Otto

A security-first AI coding agent harness for the JVM

Otto runs an AI model in a loop with tools to read, edit, search, build, and test code, and keeps its guardrails outside the model’s reach so it can’t route around them.

Features

• Every tool call passes through a single choke point that applies policy, asks for your approval, redacts secrets, and writes an audit record
• Deterministic allow, ask, and deny rules at four levels (managed, user, project, and local), where the most restrictive rule wins and a repository can never approve anything
• A shell sandboxed with macOS Seatbelt, an outbound network allowlist, and encrypted secret storage that never reads keys from the environment
• Works with Anthropic, OpenAI, xAI, and local models through Ollama, LM Studio, or vLLM
• Extensible with MCP servers, hooks, skills, slash commands, subagents, plan mode, Git checkpoints with rewind, LSP diagnostics, and plugins

Benefits

• Guardrails enforced in code, not by asking the model to behave
• Secret values redacted from tool output and kept away from every tool
• Repository content treated as untrusted: a repo can tighten policy, never loosen it
• A per-workspace audit log of every tool call
• Existing Claude Code skills and slash commands load unmodified

Design

• Java 25
• Virtual threads
• CLI
• Desktop GUI
• Swing
• JLine
• Logback
• MCP
• LSP
• Maven
• Anthropic · OpenAI · xAI · Ollama

JVMXRay

Real-time security monitoring for Java applications

JVMXRay is a security monitoring agent that watches how Java applications touch protected resources, with no source code changes or recompilation. It supplies essential Java runtime security events for security data scientists with mature centralized logging and log analytics deployments.

Features

• Monitoring requires no changes to application code. Attaches with the standard -javaagent flag and observes the app through bytecode injection
• Nineteen modular sensors: file I/O, network, SQL, cryptography, authentication, process execution, serialization, reflection, HTTP, and more
• Structured Logback events carrying trace IDs and scope chains, so a full attack chain can be rebuilt in a single query. Compatible with most centralized logging systems and your existing log analytics.
• Records every library and class the JVM loads, including third-party dependencies, to support supply chain integrity analysis and SBOM verification

Benefits

• No code changes: attach to any app with -javaagent
• 19 sensors on the resources attackers care about
• Structured events drop straight into Splunk, ELK, or Datadog
• Cross-sensor correlation from HTTP request to data exfiltration
• A complete record of every library the JVM loads

Design

• Java
• Java agent
• Bytecode injection
• Logback
• Maven

DeepViolet

TLS/SSL connection analysis, as an API and as tools

DeepViolet is a pair of open source Java projects for assessing the security of TLS/SSL connections.

Features

• An API that embeds connection analysis in custom applications, CI/CD pipelines, and security tooling
• A desktop GUI and a command-line scanner in the Tools project
• Cipher suite enumeration, certificate chain validation, revocation checks via OCSP, CRL, and Certificate Transparency, plus CAA and DANE/TLSA
• Post-quantum readiness checks
• A YAML rules engine with 65 rules across 7 categories, and an AI assistant that explains the results

Benefits

• Embed TLS assessment in pipelines and custom tooling
• GUI and CLI scanning, no code required
• Risk scoring with 65 rules across 7 categories
• Post-quantum readiness assessment
• HTML, PDF, and JSON reports with heat map comparison

Design

• Java
• YAML rules engine
• Desktop GUI
• CLI
• API
• OpenAI · Anthropic · Ollama

Charis AI

An LLM agent harness for security practitioners

Charis is a Java-based harness for running tool-using LLM agents, served through a Svelte web UI from a laptop or a remote server.

Features

• Works with Anthropic’s Claude, xAI, and local Ollama models
• Local mirrors of the NIST NVD and Google Project Zero’s “0day In The Wild” catalogue, so CVE, CVSS, and exploitation questions are answered from the data, not model memory
• Filesystem, shell, web, and memory tools
• Narrated audiobooks from content, statistical graphs with libraries like D3, and X-style messaging with timelines
• The Vault, a wiki curated by AI

Benefits

• Vulnerability answers grounded in local NVD and 0-day data
• Runs on a laptop or a remote server, used from any browser
• Security-focused tools alongside filesystem, shell, web, and memory
• A growing, extensible tool set aimed at security work

Design

• Java
• Svelte
• D3.js
• HTTP server
• NVD mirror
• Project Zero ITW

Models

• ThinkingAnthropic · xAI · Ollamalocal
• Text to speechElevenLabs · xAI · VoiceBoxlocal
• Speech to textxAI
• Image & videoxAI

AltSci

An AI research pipeline that investigates alternative science

AltSci is an AI workflow that researches alternative science claims and publishes the results as a static website.

