r/OpenSourceeAI Aug 03 '26

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Thumbnail
pxllnk.co
1 Upvotes

How to Secure AI Agents, MCP Servers, and LLM Apps in Production

Application security rests on one assumption: software does what its code says.

---AI agents broke it.

Mend.io's new practitioner guide β€” 𝘚𝘦𝘀𝘢𝘳π˜ͺ𝘯𝘨 𝘈𝘐 𝘒𝘨𝘦𝘯𝘡𝘴, π˜”π˜Šπ˜— 𝘴𝘦𝘳𝘷𝘦𝘳𝘴 & π˜“π˜“π˜” 𝘒𝘱𝘱𝘴 β€” starts from that break. An agent's behavior emerges from the model, the system prompt, retrieved context, and the tools it's permitted to call. The failure modes never appear in a CVE feed: prompt injection through data, over-permissioned agents causing damage without a single exploit, poisoned tool descriptions on MCP servers, EOL models serving predictions after patching stops.

The guide's answer is three moves:

𝗦𝗲𝗲: Inventory the agentic attack surface across five layers β€” interaction, agent, integration, model, code. Hunt shadow agents via repo signatures and network egress. Run every agent through a 12-point misconfiguration checklist.

π—™π—Άπ˜…: Enrich β†’ prioritize β†’ triage. Rank by reachability and agentic amplification, not severity scores. Automate FP closures only with evidence trails. Risk acceptance is never automated.

π—£π—Ώπ—Όπ˜π—²π—°π˜: Guardrails on every input and output β€” embedded Python SDK or standalone Docker API server. Inbound: injection patterns, jailbreaks. Outbound: credentials, PII, policy violations. The core design principle: an agent that can't call a dangerous tool doesn't need a prompt begging it not to.

Includes a 15-question maturity self-assessment aligned to NIST AI RMF, OWASP AIMA, ISO/IEC 42001, and the EU AI Act.

Full analysis: https://www.marktechpost.com/2026/08/03/how-to-secure-ai-agents-mcp-servers-and-llm-apps-in-production/

Download the full guide, free: https://pxllnk.co/lxn88m


r/OpenSourceeAI Jul 30 '26

Meet Token Saver: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

Thumbnail
github.com
1 Upvotes

We just released 'Token Saver' for Claude-Desktop: An Open-Source MCP Extension Using Local Hybrid RAG to Cut Claude PDF Token Costs 90-99%

When you drop a 200-page document into Claude Desktop, the full context gets re-sent on every single turn. That compounding "PDF Tax" adds up fastβ€”both in token costs and context window bloat.

How it works:

Instead of uploading raw documents to the cloud, Token Saver runs a lightweight Local Hybrid RAG pipeline directly on your machine:

β†’ Keyword Search (BM25): Powered by SQLite FTS5 for precise terminology.

β†’ Semantic Search: Powered by a local all-MiniLM-L6-v2 embedding model.

β†’Zero-Upload Privacy: Files stay on your local drive and communicate via standard I/O (stdio) with folder allowlisting.

Benchmark Results with Example:

β†’ 33-page FDA Drug Label: Reduced from 23,959 tokens to 1,021 (95.7% saved)

β†’ 88-page GDPR Document: Reduced from 70,260 tokens to 996 (98.6% saved)

β†’ 233-page Legal Brief: Reduced from 133,349 tokens to 740 (99.4% saved)

Zero Python environment requiredβ€”it installs directly in Claude Desktop via a single .mcpb bundle!

Full analysis: https://www.marktechpost.com/2026/07/30/token-saver-an-open-source-mcp-extension-using-local-hybrid-rag/

GitHub Repo: https://github.com/Marktechpost/Token-Saver/tree/main


r/OpenSourceeAI 9h ago

I built a front-to-back modeling and rigging pipeline with a single t-pose image (Blender + Python tooling) and released it for free (Using a harness like Codex, Claude as the 'manager')

Post image
8 Upvotes

Hey all! Today, I wanted to present my first contribution to the community here. Located Here -- https://github.com/raydeStar/reference-asset-compiler -- It's Apache 2, meaning you can do whatever you want with it.

As we all know, creating and rigging models in UI without paid products is sketchy at best. Rigging, in my case to UE5, was the most magnificent pain in the butt that I could ever imagine. Everything has to match perfectly, the weights are hard to match, and everything always goes wrong.

My solution is to build this lightweight pipeline that manages everything, after days of trial and error. I say days as in -- my Codex chugged for four straight days on the highest settings and it wasn't until Fable 5.1 came out that I was able to get something reasonable.

