Portfolio
Production platforms and open-source tools, shipped end to end with AI-native development. Here's what I've built.
Platforms
SaaSVista: AI Risk & Compliance Platform
AI Risk & Compliance Copilot. Trust Pack is the commercial product: builds credible compliance artifacts for GRC teams (NIST AI RMF, ISO 42001, EU AI Act) with AI-enriched findings and 30/60/90-day action plans. Powered by the open-source AIBOM Scanner (published on PyPI, github.com/saasvista/aibom-scanner) that detects 61 AI SDK patterns across 30+ providers.
Highlights
- • Trust Pack (commercial product): Builds compliance artifacts for GRC teams. Maps to 48 controls across 3 frameworks (NIST AI RMF, ISO 42001, EU AI Act) via 36 risk rules, generates branded PDF + JSON with 30/60/90-day action plans
- • AIBOM Scanner (open source, github.com/saasvista/aibom-scanner): zero-dependency Python CLI on PyPI (v1.0.0, Apache-2.0) with GitHub Action and SARIF output. Detects 61 AI SDK patterns, 34 risk rules, 48 compliance controls. OSS lead-gen for Trust Pack
- • Chinese AI Provider Detection: 10 providers including 3 BIS Entity-Listed CRITICAL, a concrete export-compliance differentiator for security buyers
- • Command Center: autonomous GTM ops platform. FastAPI backend with 128 endpoints across 26 migrations driving 13 concurrent daemon jobs (lead scoring, outreach, follow-up, stale-deal detection, content, KPI, social); Astro/React UI across 32 pages
api.SaaSPosture.com - SaaS Security Intelligence API
Production SaaS security intelligence platform; the industry's first AI integration security assessment, scoring whether AI agents (Claude Code, GitHub Copilot, autonomous workflows) should connect to a given SaaS and whether its identity posture is IGA-ready. 1,369+ apps assessed across 28 categories, 200+ AI apps evaluated for agent-connectivity risk, scored on a 9-dimension framework with 30+ data sources updated daily over a 7,860+ app catalog
Highlights
- • Architecture: expert-level FastAPI async stack with multi-source data orchestration, PostgreSQL full-text search, and production security design (CISSP-informed)
- • Coverage: 7,860+ SaaS applications indexed across hierarchical categories; 1,369+ assessed live on saasposture.com (200+ AI apps specifically evaluated for agent-connectivity risk), with daily enrichment expanding coverage over time
- • Multi-Source Enrichment: 33 active data sources including 18 core enrichers (G2 marketplace 99.6% coverage, VirusTotal threat intelligence, SSL Labs, SerpAPI with 52-55 citations/domain), 9 cross-enrichment sources (auto-extracted from SerpAPI), 4 generated evidence sources (70-85% success rate), 2 AI-powered sources (ai_readiness, open_researcher)
- • Security Scoring: 9-dimension assessment framework with 0-100 scoring and A-F letter grading across AI Integration Security, IAM, Compliance & Certification, API Security, Infrastructure Security, Data Protection, Vulnerability Management, Incident Response, and Breach History
AppMapper Data Transformation Tool
Enterprise-grade desktop application streamlining identity data transformation for Sales Engineers. Eliminates manual Excel manipulation for customer POCs.
Highlights
- • Reduced 3-person, 4-6 hour manual data transformation process to ~5 minutes per app migration
- • Dynamic fuzzy matching across 50+ source schemas into standardized identity formats
- • One-command Docker deployment completed in under 2 minutes
- • 78,505 lines of code (AI-assisted) with 95 test files achieving 92% code coverage
AI Memory System: Production MCP Server
Production Model Context Protocol server providing shared AI memory across 20+ projects. FastAPI + PostgreSQL 17 + pgvector with hybrid search combining vector similarity, full-text search, and Reciprocal Rank Fusion (k=60). One of two production MCP servers built and operated (the second proxies PostHog analytics operations via FastMCP).
