INDEPENDENT EXPLORATIONS
AI / MACHINE LEARNING / SECURITY

01 / MINI GPT IN C

JAKE SPILLERS / SELECTED WORK

Inside
intelligence.

Building learning systems.
Understanding their boundaries.

01 / CHANGE YOUR PERSPECTIVE

Complexity.
Up close.

From a single character to a learning system.
Every connection has a purpose.

02 / EXPLORE THE STRUCTURE

Build it.
Question it.

Models, privacy, and the boundaries of agency.
Four projects. A closer look.

MINI GPT / A TRANSFORMER IN C

Enter
the model.

Two transformer blocks. Four attention heads per block.
Follow the signal, then explore the source.

ILLUSTRATIVE FLOW / NOT LIVE INFERENCE

01 / MACHINE LEARNINGBUILT FROM FIRST PRINCIPLES

gpt.cView source

INSIDE THE FORWARD PASS

Every character
has a past.

Select a characterPOSITION 11

VISIBLE CONTEXTIntelligence12 / 32 characters

gpt.c / attentionSource excerpt · omissions between blocks

01/* Store K and V in the cache */02memcpy(key_buf[l][pos], k, sizeof(k));03memcpy(val_buf[l][pos], v, sizeof(v));04int ctx_len = pos + 1; 1205 06/* Scaled dot-product attention logits */07float al[BLOCK_SIZE];08for (int t = 0; t < ctx_len; t++) {09    float dot = 0;10    for (int j = 0; j < HEAD_DIM; j++)11        dot += q[hs + j] * key_buf[l][t][hs + j];12    al[t] = dot * inv_sqrt_d;13}

Context illustration · model not runningC / libm

CTRANSFORMERSFROM SCRATCH

Mini GPT.
Nothing hidden.

A character-level transformer, written in a single C file. Every forward pass, gradient, and update is there to follow.

Select a character to see what comes before it. The highlighted loop reads only the available context—future characters stay out of reach.

Layers: 02
Attention heads: 04
Context: 32

Repository

Continue to privacy

Explore the work ↘SCROLL TO TRAVEL ↓

02 / PRIVACY-PRESERVING MACHINE LEARNING

FROM CONNECTIONS TO PATTERNS

Individual points.
Shared patterns.

Step back from the model.
Look at the examples it learns from.

INTRODUCE UNCERTAINTY

Keep the pattern.
Blur the individual.

Explore why useful learning and individual privacy
have to be considered together.

PYTORCH / OPACUS / DP-SGD

Learning
without exposing.

A Fashion-MNIST study exploring the privacy-utility tradeoff and defenses against membership inference.

Illustrative noise 35%

Clearer clustersMore overlap

Points overlap more, while the broad clusters remain visible.

In the project, DP-SGD clips per-example gradients and adds Gaussian noise during training. This point field is a visual analogy, not the training algorithm.

CONCEPTUAL ILLUSTRATION
The slider does not represent epsilon, model accuracy, or a measured privacy guarantee.

Repository

Continue to agent security

Explore the tradeoff ↘

03 / SECURE AGENT GATEWAY

ONE TOOL CALL, TAKEN APART

The agent asks.
The gateway checks.

A request to rotate a signing key arrives. The gateway checks each part of it before anything runs.

SCROLL TO FOLLOW THE REQUEST

01 / DELEGATED IDENTITY

Verify the token.
Then read its claims.

The bearer token is split and checked: RS256 signature, expected audience, unexpired. Identity and scopes come from the verified token.

02 / FIXED REGISTRY + SCHEMA

Three tools,
one fixed registry.

The tool name is looked up in a server-side registry of three tools. Arguments are validated against that tool’s schema, and unknown fields are rejected.

03 / OPEN POLICY AGENT

Two sources
must agree.

OPA owns scope, risk and approval rules. The gateway cross-checks them against its own registry and fails closed on any mismatch.

04 / SINGLE-USE APPROVAL

Approved
once.

A human approval is bound to this tool, these arguments, this agent and this user. It is checked before policy and consumed immediately before execution.

05 / MOCK EXECUTION + REDACTED AUDIT

A sealed run.
A hashed record.

A signed, short-lived grant starts a fresh worker with no network. It runs an inert mock and is destroyed. The audit stores hashes of the arguments and result.

PYTHON / OPA / TOOL AUTHORIZATION

Permission.
Before action.

Send a mocked request through the same sequence the gateway enforces. The request in the scene changes with your choice and lights each stage as it is checked.

Choose a mocked requestRead a permitted documentdocuments.readPresent an expired identitydocuments.readName a tool outside the registryshell.execCreate a ticket without its scopetickets.createRotate a signing key (high risk)admin.rotate_key

01IdentitySigned JWT, RS256Pending
02RegistryFixed tool lookupPending
03ArgumentsSchema, extra=forbidPending
04Approval checkValidated before policyPending
05PolicyOPA + registry cross-checkPending
06ExecutionInert mock workerPending
07AuditArgument and result hashesPending

Ready to evaluate

Choose a request and run it. Each stage stops the request or hands it on.

