Eu joguei o endereço deste site no Is It Agent Ready? e recebi uma nota 21.

Depois de algumas horas lendo RFC, mexendo no Hugo, configurando Nginx e respirando fundo antes de apertar o botão de DNSSEC no Registro.br, a nota subiu para 71. O site passou a ser classificado como Agent-Integrated.

A tentação óbvia seria continuar adicionando arquivos até o scanner ficar verde em tudo. Não fiz isso.

Uma pontuação não é uma arquitetura. Publicar metadata de OAuth sem ter autenticação ou anunciar um servidor MCP que não existe seria tecnicamente desonesto. Agentes encontrariam mais arquivos, mas receberiam informação falsa.

I entered this site’s address into Is It Agent Ready? and got a score of 21.

After a few hours reading RFCs, working on Hugo, configuring Nginx, and taking a deep breath before clicking the DNSSEC button at Registro.br, the score went up to 71. The site reached the Agent-Integrated level.

The obvious temptation was to keep adding files until every scanner check turned green. I did not.

A score is not an architecture. Publishing OAuth metadata without authentication, or advertising an MCP server that does not exist, would be technically dishonest. Agents would discover more files, but those files would contain false information.

Como eu fiz uma fábrica de Shorts que roda 100% na minha máquina

Todo mundo que mexe com vídeo no YouTube já ouviu falar de Opus Clip, Klap, SubMagic e a turma. Você joga um vídeo longo, a ferramenta corta os melhores momentos, coloca legenda animada e te devolve uns Shorts prontos. Funciona. O problema é o de sempre: é SaaS, você paga por mês, e seu vídeo sobe pro servidor de alguém.

How I built a Shorts factory that runs 100% on my own machine

If you mess with YouTube at all, you’ve seen Opus Clip, Klap, SubMagic and the rest. You drop in a long video, the tool cuts the best moments, slaps on animated captions, and hands you ready-to-post Shorts. It works. The catch is the usual one: it’s SaaS, you pay monthly, and your video gets uploaded to someone else’s server.

Yesterday I made a batch of changes to SovereignRAG that I had been putting off for a while: Markdown support in the ingestion pipeline and mandatory source citations in the reports.

The practical problem was straightforward. A significant portion of OWASP documentation doesn’t come as PDF — it comes as Markdown. Without .md support, I was leaving out of context exactly the docs that matter most in a vulnerability scanner. Now the project recursively discovers both PDFs and Markdown files inside any directory passed via --docs-dir, no need to list files individually.

Ontem implementei um conjunto de mudanças no SovereignRAG que vinha enrolando faz um tempo: suporte a Markdown na ingestão e citação obrigatória de fontes nos relatórios.

O problema prático era simples. Boa parte da documentação do OWASP não vem em PDF — vem em Markdown. Sem suporte a .md, eu estava deixando fora do contexto exatamente os docs que mais importam num scanner de vulnerabilidades. Agora o projeto descobre recursivamente PDFs e arquivos Markdown dentro de qualquer diretório passado via --docs-dir, sem precisar especificar os arquivos um a um.

There was a time when OpenAI looked like one of the most idealistic projects in Silicon Valley.

The pitch was simple: artificial intelligence was becoming too powerful to be controlled only by private corporations. If AGI ever became real, it should benefit humanity, not just shareholders.

That was the idea Elon Musk believed he was supporting when OpenAI was founded in 2015 as a nonprofit. He was not the only founder, of course. Sam Altman, Greg Brockman, Ilya Sutskever and others were part of the early story too. But Musk brought something very important to the table: money, attention, credibility and a serious fear that Google could dominate advanced AI through DeepMind.

Anthropic has launched Claude Opus 4.7 with stronger performance across complex reasoning, software engineering, multimodal analysis, and long-running tasks.

At first glance, this looks like another predictable step in the AI race.

A better model. Better coding. Better vision. Better agentic behavior.

Nothing unusual there.

But the important part is not only what Anthropic released.

The important part is what Anthropic did not release.

Claude Opus 4.7 may be the company’s most capable generally available model, but it does not appear to be Anthropic’s true technical ceiling. That distinction matters.

Running LLM locally with Ollama: migrating my Job Finder project

More than one year ago I built a simple project to start studying AI.

At the time, I integrated it with the OpenAI API. It worked well, but over time I started to feel the usual friction: cost per request, dependency on external services, and limited control over the runtime.

Today, I migrated this project to run using a local LLM.

There’s a quiet war happening in tech right now.

On one side, there’s the corporate machine:

subscription-only tools, vendor lock-in, opaque AI pipelines, and dashboards designed to look “clean” while hiding all the internals that actually matter.

On the other side, you have something I care about deeply: technical sovereignty.

Owning what you run.

Knowing where it runs.

And being able to fix things without begging a helpdesk ticket to be escalated to Tier 2.

O FraudTalon deu mais um passo importante.

Mesmo com pouco tempo livre na semana, sigo comprometido em manter o FraudTalon avançando e publicando updates regulares.

A partir de hoje, é possível fazer o upload de arquivos .eml diretamente pela interface, e o sistema realiza uma análise completa combinando heurísticas de segurança de e-mails com inteligência artificial.

O pipeline está assim:

• Parse automático do .eml, com extração dos headers, remetente, destinatário, assunto e corpo
• Avaliação heurística com sinais como:
  • Mismatch entre From, Reply-To e Return-Path
  • Falhas de autenticação (DKIM, SPF, DMARC)
  • Recebimento por servidores desconhecidos
• Análise por IA (via OpenAI) levando em conta todo o conteúdo textual
• Score consolidado com os sinais suspeitos encontrados

Essa atualização transforma o FraudTalon em uma ferramenta muito mais útil para análise de e-mails suspeitos, como golpes de Pix, phishing, ou promessas falsas de investimento.

