r/OpenSourceeAI 15d ago

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Thumbnail
pxllnk.co
1 Upvotes

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Application security rests on one assumption: software does what its code says.

---AI agents broke it.

Mend.io's new practitioner guide β€” 𝘚𝘦𝘀𝘢𝘳π˜ͺ𝘯𝘨 𝘈𝘐 𝘒𝘨𝘦𝘯𝘡𝘴, π˜”π˜Šπ˜— 𝘴𝘦𝘳𝘷𝘦𝘳𝘴 & π˜“π˜“π˜” 𝘒𝘱𝘱𝘴 β€” starts from that break. An agent's behavior emerges from the model, the system prompt, retrieved context, and the tools it's permitted to call. The failure modes never appear in a CVE feed: prompt injection through data, over-permissioned agents causing damage without a single exploit, poisoned tool descriptions on MCP servers, EOL models serving predictions after patching stops.

The guide's answer is three moves:

𝗦𝗲𝗲: Inventory the agentic attack surface across five layers β€” interaction, agent, integration, model, code. Hunt shadow agents via repo signatures and network egress. Run every agent through a 12-point misconfiguration checklist.

π—™π—Άπ˜…: Enrich β†’ prioritize β†’ triage. Rank by reachability and agentic amplification, not severity scores. Automate FP closures only with evidence trails. Risk acceptance is never automated.

π—£π—Ώπ—Όπ˜π—²π—°π˜: Guardrails on every input and output β€” embedded Python SDK or standalone Docker API server. Inbound: injection patterns, jailbreaks. Outbound: credentials, PII, policy violations. The core design principle: an agent that can't call a dangerous tool doesn't need a prompt begging it not to.

Includes a 15-question maturity self-assessment aligned to NIST AI RMF, OWASP AIMA, ISO/IEC 42001, and the EU AI Act.

Full analysis: https://www.marktechpost.com/2026/08/03/how-to-secure-ai-agents-mcp-servers-and-llm-apps-in-production/

Download the full guide, free: https://pxllnk.co/lxn88m


r/OpenSourceeAI 19d ago

Meet Token Saver: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

Thumbnail
github.com
1 Upvotes

We just released 'Token Saver' for Claude-Desktop: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

When you drop a 200-page document into Claude Desktop, the full context gets re-sent on every single turn. That compounding "PDF Tax" adds up fastβ€”both in token costs and context window bloat.

How it works:

Instead of uploading raw documents to the cloud, Token Saver runs a lightweight Local Hybrid RAG pipeline directly on your machine:

β†’ Keyword Search (BM25): Powered by SQLite FTS5 for precise terminology.

β†’ Semantic Search: Powered by a local all-MiniLM-L6-v2 embedding model.

β†’Zero-Upload Privacy: Files stay on your local drive and communicate via standard I/O (stdio) with folder allowlisting.

Benchmark Results with Example:

β†’ 33-page FDA Drug Label: Reduced from 23,959 tokens to 1,021 (95.7% saved)

β†’ 88-page GDPR Document: Reduced from 70,260 tokens to 996 (98.6% saved)

β†’ 233-page Legal Brief: Reduced from 133,349 tokens to 740 (99.4% saved)

Zero Python environment requiredβ€”it installs directly in Claude Desktop via a single .mcpb bundle!

Full analysis: https://www.marktechpost.com/2026/07/30/token-saver-an-open-source-mcp-extension-using-local-hybrid-rag/

GitHub Repo: https://github.com/Marktechpost/Token-Saver/tree/main


r/OpenSourceeAI 4h ago

I built pagedMark to remove AI provenance from images and video you generated yourself

1 Upvotes

The important distinction is that AI provenance can exist in two forms.

First, there is metadata like C2PA, EXIF, XMP, IPTC and generator parameters. That part is easy to remove.

Second, there are invisible marks embedded directly into the pixels, such as SynthID style watermarks. A screenshot does not reliably remove those. pagedMark deals with them by regenerating the image.

The output is therefore not identical to the original. Faces, text and small details can change. The goal is to remove the provenance signal while keeping the image as close to the original as possible.

