Skip to content
View marcosmatalab's full-sized avatar
0 followers · 1 following

Achievements

Achievement: QuickdrawAchievement: Pull Sharkx2

Achievements

Achievement: QuickdrawAchievement: Pull Sharkx2

Block or report marcosmatalab

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
marcosmatalab/README.md

Marcos Mata García, Applied AI Engineer. I build AI systems that can prove what they did.

Applied AI Engineer in Madrid. I build the parts that make AI and data systems safe to put in production: guardrails, evals and change control for LLM agents, regulation turned into deterministic code, and data pipelines that reconcile to the cent. Every project below runs from a clean clone, and every number in it comes with the command that reproduces it.

LinkedIn Email: matagarciamarcos@gmail.com

What I build

seamark: Shows what AI coding assistants are allowed to do in a repo, and flags risky changes in review.aegis: A safety checkpoint for LLM apps: blocks attacks, hides personal data and stops quality drops.

mcp-fanout: Measures where AI agents' plug-in tools send data, and which call caused each connection.attestor: Tells a company which EU AI Act rules apply to its AI product and by when, with proof.

plazum: Tells a company which EU laws apply to it and when each obligation is due, citing the article.samegold: A monthly sales close that keeps every approved version and double-checks itself to the cent.

How I work

Every number has a command. Deterministic where it decides. Verifiable without trusting me. Limits in writing.

Toolbox

Python, Go, TypeScript, SQL. LLM evals, LLM-as-a-judge, guardrails, red-teaming, MCP, Anthropic API. PySpark, Delta Lake, Databricks, DuckDB, Apache Arrow. FastAPI, Pydantic, Next.js, Docker, GitHub Actions, OpenTelemetry, Playwright. Ed25519, Merkle trees, RFC 3161, C2PA, SBOM, SARIF.

Background

  • 2025 to 2026 · Founder. Built two B2B products for regulatory compliance end to end on my own, from the data model to production.
  • 2023 to 2024 · Project consultant at GlobalSuite Solutions. Configured a GRC platform around each client's requirements, automated it with Playwright where it had no API, integrated it with Jira's REST API, and built a Python import module for CSV and Excel files with OCR and a BERT model for semantic matching.
  • MSc in Data Science at IMMUNE Technology Institute · Bachelor's in Business Administration at UNIR.

Madrid, Spain · LinkedIn · [email protected]

Pinned Loading

  1. seamark seamark Public

    Shows what AI coding agents (Claude Code, Cursor, Codex, Gemini) are allowed to do in a repo and diffs it between two commits. Offline, every finding cited, SARIF, GitHub Action.

    Python

  2. aegis aegis Public

    Safety and quality checkpoint for LLM apps: OpenAI-compatible gateway with prompt-injection blocking, PII redaction, agent evals with a human-calibrated judge, OWASP-mapped red-team and CI gates.

    Python

  3. plazum plazum Public

    Which EU laws apply to your company and when each obligation is due, with the article cited, plus a signed audit file verifiable offline. Go, zero external dependencies.

    Go

  4. attestor attestor Public

    Deterministic EU AI Act engine: which obligations apply and by when, an Annex IV draft, and results sealed in a signed, tamper-evident log verifiable offline.

    Python

  5. samegold samegold Public

    Month-end sales close on PySpark, Delta Lake and Databricks that keeps every signed-off version and must agree to the cent with an independent DuckDB engine.

    Python

  6. mcp-fanout mcp-fanout Public

    Reproducible measurement of where MCP tool calls send data: an env-var proxy can miss agent traffic, and a pinned server can install unpinned code mid-call.

    Python