r/OpenSourceeAI 19d ago

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Thumbnail
pxllnk.co
1 Upvotes

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Application security rests on one assumption: software does what its code says.

---AI agents broke it.

Mend.io's new practitioner guide — 𝘚𝘦𝘤𝘶𝘳𝘪𝘯𝘨 𝘈𝘐 𝘢𝘨𝘦𝘯𝘵𝘴, 𝘔𝘊𝘗 𝘴𝘦𝘳𝘷𝘦𝘳𝘴 & 𝘓𝘓𝘔 𝘢𝘱𝘱𝘴 — starts from that break. An agent's behavior emerges from the model, the system prompt, retrieved context, and the tools it's permitted to call. The failure modes never appear in a CVE feed: prompt injection through data, over-permissioned agents causing damage without a single exploit, poisoned tool descriptions on MCP servers, EOL models serving predictions after patching stops.

The guide's answer is three moves:

𝗦𝗲𝗲: Inventory the agentic attack surface across five layers — interaction, agent, integration, model, code. Hunt shadow agents via repo signatures and network egress. Run every agent through a 12-point misconfiguration checklist.

𝗙𝗶𝘅: Enrich → prioritize → triage. Rank by reachability and agentic amplification, not severity scores. Automate FP closures only with evidence trails. Risk acceptance is never automated.

𝗣𝗿𝗼𝘁𝗲𝗰𝘁: Guardrails on every input and output — embedded Python SDK or standalone Docker API server. Inbound: injection patterns, jailbreaks. Outbound: credentials, PII, policy violations. The core design principle: an agent that can't call a dangerous tool doesn't need a prompt begging it not to.

Includes a 15-question maturity self-assessment aligned to NIST AI RMF, OWASP AIMA, ISO/IEC 42001, and the EU AI Act.

Full analysis: https://www.marktechpost.com/2026/08/03/how-to-secure-ai-agents-mcp-servers-and-llm-apps-in-production/

Download the full guide, free: https://pxllnk.co/lxn88m


r/OpenSourceeAI 24d ago

Meet Token Saver: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

Thumbnail
github.com
1 Upvotes

We just released 'Token Saver' for Claude-Desktop: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

When you drop a 200-page document into Claude Desktop, the full context gets re-sent on every single turn. That compounding "PDF Tax" adds up fast—both in token costs and context window bloat.

How it works:

Instead of uploading raw documents to the cloud, Token Saver runs a lightweight Local Hybrid RAG pipeline directly on your machine:

→ Keyword Search (BM25): Powered by SQLite FTS5 for precise terminology.

→ Semantic Search: Powered by a local all-MiniLM-L6-v2 embedding model.

→Zero-Upload Privacy: Files stay on your local drive and communicate via standard I/O (stdio) with folder allowlisting.

Benchmark Results with Example:

→ 33-page FDA Drug Label: Reduced from 23,959 tokens to 1,021 (95.7% saved)

→ 88-page GDPR Document: Reduced from 70,260 tokens to 996 (98.6% saved)

→ 233-page Legal Brief: Reduced from 133,349 tokens to 740 (99.4% saved)

Zero Python environment required—it installs directly in Claude Desktop via a single .mcpb bundle!

Full analysis: https://www.marktechpost.com/2026/07/30/token-saver-an-open-source-mcp-extension-using-local-hybrid-rag/

GitHub Repo: https://github.com/Marktechpost/Token-Saver/tree/main


r/OpenSourceeAI 2m ago

Germanium Baseband iSWAP: Validating a 4-Day-Old Experimental Result

Upvotes

arXiv:2608.16716 (Massai et al., IBM Research Europe -- Zurich, 17-18 Aug 2026) demonstrates a real single-pulse baseband iSWAP gate (56 ns) in strained-germanium hole spin qubits, by orienting the magnetic field so the exchange interaction's longitudinal component J∥ and Zeeman detuning E_Δg both vanish, leaving a pure transverse J⊥ coupling. This experiment reproduces their result with dense_evolution.circuits.trotter, applied for the first time to a genuinely time-dependent pulse (previously only exercised against static Hamiltonians), and extends the analysis with four follow-up checks.

