Eu joguei o endereço deste site no
Is It Agent Ready? e recebi uma nota 21.
Depois de algumas horas lendo RFC, mexendo no Hugo, configurando Nginx e
respirando fundo antes de apertar o botão de DNSSEC no Registro.br, a nota
subiu para 71. O site passou a ser classificado como Agent-Integrated.
A tentação óbvia seria continuar adicionando arquivos até o scanner ficar
verde em tudo. Não fiz isso.
Uma pontuação não é uma arquitetura. Publicar metadata de OAuth sem ter
autenticação ou anunciar um servidor MCP que não existe seria tecnicamente
desonesto. Agentes encontrariam mais arquivos, mas receberiam informação falsa.
I entered this site’s address into
Is It Agent Ready? and got a score of 21.
After a few hours reading RFCs, working on Hugo, configuring Nginx, and taking a
deep breath before clicking the DNSSEC button at Registro.br, the score went up
to 71. The site reached the Agent-Integrated level.
The obvious temptation was to keep adding files until every scanner check
turned green. I did not.
A score is not an architecture. Publishing OAuth metadata without
authentication, or advertising an MCP server that does not exist, would be
technically dishonest. Agents would discover more files, but those files would
contain false information.
How I built a Shorts factory that runs 100% on my own machine
If you mess with YouTube at all, you’ve seen Opus Clip, Klap, SubMagic and the
rest. You drop in a long video, the tool cuts the best moments, slaps on animated
captions, and hands you ready-to-post Shorts. It works. The catch is the usual
one: it’s SaaS, you pay monthly, and your video gets uploaded to someone else’s
server.
Yesterday I made a batch of changes to SovereignRAG that I had been putting off for a while: Markdown support in the ingestion pipeline and mandatory source citations in the reports.
The practical problem was straightforward. A significant portion of OWASP documentation doesn’t come as PDF — it comes as Markdown. Without .md support, I was leaving out of context exactly the docs that matter most in a vulnerability scanner. Now the project recursively discovers both PDFs and Markdown files inside any directory passed via --docs-dir, no need to list files individually.
At the time, I integrated it with the OpenAI API. It worked well, but over time I started to feel the usual friction: cost per request, dependency on external services, and limited control over the runtime.
Today, I migrated this project to run using a local LLM.
Mesmo com pouco tempo livre na semana, sigo comprometido em manter o FraudTalon avançando e publicando updates regulares.
A partir de hoje, é possível fazer o upload de arquivos .eml diretamente pela interface, e o sistema realiza uma análise
completa combinando heurísticas de segurança de e-mails com inteligência artificial.
O pipeline está assim:
Parse automático do .eml, com extração dos headers, remetente, destinatário, assunto e corpo
Avaliação heurística com sinais como:
Mismatch entre From, Reply-To e Return-Path
Falhas de autenticação (DKIM, SPF, DMARC)
Recebimento por servidores desconhecidos
Análise por IA (via OpenAI) levando em conta todo o conteúdo textual
Score consolidado com os sinais suspeitos encontrados
Essa atualização transforma o FraudTalon em uma ferramenta muito mais útil para análise de
e-mails suspeitos, como golpes de Pix, phishing, ou promessas falsas de investimento.
I’m only able to work on FraudTalon a few hours per week, but I’m committed to making steady progress and sharing weekly updates.0
Starting today, you can upload .eml files directly through the interface, and the system will run a complete analysis
using a combination of email security heuristics and artificial intelligence.
The pipeline now works like this:
Automatic .eml parsing with extraction of headers, sender, recipient, subject, and body
Heuristic evaluation with signals such as:
Mismatch between From, Reply-To, and Return-Path
Authentication failures (DKIM, SPF, DMARC)
Relaying through unknown servers
AI analysis (via OpenAI) that takes into account the full textual content
Final score with a breakdown of suspicious indicators
This update makes FraudTalon a much more powerful tool for analyzing suspicious emails like
phishing, Pix scams, or fake investment offers.
Depois de receber tantas mensagens dos meus pais, esposa, irmã e amigos perguntando se certos e-mails ou anúncios que viram nas redes sociais eram legítimos, decidi criar uma ferramenta para ajudar a identificar fraudes, golpes e tentativas de phishing.
Atualmente ele está na versão MVP 0.0.1 — funcionalidades básicas, heurísticas simples (comecei com NLP mas deixei de lado — por enquanto, não é necessário) e um único LLM baseado em nuvem. O objetivo neste estágio é validar a ideia.
After getting so many messages from my parents, wife, sister, and friends asking if emails or ads they saw on social media were legit, I decided to build a tool to help identify fraud, scams, and phishing attempts.
It’s currently in MVP version 0.0.1 — basic functionality, simple heuristics (I started with NLP but dropped it — not needed for now), and a single cloud-based LLM. The goal at this stage is to validate the idea.
Building My Own Sovereign RAG for Secure Code Analysis
Lately, I’ve been taking a closer look at some code analysis tools that claim to detect security vulnerabilities in software projects. The idea itself is solid. I got one of these tools recommended to me and decided to dig deeper to see what’s really behind these solutions.
Pretty quickly I noticed a pattern: these platforms are far from cheap. Some offer limited free plans, but we all know how this game works. When something that good is offered for “free”, the real price usually comes from somewhere else — data collection, vendor lock-in, black-box models processing your code in someone else’s cloud. And since I’ve been deeply studying AI lately, especially Retrieval-Augmented Generation (RAG), the question came naturally: why not build my own pipeline, fully local, sovereign, using open-source tools, running on my own machine, and depending on no one?
Um projeto open-source chamado Deep-Live-Cam está chamando atenção no GitHub. E com razão.
Com apenas uma imagem estática, ele consegue simular o rosto de qualquer pessoa em tempo real, dentro de uma chamada de vídeo. Tudo isso rodando localmente. Sem nuvem. Sem limites.
A consequência é direta: não dá mais pra confiar em uma chamada de vídeo.
E isso levanta a pergunta inevitável: como validamos a identidade num mundo onde rostos podem ser forjados ao vivo?
Hey everyone! I just wanted to share a new pet project I’ve been working on.
I built Job Finder to automate job searches, analyze descriptions using AI, and filter the best opportunities based on personal criteria.
Job Finder is an open-source project designed to automate job searching, analyze job descriptions using AI, and filter opportunities based on predefined criteria. Initially developed as a personal study project, it demonstrates the integration of automation, AI, and data processing, but can also be useful for others looking to streamline job searches.
Last weekend, I was coding when a song from one of my Apple Music playlists started playing: Boat Gig by the band Tribal Tech (highly recommended if you’re not familiar with it).
As the music played and I continued coding and learning to work with AI, a sort of movie ran through my mind—reflecting on where we’ve come from (at least since I hopped on the boat) in the tech world, and where we are today.