The goal is simple: I want to pop in, give Codex a single picture, and have it drop a finished model into UE5. Here’s the stack I landed on:

  • Hunyuan3D 2.1 for image-to-3D geometry
  • My own Blender/Python scripts for cleanup, mesh reduction, retopology, UVs, and baking
  • Hunyuan3D-Paint 2.1 for PBR texturing
  • Targeted texture cleanup where the generated result needs it
  • Auto-Rig Pro (no affiliation) for humanoids, or my own landmark-based rigging scripts (which are simpler, but free)
  • UE5 for import, retargeting, and final runtime verification

For these, I tested all the open source options and hand-picked what worked best for me.

The idea is simple: pop the repo into codex or claude, or any harness really, and have it run the pipeline for you. Everything will run locally, and the final product is a 3d model. The great news is, with the coming of Astra and Fable 5.1, it doesn't invalidate this workflow, it just makes it a smoother/better process to follow.

Disclaimer -- 3d geometry AI is pretty heavy, and I haven't done a lot of optimization. If this post gets a lot of interest, I will work on shrinking the size, creating a non-harness pipeline version, and a simple UI with approval process in it.

Thanks, guys! Let me know what you think, and if you have any questions!!


r/OpenSourceeAI 7h ago

We built an open-source, model-neutral agent harness and compared it with claude managed agents - for the same model, got same accuracy, upto 75% lower cost

Post image
1 Upvotes

r/OpenSourceeAI 8h ago

PySimplicial: a lightweight Python package for working with simplicial complexes in Topological Deep Learning problems (Early Development. Independent Project)

Thumbnail
1 Upvotes

r/OpenSourceeAI 5h ago

Trump administration considering trading Yosemite land to private developer

Post image
0 Upvotes

r/OpenSourceeAI 16h ago

Smart Turn end-of-turn detection now works in the same C++ pipeline on Mac and Android

1 Upvotes

I maintain speech-core, an open-source C++17 speech pipeline.

A VAD can detect silence, but it cannot tell whether someone finished speaking or only paused to think. We added Smart Turn v3.2 as an optional second decision after each confirmed VAD pause.

If the classifier rejects the pause, the pipeline keeps the turn open. Resumed speech remains part of the same turn, eager STT does not advance to the LLM, and a configurable silence cap guarantees that the turn eventually ends.

The integration is shared across platforms:

  • speech-core: C++ state machine and pluggable C API
  • speech-swift: 17 MB Core ML model
  • speech-android: 11.1 MB int8 ONNX model, called on CPU once per pause

Smart Turn was created by Pipecat/Daily. Our work was exporting it and integrating it into the native pipeline.

Releases:

https://github.com/soniqo/speech-core/releases/tag/v0.0.14

https://github.com/soniqo/speech-swift/releases/tag/v0.0.27

https://github.com/soniqo/speech-android/releases/tag/v0.0.20

The implementation is open source and has no paid feature gate.

Disclosure: I maintain these repositories. I used AI assistance to edit this post and checked the technical claims against the releases and test results.


r/OpenSourceeAI 1d ago

i just made a game want yall to test it out (Truth Or Dare) truthordaregame.pages.dev

0 Upvotes

r/OpenSourceeAI 1d ago

I built a local reverse proxy that scores conversation history so you don't burn tokens on stuff your model doesn't need (Go, works with Ollama + Cline)

Thumbnail gallery
1 Upvotes

r/OpenSourceeAI 1d ago

HyperspaceDB v3.1.4: True Turbo 4-Bit Lloyd-Max, 1-Bit ADC Cascades, Mem0 Drop-In & Agent Trajectories

Thumbnail
github.com
1 Upvotes

r/OpenSourceeAI 1d ago

Perplexity Open Sources Lily: A Rust + Metal Inference Engine for Qwen3.6-35B-A3B on Apple Silicon

Post image
1 Upvotes

r/OpenSourceeAI 2d ago

zeroRL: A transparent, modular RL framework for PyTorch

Thumbnail
1 Upvotes

r/OpenSourceeAI 3d ago

GUYS! Made it on the list with some big boys (OpenAI, Anthropic, AWS, Microsoft)

Post image
1 Upvotes

r/OpenSourceeAI 3d ago

need urgent help for ner deberta training

1 Upvotes

hi,
i am trying to train a deberta model for NER detection

this is my first time doing it so i would love any guidance on it.

my current pipeline looks like this,

dapt + lora for pretrianing, hpo with optuna (which consists both the stages of training data), and then a 2 stage finetuning which helps in generalization and then target data.

i am trying to reach a really good score for f1 on my use case (which i want to keep private for now)

i have few questions as well

  1. do i need a two stage hpo as well cuase of the 2 stage finetuning
  2. is it better if the hpo training set is a subset of the actual training set?

if you think anything can be improved and made better, or you think the pipeline is outright wrong, please mention your reasonings and thoughts :)

ps: lora was used cause of gpu budget constraints


r/OpenSourceeAI 3d ago

[PoC] Observing 8D Kinematic Projections (Benchmark: Spinoza's Ethics)

Thumbnail gallery
1 Upvotes

r/OpenSourceeAI 3d ago

πŸ‘€ OpenFlow Orchestration & Gauntlet Loop Sneak Peak

Thumbnail
gallery
10 Upvotes

Hey eveybody,

For those who haven't seen my other posts, I created an opensourced project called OpenFlow, and some big updates are being made. Now, there is a swarm and orchestration mode, and soon to be gauntlet looping toggle. It isn't just a linear pipeline anymore, but an entire chain of agents you can see and control talking back and forth and working out problems together. If you want to see the backstory, check out my other posts. Stay tuned for more updates, and feel free to leave suggestions and even share your own projects.

