Projects

Projects

Security, systems, and tooling - mostly in Rust, plus TypeScript and Python

Raven Nest MCP screenshot
security

MCP Pentesting Server • Security

A pentesting toolkit that runs as an MCP server. Wraps 22 security tools including Metasploit Framework behind a 6-layer safety architecture, exposing 46 MCP endpoints to AI assistants with input validation, output sanitisation, and session-aware context budgeting for local AI models.

Raven Nest Client screenshot
security

MCP Client • Security

TypeScript MCP client for the Raven Nest pentesting server. Communicates via JSON-RPC 2.0 over stdio, providing tool discovery, inspection, and execution through both an interactive REPL and one-shot CLI commands.

Linux System Hardener screenshot
security

Security Automation • Security

Automation for securing Linux systems. Scans for misconfigurations, applies hardening recommendations, and rolls changes back safely. Ships as a CLI, a Tauri desktop app, and a web UI. Published on the Arch User Repository (AUR).

Hyprland Keybind Manager screenshot
systems

GTK4 Application • Systems

GTK4 keybinding manager for Hyprland with conflict detection, security validation, and automatic backups. Published on the Arch User Repository (AUR).

Security Toolkit screenshot
security

CLI Security Tools • Security

Common security tasks like password strength analysis, hash generation, and basic network scanning often require multiple separate tools or online services (which may not be trustworthy). Need a unified, offline toolkit for security professionals and developers.

System Monitor screenshot
systems

Real-time Dashboard • Systems

Wanted a real-time view of one machine without installing a metrics database and dashboard stack first. The usual monitoring tools are built for fleets of servers, not a single laptop or dev box.

Rust Chess Engine screenshot
algorithms

Desktop Application • Algorithms

Chess application built as a Rust workspace with clean crate separation - pure domain logic, async Stockfish UCI engine integration, and an egui desktop GUI with graphical board rendering.

Repository Exporter screenshot
automation

Automation Tool • Automation

Backing up GitHub repositories manually is tedious and error-prone. Need an automated solution to export repositories with full metadata (issues, pull requests, releases) for archival, migration, or offline access.

BitNet Toy screenshot
algorithms

Pure-Rust ML • Algorithms

A hand-rolled BitNet b1.58 implementation in pure Rust. Every component written from scratch as a learning exercise: tensor type with AVX-512/AVX2 SIMD matmul, tape-based autograd, ternary quantisation with straight-through estimator, transformer block (RMSNorm, multi-head attention with RoPE, SwiGLU FFN), training loop, KV-cached inference, and a CUDA back-end with cuBLAS int8 GEMM on tensor cores. No third-party ML dependencies.

TV-Tabla screenshot
systems

Desktop TV Guide • Systems

Desktop TV guide for Swedish television. Fetches programme schedules from tv24.se, caches them locally in SQLite, and presents them in a clean timeline grid. Designed for people who just want to see what's on: large text, simple navigation, no account required.

Lanner screenshot
systems

Wayland Screen Recorder • Systems

Spotlight region video recorder for wlroots Wayland compositors. Draw a rectangle and record only that area: everything outside dims like a spotlight while you select, then the dim lifts to a single bright border so the rest of the screen stays usable while the region records. The overlay never appears in the recording.

Web Scraper screenshot
automation

CLI Extraction Tool • Automation

A Rust CLI tool for extracting page titles, links, headers, and meta tags from web pages. Supports an interactive prompt or scripted invocation via flags. Outputs plain text, JSON, or HTML.

Project details

Raven Nest MCP

MCP Pentesting Server • Security

A pentesting toolkit that runs as an MCP server. Wraps 22 security tools including Metasploit Framework behind a 6-layer safety architecture, exposing 46 MCP endpoints to AI assistants with input validation, output sanitisation, and session-aware context budgeting for local AI models.

