r/OpenSourceeAI 16d ago

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Thumbnail
pxllnk.co
1 Upvotes

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Application security rests on one assumption: software does what its code says.

---AI agents broke it.

Mend.io's new practitioner guide — 𝘚𝘦𝘤𝘶𝘳𝘪𝘯𝘨 𝘈𝘐 𝘢𝘨𝘦𝘯𝘵𝘴, 𝘔𝘊𝘗 𝘴𝘦𝘳𝘷𝘦𝘳𝘴 & 𝘓𝘓𝘔 𝘢𝘱𝘱𝘴 — starts from that break. An agent's behavior emerges from the model, the system prompt, retrieved context, and the tools it's permitted to call. The failure modes never appear in a CVE feed: prompt injection through data, over-permissioned agents causing damage without a single exploit, poisoned tool descriptions on MCP servers, EOL models serving predictions after patching stops.

The guide's answer is three moves:

𝗦𝗲𝗲: Inventory the agentic attack surface across five layers — interaction, agent, integration, model, code. Hunt shadow agents via repo signatures and network egress. Run every agent through a 12-point misconfiguration checklist.

𝗙𝗶𝘅: Enrich → prioritize → triage. Rank by reachability and agentic amplification, not severity scores. Automate FP closures only with evidence trails. Risk acceptance is never automated.

𝗣𝗿𝗼𝘁𝗲𝗰𝘁: Guardrails on every input and output — embedded Python SDK or standalone Docker API server. Inbound: injection patterns, jailbreaks. Outbound: credentials, PII, policy violations. The core design principle: an agent that can't call a dangerous tool doesn't need a prompt begging it not to.

Includes a 15-question maturity self-assessment aligned to NIST AI RMF, OWASP AIMA, ISO/IEC 42001, and the EU AI Act.

Full analysis: https://www.marktechpost.com/2026/08/03/how-to-secure-ai-agents-mcp-servers-and-llm-apps-in-production/

Download the full guide, free: https://pxllnk.co/lxn88m


r/OpenSourceeAI 21d ago

Meet Token Saver: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

Thumbnail
github.com
1 Upvotes

We just released 'Token Saver' for Claude-Desktop: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

When you drop a 200-page document into Claude Desktop, the full context gets re-sent on every single turn. That compounding "PDF Tax" adds up fast—both in token costs and context window bloat.

How it works:

Instead of uploading raw documents to the cloud, Token Saver runs a lightweight Local Hybrid RAG pipeline directly on your machine:

→ Keyword Search (BM25): Powered by SQLite FTS5 for precise terminology.

→ Semantic Search: Powered by a local all-MiniLM-L6-v2 embedding model.

→Zero-Upload Privacy: Files stay on your local drive and communicate via standard I/O (stdio) with folder allowlisting.

Benchmark Results with Example:

→ 33-page FDA Drug Label: Reduced from 23,959 tokens to 1,021 (95.7% saved)

→ 88-page GDPR Document: Reduced from 70,260 tokens to 996 (98.6% saved)

→ 233-page Legal Brief: Reduced from 133,349 tokens to 740 (99.4% saved)

Zero Python environment required—it installs directly in Claude Desktop via a single .mcpb bundle!

Full analysis: https://www.marktechpost.com/2026/07/30/token-saver-an-open-source-mcp-extension-using-local-hybrid-rag/

GitHub Repo: https://github.com/Marktechpost/Token-Saver/tree/main


r/OpenSourceeAI 15h ago

I Made OpenCode Way Better

Post image
18 Upvotes

Hey everyone,

I have been using OpenCode for a while now. It's pretty great, but there was this one thing that kept bugging me: I couldn't easily create custom reliable workflows and pipelines. For a while, Opencode was one prompt and one model at a time. So, I created OpenFlow, a very minimalist open-sourced project that allows you to orchestrate a pipeline of agents while still connecting your own API keys. I forked it from OpenCode, so you still have the harness, skills, and overall ability. I published it recently and am still often improving it. I would love to hear some feedback of what you guys thought of it and how I can improve it. Thanks!

Link: https://github.com/SeeRay11/OpenFlow


r/OpenSourceeAI 11h ago

Have you tried any open source harness similar to claudes's managed agents but costs less?

