I build Python tooling end to end — security automation, backend sandboxes and CLI apps people actually use. Everything public in my repos is tested and source-linked. Machine learning is the road I'm on (Project Omega, early stage), not a claim I've cashed yet — when the receipts land, they'll be right here.
- 🔭 Currently building: the security tooling trio (perimeter-watch, mgk-recon, reportforge — all public), and Project Omega — lightweight vision models with FastAPI serving, in early experiments
- 🌱 Currently deepening: Linux internals, container hardening, and offensive-security tooling (so I can find the holes before someone else does)
- 🧩 Core stack: Python (stdlib-first), FastAPI, Docker, Linux
- 💬 Ask me about: security automation, Python tooling, or the self-rendering cards on this page
If one of these tools saved you an afternoon, you can sponsor the work. Sponsorship pays for the unglamorous parts: CI minutes, live provider testing, and the time to keep release gates honest instead of green-by-accident.
No third-party widget APIs in this section — these four cards are drawn by my own generator (cards/), rendered from the live GitHub GraphQL API and committed straight back to this branch daily by .github/workflows/cards.yml, the same pattern as the snake.
Loss is the share of the year's contributions still owed at each week of the run — the curve converges only when I ship. The marker heartbeats while status reads "converging".
One sample per day; idle days hold the beam on the baseline. The sweep line scans every seven seconds.
The contribution year as a training run: loss is the share of the year's work still owed, and it converges only when I ship. The scope on the right samples one day at a time — idle days hold the beam on the baseline.
Every repo is a service on host github.com/mgkvibez — open if pushed in the last 30 days, filtered within 90, closed beyond that. Ports are stable hashes of the repo name.
Repos as models in a registry: version = stars, params = disk footprint, train loss = days since the last deploy. Loss drifts up while a repo sits idle.
Every repo is a service on host github.com/mgkvibez — open if pushed in the last 30 days, filtered within 90, closed beyond that. The registry frames them as models: version = stars, params = disk footprint, train loss = days since the last deploy.
Stats are rendered live by github-readme-stats — no local generation or workflow needed, so they're always current.
Auto-generated daily by .github/workflows/snake.yml. The snake starts electric blue and turns terminal green as it eats through the year — keyframe colours interpolated over its run, repainted after every regeneration.
Every repo is a skyscraper: height ranks commits (with codebase size and stars as tie-breakers), window lights track how recently it was pushed, the facade is tinted by its primary language, and the tallest tower wears the blinking beacon. Private repos rise as dark towers on the far edge — anonymous silhouettes, names only, no stats. The sky keeps real West African Time — sun by day, moon and stars by night, windows dimming at dawn — and the seasons pass through it: snow in winter, petals in spring, falling leaves in autumn. Re-rendered hourly, so a new repo gets its skyscraper within the hour.
A year of contributions, one cell per day. The four shades are quartiles of my own active days rather than fractions of the busiest one, and the legend prints the numeric range of every band — so the reading survives greyscale.
Left: share of code by tracked bytes, ranked, with the private count in the scope line rather than hidden. Right: the headline numbers and a 30-day sparkline — deltas come from the snapshot archive (history.jsonl), and stay absent until the archive is old enough to answer.
Left: the part of a year's work that involved somebody else — commits are the denominator, not a bar, because a shared axis would turn the collaborative measures into pixel slivers. Right: when in the week and the day the commits actually land, sampled from recent history; every stamp is UTC and the card says so.
Left: the long view — twelve monthly cells per year, shaded by the profile's own distribution. Right: the only derivative on the page — which way the language mix is moving. It needs a month of snapshots to have an honest "then", so until the archive is old enough it says exactly that instead of inventing one.