Highlights
- • 5 MCP tools (remember/recall/forget/update/list_tags) + 3 resources, shared brain across 20+ projects on local infrastructure
- • Serves live AI agent sessions daily; Docker containers with multi-week uptimes
- • Hybrid search: pgvector embeddings (OpenAI text-embedding-3-small, 1024 dims) + PostgreSQL full-text search + Reciprocal Rank Fusion for optimal recall
- • Multi-format conversation importers: ChatGPT (tree-structured mapping), Claude, Gemini, Obsidian (frontmatter/wikilinks)
Homelab AI Agent Fleet: Self-Hosted Multi-VM Agent Orchestration
Designed, built, and operated a self-hosted AI agent fleet on Proxmox: OpenClaw agent runtime control plane with a Telegram command bridge, dedicated worker agent VMs, and a GPU LLM server running local models behind an OpenAI-compatible endpoint.
Highlights
- • Alabama: autonomous agent on a dedicated VM with local-models-first routing, cloud-model escalation when stuck, self-evaluation feedback loops, and episodic memory
- • Local GPU LLM inference: Ollama on AMD RX 6800 XT (ROCm) serving qwen3:14b, qwen2.5-coder:32b, and qwen2.5:72b behind an OpenAI-compatible API
- • Strategist/worker topology: Telegram bridge to a strategist agent coordinating dedicated worker VMs
- • Production operations: OpenBao Vault secrets, Prometheus + Grafana + Uptime Kuma observability, step-ca private PKI, topology-driven mission-control UI
BizMakr (SaferStrategy): Multi-Customer Website Generator
Multi-customer website generation platform with standalone isolation architecture. One-command 30-minute onboarding from site scrape to live Vercel deployment. AI blog engine with human approval workflow.
Highlights
- • 3 paying customer sites (insurance, powder coating, real estate) with additional sites in pipeline
- • Client Impact: Collin County Insurance: 156% increase in quote requests, 68% bounce rate decrease, 3.2x longer sessions, 95+ PageSpeed. Clients reporting 4+ new calls/week.
- • Standalone customer isolation architecture (post-mortem-driven): each customer gets independent GitHub repo + Vercel project
- • One-command onboarding: bootstrap-customer.sh → scrape → questionnaire → config.json → GitHub → DNS → Vercel → live in 30 minutes
BeastStreak: Native iOS App (App Store Live)
Habit tracking iOS app built from concept to App Store approval in 60.9 hours. Swift 6 / SwiftUI / SwiftData with MVVM architecture, 286 tests, and marketing site with Remotion preview video.
Highlights
- • Concept to App Store approval in 60.9 hours, a case study in AI-assisted rapid native development
- • App Store ID: 6759068022, v1.1.0 LIVE, Swift 6 / SwiftUI / SwiftData / iOS 17+, MVVM architecture
- • 286 tests across 27 suites, 9 SwiftData @Model classes, 6 singleton service engines
- • Home screen widgets (App Intents), optional CloudKit sync, haptic feedback, ADHD-first UX
CarrollDot.com: AI-Powered Portfolio & Resume Generator
Professional portfolio site with AI chatbot that lets recruiters paste a job description, receive a fit analysis with scored matches, and generate a tailored 2-page resume, all powered by the master resume.json as single source of truth.
Highlights
- • AI chat with 3 dedicated modes: general conversation, JD fit analysis (structured scoring with strong/growth tags), and tailored resume generation
- • Two-step resume pipeline: auto-detects job descriptions (14+ keyword patterns), generates fit score, then produces customized 2-page PDF resume
- • Vercel AI SDK + Claude API with streaming responses, mode-specific system prompts, and configurable temperature/token limits
- • Dark glassmorphism design system with project-specific color accents, animated entrances, and mobile-first responsive layout
Purtle Realty Group: Revenue-Generating Real Estate Platform
Live production platform for Dallas-Fort Worth real estate. Custom sales-performance system (quota tracking, pipeline forecasting, commission calculation, daily coaching engine), GenAI integrations via Claude and OpenAI, CRM, AI blog engine, Remotion video commercials, lead magnet system, and social media automation with Fair Housing compliance. Single-realtor scale, architected to extend to additional agents and territories.