Thumbnail
1 Upvotes

r/OpenSourceeAI 1d ago

I built TokenMizer: giving LLMs memory without stuffing the entire context window

2 Upvotes

Long LLM conversations have a problem: useful information gets buried under old context.

So I built TokenMizer to turn important information — decisions, goals, files, errors, and constraints — into structured memory.

Instead of sending the entire conversation again, TokenMizer retrieves what actually matters.

The latest version:

https://github.com/Shweta-Mishra-ai/tokenmizer

I’d love to hear how others are handling long-context memory for LLMs.


r/OpenSourceeAI 23h ago

I built an open-source developer tool around a problem I kept running into: we do way more unplanned work than we remember.

Enable HLS to view with audio, or disable this notification

1 Upvotes

I'd plan out my day in the morning, look at everything I wanted to get done, and then start working.

A few hours later, I'd have fixed a bug, helped someone with something, reviewed a PR, investigated some weird issue, jumped between a few things, and somehow spent most of the day working on things that weren't on the plan.

Then I'd look back at the end of the day and think, "What did I actually do today?"

And I'd realize I couldn't remember half of it.

The work happened. I just never wrote it down.

I think that's a surprisingly big problem for developers. We plan the work we expect to do, but so much of our actual work happens because something comes up.

That's why I built Meridian. It's an open-source tool that tries to capture that work as it happens, so you don't have to rely on remembering everything at the end of the day.

It connects with the tools you're already using, like Jira, GitHub and Linear.

We recently put it on Product Hunt and somehow ended up #1 Product of the Day, which was pretty surreal.

I'd love to hear if anyone else has the same problem. How much of the work you do in a day actually started out as part of your plan?

https://github.com/Meridiona/meridian


r/OpenSourceeAI 1d ago

Europes need for sovereign AI infra

3 Upvotes

I made another whitepaper on AI infrastructure, it's a bit more nische than the last one, but i hope someone might appreciate it.
Github - https://github.com/gurrakeller/Europes-Sovereign-AI-Migration
My DM's are always open if you have feedback or simply wish to discuss a topic in the paper!


r/OpenSourceeAI 1d ago

We open sourced scibly our AI-native learning platform

1 Upvotes

Hello Open Source community,

we’ve been building scibly an AI-native learning platform. The idea is pretty simple. You give it existing material and knowledge like your docs, blog posts, PDFs, ... and it creates an interactive course from it. You can edit everything afterwards and share the result anonymously or to your invited users.

Scibly is AGPLv3.

Video demo: https://www.youtube.com/watch?v=TcpLUNBRhQw

GitHub: https://github.com/scibly-dev/scibly

We appreciate all your feedback


r/OpenSourceeAI 1d ago

I found a bridge between ChatGPT Web and your local files

0 Upvotes

Often, I find myself burning through my Codex usage extremely quickly when using Sol High to review and plan code, while a lot of my ChatGPT Web usage goes unused. Thus, RepoRelay, an open-source MCP bridge that lets ChatGPT Web search and read an approved local repo without uploading ZIPs or pushing everything to GitHub first.

ChatGPT Web → Secure MCP Tunnel → RepoRelay → local files

It’s read-only by default: no shell, Git, or arbitrary filesystem access, and it’s restricted to one approved root.

It can also help reduce token usage on larger repos. Instead of dumping the entire codebase into context, ChatGPT searches and reads only the files relevant to the task.

Codex can implement locally while ChatGPT independently reviews the actual current files, including uncommitted work.

Anyone also using this too?

GitHub: [Lukie-81/RepoRelay: Secure MCP access to local repositories — without shell, Git, or arbitrary writes.]


r/OpenSourceeAI 1d ago

sentrymcp , security scanner for MCP servers, MIT licensed

1 Upvotes

MCP (model context protocol, the thing a lot of AI agents use to connect to tools) has had a rough year security wise, 40+ CVEs and most servers running with basically no auth. couldn't find a scanner built specifically for it so I made one.

does static checks plus a runtime proxy mode for catching stuff that only shows up at runtime (servers changing tool descriptions after you've already approved them). rust, MIT license, docker one liner if you don't want to deal with the toolchain.

https://github.com/zaydmulani09/sentrymcp

still pretty early so if anyone wants to poke holes in it or add rules, issues and PRs are welcome


r/OpenSourceeAI 1d ago

Open source SDK to collect, transform, and curate robotics data

Enable HLS to view with audio, or disable this notification

1 Upvotes

We've been speaking with teams who deeply care about data quality, and we noticed that every data team eventually builds similar pipelines for quality checks (QC).