| Project | Status | Description |
|---|---|---|
| project-omega | 🛰️ Shipped | Fast vision models (PyTorch) + FastAPI serving + observability: tiny CNN with Prometheus metrics, JSON logs and latency measured on CPU. pipx install omega-vision (PyPI) |
| kali-auto-suite | 🛰️ Shipped | Automation for common pen-testing workflows (Bash, Python): authorized, non-destructive recon, scope-gated, dry run by default, every attempt audited. pipx install kaliauto (PyPI) |
| infra-hardening-checks | 🛡️ Shipped | Automated container/config hardening checks for CI pipelines: Dockerfile, compose, Kubernetes and sshd rules, with SARIF for code scanning. pipx install hardencheck (PyPI) |
| perimeter-watch | 🛰️ Shipped | Continuous exposure monitoring: dangling-DNS takeover risk, exposed cloud buckets, secret scanning, alert digests |
| mgk-recon | 🔍 Shipped | Evidence-based recon dossier: fingerprinting, redirect chains, CT-log monitoring, passive checks — every claim source-linked |
| reportforge | 📄 Shipped | Burp Suite, ZAP and nuclei output → client-ready PDF + markdown pentest reports, zero dependencies |
| sentinel-skills | 🛡️ Shipped | Five defensive security playbooks for coding agents: threat-model, triage-alert, review-diff-for-vulns, cve-research, harden-service |
| ci-whisper | 🩺 Shipped | Reads a failed CI log and returns the first real error, its causal chain and a fix, with line citations. Zero dependencies |
| depdrift | 🔗 Shipped | Lockfile diff review: typosquats, install scripts, git deps, mirror registries. Fully offline |
| migsafe | 🗄️ Shipped | PostgreSQL migration linter: flags the statement that locks your users table, with a fix per finding |
| tokentracker | 📊 Shipped | Token and cost observability for agent sessions: what ate the context, per session, per file, per skill. pipx install tokentracker-ai (PyPI) |
| flakedetective | 🔍 Shipped | Runs your suite N times, tells flaky apart from broken, and hands you repro commands plus a quarantine file. PyPI |
| globahire | 🛰️ Shipped | Personal job radar: watches public boards for roles that match your stack and pings once per real role. PyPI |
Three purpose-built security tools, open for personal and
noncommercial use under PolyForm Noncommercial 1.0.0:
watch your perimeter with perimeter-watch,
profile a target with mgk-recon,
and turn scanner output into a report a client will actually read with
reportforge. Python standard
library only — git clone and run.
Ten tools built for the work I actually do. All MIT, all tested, all install in one line:
- ci-whisper —
gh run view --log-failed | ci-whisperturns 10k lines of noise into the one paragraph that matters - migsafe —
migsafe check migrations/flags the lock, the rewrite and the irreversible step before deploy - depdrift —
depdrift review old.json package-lock.jsonanswers "what arrived, and is it sketchy?" - sentinel-skills —
npx skills add mgkvibez/sentinel-skillsgives coding agents a defensive playbook instead of an instinct - tokentracker —
tokentracker report ~/.claude/projectsranks what actually ate the context, with an explicit (unattributed) bucket so the shares add up - flakedetective —
pipx install flakedetectivethenflakedetective run --runs 10 -- pytestseparates flaky from broken and prints the loop that proves it - globahire —
pipx install globahirethenglobahire watch --profile profile.yamlpings once per genuinely new role, and never applies for you - infra-hardening-checks —
pipx install hardencheckthenhardencheck scan .flags root containers, leaked build args,curl | sh, privileged pods and root SSH before they merge, in text, JSON or SARIF - kali-auto-suite —
pipx install kaliauto, name who authorized the work inscope.json, thenkaliauto scan --scope scope.json --execute: dry run by default, out-of-scope targets refused, every attempt audited - project-omega —
pipx install omega-visionthenomega serve: a tiny CNN behind a validated API, seven Prometheus metrics, JSON logs with request ids, and latency you can re-measure instead of take on faith
- Open an issue describing the bug or feature before sending a PR.
- Fork, branch off
main, and include tests with any behavioral change. - PRs are reviewed for reliability, test coverage, and clarity of design — not just "does it run."
- X: @mgkvibez
- Email: michaeloogwu58@gmail.com
- Found a real issue in one of my repos? Open an issue there directly — it's faster than DMs.
Open the table view
| Right now | Reading | Move |
|---|---|---|