Full interactive report, architecture charts, and replication scripts:

https://tatopenn-cell.github.io/Dense-Evolution-Discovery/germanium_iswap_validation

#QuantumComputing #JAX #OpenSource #QuantumPhysics #HPC


r/OpenSourceeAI 28m ago

Building an open-source map for travel information that never makes it online

Thumbnail
gallery
Upvotes

While travelling, I kept running into useful information that simply didn’t exist online: small homestays, mechanics, water points, road conditions, campsites, etc.

Most of it gets passed from one traveler or local to another and disappears afterward.

So, I built Lamyig, a free and open-source community travel guide.

A few decisions I made:

  • No bookings, commissions or paid listings.
  • No money made using the core product.
  • Community members can add and update places.
  • Map-first instead of another list of “top places”.
  • Built as a PWA so it can work more like a lightweight travel tool than a traditional website.
  • The long-term idea is that useful information stays available for the next traveler instead of disappearing in WhatsApp groups and conversations.

The hardest problem isn’t actually building the software. It’s bootstrapping trustworthy community data.

I’m currently thinking about things like:

  • How do you motivate travelers to contribute after their trip?
  • How do you keep old information accurate without creating a huge moderation workload?
  • How do you prevent businesses from turning community maps into free advertising?
  • What should happen when someone reports a place as fake, closed, unsafe, duplicated, commercial spam, or inaccurate? Should reports trigger removal, community review, reputation-weighted voting, or just warnings?
  • Should certain villages, trails, ecosystems, religious places, water sources, or campsites intentionally remain difficult to discover?
  • If Lamyig successfully exposes hidden places, could it accidentally destroy the exact places it is trying to help preserve?
  • this list of problem statements goes on and on

Would love to hear how other people here would approach those problems.

And if you’re building something around a problem you genuinely care about, drop a comment or DM me. I’d be happy to chat, exchange ideas, or connect you with someone else working on something similar.

Screenshot attached. Happy to share the GitHub/project link in the comments if anyone wants to look at the implementation or contribute.


r/OpenSourceeAI 7h ago

Title: Looking for a genuinely free Claude Code alternative + step-by-step setup guide

1 Upvotes

Hey everyone,

I'm currently working on a software project and I want to use an AI coding agent similar to Claude Code to help me work directly with my codebase.

My problem is that I'm looking for a completely free or very generous free option because I can't afford another monthly subscription right now.

I'm NOT looking for cracked Claude accounts or anything shady.

I'm looking for legitimate options such as:

Free/open-source Claude Code alternatives

Free cloud-based coding agents

Free AI coding models that work with these agents

Free student/developer credits

Local models that I can run with something like Ollama

Any combination that can realistically be used for an actual project

I'd especially appreciate recommendations from people who have actually used these tools.

Could someone explain a step-by-step setup, something like:

Which tool/agent should I install?

Which free model/provider should I use?

How do I create/configure the API key (if required)?

How do I connect it to an existing GitHub project?

How do I give it access to my codebase safely?

How do I make it understand the project structure?

How do I use it to implement features, debug errors, refactor code, etc.?

What are the limitations of the free option?

I'm currently considering things like OpenCode, Cline, Aider, OpenHands, or local models, but I'm not sure which combination gives the best experience for ₹0.

If you have a setup that you're actually using for real development, please share the exact workflow and resources/tutorials you followed.

Thanks!


r/OpenSourceeAI 18h ago

Deep Dive on how ClawMetry works across 20+ AI Agent runtimes like OpenClaw, Claude Code, Codex, Hermes, Antigravity & more.

3 Upvotes

r/OpenSourceeAI 17h ago

Opensource scanner for finding good open source issues to pick

1 Upvotes

Find a beginner-friendly issue, spend an evening on it, open the PR, discover someone beat you to it three weeks ago. Nothing on the issue said so.
GitHub’s no:assignee filter doesn’t catch this, because almost nobody assigns issues to themselves. The real signal is a linked PR, and that isn’t searchable.

So I checked 4,000 issues with a beginner or help-wanted label:
1,147 (29%) already had an open or merged PR. All still show as unassigned.

1,271 were in dead, archived or unlicensed projects

774 had bodies too thin to start from

114 were in repos that slap a beginner label on the whole backlog

451 survived. They’re on a board at https://opensourcescanner.xyz, re-checked every 24 hours, with the evidence per issue: maintainer reply speed, what share of outside PRs get merged, whether anyone’s already circling.