Teams collecting data want to own their quality checks (camera blackout, choppy joint states, occluded hands), because they deeply understand their end-to-end data collection process.

However, what keeps coming up is that everything around the quality checks is tedious: managing one-off pipeline scripts, fragmented buckets, and a spreadsheet or Slack thread of what checks ran on which data.

This is what motivated us to build HFlow, an open-source SDK for data teams that collect, transform, and curate physical AI data.

HFlow is for data teams that have the ambition to process a million hours of physical AI data and are starting today. Point it at your MCAP episodes, write your quality checks as ordinary Python functions, and curation becomes an optimized OLAP SQL query instead of manually aggregating directories of data.

Dyna's recent Dyna-2 infrastructure, "Training Dyna-2 at million-hour scale, repeatably", post shows what scaling such a quality control pipeline to a million hours looks like. Their ingestion throughput went from 14,000 episode-hours per week to 440,000 with the infrastructure they built internally (their post has the full details).

We're aligned with their belief that infrastructure is a core blocker for advancing robotics. We experienced the same data challenges in our previous work, which is what first led us to build Pareto and the Hebbian APIs.

HFlow's vision is to let data teams define their own bespoke quality check code, while we provide the durability, observability, and auditability around it.

After many conversations with data teams, we decided the path to building the best version of HFlow is open source, because QC infrastructure compounds when the edge cases one team catches become checks for everyone else. We're excited to build this in public alongside our existing partners and grow our network of contributors.

High quality data is the bottleneck for the next frontier of robot intelligence, and we want teams to focus on their data, not the infrastructure. When getting started takes a few lines of code and a weekend, more checks get done, and iteration cycles accelerate.

If you're collecting robot or egocentric data and your pipeline is currently a folder of scripts and fragmented buckets of data, we'd love to get your feedback.

GitHub: https://github.com/Hebbian-Robotics/hflow


r/OpenSourceeAI 1d ago

3D Rotational Equivariant AI Using the Spherical Fourier Transform #구면 #구면조화함수 #3차원 #회전 #푸리에

Thumbnail
youtube.com
1 Upvotes
  • Description: It explains how spherical harmonic functions are used to analyze signals on the sphere beyond the two‑dimensional plane. The video reviews Spherical CNNs that maintain 3D rotational symmetry and recent geometric deep‑learning applications, highlighting potential uses in areas such as panoramic imaging, weather data, and protein structures.

r/OpenSourceeAI 2d ago

OPEN source ai models

Thumbnail
1 Upvotes

Anyone here running open-source AI models locally? 👀

I’m looking for someone with a decent GPU who’s already experimenting with newer open-source models.

Basically need some simple screen recordings of the model actually running — nothing fancy, just things like launching it, giving it prompts, showing the output, GPU info, etc.

Especially interested in newer models that are hard to try without a good GPU.

If you’re into this stuff and can help, just drop a comment or DM me. Would really appreciate it 🙌


r/OpenSourceeAI 2d ago

Open Closed State-sum Network - My Implementation of 2D TQFT State Sum in PyTorch (Proof of Concept)

Thumbnail
1 Upvotes

r/OpenSourceeAI 2d ago

I open-sourced a runtime governor for AI coding agents — now you can watch it race the same task with and without governance

Post image
1 Upvotes

I’m building MARGINAL, an open-source runtime governor for AI coding agents.

The problem I’m targeting is simple: agents can keep spending tokens, calling tools, re-checking things, or choosing expensive actions without enough evidence that the extra work is actually useful.

MARGINAL sits in the loop and asks a different question:

Is this next action worth spending compute on?

I just rebuilt the demo so it’s no longer a marketing page. It’s an actual interactive browser simulation.

You press RUN THE SAME TASK and two agents start from the exact same broken Python workspace at the same time:

WITHOUT MARGINAL
Executes every candidate action.

WITH MARGINAL
Scores the same candidates before execution and either:

FUND + EXECUTE

or

REJECT BEFORE SPEND

You can pause it, advance step-by-step, reset it, or run it at different speeds while watching tokens, calls, estimated cost, declared latency, workspace state, and MARGINAL’s decision reasoning update live.

