Open-source tools and utilities built during lab operations. Everything here is available on GitHub.
Shipped
Mjolnir
A hardened Slack bot for remote fleet power control. Issues wake, sleep, and status commands to Dell PowerEdge servers via iDRAC Redfish, driven entirely from a Slack slash command with challenge-response confirmation and a full audit trail.
Every command goes through Slack signing verification, channel restriction, user allowlist check, and a single-use 6-digit token challenge before anything touches a server. Unauthorized attempts cross-post to the security alert channel as critical Tattle events. An overnight bedtime timer posts a warning and gracefully shuts the fleet down at 02:00 Central if not cancelled.
Stack: Python · Flask · Slack Events API · iDRAC Redfish · Docker Compose · Cloudflare Tunnel
Status: Active · v1.0
Tattle
A passive intrusion detection pipeline built for the home lab. A dedicated Raspberry Pi sensor running Suricata feeds network events into a deduplication engine (woop_dedoop), which episodes and scores events before routing them to an LLM triage agent via LiteLLM. Structured alerts land in Slack.
The pipeline includes honeytoken credential callbacks: decoy credentials formatted to mimic real service tokens (Sentry DSNs, Slack webhooks, API key URL patterns). Any use fires an immediate critical-severity alert regardless of deduplication state.
Stack: Python · Suricata · Docker Compose · LiteLLM · Slack API
Status: Active · v1.0
Read the build post
ATT&CK Mapper
An Open WebUI tool function for querying the MITRE ATT&CK framework from inside a local AI session. Resolves detection strategies and data sources via the v14+ detection-strategy graph. The flat x_mitre_detection and x_mitre_data_sources fields were removed in v14 and tools that rely on them return empty results silently. This one does not.
Search uses specificity ranking: exact technique name matches surface above starts-with, which surfaces above contains, which surfaces above description-only. Searching “phishing” returns T1566 first.
Stack: Python · MITRE ATT&CK STIX 2.1 · Open WebUI Tool API
Status: Active · v1.5.0
View on GitHub
NVD CVE Query Tool
A Python utility for querying the NIST National Vulnerability Database API. Includes date-range filtering, proper ISO 8601 timestamp handling, and HTTP/2 compatibility fixes for environments where h2 causes issues.
Stack: Python · NIST NVD API v2.0
Status: Active
View on GitHub
Open WebUI Filter Functions
Programmatic middleware for sanitizing sensitive data before it reaches LLM inference. Uses regex pattern matching to scrub credentials, PSKs, serial numbers, and license keys from uploads in transit.
Stack: Python · Open WebUI Filter API
Status: Active
View on GitHub
AI Stack Docker Compose
Production-grade docker-compose.yml blueprint for deploying a local AI inference stack with GPU acceleration: Ollama, Open WebUI, LiteLLM, SearXNG, Tattle, Mjolnir, and supporting services.
Stack: Docker · NVIDIA Container Runtime · Cloudflare Tunnel
Status: Active
View on GitHub
In Development
LLM Benchmarking Portal
A self-hosted web application for capturing, tracking, and visualizing LLM benchmark results across the fleet. Goes beyond throughput metrics: a judge model scores output quality on accuracy, coherence, and completeness alongside performance data, making it possible to track how model quality evolves as quantizations change or hardware is added.
Designed to answer a specific question: how does a locally-served 27B parameter model on enterprise V100 hardware compare to a frontier cloud API on cybersecurity reasoning tasks? Both are available simultaneously in this lab. The portal makes that comparison rigorous and repeatable.
Stack: React · Recharts · SQLite · Python · Docker Compose
Status: In development
Policy Analyzer
Ingests an organizational cybersecurity policy document and maps it against three frameworks: CIS Controls v8, NIST CSF 2.0, and ISO 27001. Identifies control gaps and outputs a structured remediation roadmap with prioritized findings.
The intended use case is the engagement where a customer hands you a policy PDF and asks how it holds up. This tool answers that question in minutes instead of days.
Stack: Python · LiteLLM · CIS v8 · NIST CSF 2.0 · ISO 27001
Status: In development
Policy Generator
A questionnaire-driven policy generation tool. Takes organizational inputs (industry, size, regulatory exposure, existing controls) and produces a net-new cybersecurity policy and Acceptable Use Policy pre-aligned to CIS v8, NIST CSF 2.0, and ISO 27001.
Built to complement the Policy Analyzer: the Analyzer finds the gaps, the Generator builds the document that closes them.
Stack: Python · LiteLLM
Status: In development
AI Vendor Risk Assessment
Structured vendor risk scoring for AI and agentic systems. Maps vendor posture against the OWASP Agentic Top 10 and three framework pillars (CIS v8, NIST CSF 2.0, ISO 27001). Produces a scored assessment with remediation recommendations.
Built to address a gap in existing vendor risk tooling: most frameworks were not written with agentic AI systems in mind. This one was.
Stack: Python · LiteLLM · OWASP Agentic Top 10
Status: In development
AI Governance Risk Framework
Maps OWASP LLM Top 10 and Agentic Top 10 risks into policy and compliance language for the governance and executive layer. Designed for organizations deploying AI systems who need to understand their risk surface in terms their legal, compliance, and board audiences can act on.
Differentiator: explicit coverage of self-hosted AI deployment risk and framework crosswalk across OWASP, NIST, and ISO. Most governance frameworks treat AI as a cloud service. This one does not assume that.
Stack: Python · LiteLLM · OWASP LLM Top 10 · OWASP Agentic Top 10
Status: Planning
More projects shipping as the lab grows. Watch the GitHub for updates.