Key Features

  • Wraps 22 security tools including Metasploit Framework (46 MCP endpoints total)
  • Recon: nmap, masscan, whatweb, subfinder, dnsrecon
  • Vulnerability and web fuzzing: nuclei, nikto, wpscan, dalfox, feroxbuster, ffuf
  • Exploitation and cracking: sqlmap, hydra, john, testssl, enum4linux-ng
  • 6-layer safety: allowlist, input validation, preset args, timeouts, output sanitisation, quality assessment
  • Session-aware context budget tracker with three modes (full, compact, minimal) for local AI models
  • Structured findings persistence with OWASP Top 10 mapping and markdown report generation
  • 394 unit and integration tests across 3 crates (raven-core, raven-report, raven-server)

Raven Nest Client

MCP Client • Security

TypeScript MCP client for the Raven Nest pentesting server. Communicates via JSON-RPC 2.0 over stdio, providing tool discovery, inspection, and execution through both an interactive REPL and one-shot CLI commands.

Key Features

  • JSON-RPC 2.0 transport over stdio to the Rust MCP server (46 tools)
  • Interactive REPL with tab completion and persistent command history
  • One-shot CLI mode for scripting and automation
  • Typed wrappers for finding CRUD, scan management, and report generation
  • 43 unit and integration tests (59 assertions)
  • 67 E2E tests covering 36 of the 43 server tools against Juice Shop and bWAPP
  • Configurable server binary path and config via environment variables

Linux System Hardener

Security Automation • Security

Automation for securing Linux systems. Scans for misconfigurations, applies hardening recommendations, and rolls changes back safely. Ships as a CLI, a Tauri desktop app, and a web UI. Published on the Arch User Repository (AUR).

Problem Statement

Securing Linux systems requires expertise across kernel parameters, SSH, firewalls, PAM, and more. Manual hardening is error-prone and hard to reverse. Existing tools either cover only part of that or offer no safe rollback.

Solution Approach

Built a plugin-based hardening framework with checkpoint-based rollback using Ed25519-signed SQLite snapshots. Eight security plugins cover kernel hardening, SSH, firewalls (nftables/firewalld/ufw), PAM, services, auditd, file permissions, and MAC frameworks (SELinux/AppArmor).

Key Features

  • Security scanning to identify configuration weaknesses
  • Automated hardening with dry-run capabilities
  • Checkpoint-based rollback with Ed25519-signed SQLite snapshots
  • Hash-chain audit logging for tamper-evident change history
  • Multi-distribution support (Ubuntu, Debian, Fedora, RHEL, Arch, openSUSE)
  • CLI, Tauri desktop, and Trunk WASM web interfaces
  • Scheduled scanning via systemd timers
  • 2300+ Rust tests across the workspace (cargo nextest, 0 failed), plus the Playwright web, desktop and Node.js GUI suites
  • Available on AUR for Arch Linux users

Security Plugins

Kernel Hardening SSH Security Firewall (nftables) PAM Auth Service Minimisation Audit Daemon File Permissions SELinux/AppArmor

Hyprland Keybind Manager

GTK4 Application • Systems

GTK4 keybinding manager for Hyprland with conflict detection, security validation, and automatic backups. Published on the Arch User Repository (AUR).

Key Features

  • Conflict detection for keybindings
  • Security validation
  • Automatic backup system
  • GTK4-based user interface
  • Available on AUR for Arch Linux users

Tech Stack

Security Toolkit

CLI Security Tools • Security

Problem Statement

Common security tasks like password strength analysis, hash generation, and basic network scanning often require multiple separate tools or online services (which may not be trustworthy). Need a unified, offline toolkit for security professionals and developers.

Solution Approach

Built a command-line security toolkit in Rust. Everything runs offline in a single binary, and the output explains the "why" behind each result.

