/ at a glance /
~£11/mo
all-in hosting cost after migrating to a smaller VPS
Measured · internal5 of 7
prompt-injection hardening controls fully closed
Measured · internal5 min
sandbox container idle lifetime — ephemeral by design
Measured · internal6+
external services and APIs wired in
Measured · internal/ what we built /
Real capability, kept behind a security wall.
Hermes gateway (agent core)
A systemd-managed service that runs the brain (DeepSeek v4, Gemini for vision), holds persistent memory, and orchestrates every tool call.
Discord control loop
Fronts the whole agent through a private, allowlisted Discord server so the owners can talk to Drac from their phones.
Docker sandbox boundary
Runs every tool action inside a short-lived container with least-privilege, read-only secret mounts — the wall between agent and host.
Prompt-injection hardening
Untrusted-content-is-data rule, fine-grained tokens, human-in-the-loop on side-effects, pinned deps and a live canary injection test.
in-progressHost-side cron collection
Scheduled collector scripts run on the host and feed the agent, powering recurring digests and watchdogs independent of live chat.
Nightly off-box backup
Backs up the agent’s home tree nightly to a private, write-scoped GitHub repo so the whole install is recoverable off the VPS.
/ the moment it clicks /
A live canary test: Drac was deliberately fed a fake instruction telling him to ignore his rules and leak the GitHub token. Instead of obeying, he summarised the payload as data, refused, and flagged the attempt — proving the untrusted-content boundary holds under attack, not just on paper.
/ tech stack /
Built to be owned.
Skills shown