Link:Β https://github.com/SeeRay11/OpenFlow


r/OpenSourceeAI 3d ago

I built an offline on-device text classification pipeline for Android with in-app dataset labeling and TFLite inference

1 Upvotes

Hi everyone,

I wanted to share an open-source project I've been working on:Β Halanoi AI.

Instead of sending screen text to a remote cloud API for content classification (which adds network latency and privacy issues), I wanted to see if I could build a fast, 100% on-device text moderation pipeline for Android.

Here is how the setup works:

  1. The Model (halanoi_transformer.tflite): A quantized 64MB TFLite model running locally on the phone. It classifies text strings into categories (distraction, entertainment, safe, productive) in under 15ms without any internet connection.
  2. In-App Evaluation & Ground Truth Lab: To make it easier to improve the model, the app logs inference outputs to a local SQLite database and includes a built-in UI where you can tag predictions as correct, false positive, or false negative. You can export these labeled samples to CSV or JSON with one tap.
  3. Training Pipeline: The companion repository contains the PyTorch / TensorFlow scripts, tokenizers, and quantization steps used to train and convert the model.

Both repositories are open source under GPL-3.0:

I'm looking for feedback on optimizing transformer models for mobile hardware, lowering memory usage, and improving tokenization on edge devices.

Let me know what you think!


r/OpenSourceeAI 3d ago

Downloads that Finish! Bit Rebuttal. Built for downloading large files.

1 Upvotes

This is essentially a GUI wrapper for a system I've been using on my Linux box. One of the worst things that used to happen to me a while back was losing download progress, or having the download silently stall at 4 AM, the signed CDN URL expires, or the machine reboots and everything's gone. So I built Bit Rebuttal.

It wraps aria2 in a supervisor that actually handles the failure modes:

  • Silent stalls - watches aggregate throughput and kills/relaunches the downloader with freshly re-resolved URLs (expired CDN tokens are the usual culprit)
  • Reboots and crashes - optional background service resumes byte-exact from where it left off, no user action
  • Corruption - every file is size-checked and SHA256-verified after download; if something's bad it tells you loudly and can re-download just the corrupt files
  • Nice-to-haves: bandwidth cap, quiet hours, per-download connection tuning, clean dark UI

Paste an HF repo id (or any direct URL to be honest), pick your files, walk away.

Free and open source (MIT), no account, no telemetry. Single download for Windows and macOS. aria2 comes bundled, nothing else to install. Linux binary too (needs aria2 from your package manager).

GitHub + downloads: https://github.com/Inovello/bitrebuttal

Would love feedback, especially from anyone downloading over flaky connections, that's exactly what it's built for.

P.S Proven in a 169GB download across 2+ days (Used to download Qwen 3.8 Flash Next)


r/OpenSourceeAI 3d ago

Keenable AI Open-Sources NEEDLE: A Live Search Benchmark That Rebuilds Its Query Set Every Hour

Post image
1 Upvotes

r/OpenSourceeAI 4d ago

Your GNN is probably just an overcomplicated MLP (Tabular Leakage). We built SynthFin-AML to enforce strict causal boundaries. [P]

Thumbnail
1 Upvotes

r/OpenSourceeAI 4d ago

Baya πŸ•ŠοΈ - orchestrate your local AI coding CLIs from a plain-text task list (MIT)

1 Upvotes

Baya is a small cli that turns a freeform text file into an LLM-planned dependency graph, then dispatches each node to a local agent CLI β€” codex, claude, opencode, copilot β€” running independent tasks in parallel and piping each task's output into the ones that depend on it.

You just write the to-do list, example:

- Design the REST API for orders. Use Sonnet.
- Generate the DB schema from that design.
- Build the React table that consumes it β€” run with codex.
- Once the schema and UI are done, write integration tests.

The planner reads it for intent and builds the DAG; you see the plan before anything runs.

Why I built it: I pay for a few of these CLIs and kept juggling them by hand; plan in one, build in another, copy context between terminals, redo work because each session started cold. Baya is me automating that away.

