100eyes.watch

100EYES.WATCH - A WATCHTOWER, BUILT IN PUBLIC

MOST PEOPLE FIND OUT THEY WERE A TARGET AFTER IT'S TOO LATE.

I build and document ARGUS - an open-source guardian for the ordinary computer - and write about the scams and vulnerabilities people never see coming.

Follow the build ->Read the writing ->

ARGUS · SKILL CONSTELLATION

The watch, star by star

built — opens the write-up · planned — opens the idea note

  • Gate-2 Classifier

    The millisecond malware/goodware verdict before execution. Three candidates compared on EMBER 2018 v2 — XGBoost leads at 97.78% validation accuracy; CNN and fusion pending.

  • Local LLM Tier

    A local model for the uncertain zone only. It renders and recommends — containment decisions are made by the deterministic layer and execute before inference runs.

  • Cloud Escalation

    Escalation only: cases the local tier cannot settle. Raw bytes never leave the machine — the privacy boundary holds regardless of tier.

  • RAG Threat Intel

    Two channels: exact-match hash/URL/IP lookups that lock a verdict instantly, and fuzzy semantic similarity used as evidence context for the LLM.

  • Sandbox

    The dynamic gate: detonate what static analysis cannot settle, watch what it actually does.

  • Tray App

    The quiet surface: verdicts and status without opening anything.

  • GUI

    The full instrument panel: incident history, verdicts, and the audit log, readable by a human.

MAIN QUEST · ARGUS

A quiet instrument panel for what is already built.

ARGUS is an open-source, local-first Windows security daemon built around quarantine-first containment across files, email, pip/npm packages, browser extensions, and clipboard.

Open the progress node ->
  • Filesbuilt
  • Emailbuilt
  • Packagesplanned
  • Browserplanned
  • Clipboardplanned

ARGUS LOG

Latest from the log

phase-1 · email-scanner · 2026-06-25

Reading mail without touching it

Two-phase IMAP fetch: BODYSTRUCTURE first, then only the text parts, read-only via BODY.PEEK, with hard size caps.

research · gate-2-classifier · 2026-06-16

XGBoost sets the bar at 97.78 — on validation

XGBoost on 2381 EMBER features: 97.78% validation accuracy, 0.98 F1. CNN and fusion pending. Test set stays locked.

phase-1 · daemon · 2026-06-09

The daemon stands up

ArgusDaemon built: one processor thread routes watcher and scanner events through the gate pipeline. Five smoke tests pass.