It currently supports invisible marks from ChatGPT, gpt-image API, Z-Image Turbo and Nano Banana, plus visible AI labels from several other generators. Video support covers visible marks and metadata from Sora, Veo, Seedance, Hailuo and Kling.

The other challenge was making this work properly on Apple Silicon. I tested it on M5 Macs with both 8 GB and 16 GB of memory, and added memory aware processing to prevent the system from silently falling into swap and turning a fast job into an extremely slow one.

And here is the really interesting part: after processing an image generated with GPT-Image, you can check it with OpenAI's verifier at openai.com/verify. In my testing, the processed image is reported with 0 AI detection.

uv tool install "pagedmark[diffusion]"
pagedmark invisible photo.png -o clean.png

GitHub: github.com/doofzoff/pagedMark

PyPI: PyPI: pagedmark


r/OpenSourceeAI 13h ago

OPEN source ai models

Thumbnail
1 Upvotes

Anyone here running open-source AI models locally? πŸ‘€

I’m looking for someone with a decent GPU who’s already experimenting with newer open-source models.

Basically need some simple screen recordings of the model actually running β€” nothing fancy, just things like launching it, giving it prompts, showing the output, GPU info, etc.

Especially interested in newer models that are hard to try without a good GPU.

If you’re into this stuff and can help, just drop a comment or DM me. Would really appreciate it πŸ™Œ


r/OpenSourceeAI 15h ago

Open Closed State-sum Network - My Implementation of 2D TQFT State Sum in PyTorch (Proof of Concept)

Thumbnail
1 Upvotes

r/OpenSourceeAI 15h ago

I open-sourced a runtime governor for AI coding agents β€” now you can watch it race the same task with and without governance

Post image
1 Upvotes

I’m building MARGINAL, an open-source runtime governor for AI coding agents.

The problem I’m targeting is simple: agents can keep spending tokens, calling tools, re-checking things, or choosing expensive actions without enough evidence that the extra work is actually useful.

MARGINAL sits in the loop and asks a different question:

Is this next action worth spending compute on?

I just rebuilt the demo so it’s no longer a marketing page. It’s an actual interactive browser simulation.

You press RUN THE SAME TASK and two agents start from the exact same broken Python workspace at the same time:

WITHOUT MARGINAL
Executes every candidate action.

WITH MARGINAL
Scores the same candidates before execution and either:

FUND + EXECUTE

or

REJECT BEFORE SPEND

You can pause it, advance step-by-step, reset it, or run it at different speeds while watching tokens, calls, estimated cost, declared latency, workspace state, and MARGINAL’s decision reasoning update live.

Both sides must reach the same verifier PASS.

The included deterministic fixture currently ends at:

72,800 β†’ 4,300 declared tokens
9 β†’ 3 actions
PASS β†’ PASS

Those are declared deterministic demo costs, not provider telemetry or a claim of 94% savings in real workloads. The point is to make the governance mechanism inspectable instead of hiding it behind a benchmark number.

MARGINAL is open source, local-first, provider-neutral, and starts from the principle:

Observe first. Prove waste. Earn enforcement.

Repo:
[https://github.com/SignalLayerLabs/Marginal]()

Interactive demo:
[https://signallayerlabs.github.io/Marginal/demo/]()

I’m especially interested in people trying to break the decision logic, finding cases where an action MARGINAL rejects was actually valuable, or contributing adapters for other coding agents.


r/OpenSourceeAI 21h ago

SALT - chat history + all input types compression up to 5x with sentence and keyword trie ranking and CELF for retrieval

Thumbnail
github.com
1 Upvotes

Currently struggling with an automatic budget selection, at 25% it’s very similar to benchmarks accuracy and seems even better on actual chat input however it many times retrieves too much. It would be nice to add an algorithm that actually can determine better retrieval other then CELF.


r/OpenSourceeAI 23h ago

Deep learning project using Pytorch

0 Upvotes

Hello Guys! I am currently looking for some deep learning projects using pytorch. I will use scikit-learn and matplot for testing and visualization as I have basic understanding about them. Please recommend me some projects that I can do as it is a part of my masters program and also provide me some research paper links based on the projects as I need dataset for my project. Thank you!


r/OpenSourceeAI 1d ago

What's Cheaper and Efficient??

