Русская версия: README.ru.md
IP intelligence and agent operations — small open tools for network data and for the agent that helps run them
Two lines of work live here. Network intelligence: ASN, BGP, RPKI, geofeed, MMDB, VPN, Tor and crawler signals, published as reproducible datasets and dependency-light tools. Agent operations: everything learned from running one personal AI agent unattended since mid-2026 — scheduling, context and cost budgets, sandboxing, secrets, delivery, evals. Each project states the failure it prevents, and each one is small enough to read in an evening.
- Agent operations: cron hygiene, context and token budgets, delivery health, memory that does not rot
- Agent tooling: runtime plugins, declarative task evals, voice pools, publish gates
- Local-first health data: Bluetooth devices read directly, one SQLite store, no vendor cloud
- Auditable automation with explicit scope, policy, evidence, replay, and human review
- IP, CIDR, and ASN enrichment with provenance and confidence scoring
- BGP, RPKI, ROA, RIR, WHOIS, and geofeed analysis
- VPN, proxy, Tor, crawler, cloud, CDN, and hosting intelligence
- GeoIP/MMDB compilation, validation, patching, and deployment
- Reproducible datasets for SIEM, fraud detection, OSINT, and network operations
- Static dashboards and GitHub-native publishing workflows
Everything in this group comes from running one personal agent unattended since mid-2026: it fires cron jobs at 03:10, talks through a chat front end, keeps health data, reads mail, and publishes to GitHub. The notes are written from what broke, not from what a framework promises.
| Project | Description |
|---|---|
| Hermes-Agent-Ops | A 34-module series on keeping an agent alive: a cron for the crons, context compaction, cost governance, sandboxing, secret policy, delivery health, memory and skill hygiene. Every module names the failure it prevents and how it was measured. |
| Awesome-Agent-Ops | Curated list of what actually keeps a personal agent running. The list is built from data and checked in CI, so it cannot quietly rot, and every entry points at the practice, not at a vendor. |
| Hermes-Plugin-Pack | Four plugins for the Hermes runtime: a proot sandbox that gives the terminal tool a workspace and nothing else, automatic skill generation from real usage, deletion-first context compaction, and reactions turned into a verdict file. |
| Agent-Cron-Evals | Deterministic checks for scheduled agent jobs: did it run, did it succeed, did the output arrive, is the watchdog itself alive. No model, no network, and exit codes a cron can act on. |
| TTS-Voice-Pool | One call to speak through several text-to-speech providers: key rotation, quotas, cooldowns, a monthly ceiling and a free fallback engine, so the voice never depends on one vendor. |
| Agent-Mission-Control | Local control plane for autonomous coding agents: contract-scoped missions with explicit file boundaries, command policy, evidence capture, scope ledgers, and replayable event logs. |
| Project | Description |
|---|---|
| IP-Knowledge-Layer | Open enrichment layer for CIDR, ASN, cloud, CDN, crawler, Tor, and VPN context with source provenance and confidence. |
| IPxray | Offline IP, CIDR, and ASN resolver with provenance, freshness, and explainable infrastructure context. |
| ASNforge | Reproducible ASN and prefix-origin intelligence compiler for enrichment, routing analytics, and security pipelines. |
| ASN-Signal-Graph | ASN-level aggregation of VPN overlap, Tor visibility, public-feed exposure, and defensive network signals. |
| ASN-Karma | ASN risk pipeline that aggregates hostile infrastructure evidence and publishes scored operational datasets. |
| BlackRoute | Security intelligence pipeline for hostile IP infrastructure, abuse feeds, anonymizers, and attack telemetry. |
| BogonForge | Reproducible compiler for IANA and RFC special-use IP and ASN policy. |
| RIR-SQL-Forge | Builds local ownership and abuse-contact databases from public RPSL data in SQLite, DuckDB, Parquet, and CSV. |
| Cloud-Egress-IP-Ranges | Daily cloud, CDN, PaaS, CI/CD, serverless, and hosting egress ranges with metadata, diffs, and security exports. |
| Sat-geoip | Satellite-internet intelligence from operator GeoIP feeds, PoP mappings, BGP, RIR/RPKI evidence, and history. |
| DNS-Threat-Intelligence-dataset | Legal OSINT pipeline for collecting, normalizing, enriching, scoring, and publishing DNS threat intelligence. |
| Project | Description |
|---|---|
| RouteSentinel | Daily route-security snapshot analyzer for BGP RIB dumps and RPKI VRP datasets. |
| GeoFeed-Harvester | Discovers and validates RFC 8805 geofeeds, preserves provenance, and checks BGP visibility. |
| GeoForge | Compiles a consensus GeoIP database from public geolocation, geofeed, RIR, and WHOIS sources. |
| Project | Description |
|---|---|
| MMDBForge | Developer toolkit for inspecting, validating, diffing, and explaining MaxMind DB files. |
| MMDBbridge | Schema-driven CSV-to-MMDB and MMDB-to-CSV bridge for custom IP intelligence datasets. |
| MMDBpatch | Declarative YAML patching with dry-run diffs and reproducible MMDB overlays. |
| MMDB-WatchTower | Production updater with verification, smoke tests, atomic swaps, rollback, and Prometheus metrics. |
| Project | Description |
|---|---|
| CrawlerScope | Interactive IP intelligence dashboard for search crawlers, AI bots, scanners, and user-triggered fetchers. |
| AI-Crawler-Blocklist | Verified AI crawler IP ranges, user-agent rules, robots.txt controls, and deployment-ready firewall snippets. |
| Tor-Radar | Hourly public Tor relay snapshots and a browser-only interactive intelligence dashboard. |
| Hisense-VIDAA-DNS-Clean-TV-Blocklist | DNS blocklist for reducing telemetry, promotions, and unwanted VIDAA TV services. |
| Project | Description |
|---|---|
| PrefixLint | CI-native linter and normalizer for blocklists, allowlists, CIDR feeds, ipset, nftables, and network policy data. |
| PrefixCloak | Prefix-preserving IPv4/IPv6 sanitizer that keeps subnet-level log and SIEM analytics useful. |
| Project | Description |
|---|---|
| VPN-Infrastructure-Intelligence-Lab | Aggregate VPN infrastructure dataset and dashboard for provider, country, ASN, relationship, and hosting analysis. |
Devices that only talk to their own app are a data silo with a battery. These projects read them directly, keep the numbers locally, and write down the protocol so the next device is not a research project again.