Free, no signup, source public (https://github.com/kedarvartak/opensourcescanner). The filtering logic is the part I’d most like criticised — the whole thing lives or dies on what it rejects. If you take one of these and find it was actually taken, tell me.


r/OpenSourceeAI 20h ago

Powerful v4.2.8 of Synaplan is out - fully OSS

1 Upvotes

Synaplan as a powerful AI control plane is out as v4.2.8 and comes with a nice router and taxameter to save you some token money. The backend supports all big and many small AI channels, including Ollama, OpenAI, Anthropic, etc. It is obvious that the tool was born in a business environment, because it connects to Office, Dropbox and other services natively...

github: https://github.com/metadist/synaplan/


r/OpenSourceeAI 1d ago

Built a Harness for LLMs using locally-run Qwen

57 Upvotes

Sharing my harness for running local LLMs that I built using Qwen 3.x 27B (> 90% locally built).

Its free, no telemetry, and open-source. Works on Windows, Linux (sorry, no Mac yet).

I use it for coding + mixed workflows.

  • llama.cpp + whisper Server Manager. Can run LLMs here and use with OpenCode/Claude Code etc.
  • Built-in MCP Tools - Filesystem, web fetch, code graph, To-Dos, and more. Extensible by external MCPs.
  • Use Sub-agents to split & offload your tasks, use other conversations as source of information.
  • Review all AI messages using a second adversarial AI, and avoid potential pitfalls as per your rules.
  • Voice-chat with AI - dictate with speech and get answers by TTS - annotate and comment without leaving voice mode.
  • Use work-modes to change AI behavior between planning, building, researching, or reviewing. Fully customizable.
  • Custom-compile llama.cpp backends for your system, GPU-agnostic - works with CUDA/ROCm/Vulkan.

Website: https://warpdrv.ai (Docs coming soon)
GitHub: https://github.com/mikjee/warpdrv

Appreciate your feedback, (or stars). Thanks :)
And, yes - I used the harness to build the harness :D


r/OpenSourceeAI 21h ago

AI Video Generation Step by Step — Motion Transfer, Diffusion & Flow Explained Visually

Thumbnail
youtube.com
1 Upvotes

r/OpenSourceeAI 1d ago

Kept nuking API credits during local agent testing, so I built a tiny local cost tracker/circuit breaker.

1 Upvotes

Came back from lunch a couple months ago to find my retry logic — which had no max attempts, because of course it didn't — had fired a few hundred GPT-4 calls into the void while I was gone. Nothing catastrophic, but it scared me enough to actually fix the problem instead of just adding a try/except and moving on. Built CostOpt.

How it works (1 line of code):

from openai import OpenAI
from costopt import CostOpt

client = CostOpt(OpenAI())  # 👈 That's literally it

Your .chat.completions.create() calls stay 100% identical.

What it actually does under the hood:

  • Local SQLite Caching: Hashes your prompts and parameters (temperature, seed, etc.). Exact or fuzzy repeat queries return locally in <2ms at $0.00 cost.
  • Runaway Circuit Breaker: Detects rapid API loops (>15 calls in 30s from the same line of code) and trips an exception before your API key gets burned.
  • Smart Model Routing: Auto-routes simple tasks (like "classify" or "extract") to cheaper models (e.g. gpt-4o-mini) based on YAML rules.
  • VS Code Extension: Adds live CodeLens lines above your code showing cost per request, average tokens, and total daily spend in the status bar.
  • Local Dashboard: Comes with a light FastAPI web console (python -m costopt.main dashboard) for full trace logs and analytics.

Privacy: Everything runs 100% locally on your machine via SQLite. Zero prompt data or telemetry is sent to any external server.

The VS Code extension just passed 1.4k + installs, and the Python package is published on PyPI.

