Building in the open
Ideas I am exploring or building in public. Each entry says what problem it solves and how. Updated when something changes, not on a schedule.
MCP servers can change a tool's description or schema after you approved it (tool poisoning, rug-pulls). Nothing pins what an agent is allowed to call.
A lockfile of tool description and schema hashes, a CI check that fails on drift, and a stdio proxy that hides changed tools and refuses calls to them while the agent runs. Version 0.2 works today. Next: signed lockfiles.
AGENTS.md, skills, hooks and mcp.json run with your permissions, yet nobody scans or signs them. Public studies found a third of shared skills flawed and some malicious.
A CLI that finds agent config in a repo and flags hidden Unicode, prompt-injection phrasing, remote code in hooks, unpinned MCP servers and auto-approve settings, with SARIF output for code scanning. It signs every config file into an ed25519 manifest, and verify fails on any change or an untrusted signer. Version 0.2 adds a VS Code gate: it verifies the workspace when it opens, and if the signature fails, or an unsigned repo has a high-severity finding, it switches off AGENTS.md, instructions, skills, hooks and MCP autostart for that workspace until you unlock it. Trusted keys live in your user settings, so a repository cannot trust itself.
Several coding agents in one repo collide on builds, installs, commits and deploys. Worktrees isolate files but nothing coordinates shared resources.
The FIFO queue I already run on my machine, extracted as a cross-platform daemon with a CLI, an MCP server and a library: tickets with leases, freeze marks with a reason, and a hash-chained journal. The protocol is written up as an open draft, ACP-Lock 0.1, so other tools can speak it. Version 0.2 adds pre-tool hooks for Claude Code, Codex, Copilot CLI and VS Code: a build, install, deploy or commit an agent tries to run is rewritten into a queued `agentq run`, and a frozen resource is refused with its reason.
Phone-to-desktop-to-TV pairing gets rewritten in every app I build.
One Rust crate: an 8-character code that works once, SPAKE2 bound to both devices' keys so a man in the middle gets one guess, a 6-digit SAS, a MAC-sealed list of paired devices, and pairing over iroh. A TypeScript package shares the code and SAS logic, tested against the same vectors. Version 0.2 adds Kotlin bindings through UniFFI, tested on a JVM, and per-app domain strings so an app can adopt it without re-pairing. dashy now pairs on the crate: SPAKE2 is its link protocol v2, so the typed code never crosses the network, and older devices still pair over v1. Next: titi.
Every Romanian developer reimplements ANAF UBL and CIUS-RO validation and learns the same edge cases the hard way.
An open-source UBL builder and validator extracted from Brivio, with a hosted validator anyone can try.
Watch Face Format is mandatory on Wear OS since January 2026, and faces are hand-written XML.
A typed Kotlin DSL that generates valid WFF, with previews and lint rules.
Want one of these sooner, or have a better idea? Write to me.