31 hands-on, production-grade agentic AI engineering projects built from scratch — AI agents, RAG, LLMOps, guardrails, evaluation, and decision-quality observability. By Mahesh Guntumadugu.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 3 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
describe_table
-
list_tables
-
query
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit bf5d5f3 · analyzer v33 · 2d ago
danger signals4
- dynamic code execution new Function() gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/tools.js :53
const fn = new Function(`"use strict"; return (${sanitized})`); - dynamic code execution new Function() gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/src/tools.js :53
const fn = new Function(`"use strict"; return (${sanitized})`); - dynamic code execution eval() gmaheshraju-Hands-on-AgenticAI-bf5d5f3/src/pages/blog/EvalEngineering.jsx :647
<Pill type="green">Outcome eval (did it end correctly?)</Pill> Score the final answer against ground truth, same as any RAG eval. Necessary but insufficient. It can't tell you that the agent called a - credential in logs credential in log gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/28-compliance-audit/src/demo.js :68
console.log(` password field: ${e3.input.password}`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 343
filesystem 38
- fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/02-agent-memory/src/demo.js :18
import fs from "fs"; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/03-agent-harness/src/demo.js :14
import { writeFileSync } from 'node:fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/03-agent-harness/src/tracer.js :9
import { appendFileSync, writeFileSync } from 'node:fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/06-llmops/src/dashboard.js :9
import fs from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/07-guardrails/src/runner.js :12
import { readFile } from 'fs/promises'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/08-eval-engineering/src/demo.js :13
import { readFileSync } from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/08-eval-engineering/src/regression.js :10
import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/08-eval-engineering/src/reporter.js :7
import { writeFileSync } from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/08-eval-engineering/src/runner.js :13
import { readFileSync } from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/comparison.js :7
import { readFileSync, writeFileSync, existsSync } from "fs"; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/demo.js :15
import { readFileSync, writeFileSync, existsSync } from "fs"; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/evaluate.js :8
import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
show 26 more
- fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/fineTuning.js :9
import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs"; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/rag.js :8
import { readFileSync } from "fs"; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/11-cost-latency/src/baseline.js :8
import { readFileSync } from 'fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/13-responsible-ai/src/demo.js :24
import { writeFile, mkdir } from "node:fs/promises"; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/13-responsible-ai/src/modelCard.js :11
import { writeFile, mkdir } from "node:fs/promises"; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/14-forward-deployed-engineering/src/checklist.js :10
import fs from 'fs/promises'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/14-forward-deployed-engineering/src/connectors/filesystem.js :8
import fs from 'fs/promises'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/14-forward-deployed-engineering/src/dashboard.js :14
import fs from 'fs/promises'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/14-forward-deployed-engineering/src/evalBuilder.js :11
import fs from 'fs/promises'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/coder.js :11
import { readFile, writeFile, mkdir } from 'node:fs/promises'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/demo.js :24
import { readFile, writeFile, copyFile, mkdir } from 'node:fs/promises'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/repoExplorer.js :8
import { readdir, readFile as fsReadFile, stat } from 'node:fs/promises'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/18-workflow-engine/src/demo.js :5
import { readFile } from 'node:fs/promises'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/19-agent-observability/src/demo.js :4
import fs from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/budget.js :1
import fs from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/commands/explain.js :1
import fs from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/config.js :1
import fs from 'fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/demo.js :62
import fs from 'fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/harness.js :1
import { writeFileSync, mkdirSync } from 'node:fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/memory.js :2
import { mkdirSync } from 'node:fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/prompts.js :1
import { readFileSync, writeFileSync, mkdirSync, readdirSync, existsSync } from 'node:fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/tests/selfImprovement.test.js :13
import { mkdtempSync, rmSync } from 'node:fs'; - fs gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/src/db.js :2
import { mkdirSync } from 'node:fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/scripts/check-freshness.mjs :18
import { readdirSync, readFileSync } from 'node:fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/scripts/check-slop.mjs :14
import { readFileSync, readdirSync } from 'node:fs'; - fs (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/scripts/prerender.mjs :17
import { mkdir, readFile, writeFile } from 'node:fs/promises';
shell / exec 3
- shell gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/repoExplorer.js :10
import { execSync } from 'node:child_process'; - shell gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/testRunner.js :11
import { execSync } from 'node:child_process'; - shell gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/git.js :1
import { execSync, execFileSync } from 'child_process';
network 24
- net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/01-agent-system-design/src/review.js :26
const res = await fetch('https://api.anthropic.com/v1/messages', { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/01-agent-system-design/src/tools.js :30
const res = await fetch(`${GITHUB_API}${path}`, opts); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/05-rag-pipeline/src/vectorSearch.js :29
