I investigate AI agents, MCP integrations, and the systems behind their tools: identity, permissions, shared state, and resource lifecycles.
My background is in Web3 security, including bridge architecture, cross-chain authorization, token accounting, and security invariants. My current focus is AI Agent Security, using architecture mapping, source review, AI-assisted tooling, and controlled local testing.
Case study · Architecture · Evidence
Traced the task → model → tool → event bus → browser flow. In a direct-tool local check, the navigation tool returned a domain-policy error while the owned receiver still recorded the selected HTTP request.
Outcome: documented a navigation-guard enforcement mismatch and its source path. Attacker reachability and exploitable security impact remain unconfirmed.
Case study · Architecture · Upstream fix verification
Reviewed authentication, OAuth token lifecycle, shared storage, sessions, and transport failures. Independently reproduced a known MCP SDK SSE bug through FastMCP: the server rejected a revoked credential, but the client continued waiting.
Outcome: verified the proposed upstream fix against its exact base and head, with release 2.3.0 as a control, across nine local cases. The tested PR head surfaced the error promptly and allowed a subsequent call on the same connection after reauthorization of the same client. This is verification of a known reliability fix; no authorization bypass or application-wide DoS was established.
Case study and local patch · Upstream bug report
Investigated Learn with GenAI, an application built on LangGraph. Traced the HTTP stream → workflow → SQLite checkpoint saver flow. Ordinary chat requests completed while their SQLite connections and worker threads remained alive.
Outcome: reported an application resource-lifecycle bug and prepared a local cleanup patch. The same nine regression tests went from 1 pass / 8 failures before the patch to 9 passes afterward, covering completion, errors, cancellation, iterator cleanup, and checkpoint resume. The defect belongs to the application; a LangGraph library vulnerability or exploitable service outage was not established. The patch has not been merged upstream.
A defensive Python lab covering tool permissions, document-level access, HTML text encoding, and action limits. Includes deterministic tests and seeded randomized policy checks with synthetic data.
- Agent-to-tool trust boundaries and application permissions.
- MCP authentication, authorization, and session lifecycle.
- Memory isolation and untrusted content at retrieval and tool boundaries.
- OAuth token storage, concurrency, timeouts, cancellation, and cleanup.
- Invariant-based testing and clear classification of observed failures.
Map the architecture → identify boundaries → define invariants → inspect enforcement → test locally → check controls → report evidence and limits.
I use AI throughout research and testing and disclose that assistance in upstream contributions. Each case records the assessed versions, configuration, observations, and remaining proof gaps. I distinguish library defects, application bugs, configuration risks, and confirmed security impact.
Earlier work examined cross-chain message flows, bridge authorization, and token-accounting invariants:
- Arbitrum Bridge
- Optimism Bridge
- Push Chain Gateway
- Solidity Audit Agent — an evidence-gated review workflow with synthetic examples.
Open to junior AI security roles, internships, and research collaboration with teams building agents, MCP services, and tool-enabled applications.