DEV Community: kxrn_gupta

ForgeGuard: Building an Autonomous AI DevSecOps Side Hustle with Open-Weight Models

kxrn_gupta — Fri, 16 Oct 2026 13:35:55 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle.

What I Built

ForgeGuard is an autonomous AI-powered security scanner, STRIDE threat modeler, and self-healing patch engine designed specifically for freelance DevSecOps consultants and engineering teams.

As an independent builder and consultant, offering security audits to startups and indie founders is one of the highest-value technical side hustles. However, manual vulnerability auditing, calculating attack surfaces, and writing threat models typically takes 10+ hours per repository.

ForgeGuard turns this into a high-margin, automated workflow:

Scans entire Python codebases via recursive AST visitors in under 10ms.
Maps discovered entry points against all 6 STRIDE threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).
Synthesizes automated, AST-verified remediation patches powered by open-weight AI with guaranteed zero broken builds and 1-click snapshot rollbacks.

Clients realistically pay $500 to $2,000 per audit before product launches or funding rounds to guarantee they aren't leaking hardcoded secrets, exposing SQL/command injection flaws, or violating OWASP Top 10 standards.

Demo

🎥 Video Walkthrough (YouTube): Watch the Full 3.5-Minute Demo
🖥️ Interactive Cyberpunk Dashboard: Live Tailwind CSS dark-mode UI with real-time CVSS 3.1 gauges, interactive STRIDE blast-radius matrix, and a side-by-side AST-verified code diff studio.

Code

GitHub Repository: https://github.com/karan5028ji/forgeguard
License: MIT
Quickstart: Zero heavy external dependencies required for the core scanner engine!

# Clone the repository
git clone https://github.com/karan5028ji/forgeguard.git
cd forgeguard

# Run a high-speed SAST scan in sub-10ms
python -m forgeguard.cli scan examples/vulnerable_app/app.py

# Generate full executive audit with STRIDE threat model
python -m forgeguard.cli audit examples/vulnerable_app/ --json audit_report.json

# Preview autonomous patches
python -m forgeguard.cli patch examples/vulnerable_app/ --dry-run

# Launch local interactive cyberpunk dashboard
python -m forgeguard.cli serve examples/vulnerable_app/ --port 8899

How I Built It

ForgeGuard uses a tri-agent collaborative architecture powered by open-weight AI:

Agent 1: Deterministic Security Auditor: Runs native Python AST visitors and taint-flow tracking to detect OWASP Top 10 / CWE vulnerabilities (SQL injection, pickle deserialization, shell command injections, path traversal, hardcoded secrets).
Agent 2: Automated STRIDE Threat Modeler: Analyzes structural data flows to evaluate asset blast radius and maps entry points across STRIDE categories.
Agent 3: Autonomous Remediation Engineer: Connects to Meta-Llama-3.1-8B-Instruct (via Featherless.ai with an offline heuristic fallback) to generate unified diffs. Every suggested patch is passed through a strict Python AST syntax gate before writing to disk, ensuring no broken builds.

Why Does Open Innovation Matter?

For an AI-powered security side hustle, relying on closed proprietary cloud APIs is a major barrier:

Total Code Privacy: Enterprise clients and security-conscious founders will never allow their proprietary, unreleased intellectual property to be sent to closed third-party cloud servers with uncertain training policies. Open-weight models (Llama 3.1) can be run locally or in private environments with zero data leakage.
Zero Marginal Cost per Audit: Scanning large codebases with thousands of AST nodes through closed per-token APIs destroys consulting margins. Open-weight models offer unlimited inference with zero per-token cost anxiety.
Offline & Deterministic Reliability: Security tools cannot fail if an internet connection drops or API rate-limits hit. ForgeGuard's architecture guarantees that even in complete offline isolation, local heuristics and open-weight models keep the audit pipeline running.

Prize Categories

Most Creative Side Hustle
Best Use of Open-Source / Open-Weight AI

How to Build & Certify an Autonomous AI Agent in 45 Minutes for Free (Microsoft Copilot Studio)

kxrn_gupta — Sat, 10 Oct 2026 15:36:24 +0000

How to Build & Certify an Autonomous AI Agent in 45 Minutes for Free

Most AI tutorials online start with the same premise: "Get an OpenAI API key, enter your credit card, install LangChain, and write 200 lines of boilerplate code."