  • Password strength validator (entropy-based, not just character rules)
  • Hash generator (Argon2id, bcrypt, PBKDF2, SHA-256/512)
  • Network scanner (port scanning, service detection)
  • Certificate inspector (TLS/SSL certificate analysis)
  • Entropy analyser for randomness testing
  • Educational output explaining security concepts

Security & Ethics

  • Educational purpose - includes explanations and best practices
  • Ethical usage warnings in CLI and documentation
  • Legal disclaimer: only use on systems you own/have permission
  • No password transmission - all processing local
  • Uses well-audited cryptographic libraries (ring, argon2)

System Monitor

Real-time Dashboard • Systems

Problem Statement

Wanted a real-time view of one machine without installing a metrics database and dashboard stack first. The usual monitoring tools are built for fleets of servers, not a single laptop or dev box.

Solution Approach

Developed a Rust-based system monitoring dashboard using Server-Sent Events (SSE) for real-time updates. The backend collects system metrics (CPU, memory, disk, network) and streams them to the frontend via SSE. HTMX handles dynamic updates without writing custom JavaScript.

  • Server-Sent Events for efficient real-time streaming
  • sysinfo crate for cross-platform system metrics
  • HTMX for declarative real-time UI updates
  • Minimal resource overhead (~5MB RAM, <1% CPU)
  • Historical data tracking with time-series visualisation

Key Challenges

  • SSE Connection Management: Handling client disconnections gracefully and preventing memory leaks. Implemented automatic clean-up with weak references.
  • Cross-Platform Metrics: Different APIs for Linux, macOS, Windows. Used the sysinfo crate's abstraction layer for consistency.
  • Update Frequency Balance: Too frequent = resource waste, too slow = stale data. Settled on 1-second intervals with configurable throttling.

Learning Outcomes

SSE fits this better than WebSockets. The data only flows one way, and the browser reconnects on its own. Collecting system metrics in Rust and managing the async tasks around them was the part I had to learn properly. HTMX then handled every live update, so there was no JavaScript framework to add.

Rust Chess Engine

Desktop Application • Algorithms

Chess application built as a Rust workspace with clean crate separation - pure domain logic, async Stockfish UCI engine integration, and an egui desktop GUI with graphical board rendering.

Key Features

  • Workspace architecture - core, engine, and desktop crates
  • Stockfish UCI integration with configurable skill levels and search depth
  • egui desktop GUI with graphical board and piece rendering
  • Pure domain logic with zero external dependencies in core crate

Repository Exporter

Automation Tool • Automation

Problem Statement

Backing up GitHub repositories manually is tedious and error-prone. Need an automated solution to export repositories with full metadata (issues, pull requests, releases) for archival, migration, or offline access.

Solution Approach

Built a CLI tool that interfaces with GitHub's REST API to export repositories as structured archives.

  • GitHub REST API integration with authentication
  • Parallel fetching for performance (async/await)
  • Multiple export formats (JSON, Markdown, ZIP)
  • Incremental exports (only fetch changes since last run)
  • Rate limiting awareness (respects GitHub API limits)

BitNet Toy

Pure-Rust ML • Algorithms

A hand-rolled BitNet b1.58 implementation in pure Rust. Every component written from scratch as a learning exercise: tensor type with AVX-512/AVX2 SIMD matmul, tape-based autograd, ternary quantisation with straight-through estimator, transformer block (RMSNorm, multi-head attention with RoPE, SwiGLU FFN), training loop, KV-cached inference, and a CUDA back-end with cuBLAS int8 GEMM on tensor cores. No third-party ML dependencies.

Problem Statement

Wanted to genuinely understand BitNet b1.58 (ternary weights with INT8 activations, trained via straight-through estimator) by writing every layer from scratch in Rust with no third-party machine learning dependencies.

Solution Approach

Built a single-crate implementation: tensor + autograd + quantisers + transformer + training + inference + binary export, plus an optional CUDA back-end behind a feature flag for tensor-core int8 training.