| Project | Description |
|---|---|
| BLE-Vitals-Bridge | Blood pressure and body weight into one local SQLite file: Bluetooth SIG frame parsers (ISO 11073 SFLOAT, the imperial bit), deduplication by construction, a watchdog that notices a silent device, and CSV out. No cloud, no vendor app, no account. |
| Beurer-BM59-Unlocked-Reverse-Engineering | Protocol notes for a blood-pressure cuff that ships with an app: GATT services, frame layout, what the vendor tool does, and what can be read without it. |
| Xiaomi-Scale-Unlocked-Reverse-Engineering | The same for a Mi scale: advertisement format, the standard weight service, and why an encrypted MiBeacon device stays unreadable without the binding key. |
| KardiaMobile-6L-Unlocked-Reverse-Engineering | The same for an AliveCor ECG: the BLE handshake, frame decoding, and what the official app adds on top of the raw signal. |
These repositories remain public as historical datasets and research artifacts.
| Project | Description |
|---|---|
| VPN-Infrastructure-Atlas | Interactive atlas of aggregate VPN provider footprints by country, ASN, and hosting network. |
| ASN-VPN-Network-Intelligence | Historical VPN infrastructure collector outputs published as aggregate CSV datasets. |
| vpn-provider-overlap-intelligence | Historical analysis of VPN provider overlap across IPs, prefixes, ASNs, and hosting networks. |
development objective
-> explicit mission contract and scope
-> agent execution with command and file policy
-> evidence, event logs, and scope ledger
-> automated verification and replay
-> human review and controlled delivery
public network sources
-> collection and normalization
-> CIDR and ASN attribution
-> BGP, RPKI, RIR, WHOIS, and geofeed validation
-> cloud, hosting, VPN, Tor, crawler, and threat signals
-> provenance and confidence scoring
-> CSV, JSONL, Parquet, SQLite, DuckDB, MMDB, dashboards, and APIs
one agent, one small server, no operator on duty
-> scheduled jobs that must not fail silently
-> context, token and cost budgets
-> a sandbox, a secret policy, and a gate before anything is published
-> delivery the human actually reads
-> evals, and an autopsy when it breaks anyway
Languages: Go Python JavaScript HTML
AI engineering: Coding Agents Agent Orchestration Tool Policies Evaluation Evidence Capture Workflow Automation
Agent runtime: Hermes Agent Plugins Skills Cron Context Budgets Task Evals
Device protocols: BLE GATT ISO 11073 MiBeacon SQLite
Formats: CSV JSON JSONL Parquet SQLite DuckDB MMDB CIDR
Network data: ASN BGP RPKI ROA RIR RPSL WHOIS GeoIP GeoFeed
Infrastructure signals: VPN Proxy Tor Crawler Cloud CDN Hosting Scanner Reputation
| Principle | Practice |
|---|---|
| Reproducibility | Deterministic builds and auditable inputs |
| Controlled autonomy | Explicit scope and policy for agent-driven work |
| Verifiable delivery | Evidence, replay, tests, and human-reviewable reports |
| Source transparency | Provenance, freshness, and confidence remain visible |
| Operational utility | Outputs are designed for local lookup and security pipelines |
| Static delivery | Prefer portable artifacts, GitHub Pages, and backend-free dashboards |
| Defensive scope | Publish infrastructure intelligence without exposing sensitive raw inventories |
Relevant areas include autonomous coding systems, agent orchestration, AI development workflows, auditable automation, IP intelligence datasets, ASN and routing analytics, VPN and Tor infrastructure research, crawler visibility, GeoIP/MMDB quality engineering, RPKI/BGP measurements, fraud detection, and SIEM enrichment.
Licensing varies by repository and upstream source constraints. Code is generally released under Apache-2.0 or MIT; generated datasets commonly use CC0-1.0. Refer to each repository's license and source documentation.