own-your-stack

Privacy meta-search that remembers nothing: no accounts, no ads, no query log, engine traffic only through a VPN, a Turnstile-gated API with a fuzzed auth boundary. Live at amnesia.tax

Stealth headless Chromium on your own CDP endpoint, with a prompt-injection firewall between the agent and the web.

A deterministic, offline firewall for AI agent tool calls: same call, same verdict, no model in the path.

Local-first LLM router: the easy majority on a small local model, only the hard queries escalate to a frontier endpoint.

A PII-redacting proxy for the OpenAI and Anthropic APIs that fails closed: emails, phone numbers, card numbers, SSNs and API keys are replaced with placeholders before a request leaves.

Where your GitHub Actions time goes, and what to fix first.

The lab where ci-wizard's method is proven: self-hosted GitHub Actions runners that publish their start and run times live.

Out-of-band monitoring that scores an agent's whole action sequence against its declared job.

The gate every fix lands through: Redline, an AI code review run as reusable workflows, with the fix lane, the pin bump and shared actions.

GitHub Action for truecopy: fails the build when a pinned agent skill or MCP server drifts or is poisoned; also poison-scans a manifest or marketplace.

Vet, sign and pin every agent skill and MCP server before it runs, then fail the build when the bytes change.

redstamp + truecopy + strongroom behind one governed MCP server: vet the tool, contain the call, never hold the key.

A starter rubric for Redline on a GitHub-hosted runner: a reviewer prompt to copy and make your own.

Own your agent secrets — your agent holds a scoped, single-use lease, never the raw API key. strongroom injects the real secret only at egress, so a leaked prompt or poisoned tool can't leak a credential. Encrypted vault · tamper-evident audit · zero deps · MCP. Part of Own Your Agent Security (redstamp · truecopy · strongroom) + plumbline.