Key Features

  • Trains end-to-end on TinyShakespeare in 8-15 min on CPU (val_ppl 4.869 at 30k cumulative steps)
  • Three on-disk formats: f32 with masters (lossless resume), ternary i8 (2.92x), base-3 packed (6.02x)
  • Runtime-detected matmul: AVX-512 (16 f32/step), AVX2 (8 f32/step), scalar fallback; multi-threaded across output rows
  • CUDA back-end via cudarc 0.19: cuBLAS sgemm + 9 hand-rolled NVRTC kernels + per-op trait abstraction
  • Real BitNet ternary training on Ada tensor cores via cublasGemmEx int8 GEMM (cuBLAS_GEMM_DEFAULT_TENSOR_OP)
  • KV-cached inference around 50 to 100 times faster per token than the full forward path
  • 140 tests on default build, 172 with --features cuda; zero warnings on cargo build --release

TV-Tabla

Desktop TV Guide • Systems

Desktop TV guide for Swedish television. Fetches programme schedules from tv24.se, caches them locally in SQLite, and presents them in a clean timeline grid. Designed for people who just want to see what's on: large text, simple navigation, no account required.

Key Features

  • Now view: horizontal timeline grid with a live now-marker, channels as rows, programmes as time-proportional blocks
  • Favourites: star programmes by title and see all upcoming airings across channels and days
  • Week planner: browse schedules up to 5 weeks ahead, day by day per channel
  • Offline-first: cached data displays instantly, background refresh keeps it current
  • Multilingual UI: Swedish (default), English, Portuguese
  • Channel management: toggle visibility and reorder to your preference
  • Privacy-respecting: no accounts, no tracking, all data stays local

Lanner

Wayland Screen Recorder • Systems

Spotlight region video recorder for wlroots Wayland compositors. Draw a rectangle and record only that area: everything outside dims like a spotlight while you select, then the dim lifts to a single bright border so the rest of the screen stays usable while the region records. The overlay never appears in the recording.

Key Features

  • Spotlight selection: every monitor dims with a live rubber-band rectangle and a true transparent hole
  • Border-only recording: pointer and keyboard pass through, so the rest of the system stays usable
  • Stop via on-overlay button or a global keybind toggle; Esc cancels before recording starts
  • Records to crash-safe MKV through wf-recorder, finalised cleanly so the file is always playable
  • Never films its own UI: dim, border, and control bar all sit outside the captured geometry
  • Built and tested on Hyprland; designed for any wlroots compositor (Sway, river, Wayfire)

Tech Stack

Web Scraper

CLI Extraction Tool • Automation

A Rust CLI tool for extracting page titles, links, headers, and meta tags from web pages. Supports an interactive prompt or scripted invocation via flags. Outputs plain text, JSON, or HTML.

Key Features

  • Interactive URL prompt when no argument is supplied
  • Extracts title, links (with duplicate detection), h1 to h6 headers, and meta tags (name, OpenGraph, http-equiv)
  • Output formats: plain text, JSON, HTML
  • Configurable delay flag for rate-limit respect
  • Timeout handling and error recovery
  • Installable globally via cargo install --path .

Security-First Portfolio

This Website • Security

Problem Statement

Most portfolio websites focus on aesthetics over security. I wanted mine to practise the security work I write about - and to document every measure openly so it can be reviewed.

Solution Approach

Built the site in Rust and Actix-web, applied the controls listed below from the start, then had it independently pentested.

  • JWT authentication with refresh token rotation
  • Argon2id password hashing (OWASP recommended)
  • 12 OWASP security headers (CSP, HSTS, COOP, etc.)
  • Rate limiting with account lockout protection
  • PostgreSQL through one least-privilege role, every query parameterised
  • Request tracing with unique IDs for audit correlation

Security Considerations

  • Zero-trust architecture - validate everything
  • Defence in depth - multiple security layers
  • Transparent security posture via /security endpoint
  • Automated security scanning before every push (cargo audit, cargo deny)
  • Token transport via Authorization header (CSRF-immune)

Let's Build Something

If any of these projects overlap with what your team is building, I'd like to hear from you. Based in Gothenburg, open to remote - backend, security engineering, or DevSecOps.