The Stack
Most AI content out there
is a joke.
I don't mean that as a dismissal — I mean it as an observation. I've been watching this space long enough to notice that most of what flies around is either people who just discovered something exciting and haven't thought through the risks, or people selling courses on the back of that excitement.
Neither type is asking the question I actually care about: where exactly does AI touch your system, and is that safe?
Two kinds of noise
The first kind is fine, actually. Someone discovers AI, gets excited, starts sharing. The risk model is fuzzy — "AI can do everything" — but the curiosity is real. That resolves with time.
The second kind is the grift. AI as a content vehicle. Courses, newsletters, communities, all selling access to something that's fundamentally just a tool. The tool is the product. I have less patience for that one.
What both have in common: they treat AI as a single, uniform thing that everyone uses the same way. That's not how it works.
Different people see different problems
I've been in rooms where an IT admin, a CISO, and a line manager were all talking about "using AI" — and describing three completely different things. Not because anyone was confused. Because they actually had three different problems.
The IT admin wanted a terminal that doesn't break when an AI runs a command. The CISO wanted to know who touched what and when. The manager wanted less time on manual lookups. Same technology. Different intervention points.
The Tree Swing Cartoon is exactly this. Everyone looks at the same brief and sees a different problem. AI is the new swing. The FDE's job — the thing I think I'm actually good at — is being in the room and knowing which version of the problem is real.
So the real question isn't "how do I use AI?" It's "where, specifically, can AI act in my workflow — and what does safe access look like at that exact point?"
Each tool is a judgment call
Everything I've built is an answer to a specific version of that question. Not "AI for everything" — but AI, specifically, at this layer, with these constraints, for this type of operator.
Each one of these is a judgment call. Not just "can AI do this?" — but "what does safe, auditable, reversible AI access look like at this specific touchpoint?"
The work
AI agents in non-interactive shells can't use REPLs, send Ctrl+C, or hold state. pty-mcp solves that — local shell, SSH, serial port, persistent sessions, HPKE credential injection, audit log.
Vaultwarden proxy that delivers credentials to AI agents via HPKE sealed delivery. The agent never sees plaintext — the secret goes directly into the PTY buffer.
Remote MCP server for on-prem Active Directory. Read-only operations today (user search, group membership, locked accounts, audit reports). Policy engine between AI and AD ops. Write tools in Phase 4.
Controlled AI access to Microsoft Entra ID and M365 via Microsoft Graph API. Complements ad-mcp for hybrid environments — cloud identity, same policy principles.
Server monitoring agent that autonomously investigates alerts. Pulls metrics, correlates events, surfaces root causes without a human in the loop — then writes a structured report.
42 MCP tools for infrastructure operations: port allocation, DNS management, Cloudflare Tunnel, service deployment. v2.0.0 separates allocation from observation — records the server did not create derive no paths, so a guessed path cannot be stored as a fact.
Vendor PDF → Gemini multimodal extraction → 5-round agentic NetSuite item matching. Turns messy vendor documents into structured ERP line items with a quality feedback loop.
Full quote-to-sales-order workflow for a hardware distributor. 347 commits of production ERP logic. AI-accessible layer built on top of real business operations.
Proof of concept: autonomous incident response
In February 2026, Jeeves investigated a real production alert autonomously — no human initiated the analysis. It pulled metrics, correlated logs, identified the root cause, and produced a structured report in 31.4 seconds across 5 sources.
✓ Trigger: CPU spike alert on asablue (Netcup DE)
✓ Duration: 31.4 seconds
✓ Sources: 5 (metrics, syslog, process table, nginx, application log)
✓ Human loop: none — fully autonomous investigation
✓ Output: structured root cause report with remediation steps
# This is what "monitoring & response layer" looks like in practice
The architecture isn't a limitation
The common version of enterprise AI is "give the AI access and see what happens." I think that's backwards.
What I've been building toward: narrow tools, explicit schemas, policy before operations, audit always. AI that has a specific job with a specific scope — not a general-purpose agent loose in your infrastructure.
The same principle shows up everywhere in this stack: read-only first, write later. Not because AI is inherently dangerous — but because trust is earned with evidence. Start with observation. Add action when the model is validated.
That's not a constraint on what AI can do. That's how you build something you can actually put in front of a customer.