SIMULATED EXECUTION
Requests, tokens and approvals here are mocked in the browser. This page calls no policy engine, runs no tool and grants no access. Stage order and outcomes follow the repository’s routes.py and authz.rego.

Repository

Continue to security analysis

Try a mocked request ↘

04 / MCP SECURITY SCANNER

STATIC ANALYSIS FOR MCP SERVERS

A server,
read as a tree.

MCP tools turn model-chosen input into real side effects. The scanner parses the Python source with ast and follows that input to where it lands.

SCROLL TO FOLLOW THE INPUT

01 / TOOL INPUT

The model
picks the value.

@mcp.tool() registers export_report as a tool, so the model chooses what goes into name. The scanner treats every tool parameter as tainted.

02 / PROPAGATION

Follow it
through every string.

Taint moves through assignments, f-strings and concatenation. name flows into target, target flows into cmd.

03 / SINK

A shell
at the end of the line.

The scanner reads line 14 as a syntax tree. subprocess.run gets a tainted argument with shell=True, so a shell will parse model-chosen text.

04 / FINDINGS

Reported
with evidence.

Each finding carries a rule, severity, line, function and SAIF category, as text, JSON or SARIF 2.1.0. With --fail-on high, this file fails CI.

PYTHON AST / MCP / SAIF

Fix it.
Scan again.

The sample server has two findings. Apply a fix and the file in the scene changes, then gets scanned again.

Apply fixesPass an argv listsubprocess.run([…]) without shell=TrueContain the note pathresolve(), then is_relative_to(NOTES)

1 CRITICAL, 1 HIGH--fail-on high → exit 1

MCP001Command injection via tool parameterline 14 · export_report() · tainted parameter reaches subprocess.run(shell=True)
MCP002Path traversal via tool parameterline 20 · read_note() · open() path built from tainted tool parameter

MCP Security Scan: server.py
============================
  Summary: 1 CRITICAL, 1 HIGH

  [CRITICAL] MCP001 line 14 in export_report()
    Command injection via tool parameter
    SAIF: Insecure Integrated Component (IIC)
    tainted parameter reaches subprocess.run(shell=True)

  [HIGH] MCP002 line 20 in read_note()
    Path traversal via tool parameter
    SAIF: Insecure Integrated Component (IIC)
    open() path built from tainted tool parameter

RECORDED OUTPUT
Findings, JSON and SARIF come from mcp-security-scanner 0.1.0 run on these exact four files. This page runs no scanner in the browser.

Repository

Continue to about

Fix and rescan ↘

05 / THE WORK, IN ORDERFOUR REPOSITORIES · ALL PUBLIC

01Mini GPT, built in C.A character-level transformer with manual backprop, in one C file.jspillers10/mini-gpt-c
02Learning without exposing.DP-SGD against membership inference on Fashion-MNIST.jspillers10/privacy-preserving-ml-defense
03A boundary for agency.Signed identity, OPA policy and single-use approvals for agent tool calls. 59 tests, 96% coverage, 26 Rego tests, cross-version CI.jspillers10/secure-agent-gateway
04A server, read as a tree.Static taint analysis for MCP servers, mapped to SAIF. 199 tests, nine CI jobs, and a reproducible benchmark that raised F1 from 0.843 to 0.989.jspillers10/mcp-security-scanner

ABOUT / JAKE SPILLERS

Understand it.
Build it.
Question it.

I’m Jake. I build AI systems and the engineering around them: models written from scratch, agent infrastructure, and tooling that ships with tests and CI.

My projects explore how learning systems work and what happens at their boundaries: a transformer written in C, privacy defenses for training data, controls for agent tool use, and static analysis of MCP servers.

CREDENTIALS

Machine Learning Engineer AssociateAWS · MLA
Solutions Architect AssociateAWS · SAA
Certified Offensive AI ExpertHack The Box · COAE
Certified Defensive Security AnalystHack The Box · CDSA
Security+CompTIA

Insideintelligence.

Complexity.Up close.

Build it.Question it.

Enterthe model.

Every characterhas a past.

Mini GPT.Nothing hidden.

Individual points.Shared patterns.

Keep the pattern.Blur the individual.

Learningwithout exposing.

The agent asks.The gateway checks.

Verify the token.Then read its claims.

Three tools,one fixed registry.

Two sourcesmust agree.

Approvedonce.

A sealed run.A hashed record.

Permission.Before action.

A server,read as a tree.

The modelpicks the value.

Follow itthrough every string.

A shellat the end of the line.

Reportedwith evidence.

Fix it.Scan again.

Understand it.Build it.Question it.

Inside
intelligence.

Complexity.
Up close.

Build it.
Question it.

Enter
the model.

Every character
has a past.

Mini GPT.
Nothing hidden.

Individual points.
Shared patterns.

Keep the pattern.
Blur the individual.

Learning
without exposing.

The agent asks.
The gateway checks.

Verify the token.
Then read its claims.

Three tools,
one fixed registry.

Two sources
must agree.

Approved
once.

A sealed run.
A hashed record.

Permission.
Before action.

A server,
read as a tree.

The model
picks the value.

Follow it
through every string.

A shell
at the end of the line.

Reported
with evidence.

Fix it.
Scan again.

Understand it.
Build it.
Question it.