Portfolio · 2025–2026

Three systems,
currently running.

Selected work from the past eighteen months. Every system below runs on the client's own hardware or behind their firewall. We have removed names where NDAs require it, and left the technical surface intact.

Engagements
17
In production
12
Median deploy
21d
Data exfil
0
01 — BaseIQ 02 — Sentinel 03 — Aegis Clinical
01
Web3 · Base L2 · On-chain Intelligence

BaseIQ — the swarm that reads Base.

Status · Live
Deployed · Sep 2025
Stack · On-prem · OSS

An agent swarm reading every block on Base — turning a chain into a private signal feed.

The brief
A multi-strategy crypto fund needed visibility into every new contract and dApp deployed on Base as it happened — filtered by their own thesis, with no exposure to a third-party data vendor.
The system
Twelve agents running in the client's own VPC. A block-listener pipes every new deployment into a classifier agent, then a thesis-fit agent tuned on the fund's investment memos. Anything that passes a criteria gate goes to a research agent that scrapes the team, the GitHub and the on-chain liquidity within sixty seconds.
The privacy posture
No prompts, no thesis vectors, no analyst notes leave the client perimeter. Open-weight models run on two A100s the fund already owned. Every agent action is replayable and signed.
The outcome
Three early-stage positions in the first quarter that the fund attributes directly to BaseIQ surfacing them before listing-aggregators picked them up. Median time from contract deploy to analyst inbox: 42 seconds.
BaseIQ · Sample feed · recording from launch scanning · 12 agents
12:04:220x9aF1…d3 NewPairSCAN
12:04:190xB72e…77 VaultSCAN
12:04:110x4cE0…91 PerpDEXMATCH · thesis-fit 0.87
12:03:580x1AAb…02 ERC-20REJECT · honeypot
12:03:440x7d12…fe RouterSCAN
12:03:210xeE39…aa LSTMATCH · liquid-staking
12:03:080x802A…11 NFTMintPARK
12:02:510xc15B…30 BridgeSCAN
42s
Deploy → analyst inbox · median
19.8k
Contracts classified · month one
3
Early-stage positions attributed
0B
Bytes egress from client VPC
"
We see things on Base before the aggregators do — and our edge never leaves our own machines. — Managing Partner · Crypto-Native Fund
02
Security · Ethereum L1 · Continuous Audit

Sentinel — a bug bounty that never sleeps.

Status · Live
Deployed · Mar 2025
Coverage · 38 contracts

An agent that watches every transaction touching your contracts — and tells the owner before the exploit clears.

The brief
A protocol team had been through three audit firms and still felt blind. A static audit is a snapshot. The threats they were losing sleep over were live: governance upgrades, oracle drift, hostile flash-loan compositions, contract upgrades by compromised multisigs.
The system
Sentinel is a fleet of specialised agents — a simulator that re-executes every incoming transaction against a forked state, an invariant agent that validates a hand-written security spec, and a reasoning agent that classifies anomalies in plain English. When something fires, alerts are dispatched over signal-protocol messaging directly to contract owners.
The privacy posture
Sentinel runs in a hardened enclave the client controls. No exploit signature, no invariant spec, and no alert ever traverses a hosted API. Messaging keys are owner-rotated and ephemeral.
The outcome
In its first year Sentinel surfaced $11.4M of would-be losses across client protocols — pre-empting two exploits that hit unmonitored peers a few hours later.
sentinel · ethereum mainnet · block 19,440,217 armed · 4 critical · 12 warn
Transactions
Armed
17:02:11·tx 0x4f1a… swap → router · invariants OK
17:02:09·tx 0x8b22… deposit · TVL Δ +0.4%
17:02:07!oracle drift 0.83% · vault-eth · within tolerance
17:02:04·tx 0xc921… approve · LP token
17:02:01✕upgrade() called on Vault by EOA 0xB4f1… not in safelist
17:01:58·tx 0x71De… borrow · health 2.1
17:01:55!flash-loan composition · 4 hops · simulating…
17:01:52·tx 0x3a02… repay · loan closed
17:01:49·tx 0xFFc1… stake · invariants OK
Owner Alerts
E2E · Signal
Outbound to @vault-owner — encrypted, ephemeral key.
▲ Critical · 17:02:01 UTC
Unauthorised upgrade() on Vault.sol by an EOA outside your safelist. Multisig quorum did not sign. Recommend pausing now.
Acknowledge
! Warn · 17:01:55 UTC
Flash-loan composition simulating against forked state · 4 hops, suspect re-entrancy on claim().
Watching
$11.4M
Would-be losses surfaced · Y1
147ms
Tx → owner alert · p50
38
Contracts continuously audited
0
Successful exploits on coverage
"
We were paged on Signal at 03:14, paused the vault at 03:14:46. Sentinel saw the malicious upgrade in the same block it was mined. — CTO · DeFi Protocol, $1.4B TVL
03
Medical · On-Premise · Air-Gapped