* const response = await fetch('https://api.openai.com/v1/embeddings', { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/06-llmops/src/dashboard.js :8
import http from 'http'; - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/12-ai-ux/public/chat.js :210
fetch("/api/chat/stop", { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/.sample-project-backup/src/app.js :10
import { createServer } from 'node:http'; - net (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/.sample-project-backup/tests/app.test.js :26
const res = await fetch(`${baseUrl}/users`); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/sample-project/src/app.js :10
import { createServer } from 'node:http'; - net (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/sample-project/tests/app.test.js :26
const res = await fetch(`${baseUrl}/users`); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/coder.js :258
const res = await fetch(\`http://localhost:\${port}\${path}\`); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/16-ai-coding-agent/src/issueParser.js :155
const res = await fetch(apiUrl, { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/17-voice-agent/src/server.js :22
import { createServer } from 'http';
show 12 more
- net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/17-voice-agent/src/speechToText.js :94
// const res = await fetch('https://api.openai.com/v1/audio/transcriptions', { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/17-voice-agent/src/textToSpeech.js :122
// const res = await fetch('https://api.openai.com/v1/audio/speech', { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/llm.js :1
import https from 'https'; - net (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/22-context-engineering/src/tests/context.test.js :52
const code = 'async function fetchData(url: string): Promise<Response> {\n return await fetch(url);\n}'; - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/llm.js :79
const res = await fetch(`${this.ollamaBaseUrl}/api/tags`, { signal: AbortSignal.timeout(5000) }); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/tools.js :9
const res = await fetch(url, { signal: AbortSignal.timeout(10000) }); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/public/app.js :69
const res = await fetch(`${API}/providers`); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/src/llm.js :107
const res = await fetch(`${this.ollamaBaseUrl}/api/chat`, { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/src/tools.js :9
const res = await fetch(url, { signal: AbortSignal.timeout(10000) }); - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/src/components/Subscribe.jsx :29
const res = await fetch(ACTION, { - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/src/data/diagrams.js :44
{"n": "30", "dir": "self_improving_v1", "project": "self-improving-agent", "post": null, "alt": "L1", "title": "30 Self-Improving Agent \u2014 Research Loop + Prompt Evolution", "desc": "One process ( - net gmaheshraju-Hands-on-AgenticAI-bf5d5f3/src/pages/blog/AiUxPatterns.jsx :19
const res = await fetch('/api/chat', {
secrets 14
- secrets (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/01-agent-system-design/src/demo.js :82
"suggestion": "Use an environment variable: const JWT_SECRET = process.env.JWT_SECRET; and validate it exists at startup. Add JWT_SECRET to .env.example with a placeholder.", - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/01-agent-system-design/src/review.js :98
const githubToken = process.env.GITHUB_TOKEN; - secrets (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/05-rag-pipeline/src/demo.js :98
const SECRET = process.env.JWT_SECRET || 'dev-secret-change-in-production'; - secrets (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/08-eval-engineering/src/demo.js :119
const useLLM = !!process.env.GEMINI_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/08-eval-engineering/src/runner.js :209
const apiKey = process.env.GEMINI_API_KEY; - secrets (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/demo.js :91
const apiKey = process.env.GEMINI_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/evaluate.js :130
const apiKey = options.apiKey || process.env.GEMINI_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/fineTuning.js :297
const apiKey = process.env.GEMINI_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/prompting.js :97
const apiKey = process.env.GEMINI_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/09-fine-tuning-vs-rag/src/rag.js :187
const apiKey = process.env.GEMINI_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/17-voice-agent/src/speechToText.js :68
this.apiKey = apiKey || process.env.OPENAI_API_KEY; - secrets (weak) gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/20-ai-cli-tool/src/demo.js :14
+ const payload = jwt.verify(token, process.env.JWT_SECRET);
show 2 more
- secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/llm.js :10
this.nvidiaApiKey = opts.nvidiaApiKey || process.env.NVIDIA_API_KEY; - secrets gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/src/llm.js :10
this.nvidiaApiKey = opts.nvidiaApiKey || process.env.NVIDIA_API_KEY;
database 8
- db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/02-agent-memory/src/memory.js :20
import Database from "better-sqlite3"; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/04-multi-agent-systems/src/agents/writer.js :126
import { Pool } from 'pg'; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/06-llmops/src/metrics.js :8
import Database from 'better-sqlite3'; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/10-tool-use/src/database.js :8
import Database from 'better-sqlite3'; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/15-mcp-server/src/database.js :14
import Database from "better-sqlite3"; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/19-agent-observability/src/store.js :1
import Database from 'better-sqlite3'; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/30-self-improving-agent/src/memory.js :1
import Database from 'better-sqlite3'; - db gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/31-agent-chat/src/db.js :1
import Database from 'better-sqlite3';
tool registrations 3
- query gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/15-mcp-server/src/server.js :42
- list_tables gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/15-mcp-server/src/server.js :143
- describe_table gmaheshraju-Hands-on-AgenticAI-bf5d5f3/projects/15-mcp-server/src/server.js :174
declared dependencies 8
- react@^19.2.7
- react-dom@^19.2.7
- react-router-dom@^7.18.1
- @types/react@^19.2.17
- @types/react-dom@^19.2.3
- @vitejs/plugin-react@^6.0.3
- oxlint@^1.71.0
- vite@^8.1.1