I build local-first security and workflow tools for AI coding agents.
My open-source work focuses on a practical question: how can developers let coding agents work with repositories without giving up safety, clarity, or maintainability?
| Project | Use it when you need to | Try it |
|---|---|---|
| repo-trust-scan | Inspect an unfamiliar repository before opening it with Codex, Claude Code, Cursor, or Copilot | uvx repo-trust-scan scan ./repo |
| mcp-server-doctor | Diagnose MCP client configuration, process startup, and stdio handshake failures | uvx mcp-server-doctor check ./mcp.json |
| agent-rules-lint | Check AGENTS.md, CLAUDE.md, Cursor rules, and Copilot instructions for quality and safety issues | uvx agent-rules-lint ./repo |
These three CLIs have no runtime Python dependencies and use PyPI Trusted Publishing. Static checks do not execute target code. MCP process probes are opt-in and should only be used with servers you trust. No scanner can certify that a repository is safe.
For CI integration, start with the repo-trust-scan Action or mcp-server-doctor Action. Both repositories explain the checks and their limits.
The wider toolkit covers the repository lifecycle from creation to maintenance:
| Stage | Project | What it does |
|---|---|---|
| Create | agent-repo-kit | Scaffold launch-ready, agent-friendly open-source repositories. |
| Understand | repo-context-card | Generate compact repository context cards for coding agents. |
| Measure workflows | repo-agent-bench | A/B test agent instructions, Skills, MCP setups, and commands with deterministic evidence. |
| Validate instructions | agent-rules-lint | Lint repository-level agent instructions before they affect real work. |
| Check trust | repo-trust-scan | Detect risky execution surfaces, hooks, MCP configs, and trust-boundary issues. |
| Diagnose MCP | mcp-server-doctor | Diagnose client configuration and stdio handshake failures for MCP servers. |
| Validate MCP Apps | mcp-app-check | Statically check MCP Apps readiness and common security issues without running target code. |
| Prepare release | oss-launch-check | Audit open-source launch readiness across documentation, legal, CI, security, and packaging. |
- consulting-skills-lab — portable consulting skills with illustrative examples, evaluation cases, and release packages.
- awesome-ai-agents-zh — a curated Chinese directory of AI agents, MCP tools, and AI developer tooling.
- Local-first and privacy-conscious
- No model or network calls in default analysis paths
- Deterministic output that works in CI
- Clear findings with practical remediation
- Useful to humans before it is clever for agents
Based in London. Building in public, improving the toolkit through real repository use, and open to thoughtful issues and contributions.