Application security & AI security, in Python. I build static scanners for the inputs AI agents trust (MCP tool metadata, agent memory files, RAG documents), measure them on real repositories, and publish what they miss.
B.Tech CSE (Cybersecurity), IIIT Kottayam, 2024–2028 · Looking for Summer 2027 security / AI-security internships praisingharris@gmail.com · LinkedIn · PyPI
| Project | What it is | Measured result |
|---|---|---|
| aisec-suite · PyPI 0.4.0 | A CI security gate for AI-agent inputs. One aisec scan runs the scanners below and emits SARIF; it also ships as a GitHub Action. |
Tool-poisoning detector: 48.1% recall on 54 held-out synthetic attacks (naive regex: 0%), 0.03% false positives (1 of 3,974 real tool descriptions). Method and caveats in STUDY.md. |
| mcpaudit · PyPI 0.8.0 | Scans MCP server tool surfaces for tool poisoning, over-broad scope, rug pulls and confused-deputy behaviour. | Scope-rule rewrite (v0.7) raised precision from 40% to 72.7% on a blind-labelled fresh corpus of 45 repos, keeping all 16 true findings. |
| mcp-scan-study | Hand-labelled scan of 135 public MCP-server repos. | Found no tool poisoning in the wild. Naive scope rules were right 37.5% of the time. |
| memsentry · ragsentry | Static scanners for injected instructions in agent memory/context files and in RAG source documents. | memsentry 1.2.0 cut findings on 170 real context files from 61 to 5. |
| soc-parallax | Behavioural detection platform: per-entity baselines, attributable risk scores, MITRE ATT&CK mapping (FastAPI, Neo4j, Next.js). | On 278 real EVTX attack samples, 29.5% reach medium severity or higher (27.3% held-out). |
| osiris | My daily-use personal AI assistant runtime: 8 providers with failover, 9 tool-scoped agents, embedding memory. | Used every day from the terminal. |
On PyPI: aisec-suite 0.4.0 · pyhroff-mcpaudit 0.8.0 · memsentry 1.2.0 · pyhroff-ragsentry 1.1.0
Merged and shipped:
- tobymao/sqlglot #8780 (v30.25.0): copy the
DataTypenode for each cast in_replace_lambdaso no AST node has two parents. - sqlfluff/sqlfluff #8901, #8902 (4.5.0): remove unsupported
FLUSHfrom the Doris and StarRocks grammars. - BerriAI/litellm #47091: normalise a string
stopto a list for Cohere.
Open, under review:
- BerriAI/litellm #47105: fail closed when a key or team has access groups but an empty model list (issue #46951). Also #47106 and #47107.
- sqlfluff/sqlfluff #8900 (maintainer-approved).
- crewAIInc/crewAI #8240 (MCP pagination), #8242, #8244, #8245.
- PrefectHQ/fastmcp #6063: wall-clock timeout and callback cap for the Monty sandbox.
- graphql-python/graphene #1610: lazy type references for
Connection.Meta.node. - PennyLaneAI/pennylane #10391:
Evolutionpytree leaves andbind_new_parameterswith a parametric base. - quantumlib/Qualtran #1986: CNOT count in
Add.build_call_graphfor unequal register bitsizes.
- Every number above links to the repo or PR it comes from, including the ones that don't flatter me: the null result in the wild, and the held-out set I evaluated twice.
- Detectors are review aids, not security boundaries. My tool-poisoning detector still misses about half of unseen attacks.