Aegis Clinical — the ER's local intelligence.

Status · Live
Deployed · Jan 2026
Hosting · In-hospital

A private agent fleet that turns terabytes of patient history into a 4-second answer — without a single byte leaving the hospital.

The brief
A 700-bed teaching hospital wanted an ER copilot that could pull a patient's full longitudinal record — EHR notes, imaging metadata, allergy graphs, prior labs, family history — and present a triaged summary at the moment the resident sees the patient. Cloud was non-negotiable: it could not be used.
The system
Aegis runs on a single in-house GPU cluster behind the hospital's clinical VLAN. A retrieval agent reads from local EHR + PACS + LIS over read-only adapters. A summarisation agent, fine-tuned on de-identified hospital data, produces the triage card. A safety agent checks every output against drug-interaction and consent constraints before display.
The privacy posture
No PHI leaves the cluster. No outbound network. Every query is bound to a clinician badge tap and a patient bracelet scan — both logged, both expiring. The full inference path is reviewable by the hospital's privacy officer.
The outcome
Median time-to-context in the ER dropped from 11 minutes to 3.8 seconds. Clinicians reported recovering more than an hour per shift previously spent chart-trawling.
aegis · ed-2 terminal · badge-bound session 00:42 on-prem inference · air-gapped
RM
R. Mendez · M, 67
MRN ·· 7740-21 · Bracelet ✓ · 14:02 UTC
Note"R. Mendez" is a pseudonym. All patient identifiers in this case study — name, MRN, dates — have been substituted for confidentiality. The system architecture and timings are real.
HR
112
BP
88/52
SpO₂
94%
Temp
38.4
14:02ER admit · chest pain, dyspnoea
2024-08CABG x3 · post-op uneventful
2024-02Cardiology · LVEF 45% · stable
2023-11Allergy noted · amoxicillin
chronicHTN · T2DM · CKD st.3
family1st-deg MI < 55 · father
Aegis · Triage Brief
on-prem · 3.8s
"Summarise this patient for me — five seconds."
67-year-old male, post-CABG x3 (2024), presenting hypotensive (88/52) and tachycardic (112) with dyspnoea and chest pain. Strongly consider ACS or graft failure — last LVEF 45%.

Holds & flags:
• Amoxicillin allergy on file (2023).
• CKD stage 3 — adjust contrast and renally-cleared dosing.
• Father MI < 55 · elevated familial risk.

Suggested next steps: 12-lead ECG · serial troponins · bedside echo · cardiology consult paged (queued, awaiting clinician approve).
Sources · EHR · PACS · LIS · 1.4TB scanned 🔒 zero egress · session 00:42
3.8s
Median time-to-context · ER
1.4TB
Scanned per patient pull
68m
Reclaimed per clinician shift
0b
PHI leaving the hospital
"
For the first time in twenty years of medicine, the chart catches up to me — not the other way around. And the data never leaves the building. — Director · Emergency Medicine, Teaching Hospital
Begin

Your next system —
built in-house.

Book Your Free Audit ← Back to Methora