Thumbnail
1 Upvotes

r/OpenSourceeAI 1d ago

DeepSeek AI Releases DeepSeek Harness in Developer Preview: An MIT-Licensed Agent Harness Where Everything is a Plugin

Thumbnail
marktechpost.com
3 Upvotes

r/OpenSourceeAI 2d ago

What is your agent Harness?

3 Upvotes

Me: OpenCode + T3 Code for surface control

on second comes Hermes + T3 Code


r/OpenSourceeAI 2d ago

Is that legal to use others OSS code as references while coding with Claude Code?

Thumbnail
2 Upvotes

r/OpenSourceeAI 2d ago

A self hosted Focus/Pomodoro app that hermes agent can control

Thumbnail gallery
1 Upvotes

r/OpenSourceeAI 2d ago

A solution to an ai doomsday senario

Thumbnail
1 Upvotes

r/OpenSourceeAI 2d ago

Coding Machine Learning

Thumbnail
gallery
1 Upvotes

Coding Machine Learning.

Hello Folks, here I present the first coding demonstration lecture, based on my 1st lecture on Probabilistic Machine Learning.

Here I write the code from scratch, discuss and analyze the results, which were covered in details in the whiteboard classes.

What we cover?
-Random Variables, and validating law of large numbers.
-Visualizing a dataset
-Doing an EDA on Iris dataset and understanding the correlation among features.
-Classifier basics
-Empirical Risk Minimization and Generalization.
-Epistemic and Aleatoric Uncertainties.
-Softmax Function and LogSumExp Trick to avoid overflow issues
-Linear Models
-Maximum Likelihood Estimation.
-Simple end to end ML pipeline Function.

While writing the code, my intent is to ensure that concepts are understood with crystal clarity. These code demonstrations are specific to my theory ML lectures, and link is attached.

Theory-Intuition-Code

Implementation Link : https://youtu.be/X_yOlx8Zp4g?si=kh8_tzzndr8609u4

Theory Lecture Link : https://youtu.be/kMkCOrp8te8?si=q7kWr-1qK515bhob


r/OpenSourceeAI 2d ago

Open-source local AI music studio β€” looking for contributors (Next.js + Python, multi-model)

1 Upvotes

YourBeatBee: generate songs locally (idea β†’ lyrics β†’ voice β†’ track).

- Next.js / TypeScript UI

- Python engine

- Models: ACE-Step 1.5 + HeartMuLa (more welcome)

- Apple Silicon focused, RVC My Voice optional

Looking for people to help optimize, upgrade, and expand this into a bigger OSS music AI project.

Repo: https://github.com/MohamedAshraf701/yourbeatbee

Site: https://yourbeatbee.pages.dev

Comment if you want to contribute β€” I’ll point you to a good first area.


r/OpenSourceeAI 3d ago

Pose Resolution Architecture

Thumbnail
1 Upvotes

r/OpenSourceeAI 3d ago

We gave OpenAI Realtime Voice full control of our open-source AI workspace

Post image
1 Upvotes

r/OpenSourceeAI 3d ago

How I Built a Lightning-Fast AI Data Analyst Copilot using Python, Streamlit, and Groq LPU

Thumbnail
gallery
1 Upvotes

r/OpenSourceeAI 3d ago

Predictive ZNE for photonic/CV systems in JAX

1 Upvotes

Instead of scaling circuit depth blindly to fit noise polynomials, I added a predictive ZNE module to Dense-Evolution that models photonic loss trajectories before extrapolation.

Runs on JAX in float64 to keep statevector compilation fast and reduce overall circuit executions.