Features

• Each run reviews more than 100 projects, from Tesla’s radiant energy and the aether to cold fusion and antigravity
• A panel of AI agents: a physicist tests claims against known physics, a mathematician checks derivations, a contrarian makes the strongest honest case, and an arbiter reconciles them into a verdict
• Projects ranked by how interesting they are, with each verdict and its evidence status alongside, because interest is not proof
• Results published as a static HTML site

Benefits

• Side-by-side review of 100+ projects and the themes that link them
• Every claim gets an explicit verdict, from Established to Refuted by calculation
• Evidence status shows what was actually read versus only cited
• An investigator agent tracks down outside records and leads
• Each run records what changed and why, so results can be compared over time

Design

• Multi-agent AI workflow
• Adversarial review
• Static site generation
• HTML · CSS · JS

Backup

Encrypted, rolling-generation backups for the desktop

Backup is a Java Swing desktop app that backs up named sets of folders, like Documents, Photos, and Projects, into a single rolling ZIP archive.

Features

• Every run is a full backup saved as a new generation, with older generations pruned to a retention count you choose
• Each backup is written to a temporary file and rolled into place only after it succeeds, so a failed or cancelled run can never damage the last good archive
• Optional compression and encryption
• Each archive carries its own manifest, so the archive and its passphrase are all you need to restore onto an erased machine

Benefits

• Every generation is a complete snapshot, even when you back up only some folders
• AES-256-GCM encryption with hashed filenames and no file-size limit
• Restore from the archive alone, to the original or a different folder
• Validation re-checks every file’s checksum and flags source files changed since the backup
• Speed throttling keeps inexpensive drives with poor heat sinking from overheating and burning out; sometimes slower is better

Design

• Java 21
• Swing
• FlatLaf
• Desktop GUI
• AES-256-GCM
• PBKDF2
• ZIP · Deflate
• Maven
• jpackage

Q Researcher

A research workbench for the Q drops

Q Researcher is a Java/Swing desktop app for studying the Q drops purely as a data science exercise; I don’t have an opinion on their content yet.

Features

• Google-style search with phrases, OR, exclusions, parentheses, and tag:, date:, author: and /regex/ filters, plus a built-in guide
• An AI research assistant, using your own Claude or Grok key, that searches the drops and the web, compares drops, and drafts sourced notes
• Analytics charts of activity and term trends over time, the “Q Clock,” and delta finders for exact day gaps and matching minutes
• Session tabs, per-drop notes, backlinks, side-by-side compare, and “similar drops” by wording or by meaning

Benefits

• Search all 4,966 drops and about 1,700 images, with images found by AI-generated keywords
• Keep research organized in saved session tabs and searchable notes
• Sourced AI notes that treat official statements as claims, not verdicts
• Spot timing patterns with click-to-filter charts, deltas, and mirrors
• Save any drop as a shareable image card, with your note if you like

Design

• Java 21
• Swing
• FlatLaf
• Desktop GUI
• Claude / Grok APIs
• TF-IDF
• Maven
• jpackage

Iron Dome

A JavaFX arcade game, built with Claude Code

Iron Dome is a JavaFX arcade game inspired by the 1981 Apple II+ classic Sabotage, built mainly to see how far Claude Code could take a game from concept to something playable.

Features

• Defend a turret through 50 waves of helicopters, jets, UFOs, bombers, and paratroopers
• Boss fights against the Crimson Zeppelin and the Sky Behemoth
• Sound effects generated mathematically, with no audio files

Benefits

• 50 waves with two multi-stage boss fights
• Procedurally generated audio, zero sound assets
• A real-world test of AI-assisted development, concept to playable
• Retro arcade play in the spirit of the Apple II+ original

Design

• Java
• JavaFX
• Desktop GUI
• Procedural audio
• Claude Code