Application security & AI security, in Python. I build static scanners for the inputs AI agents trust (MCP tool metadata, agent memory files, RAG documents), measure them on real repositories, and publish what they miss.
B.Tech CSE (Cybersecurity), IIIT Kottayam, 2024–2028 · Looking for Summer 2027 security / AI-security internships praisingharris@gmail.com · LinkedIn · PyPI
| Project | What it is | Measured result |
|---|---|---|
| aisec-suite · PyPI 0.6.0 | A CI security gate for AI-agent inputs. One aisec scan runs the scanners below and emits SARIF; it also ships as a GitHub Action. |
Tool-poisoning detector: 53.7% recall on my own held-out attacks, but 14.0% on attacks written by others (MCPTox and MCP-Poison-Bench, pre-registered, run once; naive regex 6.8-10.5%) and 0 of 74 on MCP-Poison-Bench's documentation-style held-out set. 0 false positives on 362 real tools of the attacked servers, 0.05% on 3,974 others. Reachability follows tool calls into Godot and Unity engine plugins. A provenance-based runtime guard stops 56.9% of AgentDojo attacks (99.3% in banking, 95.2% in slack) at 22.7% utility cost. A pre-registered learned layer did not close the documentation gap (0.8% MCPTox recall, 2.89% false alarms) and was kept out of the package. Method and caveats in STUDY.md. |
| mcpaudit · PyPI 0.8.0 | Scans MCP server tool surfaces for tool poisoning, over-broad scope, rug pulls and confused-deputy behaviour. | Scope-rule rewrite (v0.7) raised precision from 40% to 72.7% on a blind-labelled fresh corpus of 45 repos, keeping all 16 true findings. |
| mcp-scan-study | Hand-labelled scan of 135 public MCP-server repos. | Found no tool poisoning in the wild. Naive scope rules were right 37.5% of the time. |
| memsentry · ragsentry | Static scanners for injected instructions in agent memory/context files and in RAG source documents. | On attacks written by others (BIPIA, InjecAgent; pre-registered, run once) both catch the stock phrase "ignore all previous instructions" and only 0-3% of attacks written without it, no better than a naive regex. Results in STUDY 3e. |
| soc-parallax | Behavioural detection platform: per-entity baselines, attributable risk scores, MITRE ATT&CK mapping (FastAPI, Neo4j, Next.js). | On 278 real EVTX attack samples, 29.5% reach medium severity or higher (27.3% held-out). |
| osiris | My daily-use personal AI assistant runtime: 8 providers with failover, 9 tool-scoped agents, embedding memory. | Used every day from the terminal. |
On PyPI: aisec-suite 0.5.0 · pyhroff-mcpaudit 0.8.0 · memsentry 1.2.0 · pyhroff-ragsentry 1.1.0
AI security
- promptstrike: red-teaming CLI that runs published jailbreak algorithms (PAIR, TAP, Crescendo, GCG) against a model, with a CI gate on attack success rate.
- ModelHawk: static scanner for code-execution backdoors in PyTorch / pickle model files, without loading them.
- trainsentry · loopcheck: poisoning patterns in fine-tuning datasets; waste and thrashing in agent loops.
- adversagen · agent-security-ci: attack-payload generator used to test the scanners above, and the regression harness that runs them together.
- proxy-hackathon · proxy-Strands: web-task agent with a prompt-injection defence layer and human approval gates (hackathon build and Strands Agents rebuild).
Detection and application security
- PurpleLens: detection-coverage validation by running synthetic ATT&CK events through real Sigma rules.
- pqc-scanner: finds quantum-vulnerable cryptography in code and suggests NIST PQC replacements.
- darkdecoder · attack-chain-mapper · chrono-leak: threat-intel analysis mapped to ATT&CK/ATLAS; recon with CVE correlation and patch prioritisation; OSINT self-audit.
- redteam-toolkit: learning toolkit for authorised engagements.
Cryptography and quantum
- zerotrust-ai: from-scratch Schnorr zero-knowledge proofs for AI accountability protocols (model side stubbed, stated up front).
- qec-lab · quantum-collapse: surface-code error-correction simulator; infrastructure cascade simulator for a cryptographically relevant quantum computer.
Team hackathon projects
- PhantomGrid: behavioural-biometrics step-up authentication for banking (CBI Hackathon 2026, security and testing lead).
- lucid-housing-ai: neuro-symbolic housing-support assistant where a rules engine, not the LLM, decides eligibility (USAII Global AI Hackathon 2026).
Merged and shipped:
- tobymao/sqlglot #8780 (v30.25.0): copy the
DataTypenode for each cast in_replace_lambdaso no AST node has two parents. - sqlfluff/sqlfluff #8901, #8902 (4.5.0): remove unsupported
FLUSHfrom the Doris and StarRocks grammars. Also #8899: useCommaSegmentin the StarRocks fixed-range partition grammar. - BerriAI/litellm #47091: normalise a string
stopto a list for Cohere.
Open, under review:
- BerriAI/litellm #47105: fail closed when a key or team has access groups but an empty model list (issue #46951). Also #47106, #47107, #47311 (budget authorization) and #47312 (scope MCP access groups to the caller).
- sqlfluff/sqlfluff #8900 (maintainer-approved).
- crewAIInc/crewAI #8240 (MCP pagination), #8242, #8244, #8245.
- PrefectHQ/fastmcp #6063: wall-clock timeout and callback cap for the Monty sandbox.
- graphql-python/graphene #1610: lazy type references for
Connection.Meta.node. - PennyLaneAI/pennylane #10391:
Evolutionpytree leaves andbind_new_parameterswith a parametric base. - quantumlib/Qualtran #1986: CNOT count in
Add.build_call_graphfor unequal register bitsizes. Also #1988:MeasureX.as_cirq_op. - data-privacy-stack/presidio #2418: correct the container port in the source-build install docs.
- Every number above links to the repo or PR it comes from, including the ones that don't flatter me: the null result in the wild, the held-out set I have now evaluated three times, and the 14% my detector scores on attacks written by other people.
- Detectors are review aids, not security boundaries. My tool-poisoning detector misses most attacks it was not designed around, and all of those phrased as ordinary documentation.