While that's great for raw research, enterprise engineering is rapidly moving toward managed agentic platforms. In real-world enterprise environments, companies don't just want a chatbot that hallucinates — they require:

Grounded Data Integration (RAG): Restricting agent knowledge strictly to internal company policies, Dataverse tables, and internal documentation without leaking data to the public internet.
Deterministic Orchestration: Guiding conversations with structured state machines and logic branches when financial, HR, or operational actions are involved.
Multi-Channel Delivery: Deploying the same agent brain across Microsoft Teams, web apps, and internal portals without rewriting backend services.

Today, I went through the official Microsoft Applied Skills: Build an agent in Microsoft Copilot Studio assessment lab — and passed with an official credential signed by Satya Nadella.

Here is a full breakdown of the architecture, the hands-on building blocks, and how you can run this entire lab in a free browser sandbox without paying a dime.

🏛️ The Architecture: What Makes an Agent "Autonomous"?

A standard chatbot simply receives a prompt and streams tokens from an LLM.

An Autonomous AI Agent, by contrast, operates on a multi-layered execution loop:

┌────────────────────────────────────────────────────────┐
│                   USER INTENT / INPUT                  │
└───────────────────────────┬────────────────────────────┘
                            ▼
┌────────────────────────────────────────────────────────┐
│             COPILOT STUDIO REASONING CORE              │
│       (LLM Orchestration + Moderation Filters)         │
├───────────────────────────┬────────────────────────────┤
│                           │                            │
│  [Topic Match?]           │  [General Query?]          │
│  Deterministic Branching  │  Grounded Knowledge (RAG)  │
│  • Sick / Vacation Logic  │  • Internal FAQs (.docx)   │
│  • Global Session States  │  • Dataverse Tables        │
│                           │  • Public Regulatory URLs  │
└─────────────┬─────────────┴─────────────┬──────────────┘
              │                           │
              ▼                           ▼
┌───────────────────────────┐ ┌──────────────────────────┐
│   BACKEND ACTION / TOOL   │ │   GENERATIVE SYNTHESIS   │
│   (Power Automate Flow)   │ │  Strict Grounding Output │
└─────────────┬─────────────┘ └───────────┬──────────────┘
              │                           │
              └─────────────┬─────────────┘
                            ▼
┌────────────────────────────────────────────────────────┐
│          MULTI-CHANNEL OUTPUT (Teams / Web)            │
└────────────────────────────────────────────────────────┘

🛠️ Step-by-Step: Building the Enterprise Support Agent

In our scenario, we designed HRSupport — an enterprise AI agent serving internal company employees for benefits, leave policies, and vacation approvals.

Here are the 4 core pillars of building it:

1. Grounding Knowledge (Strict RAG)

Instead of letting the model hallucinate answers from its base training weights:

Structured Data: Connected Microsoft Dataverse tables (Office Location).
Unstructured Documents: Uploaded internal policy files (BenefitsFAQ.docx).
Web References: Added regulatory resources (Office of Personnel Management).

Crucial Production Setting: Turn OFF public web search. If an employee asks about maternity leave, the agent must pull exclusively from vetted internal files — not random forum threads on Google.

2. Conversational State & Deterministic Topics

When a user asks: "How many vacation days do I have left?", an LLM shouldn't guess.

We created a custom topic named Leave Remaining:

Interactive Question Node: Presents multiple-choice branches (Sick leave vs. Vacation leave).
Global Session Variable: Stores the selected leave type as a global state variable (Global.LeaveType) accessible across the session.
Escalation Management: Disabled standard human hand-off topics (Escalate) to ensure all requests route deterministically through automated self-service.

3. Tool Calling with Generative AI Synthesis

For the vacation branch, the agent needs to fetch real balance numbers from backend HR systems:

We integrated an automated workflow named Get Number of Days of Leave as a Tool (Plugin Action).
Configuration: Configured the tool to only trigger from within specific topic branches, passing the user's custom leave type as an input parameter.
Generative Completion: Rather than showing raw JSON, the agent synthesizes the workflow output into natural, professional prose formatted with bullet points and clear manager approval reminders.

4. Cross-Platform Publishing

Once verified in the interactive test canvas:

Enabled the Microsoft 365 & Teams channel.
Configured organizational distribution via the Teams App Catalog so employees can query the bot directly in their daily chat workflow.

🚀 How to Try This Free Sandbox (No Credit Card)

Microsoft has made this entire interactive virtual machine environment accessible for free on Microsoft Learn. You don't need an Azure enterprise subscription or local GPU hardware.

Head over to the official Microsoft Applied Skills: Build an agent in Microsoft Copilot Studio assessment page.
Sign in with your personal or student Microsoft account.
Click "Take Assessment" — it spins up an isolated, full Windows cloud VM in your browser with pre-configured Copilot Studio access.
Complete the scenario, test your bot, and submit. You'll receive an official verifiable Microsoft credential badge to add to your LinkedIn profile.