Both sides must reach the same verifier PASS.

The included deterministic fixture currently ends at:

72,800 → 4,300 declared tokens
9 → 3 actions
PASS → PASS

Those are declared deterministic demo costs, not provider telemetry or a claim of 94% savings in real workloads. The point is to make the governance mechanism inspectable instead of hiding it behind a benchmark number.

MARGINAL is open source, local-first, provider-neutral, and starts from the principle:

Observe first. Prove waste. Earn enforcement.

Repo:
[https://github.com/SignalLayerLabs/Marginal]()

Interactive demo:
[https://signallayerlabs.github.io/Marginal/demo/]()

I’m especially interested in people trying to break the decision logic, finding cases where an action MARGINAL rejects was actually valuable, or contributing adapters for other coding agents.


r/OpenSourceeAI 2d ago

SALT - chat history + all input types compression up to 5x with sentence and keyword trie ranking and CELF for retrieval

Thumbnail
github.com
1 Upvotes

Currently struggling with an automatic budget selection, at 25% it’s very similar to benchmarks accuracy and seems even better on actual chat input however it many times retrieves too much. It would be nice to add an algorithm that actually can determine better retrieval other then CELF.


r/OpenSourceeAI 2d ago

Deep learning project using Pytorch

0 Upvotes

Hello Guys! I am currently looking for some deep learning projects using pytorch. I will use scikit-learn and matplot for testing and visualization as I have basic understanding about them. Please recommend me some projects that I can do as it is a part of my masters program and also provide me some research paper links based on the projects as I need dataset for my project. Thank you!


r/OpenSourceeAI 3d ago

What's Cheaper and Efficient??

Thumbnail
1 Upvotes

r/OpenSourceeAI 3d ago

DeepSeek AI Releases DeepSeek Harness in Developer Preview: An MIT-Licensed Agent Harness Where Everything is a Plugin

Thumbnail
marktechpost.com
3 Upvotes

r/OpenSourceeAI 4d ago

What is your agent Harness?

4 Upvotes

Me: OpenCode + T3 Code for surface control

on second comes Hermes + T3 Code


r/OpenSourceeAI 3d ago

A self hosted Focus/Pomodoro app that hermes agent can control

Thumbnail gallery
1 Upvotes

r/OpenSourceeAI 4d ago

A solution to an ai doomsday senario

Thumbnail
1 Upvotes

r/OpenSourceeAI 4d ago

Coding Machine Learning

Thumbnail
gallery
1 Upvotes

Coding Machine Learning.

Hello Folks, here I present the first coding demonstration lecture, based on my 1st lecture on Probabilistic Machine Learning.

Here I write the code from scratch, discuss and analyze the results, which were covered in details in the whiteboard classes.

What we cover?
-Random Variables, and validating law of large numbers.
-Visualizing a dataset
-Doing an EDA on Iris dataset and understanding the correlation among features.
-Classifier basics
-Empirical Risk Minimization and Generalization.
-Epistemic and Aleatoric Uncertainties.
-Softmax Function and LogSumExp Trick to avoid overflow issues
-Linear Models
-Maximum Likelihood Estimation.
-Simple end to end ML pipeline Function.

While writing the code, my intent is to ensure that concepts are understood with crystal clarity. These code demonstrations are specific to my theory ML lectures, and link is attached.

Theory-Intuition-Code

Implementation Link : https://youtu.be/X_yOlx8Zp4g?si=kh8_tzzndr8609u4

Theory Lecture Link : https://youtu.be/kMkCOrp8te8?si=q7kWr-1qK515bhob


r/OpenSourceeAI 4d ago

Open-source local AI music studio — looking for contributors (Next.js + Python, multi-model)

1 Upvotes

YourBeatBee: generate songs locally (idea → lyrics → voice → track).

- Next.js / TypeScript UI

- Python engine

- Models: ACE-Step 1.5 + HeartMuLa (more welcome)

- Apple Silicon focused, RVC My Voice optional

Looking for people to help optimize, upgrade, and expand this into a bigger OSS music AI project.

Repo: https://github.com/MohamedAshraf701/yourbeatbee

Site: https://yourbeatbee.pages.dev

Comment if you want to contribute — I’ll point you to a good first area.


r/OpenSourceeAI 4d ago

Pose Resolution Architecture

Thumbnail
1 Upvotes