| Contributions (365d) | 719 total | ▲ 410 in 30d |
| Last 30 days | 455 | see the activity card |
| Metric | Last 365 days | Move |
|---|---|---|
| Contributions | 719 | — |
| Commits | 321 | — |
| Pull requests | 67 | — |
| Issues | 16 | — |
| Reviews | 0 | — |
| Current streak | 56d | — |
| Longest streak | 56d | — |
| Repositories | 49 | — |
| Stars earned | 81 | — |
| Followers | 23 | — |
| Collaborative acts | 83 (11.5% of all) | — |
| Language | Share | Tracked size |
|---|---|---|
| TypeScript | 73.1% | 17.7 MB |
| Python | 20.5% | 5.0 MB |
| JavaScript | 4.0% | 1001.3 kB |
| Other (10) | 2.4% | — |
| Commit rhythm | Value |
|---|---|
| Busiest slot | Sat 13:00 (35 commits) |
| Sample | 512 recent commits |
| Nights, 22:00–06:00 | 17% of the sample |
| Clock | UTC — every stamp came back without an offset |
| Year | Contributions |
|---|---|
| 2025 | 17 |
| 2026 | 705 |
| Building | Commits | Size | Stars | Last push | State | Access |
|---|---|---|---|---|---|---|
| fast-dev | 1909 | 14.2 MB | 1 | 2026-10-27 | occupied | private |
| mgkvibez | 314 | 1.6 MB | 2 | 2026-11-01 | occupied | public |
| ron-weasley-ii | 289 | 2.3 MB | 2 | 2026-10-16 | occupied | private |
| Tinda | 91 | 904 kB | 2 | 2026-10-16 | occupied | private |
| ci-whisper | 20 | 203 kB | 5 | 2026-11-01 | occupied | public |
| openclaw-profile-cards | 20 | 269 kB | 2 | 2026-10-31 | occupied | public |
| Lisa-1 | 19 | 16.5 MB | 2 | 2026-10-31 | occupied | public |
| Godmode_Ai | 18 | 96 kB | 2 | 2026-10-31 | occupied | public |
| mgk-recon | 15 | 34 kB | 1 | 2026-10-31 | occupied | public |
| perimeter-watch | 15 | 45 kB | 1 | 2026-10-31 | occupied | public |
| migsafe | 14 | 103 kB | 3 | 2026-11-01 | occupied | public |
| reportforge | 13 | 33 kB | 1 | 2026-10-31 | occupied | public |
| depdrift | 12 | 62 kB | 4 | 2026-10-31 | occupied | public |
| tokentracker | 11 | 68 kB | 2 | 2026-10-31 | occupied | public |
| paymock | 9 | 42 kB | 1 | 2026-10-31 | occupied | public |
| standalone-webcontainer | 8 | 109 kB | 1 | 2026-10-31 | occupied | public |
| sentinel-skills | 8 | 70 kB | 2 | 2026-10-31 | occupied | public |
| kratos-ii | 8 | 108 kB | 2 | 2026-09-15 | quiet | private |
| odia | 8 | 4.3 MB | 1 | 2026-06-18 | dormant | private |
| agentic-harness-orchestrator | 7 | 103 kB | 2 | 2026-10-31 | occupied | public |
| sharpsharp-bmoni | 7 | 65 kB | 2 | 2026-10-31 | occupied | public |
| voxserve | 7 | 29 kB | 1 | 2026-10-31 | occupied | public |
| flakedetective | 6 | 38 kB | 2 | 2026-10-31 | occupied | public |
| ma-lab | 6 | 98 kB | 2 | 2026-10-16 | occupied | private |
| voiceprint | 6 | 90 kB | 2 | 2026-10-15 | occupied | private |
| doc-drift | 5 | 20 kB | 0 | 2026-10-31 | occupied | public |
| Agentic-project | 5 | 4 kB | 2 | 2026-10-31 | occupied | public |
| telegram-webhook-starter | 5 | 27 kB | 1 | 2026-10-31 | occupied | public |
| paystack-webhooks | 4 | 38 kB | 0 | 2026-10-31 | occupied | public |
| the-intel | 4 | 1.5 MB | 2 | 2026-10-31 | occupied | public |
| bolt | 4 | 14.1 MB | 2 | 2026-10-31 | occupied | public |
| pocketcrdt | 4 | 7 kB | 1 | 2026-10-31 | occupied | public |
| bolt.dye | 4 | 2.1 MB | 2 | 2026-10-31 | occupied | public |
| infra-hardening-checks | 4 | 21 kB | 2 | 2026-10-31 | occupied | public |
| discord-webhook-starter | 4 | 24 kB | 1 | 2026-10-31 | occupied | public |
| the-intels | 3 | 25 kB | 2 | 2026-10-31 | occupied | public |
| open_hands | 3 | 1 kB | 2 | 2026-10-31 | occupied | public |
| globahire | 3 | 81 kB | 2 | 2026-10-31 | occupied | public |
| kali-auto-suite | 3 | 27 kB | 2 | 2026-10-31 | occupied | public |
| project-omega | 3 | 75 kB | 2 | 2026-10-31 | occupied | public |
| webcontainer | 3 | 10 kB | 1 | 2026-10-23 | dormant | public |
| lisa | 3 | 69 kB | 1 | 2026-08-13 | quiet | private |
| Agents | 3 | 7 kB | 1 | 2026-07-22 | dormant | private |
| bolt.gives | 2 | 5.7 MB | 2 | 2026-10-31 | occupied | public |
| qttx-app | 2 | 2 kB | 1 | 2026-10-16 | occupied | private |
| Heimdall-II | 1 | 33 kB | 1 | 2026-10-29 | occupied | private |
| openclaw | 1 | 53 kB | 1 | 2026-08-12 | quiet | private |
| blog-agility-cms-nextjs | 1 | 154 kB | 1 | 2025-12-01 | dormant | private |
| bolt.new | 1 | 841 kB | 1 | 2025-12-01 | dormant | private |
Private repositories are listed for their activity only — they are not linked, because the link would 404 for everyone but me.
Generated by cards/ on 2026-11-01, from the live GitHub GraphQL API. Table maintained between the cards:table markers.