Things I've built and still run, not things I built once and screenshotted.
A Model Context Protocol server exposing 24 Kali pentest tools over SSH, so an AI agent can drive offensive-security tooling with guardrails instead of a bare shell. CIDR allowlisting scopes what it can touch, destructive actions require an explicit confirmation step, and every call is written to an audit DB. This is the concrete artifact behind "AI x offensive security" — not a demo, a server that runs.
A six-stage collection pipeline (collect, normalize, enrich, score, dedupe, publish) that pulls from CISA KEV and NVD, scores CVEs with EPSS instead of raw CVSS severity, and publishes short per-niche digests instead of one unread firehose. Runs as a production service behind the homelab’s forward-auth.
Read the write-up →A single-operator SOC built on a homelab budget: log collection and normalization, a SIEM, detections written and version-controlled as Sigma rules, hypothesis-driven threat hunting instead of alert-chasing, and SOAR playbooks that automate the 80% of response that doesn’t need a human. Documented end to end in the Blue Team Homelab series.
Read the write-up →30+ self-hosted services across a 2-node Proxmox cluster, run solo: SSO-gated by default via forward-auth, one source of truth for monitoring, and systemd memory-guard discipline that exists because an unguarded service once OOM-crashed the VM. The Start Your AI Homelab series documents how to build the foundations; the two-years-in field note covers what actually broke.
Read the write-up →Real-time market-data automation and Discord bots operated for a live trading community — webhook ingestion, scheduled data pulls, and community-facing bots kept running under real users. Framed here as software-operations evidence, not trading advice.