💡 Student Builder Tip: Free $100 Cloud Compute

If you're building full-stack AI web apps or backend services for academic and open-source projects:

Make sure you also claim the Microsoft Azure for Students Program. It gives you $100 in free cloud credits every year without requiring a credit card, plus free access to developer tools, Linux VMs, and database instances.

What are you building?

Have you started experimenting with autonomous agents in Copilot Studio, LangGraph, or custom MCP servers? Drop your thoughts or project links in the comments below! 👇

Building Win-Optimizer-Pro: A Modern, Tauri-Based Windows Debloater for Maximum Performance

kxrn_gupta — Fri, 04 Sep 2026 13:13:14 +0000

If you’re a developer, gamer, or power user, you probably know the struggle of setting up a fresh Windows 10 or 11 installation. Out of the box, Windows is packed with bloatware, aggressive background telemetry, and pre-installed apps that eat up valuable RAM and CPU cycles.

While there are many debloat scripts out there, I wanted to build something modern, blazingly fast, and equipped with a clean Graphical User Interface (GUI). That’s why I built Win-Optimizer-Pro.

In this post, I’ll share why I built it, the tech stack I chose, and how you can use it to squeeze maximum performance out of your machine.

The Problem: Why Another Optimizer?
Most Windows optimizers fall into two categories:

Raw PowerShell Scripts: Powerful, but intimidating for everyday users and prone to breaking things if you don't know what you're doing.
Heavy Legacy GUIs: Apps built on older frameworks that are ironically bloated themselves.
I wanted the best of both worlds: the raw system-level power of PowerShell, wrapped in a lightweight, modern, and memory-safe application.

The Tech Stack: Tauri + Rust + React
To keep the application incredibly lightweight while maintaining a beautiful UI, I chose the Tauri framework.

Tauri & Rust: Unlike Electron, which bundles an entire Chromium engine (resulting in huge app sizes and high RAM usage), Tauri uses the OS's native webview. By leveraging Rust for the backend, Win-Optimizer-Pro achieves a tiny footprint and blazing-fast execution speeds.
React: For the frontend, React allowed me to build a snappy, responsive, and intuitive dashboard.
PowerShell & Winget: Under the hood, the app safely executes optimized PowerShell commands and utilizes the winget package manager to clean up the system, remove bloat, and apply privacy tweaks.
Key Features of Win-Optimizer-Pro
Here is what the tool can currently do for your Windows environment:

🚀 Aggressive Debloating: Safely removes pre-installed Windows junk apps that you never use.
🛡️ Privacy & Telemetry Control: Disables aggressive background tracking and telemetry, keeping your data private and freeing up system resources.
⚡ System Performance Tweaks: Applies registry and system tweaks optimized for gaming and heavy development workflows.
📦 Winget Integration: Easily manage, update, and clean packages seamlessly.

Open Source & Community
Win-Optimizer-Pro is completely open-source. Whether you want to use it to speed up your PC, or dive into the code to see how a Tauri/Rust desktop app interacts with Windows APIs, you can check it out on my GitHub.

🔗 View the Repository on GitHub

I’m constantly looking to improve the app. If you have ideas for new optimization tweaks or want to contribute to the React frontend or Rust backend, PRs are always welcome!

I’m Kxrn (Karan Gupta) — bridging code and sound. By day I build zero-cost AI orchestrators and system utilities, and by night I produce independent music under DuskyMoon Productions. You can find me on X (Twitter) or check out my latest music on Spotify.

Building Zero-Cost Multi-Agent AI Orchestrators & Local Assistants: My Journey with SwarmForge and O.D.I.N.

kxrn_gupta — Wed, 26 Aug 2026 23:42:24 +0000

Building Zero-Cost Multi-Agent AI Orchestrators & Local Assistants: My Journey with SwarmForge and O.D.I.N.

By Kxrn

As a software developer and music producer, my daily workflow is a chaotic symphony of IDEs, digital audio workstations (DAWs), and an endless stream of background processes. I’ve always been obsessed with automation, but recently, I wanted to push the boundaries. I didn't just want basic scripts; I wanted assistants—systems capable of reasoning, orchestrating complex tasks, and managing my digital life without burning a hole in my wallet or melting my PC.

This is the story of how I built SwarmForge, a zero-cost multi-agent AI orchestrator, and O.D.I.N. (along with its counterpart, SHIVA), a highly efficient local assistant powered by a blend of Python and C++ Win32 daemons. If you want to dive into the code behind these tools, you can find my work on my GitHub profile.