Highlights
- • Designed and shipped a production sales-performance system: GCI quota tracking against annual target, weighted pipeline forecasting by deal-stage probability, and commission calculation with a seller net-sheet calculator
- • Built a daily coaching engine that ranks the agent's next actions: at-risk deals, follow-up SLA breaches, and nurture cadences with recommended outreach timing
- • Integrated GenAI (Anthropic Claude and OpenAI) for stage-aware outreach drafting in the agent's voice, call debriefs from voice dictation, and automated CMA/valuation narratives; sales-performance calculations kept deterministic
- • Architected per-realtor partitioning and a territory model to extend the platform beyond a single agent; multi-agent routing and territory assignment remain in design
Pressroom: Multi-Agent Content Automation Pipeline
12-stage nightly content automation pipeline: scout/research → intake/selection → editor → polish → quality gates → publishing. Product-agnostic writing engine with multi-platform content packs.
Highlights
- • 12-stage nightly automation: scout/research → intake/selection → editor → polish → quality gates → publishing
- • Fed by an autonomous research engine: hypothesize-execute-score loop with LLM-as-judge evaluation (relevance, novelty, actionability, SEO), semantic + Jaccard dedup, pgvector memory store, scheduled daily runs, 1,100+ scored findings
- • Product-agnostic writing engine (currently feeding interpersonal.dev, extensible to any product)
- • Multi-platform content packs: blog post + social drafts per run; 11 pipeline-generated posts published to the live site
interpersonal.dev: Communication Skills Platform
Content-driven platform targeting systems-minded professionals. Astro 5 + React + PostHog analytics with automated content pipeline from Pressroom nightly runs, 14-day email validation course, and full product launch cycle.
Highlights
- • Astro 5 + React + PostHog analytics, Vercel deployment
- • 14-day email validation course (ConvertKit), 11 pipeline-generated blog posts published
- • Automated content pipeline (receiving end of Pressroom nightly runs)
- • Targeting systems-minded professionals: engineers, PMs, tech leads
Open Source
Tools I built and published. Code on GitHub, free to use.
AgenticScrum Framework
Open-source framework for structured AI agent collaboration. Brings Agile principles to AI code generation with role-based agent orchestration.
Highlights
- • Open-source framework (beta v1.0.0-beta.10) for structured AI agent collaboration. Built before Claude Code had sub-agents or shipped 'skills' natively (June 2025); used to build a couple of internal apps before being superseded by platform-native sub-agent and skill support
- • Conversational onboarding workflow for project setup with structured review gates
- • Implemented Human-in-the-Loop (HITL) workflows for AI hallucination prevention
- • 51,094 lines of framework code (AI-assisted, built in 8 days) with comprehensive documentation
AIBOM Scanner: AI Bill-of-Materials & Compliance
Open-source, zero-dependency Python CLI that scans codebases for AI SDK usage and generates an AI Bill of Materials, mapping compliance risk to NIST AI RMF, ISO 42001, and the EU AI Act.
Highlights
- • Published on PyPI (pip install aibom-scanner, v1.0.0, Apache-2.0, Python 3.10+) with a published GitHub Action and 43 passing tests
- • 61 detection patterns across 30+ AI providers; flags 10 Chinese AI providers including 3 BIS Entity-Listed as CRITICAL
- • 34 risk rules mapped to 48 compliance controls across 3 frameworks (NIST AI RMF 23, ISO 42001 15, EU AI Act 10)
- • Agentic-AI detection (CrewAI, AutoGen, LangGraph, Semantic Kernel, MCP) plus secrets and dev-tool detection; SARIF output for GitHub code scanning and CI severity gating
ASP Security Auditor: Google Workspace MFA-Bypass Detection
Open-source Python CLI that audits every user in a Google Workspace domain for app-specific passwords (ASPs), the MFA-bypass credential weaponized by the UNC6293/APT29 (Cozy Bear) Gmail campaign. Surfaces a blind spot the Google Admin Console and standard audit logs do not expose.
Highlights
- • Enumerates ASPs domain-wide via the Google Admin SDK Directory API (asps endpoint), parallelized across all users; reports creation and last-used timestamps and flags admin accounts as highest risk
- • Detection and remediation in one tool: per-ASP and bulk revocation, read-only by default (admin.directory.user.readonly + user.security scopes)
- • HTML, CSV, and JSON output for readouts, spreadsheets, and SIEM ingestion; designed to run on a schedule with new-ASP alerting
- • Built in response to the 2025 UNC6293/APT29 state-sponsored campaign; published Apache-2.0 (github.com/saasvista/asp-auditor)
Want to see the code?
View GitHub Profile