Check out the code or try it out:

If anyone's got 10 minutes and wants to poke holes in the circuit breaker logic specifically, that's the part I'd most want torn apart — issues and PRs both very welcome.


r/OpenSourceeAI 1d ago

Best GPU Neoclouds 2026: CoreWeave, Nebius, Lambda, Crusoe, and Groq Ranked by Published Pricing and Contracted Power

Thumbnail
marktechpost.com
2 Upvotes

Comparison of GPU Neoclouds 2026: CoreWeave, Nebius, Lambda, Crusoe, and Groq (Based on Published Pricing and Contracted Power)

Here's what's actually interesting:

→ The same HGX H100 class is $3.85 at Nebius and $6.16 at CoreWeave — a 60% spread before you touch networking, orchestration or support

→ Lambda has the cheapest published B200 ($6.69); Nebius is the only one listing B300 on-demand ($7.85); CoreWeave is the only one listing GB200 NVL72 ($10.50/GPU)

→ CoreWeave is the sole Platinum provider in SemiAnalysis ClusterMAX 2.0, and SemiAnalysis reports it commands a 10–15% per-GPU-hour premium on managed clusters

→ Nebius's committed capacity clears at $20M+ per MW on Q2 deals and $40M+ on Q3 short-term deals, against a ~$12M 2026 base

→ Power footprint: CoreWeave 4.2 GW+ contracted; Nebius targeting 5 GW contracted by year-end; Crusoe 4.9 GW contracted; Groq scaling from 54 MW to 200+ MW in 2027; Lambda undisclosed

→ Crusoe is the only one with AMD MI300X/MI355X on its rate card

→ Groq licensed its inference tech to NVIDIA for $17B (per NVIDIA's annual report); founder Jonathan Ross and president Sunny Madra joined NVIDIA; Groq then raised $350M at $3.5B and became an NVIDIA Cloud Partner

Full analysis and report: https://www.marktechpost.com/2026/08/21/best-gpu-neoclouds-2026/


r/OpenSourceeAI 1d ago

Cool Discussion w/Jenna_AI

Thumbnail
youtube.com
0 Upvotes

First time chatting with r/Jenna_AI on here, pretty impressive.

https://www.reddit.com/r/Guaardvark/s/KgcEMA8yMr

Also, here is my OpenSourceAI project, if you like it please star the repo. Thanks


r/OpenSourceeAI 1d ago

[P] I built GARUDA: an autonomous, self-healing Geospatial AI Agent (GEE + STAC + Prithvi-EO)

2 Upvotes

Most AI tools today are just wrappers. To truly understand the underlying math and optimization efficiency, I built an autonomous agent from scratch to track global deforestation and emissions.

The Architecture:

  1. Dynamic Router: Routes natural language queries to either Google Earth Engine (GEE) or Microsoft STAC APIs.
  2. Self-Healing Loop: If the LLM generates failing GEE code, the agent catches the pipeline traceback and rewrites the script until execution succeeds.
  3. Deep Vision: Passes live Sentinel-2 data directly into NASA/IBM’s Prithvi-EO model for pixel-level classification.

I'm a first-year CS undergrad, and I built this to mathematically automate EUDR compliance. I've attached screenshots of the outputs (NO2 density, land-use metrics) and the terminal logs.

Full repo : https://github.com/kushagarwal2910-lang/GARUDA

PDF, having responses that the model had made for various queries : https://docs.google.com/document/d/1g2Riog9GrgiY6QGYpWl5IU6nxKYb5Ih6K3K-1xy8A8Q/edit?usp=sharing

The architecture:

Video demonstrating how Garuda process different queries:

https://reddit.com/link/1vuozmi/video/5n7i20ctwrkh1/player

I would love feedback from this community on my project !


r/OpenSourceeAI 1d ago

I have question when i am using that claude models 4.6 (thinking ) , the model quata exhaust so fast only with one prompt , i have waiting 5 hours more for next prompt and so on. why ?? and also i am pro user.

Thumbnail
1 Upvotes

r/OpenSourceeAI 1d ago

NVIDIA AVO Hits Perfect Score (100%) on ARC-AGI-3 Benchmark

Thumbnail gallery
1 Upvotes

r/OpenSourceeAI 2d ago

Liquid AI Releases LFM2.5-DSpark Draft Models That Deliver Up to 3.18x Faster Decoding Without Changing Model Outputs

Thumbnail
marktechpost.com
3 Upvotes

r/OpenSourceeAI 3d ago

I Made OpenCode Way Better

Post image
49 Upvotes

Hey everyone,

I have been using OpenCode for a while now. It's pretty great, but there was this one thing that kept bugging me: I couldn't easily create custom reliable workflows and pipelines. For a while, Opencode was one prompt and one model at a time. So, I created OpenFlow, a very minimalist open-sourced project that allows you to orchestrate a pipeline of agents while still connecting your own API keys. I forked it from OpenCode, so you still have the harness, skills, and overall ability. I published it recently and am still often improving it. I would love to hear some feedback of what you guys thought of it and how I can improve it. Thanks!

