Privacy meta-search that remembers nothing: no accounts, no ads, no query log, engine traffic only through a VPN, a Turnstile-gated API with a fuzzed auth boundary. Live at amnesia.tax
Stealth headless Chromium on your own CDP endpoint, with a prompt-injection firewall between the agent and the web.
A deterministic, offline firewall for AI agent tool calls: same call, same verdict, no model in the path.
Local-first LLM router: the easy majority on a small local model, only the hard queries escalate to a frontier endpoint.
A PII-redacting proxy for the OpenAI and Anthropic APIs that fails closed: emails, phone numbers, card numbers, SSNs and API keys are replaced with placeholders before a request leaves.
GitHub Action for truecopy: fails the build when a pinned agent skill or MCP server drifts or is poisoned; also poison-scans a manifest or marketplace.
Out-of-band monitoring that scores an agent's whole action sequence against its declared job.
redstamp + truecopy + strongroom behind one governed MCP server: vet the tool, contain the call, never hold the key.
Vet, sign and pin every agent skill and MCP server before it runs, then fail the build when the bytes change.
The lab where ci-wizard's method is proven: self-hosted GitHub Actions runners that publish their start and run times live.
The gate every fix lands through: Redline, an AI code review run as reusable workflows, with the fix lane, the pin bump and shared actions.
Own your agent secrets — your agent holds a scoped, single-use lease, never the raw API key. strongroom injects the real secret only at egress, so a leaked prompt or poisoned tool can't leak a credential. Encrypted vault · tamper-evident audit · zero deps · MCP. Part of Own Your Agent Security (redstamp · truecopy · strongroom) + plumbline.
Where your GitHub Actions time goes, and what to fix first.
To associate your repository with the own-your-stack topic, visit your repo's landing page and select "manage topics."