FraudTalon just took another important step.

I’m only able to work on FraudTalon a few hours per week, but I’m committed to making steady progress and sharing weekly updates.0

Starting today, you can upload .eml files directly through the interface, and the system will run a complete analysis using a combination of email security heuristics and artificial intelligence.

The pipeline now works like this:

• Automatic .eml parsing with extraction of headers, sender, recipient, subject, and body
• Heuristic evaluation with signals such as:
  • Mismatch between From, Reply-To, and Return-Path
  • Authentication failures (DKIM, SPF, DMARC)
  • Relaying through unknown servers
• AI analysis (via OpenAI) that takes into account the full textual content
• Final score with a breakdown of suspicious indicators

This update makes FraudTalon a much more powerful tool for analyzing suspicious emails like phishing, Pix scams, or fake investment offers.

Depois de receber tantas mensagens dos meus pais, esposa, irmã e amigos perguntando se certos e-mails ou anúncios que viram nas redes sociais eram legítimos, decidi criar uma ferramenta para ajudar a identificar fraudes, golpes e tentativas de phishing.

Foi assim que nasceu o FraudTalon

Atualmente ele está na versão MVP 0.0.1 — funcionalidades básicas, heurísticas simples (comecei com NLP mas deixei de lado — por enquanto, não é necessário) e um único LLM baseado em nuvem. O objetivo neste estágio é validar a ideia.

After getting so many messages from my parents, wife, sister, and friends asking if emails or ads they saw on social media were legit, I decided to build a tool to help identify fraud, scams, and phishing attempts.

That’s how FraudTalon was born.

It’s currently in MVP version 0.0.1 — basic functionality, simple heuristics (I started with NLP but dropped it — not needed for now), and a single cloud-based LLM. The goal at this stage is to validate the idea.

Running AI models locally on your Mac M1 is easier than you think.

No cloud. No expensive subscriptions. No unnecessary complexity. Just your own hardware and full control.

I just released a 30-minute playbook that shows exactly how to run Ollama fully local on Mac M1:

• Full install guide
• Copy-paste terminal commands
• Model recommendations tested on M1 hardware
• Performance optimization tips
• Local security checklist
• Bonus cheat sheet included

Launch price: $5

Building My Own Sovereign RAG for Secure Code Analysis

Lately, I’ve been taking a closer look at some code analysis tools that claim to detect security vulnerabilities in software projects. The idea itself is solid. I got one of these tools recommended to me and decided to dig deeper to see what’s really behind these solutions.

Pretty quickly I noticed a pattern: these platforms are far from cheap. Some offer limited free plans, but we all know how this game works. When something that good is offered for “free”, the real price usually comes from somewhere else — data collection, vendor lock-in, black-box models processing your code in someone else’s cloud. And since I’ve been deeply studying AI lately, especially Retrieval-Augmented Generation (RAG), the question came naturally: why not build my own pipeline, fully local, sovereign, using open-source tools, running on my own machine, and depending on no one?

Construindo meu próprio RAG soberano para análise de segurança de código

Nos últimos tempos, comecei a olhar com mais atenção para algumas ferramentas de análise de código que prometem identificar falhas de segurança em projetos. A ideia é boa. Recebi uma dessas ferramentas como sugestão e fui atrás para entender melhor o que havia por trás da proposta.

Logo de cara percebi um padrão: os preços dessas plataformas não são exatamente convidativos. Algumas até oferecem planos gratuitos limitados, mas a gente sabe como funciona o jogo. Quando algo muito bom aparece “de graça”, o custo real costuma vir de outro lugar. Coleta de dados, lock-in na plataforma, modelos black-box processando seu código na nuvem de terceiros. E como hoje eu venho estudando bastante IA e, em especial, o tema dos RAGs (Retrieval-Augmented Generation), a pergunta veio automática: por que não montar o meu próprio pipeline, 100% local, soberano, usando ferramentas open-source, rodando direto na minha máquina, sem depender de ninguém?

An open-source project called Deep-Live-Cam is gaining traction on GitHub — and for good reason.

With just a single still image, it can mimic anyone’s face in a live video call. In real-time. Running locally. No cloud required.

The implication is clear: you can no longer trust a video call at face value.

So here’s the question: how do we verify identity in a world where faces can be forged on demand?

Um projeto open-source chamado Deep-Live-Cam está chamando atenção no GitHub. E com razão.

Com apenas uma imagem estática, ele consegue simular o rosto de qualquer pessoa em tempo real, dentro de uma chamada de vídeo. Tudo isso rodando localmente. Sem nuvem. Sem limites.

A consequência é direta: não dá mais pra confiar em uma chamada de vídeo.

E isso levanta a pergunta inevitável: como validamos a identidade num mundo onde rostos podem ser forjados ao vivo?

Hey everyone! I just wanted to share a new pet project I’ve been working on.

I built Job Finder to automate job searches, analyze descriptions using AI, and filter the best opportunities based on personal criteria.

Job Finder is an open-source project designed to automate job searching, analyze job descriptions using AI, and filter opportunities based on predefined criteria. Initially developed as a personal study project, it demonstrates the integration of automation, AI, and data processing, but can also be useful for others looking to streamline job searches.

Last weekend, I was coding when a song from one of my Apple Music playlists started playing: Boat Gig by the band Tribal Tech (highly recommended if you’re not familiar with it).

As the music played and I continued coding and learning to work with AI, a sort of movie ran through my mind—reflecting on where we’ve come from (at least since I hopped on the boat) in the tech world, and where we are today.