dario · 544★ · 27,000+ npm installs a month · 594 releases
12 fixes merged upstream into Node.js, Hugging Face, Erigon, GitHub, Raycast, gosec and more
Portfolio · Engineering log · What I build · hello@sprayberrylabs.com
One local endpoint that puts your Claude and ChatGPT subscriptions behind any coding tool. Cursor, Cline, Aider, Claude Code, Codex CLI and the Agent SDK all talk to it; either plan answers either wire shape, with failover between them, session-sticky multi-seat pooling, and hourly drift watchers that track Claude Code's request shape. Zero runtime dependencies.
Every release is SLSA-attested and published from CI with no long-lived token. 9.4 OpenSSF Scorecard, 100% Best Practices.
Fixes found, reproduced and landed in other people's projects, reviewed and merged by their maintainers.
| Project | The fix |
|---|---|
| nodejs/undici #5827 | The WebSocket parser kept a message's compressed flag after it completed, so a stray continuation frame was accepted instead of failing the connection. |
| huggingface_hub #4546 · #4896 | Two Windows long-path bugs in the client the Hugging Face stack is built on: a crash downloading into a deep directory, and a tree cache that silently switched itself off. |
| erigontech/erigon #24022 | A consensus-layer TTL cache now expires on read instead of running a sweep goroutine, and a peer-refresh loop no longer outlives its owner's context. |
| github/advisory-database #8824 | A security advisory's patched-version range that missed the 1.x fix. |
| securego/gosec #1746 | An always-out-of-range index that the G602 analyzer waved through under an equality guard. |
| raycast/extensions #31314 | A scoreboard command sent a date range the ESPN endpoint rejects with a 400; it now asks one day at a time. |
| qax-os/excelize #2402 | Conditional-formatting and data-validation ranges moved onto the wrong row when their first row was deleted. |
| getopenscreen/openscreen #708 | Linux capture lost an early first frame; the capture-started state is now latched. |
| silverbulletmd/silverbullet #2128 | Short or link-leading task lines never got the page reference their Linked Mentions toggle needs. |
| williamngan/pts #228 | A numeric equality threshold excluded a difference exactly at the threshold, unlike the point comparison beside it. |
| awesome-mcp-servers #10332 | truecopy listed under Security. |
Two questions every agent deployment has to answer: what is it allowed to do, and what does it run on? Everything here is open source, and runs the operation that ships it.
Own Your Agent Security. Deterministic gates around what an agent may do.
| redstamp | An offline firewall for agent tool calls: blocks RCE, secret exfiltration, SSRF, prompt injection and poisoned MCP tools, with a tamper-evident audit trail. Runs under CrewAI, LangGraph, the OpenAI Agents SDK and AutoGen. |
| truecopy | Vet, sign and pin every skill and MCP server, then fail the build when the bytes change. 68,560 skills audited across two ecosystems. |
| plumbline | Out-of-band monitoring that scores an agent's whole action sequence against its declared job, catching an escape assembled from individually allowed steps. |
| agent-security-stack | redstamp and truecopy behind one governed MCP server, with scoped single-use credential leases. |
Own Your Stack. The plan you already pay for, on the machine you already own.
| dario | Subscription routing for every coding tool (above). |
| cordon | A PII-redacting LLM gateway that fails closed, shipped as an attested container. |
| browser-bridge | Stealth headless Chromium on your own CDP endpoint, with a prompt-injection firewall in front of it. |
| amnesia | Privacy meta-search with no accounts, no ads and no query log, live at amnesia.tax. |
| pgflex · redisflex | One Postgres API and one Redis API, real servers in production and in-process engines for tests, so a whole platform runs without Docker. |
The whole map on one page → ownyourstack.sprayberrylabs.com
askalf is the agent operation behind Sprayberry Labs: an orchestrator and specialist agents that ship, review, audit and watch production, with one human approving what matters. It runs on the tools above. dario routes its model traffic, redstamp gates its tool calls, truecopy verifies every skill at load, and every pull request gets a gating review from a different model family than the one that wrote it, in the open, before a human merges.
I'm that human: fifteen-plus years in systems and infrastructure engineering, data centers and virtualization before the agent work. I architect it, review it and sign everything that leaves the shop, and I write down what actually happens.
Write-ups: the numbers and the misses
- We scanned the marketplace that started the poisoned-skills panic: all 66,541 ClawHub skills poison-scanned with truecopy. Zero confirmed malicious, 813 deterministic alarms, every one checked and mapped.
- The leaderboard I refused to build: why an agent-firewall leaderboard is a category error, and a threat-model map instead, misses included.
- Auditing the skills supply chain: truecopy across 2,019 published Claude skills.
- Zero raw credentials: moving a live agent fleet from 132 inherited environment keys to scoped leases, one seam at a time.
- An injection firewall for the agentic browser: why the lethal trifecta is structural, and how to gate it.
- A self-healing release pipeline: how dario ships, health-gates and rolls itself back.
- Own your inference: the measurements behind hybrid.
- redstamp governing third-party frameworks: CrewAI · LangGraph · OpenAI Agents SDK · AutoGen
Full engineering log → sprayberrylabs.com/blog
Supply-chain receipts
- Live OpenSSF Scorecard on dario, redstamp, truecopy, plumbline, agent-security-stack, cordon, browser-bridge and amnesia; 100% OpenSSF Best Practices on dario, truecopy, redstamp and amnesia.
- npm packages publish from CI through OIDC trusted publishing, with provenance and no long-lived token.
- cordon ships as an attested container from GHCR.