I work on the security of AI agent infrastructure: the tooling, protocols and pipelines that let language models act on the world.

Currently Founding Engineer at a stealth AI startup and Applied AI Researcher at Shankyaa, working on cryptographic agent security, prompt-injection defence, and high-throughput ML pipelines. Deepening the security side through an M.Sc. in Cybersecurity at BTU Cottbus-Senftenberg.

Before that I spent three years building production data infrastructure, including a year at the Global Legal Entity Identifier Foundation in Frankfurt, where the pipelines I built published reference data consumed by regulated financial institutions. That is where I learned to care about what a system guarantees rather than what it usually does.

Most of my open-source work now goes into the Model Context Protocol ecosystem, finding and fixing attack surfaces in the plumbing LLMs use to talk to the world.

• AI / ML Engineering
• AI Agent Security and Red-Teaming
• Platform, Data and DevOps Engineering
• Research collaboration in AI safety and evaluation

Independent security research on the Model Context Protocol ecosystem and on LLM red-teaming frameworks.

pip install mcp-scan
mcp-scan web_search wеb_search    # the second one is Cyrillic е (U+0435)

A malicious MCP server can register a tool whose name renders identically to a legitimate one in every font, bypassing ASCII allow-lists while routing calls to its own handler. mcp-scan catches bidi control characters, NFKC-detectable homoglyphs, surviving confusables, invisible characters and oversized names.

→ github.com/manjunathbhaskar/mcp-scan

A vulnerability scanner and auto-fixer built as one Rust/Python core, exposed as both an MCP server and a CLI. It exists because of a specific, verified bug: a real open-source agent-security project's scope check returns "allowed" when its config file is missing or its target list is empty. TitanSec's scope gate is compiled Rust sitting at a single tool-dispatch choke point, so a missing or malformed scope denies by default instead of allowing.

Static scanners (secrets, dependencies, SAST, crypto, IaC, container images, CI/CD misconfig, supply chain) and a mechanical fix pipeline are live, proven with a real pushed branch and a real opened pull request, not just unit tests. The first two live-testing tools already enforce a domain-verification tier split in practice: a port scan against an unverified domain is denied while a passive subdomain lookup against that same domain is allowed.

Private for now while it's still being built out. Happy to share the architecture or open it up on request.

Most prediction tools tell you what the crowd thinks. BlackSwanX looks for where the crowd is wrong, then stress-tests that thesis with an injector that asks what happens if the assumption collapses.

An agent that advises a factory operator, where every reading is authenticated, every recommendation is cited, and autonomous action is gated behind verified human intervention.

Your face can be photographed and your voice cloned. Brainwaves originate inside the skull and cannot be replayed from a static recording. Even if the auth database is stolen, it contains only a commitment indistinguishable from a random number.

Hybrid architecture: decompose the signal, model the temporal structure, boost the residuals.

Languages and ML

Data and Infrastructure

Security and agents

MCP · Prompt-injection defence · Ed25519 · HMAC · Pedersen commitments · Schnorr ZKP · Zero-trust architecture · garak · PyRIT · Ollama · Graph RAG · LangFuse

Founding Engineer · Stealth AI Startup, Fulda Agentic memory Cryptographic agent control Evaluation frameworks Async Python

Applied AI Researcher · Shankyaa, Germany Media integrity Privacy-preserving biometrics High-throughput pipelines

Data Engineer, Cloud Security & Automation · GLEIF, Frankfurt am Main Python ELT Data quality gates in CI/CD Regulated financial data

Data Engineer, DevSecOps & Cloud · Torry Harris Business Solutions, India Terraform IAM/SSO as code dbt + BigQuery at 10 TB+/month

Researching:
  - AI agent security and the MCP attack surface
  - Adversarial evaluation of agentic systems
  - Alignment drift in agents with persistent memory

Building:
  - mcp-scan and upstream hardening for MCP
  - Local-first multi-agent systems (zero API cost)
  - Evaluation and gating frameworks

Reading:
  - Interpretability and faithful explanation
  - Continual and lifelong learning

Open_To:
  - AI / ML engineering
  - Agent security and red-teaming
  - Research collaboration

Email • LinkedIn • GitHub • Shankyaa • ResearchGate

"Prefer guarantees to good behaviour."