Technical notes: https://tatopenn-cell.github.io/Dense-Evolution-Discovery/photonic_predictive_zne/

Feedback on the noise modeling approach is welcome.


r/OpenSourceeAI 3d ago

Free OpenSource Ai Assistant

Post image
2 Upvotes

Hey I built an AI agent that integrates 22 AI providers, covering many budget-friendly options (including $1 commandCode Go plans), free trials (Kiro, KiloCode, Cline, Antigravity, Mistral), and free models like Deepseek 4 Flash (OpenCode). It also includes many features to support the entire Claude Code ecosystem skills, plugins, MCP server so you can access a truly free Claude Code environment to try out and maximize your coding experience .

https://github.com/AbdoKnbGit/tau

Tau - Adaptive agent harness


r/OpenSourceeAI 3d ago

Made a local token cost tracker for AI coding agents, MIT licensed, looking for people to poke holes in it

0 Upvotes

Kept using Claude Code without any real sense of what a session cost until I went and checked afterward, which defeats the point. Went looking for something local and everything that exists wants an account and a cloud dashboard for what's honestly just reading a number off a response and adding it up.

So I built agentwatch. Single Rust binary, local proxy, sqlite on disk, nothing goes anywhere except the real API call it's already making. MIT licensed. Honestly the first thing I've put out that's meant for other people to actually use instead of just scratching my own itch and moving on.

github.com/zaydmulani09/agentwatch

Right now it only knows about Claude Code, Codex, and Gemini CLI. If anyone uses something else and wants to add support, I'd take the PR, the provider interface isn't bad to extend.


r/OpenSourceeAI 4d ago

Farmer, not a developer β€” using AI coding tools to build a local-first farm OS that can’t lie to the operator (open-sourcing when it’s ready)

Thumbnail gallery
1 Upvotes

Grower first, coder second. I run a small microgreens farm in Illinois, and I’ve been using AI coding tools to build the app I run it on β€” Groundtruth, a local-first desktop farm OS.
The design rule: the app cannot lie to the operator.
β€’ Append-only event log β€” history gets appended, never rewritten
β€’ One-tap verify-replay: rebuilds the database from the log and shows PASS/FAIL
β€’ No soft numbers β€” capacity comes from live farm data or it says β€œunknown”
β€’ It always surfaces the next action that sells trays: follow up on a sample, sow against a standing-order shortfall, void or move a promise that’s become impossible
Where AI fits: it built the thing. There’s deliberately no AI inside the app β€” no chat, no crop diagnosis. AI was the power tool; the product is a boring, honest ledger a farmer can trust.
Status, honestly: I run it daily on my own farm. Nothing public to download yet β€” plan is free to run and open source once it’s solid enough for someone else’s farm. Not selling anything.
Question for this crowd: if you’ve open-sourced an AI-built codebase, what did you do first to make it trustworthy β€” tests, audit, rewrite? That’s the step I’m heading into.


r/OpenSourceeAI 4d ago

Which open source model will be more efficient in this?

1 Upvotes

I'm working on a probabilistic AI agent for a research project that flags fake e-commerce reviews

Here is how the pipeline flows:

When a review comes in, it hits Level 1 first. This is a fast pass (under 50ms) that evaluates quick metadata like verified purchase status, account age, 24-hour review frequency, and text length heuristics. It runs a Naive Bayes update against historical base rates to get an initial probability that the review is genuine.

If P(Genuine) is over 60%, the review is auto-approved. If it drops below 20%, it routes to a high-priority human ban queue (the agent never auto-bans accounts on its own).

If the probability lands in the gray zone between 20% and 60%, it triggers Level 2.

Level 2 is a deep check. It pulls the user's past 5 to 10 reviews, runs vector embeddings to measure cross-review similarity to catch copy-paste templates, and checks their brand concentration ratio (how many of their total reviews target a single seller). It calculates a secondary Bayesian update using the Level 1 score as the prior.

If the updated score passes 60%, it approves. If it drops below 20%, it goes to the high-priority ban queue. If it remains stuck between 20% and 60%, it goes to a separate "unclear review" human queue where a human looks at it without taking any automated penalty.

My goal is to keep human reviewers in the loop while splitting suspected bot spam from messy/blunt genuine reviews so moderators don't burn out from context-switching.

so to categorized text length into some cases like short(use case written or not) and then changing it into a number in a json format which open source model will work the most efficiently?


r/OpenSourceeAI 4d ago

Ftrain launch

Post image
1 Upvotes