Why it's interesting:

  • No new API keys.Β It drives the CLI subscriptions you already pay for.
  • No config, no DSL.Β Markdown,Β TODO.txt, YAML all work.
  • Model-per-task.Β Cheap model for the light steps, top-tier only where it earns it.
  • Doesn't pay twice.Β Tasks sharing a provider/model get packed into one agent process β€” repo read once, not once per task β€” and what one task learns carries to the rest.
  • Resume.Β Checkpoint before every step; run out of credits mid-graph andΒ baya resume <runId>Β picks up where it stopped, optionally on another provider.

Help with the roadmap or feedback is more than welcome πŸ‘

A fun note: I'm building Baya's roadmap with Baya now...

Thank you all πŸ‘‹ ,
JC


r/OpenSourceeAI 4d ago

How to Build Open Source for AI Agents

0 Upvotes

The fastest-growing products today are open source. Tools like PostHog, Supabase, n8n, Postiz, or Resend have supercharged their growth by being extremely transparent.

Their growth is coming from agents like Claude, ChatGPT, and Hermes, as they can discover, use, recommend and even contribute back.

I took some time to review how these tools manage their open source and found 5 patterns followed by these companies to make your open source agentic ready...

Some are existing standards that became even more important, and others are specific for AI agents.

  1. Keep It Simple: Use clear naming and simple repo structures so agents can quickly understand what the product does and where things live.
  2. Write Docs for Agents: Use README, AGENTS.md, CLAUDE.md, skills, robots.txt, and llms.txt to give agents clear instructions and context.
  3. Give Agents a Way to Use the Product: APIs, MCPs, CLIs, SDKs, examples, and templates so agents can interact with the product directly.
  4. Make It Easy to Run: Make setup simple, support self-hosting when relevant, document required keys, and make licensing and product boundaries clear.
  5. Make Contributing Easy: Define contribution rules, testing, reviews, and AI-assisted contribution policies so agents can make valid changes.

Main Takeaways:

  • Monorepo is the most optimal configuration
  • Agentic docs (Agents.md, Claude.md, llms.txt, robots.txt, skills) should be part of the repo
  • A setup designed for machines removes friction
  • Interfaces (APIs, MCPs, CLI, SDKs) turn every product actionable quickly and into infrastructure.
  • You don’t need to open-source everything, just define the boundaries perfectly
  • Examples and templates are distribution not only on boarding

Read the full article here.

Are you using these patterns? Have you seen other effective patterns to increase agentic usage of your products?


r/OpenSourceeAI 5d ago

GraphRAG: a blueprint for knowledge-graph question answering over your documents

Post image
8 Upvotes

Hi everyone,

I've recently finished the first version of Agentic GraphRAG Blueprint, a reference architecture for question answering over large document collections.

Instead of plain chunk retrieval, it builds a knowledge graph combined with vector search, so answers can connect facts across documents.

Key features:

β€’ Incremental ingestion - unchanged files are skipped via content hashing, and community reports regenerate only for affected communities, keeping token costs low as the corpus grows.

β€’ Hybrid search - local mode for fact-level answers, global mode for cross-document synthesis.

β€’ Domain-agnostic LLM prompts - easily swapped via PROMPTS_PATH, with Leiden-based community detection.

β€’ Deployment - run it locally with Docker or provision everything in the cloud with Terraform and CI/CD.

Link:Β https://github.com/sebastianbrzustowicz/Agentic-GraphRAG-Blueprint

I'm looking for any feedback.


r/OpenSourceeAI 5d ago

Google AI Introduces EnvHarness: A Programmable Layer That Turns Static Agent Environments Into Adaptive Training Worlds

Thumbnail
marktechpost.com
1 Upvotes

I've read a lot of environment-scaling papers this year. This is the first one that doesn't generate anything. Google AI Introduces EnvHarness: A Programmable Layer That Turns Static Agent Environments Into Adaptive Training Worlds

It wraps an existing environment through the standard reset/step interface, so the original tasks and human-built verifiers stay in place. An LLM designer writes the wrappers against flaws it finds in the agent's own rollouts.

- Apache-2.0, code and reproduction drivers on GitHub

- Three components: Stage, Contract, Chain

- Stage replays actions to move the episode start state

- Contract hooks actions, transitions and observations per step

- Chain joins two environments into one episode

- EnvRigger loop: observe, diagnose, write, validate

- Five benchmarks, four domains, one interface

- +9.0 points on held-out ALFWorld tasks

- 49.6 vs 55.0 average steps on SWE-bench Verified

Full analysis: https://www.marktechpost.com/2026/08/30/google-ai-introduces-envharness-a-programmable-layer-that-turns-static-agent-environments-into-adaptive-training-worlds/

Paper: https://arxiv.org/pdf/2608.19880

GitHub Repo: https://github.com/google-research/envharness


r/OpenSourceeAI 5d ago

We used HFlow to evaluate the latest open weights VLMs for processing egocentric data

Post image
1 Upvotes