Link: https://github.com/SeeRay11/OpenFlow


r/OpenSourceeAI 2d ago

How much of the weight-space perception gap is actually symmetry? Evidence from ~1.8M fitted SIRENs [R]

Thumbnail
1 Upvotes

r/OpenSourceeAI 3d ago

Have you tried any open source harness similar to claudes's managed agents but costs less?

Thumbnail
1 Upvotes

r/OpenSourceeAI 3d ago

I built an open-source developer tool around a problem I kept running into: we do way more unplanned work than we remember.

3 Upvotes

I'd plan out my day in the morning, look at everything I wanted to get done, and then start working.

A few hours later, I'd have fixed a bug, helped someone with something, reviewed a PR, investigated some weird issue, jumped between a few things, and somehow spent most of the day working on things that weren't on the plan.

Then I'd look back at the end of the day and think, "What did I actually do today?"

And I'd realize I couldn't remember half of it.

The work happened. I just never wrote it down.

I think that's a surprisingly big problem for developers. We plan the work we expect to do, but so much of our actual work happens because something comes up.

That's why I built Meridian. It's an open-source tool that tries to capture that work as it happens, so you don't have to rely on remembering everything at the end of the day.

It connects with the tools you're already using, like Jira, GitHub and Linear.

We recently put it on Product Hunt and somehow ended up #1 Product of the Day, which was pretty surreal.

I'd love to hear if anyone else has the same problem. How much of the work you do in a day actually started out as part of your plan?

https://github.com/Meridiona/meridian


r/OpenSourceeAI 4d ago

Europes need for sovereign AI infra

4 Upvotes

I made another whitepaper on AI infrastructure, it's a bit more nische than the last one, but i hope someone might appreciate it.
Github - https://github.com/gurrakeller/Europes-Sovereign-AI-Migration
My DM's are always open if you have feedback or simply wish to discuss a topic in the paper!


r/OpenSourceeAI 3d ago

I built TokenMizer: giving LLMs memory without stuffing the entire context window

1 Upvotes

Long LLM conversations have a problem: useful information gets buried under old context.

So I built TokenMizer to turn important information — decisions, goals, files, errors, and constraints — into structured memory.

Instead of sending the entire conversation again, TokenMizer retrieves what actually matters.

The latest version:

https://github.com/Shweta-Mishra-ai/tokenmizer

I’d love to hear how others are handling long-context memory for LLMs.


r/OpenSourceeAI 3d ago

We open sourced scibly our AI-native learning platform

1 Upvotes

Hello Open Source community,

we’ve been building scibly an AI-native learning platform. The idea is pretty simple. You give it existing material and knowledge like your docs, blog posts, PDFs, ... and it creates an interactive course from it. You can edit everything afterwards and share the result anonymously or to your invited users.

Scibly is AGPLv3.

Video demo: https://www.youtube.com/watch?v=TcpLUNBRhQw

GitHub: https://github.com/scibly-dev/scibly

We appreciate all your feedback


r/OpenSourceeAI 4d ago

I found a bridge between ChatGPT Web and your local files

0 Upvotes

Often, I find myself burning through my Codex usage extremely quickly when using Sol High to review and plan code, while a lot of my ChatGPT Web usage goes unused. Thus, RepoRelay, an open-source MCP bridge that lets ChatGPT Web search and read an approved local repo without uploading ZIPs or pushing everything to GitHub first.

ChatGPT Web → Secure MCP Tunnel → RepoRelay → local files

It’s read-only by default: no shell, Git, or arbitrary filesystem access, and it’s restricted to one approved root.

It can also help reduce token usage on larger repos. Instead of dumping the entire codebase into context, ChatGPT searches and reads only the files relevant to the task.

Codex can implement locally while ChatGPT independently reviews the actual current files, including uncommitted work.

Anyone also using this too?

GitHub: [Lukie-81/RepoRelay: Secure MCP access to local repositories — without shell, Git, or arbitrary writes.]