watch mode finds tools that silently fail every other call.

• No dependencies, Python standard library

Gives two OpenAI-compatible endpoints the same judgment-heavy tasks, shuffles A and B per task and reveals model names only after a human has judged every task. Includes a set of security-shaped tasks.

• Basis for choosing production models

A set of internal experiments: an A/B harness for picking the production model, the electricity cost of local inference against API prices, what survives context compaction, whether a weaker model can improve a stronger one, and whether role boundaries survive translation.

• Compaction: recall raised from 6/22 to 17/22
• Small model: 6× slower, 12× more electricity

Listens on an interface without sending traffic and builds a model of hosts, roles and services from ARP, DHCP, DNS, mDNS, TLS SNI and more. A local model writes the report; only aggregated observations reach it, and nothing leaves the machine.

• Explore mode within a budget

A learning app for the board game Go: analyse games, play the engine at adjustable strength, work through a beginner course. Behind it, a hardened REST and MCP front end for KataGo with signed, replay-proof requests.

• Learning engine runs offline in the browser
• OWASP Top 10 documented

13 wine regions, about 660 wine towns and some 5,900 wineries with addresses, opening hours and visitor comments, plus a calendar of wine festivals across every region. Automated data jobs keep dates and records current.

• Wine-festival calendar for every region
• Map of wine vending machines
• “The sky over …” with sunset and moon days

Website, podcast and social formats about the sky: every planetary position is computed with ephem, the interpretations come from hand-written text blocks. Plus an interactive star map and skyandsigns.com as the localised English and Spanish edition.

• Star map with compass, ISS, comets and eclipses
• Weekly, monthly and yearly horoscopes to 2030
• WordPress plugin for the daily horoscope

Type the clue, pick the length, done: over 500,000 solutions sorted by letter count. A local language model continuously grades the clue–answer pairs. Plus a curated puzzle collection and three new crosswords every day at three difficulty levels.

• Dense grid builder with solvability check
• Public MCP server (solve_clue, build_crossword …)

Calculates with the Widmark and Watson formulas and shows a range instead of false precision, plus the time when you are back under 0.5 or 0.0 per mille. One PHP core serves the page, the no-JS fallback and the MCP; tests check that JS and PHP agree.

• Listed in the official MCP registry

Army, air force and navy side by side by NATO rank code, each rank with its own page, insignia, abbreviation and pay. Plus a comparison tool, branch colours and an explainer of the new military service — every fact backed by a primary source.

• Rebuilt in 2026 with a rank-ladder design

A trilingual website for a planned retreat on Gran Canaria for neurodivergent adults in burnout. Plus Scroll Mala: an offline PWA counter for repetitions (one scroll = one bead), no account and no tracking, in 35 languages and as a Telegram Mini App.

• Scroll Mala: offline-first, 35 languages, 6 themes
• Telegram bot with timer and breathing helper

A non-commercial village portal: daily overview, Ortsfunk podcast, event calendar, plain-language council summaries, live bus departures, business directory, property listings and more. 35 sources are read every morning; a 17-step chain stops completely if one step fails.

• About 60 podcast episodes since August 2026
• More than 20 automatic jobs, publicly visible
• Fact check before every publication

Shows departures of one bus or tram stop with real-time delays and service alerts from an EFA journey planner. Visitors never reach the planner directly: the site fetches and caches. In use on ebersheim.de as “Bus ab Neugasse”.

• Widget and [abfahrtstafel] shortcode
• Download on this site

Imports listings from agents’ software via OpenImmo over per-agent SFTP inboxes and Spanish feeds via Kyero v3, takes private offers and forwards enquiries through a relay form that stores nothing. Legal requirements such as the energy certificate are enforced.

• German, English, Spanish
• Read-only MCP for listings
• Reviewed against the OWASP Top 10

Harvests every district-council meeting from the city’s public council information system — 230 meetings and almost 4,000 agenda items in the current term — classifies topics and shows which questions were answered and which were not.

• In development