Bridging the Gap: Python Wrappers & C++ Win32 Daemons

When building local assistants like O.D.I.N. and SHIVA, you quickly realize that Python is fantastic for AI logic, natural language processing, and API integrations. However, when it comes to raw system-level automation, keylogging, window management, or low-latency background processing on Windows, Python can feel like trying to run a marathon in flip-flops.

To solve this, I adopted a hybrid architecture: Python handles the brains, while C++ Win32 background daemons act as the muscle.

I wrote lightweight C++ executables that run silently in the background, interacting directly with the Win32 API. These daemons handle the heavy lifting—like granular process control, audio routing for my music production sessions, and system monitoring. Python then acts as a wrapper, communicating with these daemons via Inter-Process Communication (IPC) mechanisms like named pipes.

Here is a conceptual look at how O.D.I.N.'s Python brain sends commands to a C++ Win32 daemon:

import win32file
import win32pipe

def send_command_to_daemon(command: str):
    # Connect to the C++ Win32 Named Pipe
    pipe_name = r'\\.\pipe\ODIN_Daemon_Pipe'
    try:
        handle = win32file.CreateFile(
            pipe_name,
            win32file.GENERIC_READ | win32file.GENERIC_WRITE,
            0,
            None,
            win32file.OPEN_EXISTING,
            0,
            None
        )
        win32file.WriteFile(handle, command.encode('utf-8'))
        print(f"Command '{command}' dispatched to O.D.I.N. C++ daemon.")
    except Exception as e:
        print(f"Daemon communication failed: {e}")

This hybrid approach ensures that the system footprint remains minuscule, which is critical for reasons I'll explain later.

Forging the Swarm: The Architecture of SwarmForge

While O.D.I.N. acts as my personal system-level assistant, I also needed something to help me write and manage code. Enter SwarmForge, my zero-cost multi-agent AI coding orchestrator.

The goal of SwarmForge was to create a hierarchical team of AI agents—a manager, a researcher, a coder, and a reviewer—that could tackle complex coding tasks autonomously. And it had to cost zero dollars to run, leveraging free-tier APIs and local models.

How SwarmForge Works

The Orchestrator: The main node receives my natural language prompt and breaks it down into sub-tasks.
Dynamic Provisioning: SwarmForge spins up specialized agents based on the task requirements.
Shared Memory Workspace: Instead of passing massive context windows back and forth (which is expensive and slow), agents read and write to a centralized markdown-based memory pool and a virtual file system.

By keeping the context lean and strictly defining agent roles, SwarmForge achieves high-quality code generation without the API costs usually associated with large-scale multi-agent systems.

The Reality Check: Overcoming Hardware Constraints

It’s easy to design elegant architectures on paper. It’s entirely different when you have to run them on a modest rig. My workstation is powered by an Intel Core i7-4790, 16GB of RAM, and a GTX 1050 OC. By today's AI standards, this is a potato.

Running LLMs, Python orchestrators, C++ background daemons, and an instance of a DAW simultaneously on this hardware is an absolute battle for resources. Here is how I survived:

1. Ruthless Memory Management

With only 16GB of RAM, swapping to disk is a death sentence for performance. SwarmForge uses a "lazy-loading" approach for its agents. They are instantiated only when needed and immediately destroyed after their task is logged to the Shared Context Pool.

2. Offloading and Quantization

For local inference, the GTX 1050 OC (with a mere 2GB of VRAM) means standard models are out of the question. I rely heavily on quantized models (GGUF format, Q3 or Q4) loaded primarily into system RAM, using the GPU only to accelerate a few layers. It’s not blindingly fast, but it works.

3. C++ to the Rescue

This is where the C++ Win32 daemons in O.D.I.N. and SHIVA truly paid off. A Python script polling the system every second consumes noticeable CPU cycles. A C++ daemon utilizing Win32 event hooks (SetWindowsHookEx) consumes effectively zero CPU overhead until an event triggers it. This saved precious compute bandwidth for the AI models.

Final Thoughts

Building zero-cost multi-agent orchestrators and highly integrated local assistants isn't just about throwing LLMs at a problem. It's about engineering solutions that respect the constraints of your hardware. By marrying the rapid prototyping of Python with the low-level efficiency of C++ Win32 APIs, I was able to turn my aging i7-4790 into a powerhouse of automated productivity.

Whether I'm producing my next track or engineering a new feature, SwarmForge and O.D.I.N. are always running quietly in the background, ready to assist.

If you’re interested in collaborating, want to see my music, or just want to chat about AI and development, check out my developer portfolio or explore the source code of my projects over on GitHub.