Host-level software composition analysis in submission
The research behind STAX — building dependency graphs from observed runtime behavior, and how it compares to manifest-based scanners.
Security engineer · builder · trickyfalcon
I build AI that keeps your data where it belongs.
PrivateSecureUsableAlways improving
I'm Mohammed Ashraf Ali — most people call me Ashraf, and online I go by trickyfalcon. By day I'm a senior security engineer working on the boundary between security and AI: governing what AI agents are allowed to do, watching what they actually do, and closing the gaps in between. A lot of the job comes down to one thing — making invisible things visible.
Coming from security, I keep running into the same problem: the privacy and data-exposure risks that show up the moment sensitive data leaves your control for someone else's AI service. That's the itch behind everything I build — AI that's private by default, secure by design, and usable enough that people actually adopt it. It runs on your own infrastructure, stays in your environment, and keeps getting better instead of standing still.
The rest of the time I run ByteBunker Labs, a small security research and product studio where I build the tools I wish already existed — and write up what I learn along the way.
The through-line
Everything I build runs on your own hardware.
Local models, local data, confidential compute — assurance that's structural, not contractual. The sensitive parts never leave your infrastructure or your jurisdiction. Private by default, secure by design, sovereign where it matters, and still usable. It's why STAX, Theriac, Delvix, and mdl run where your data already lives — not on someone else's API.
The rig
"Runs on your own hardware" isn't a figure of speech here. The whole stack above — local models, local data, local inference — runs on a rig I own and control, not rented GPUs and not someone else's cloud. And it's growing.
2× NVIDIA DGX Sparkmore coming online
What I'm building
-
STAX
notesHost-level software composition analysis that builds confidence-graded dependency graphs from what actually runs on a machine — across Windows, macOS, and Linux — instead of trusting manifests. Benchmarked head-to-head against Grype and Snyk.
-
Theriac
theriac.ainotesA multilingual pipeline for extracting traditional-medicine knowledge — the Unani and Ayurvedic traditions, plus Arabic, Hebrew, and Persian source texts — into a searchable, citation-grounded RAG system.
-
Delvix
notesA multi-agent platform for autonomous security engineering — investigation, response, offensive validation, remediation, and compliance, across the SOC, AppSec, and beyond. Model-agnostic and self-hosted. A ByteBunker Labs product.
-
A small command-line tool for managing GGUF models across local inference runtimes — the kind of thing you build once and then can't live without.
-
FingerKeys
notesA finger-worn BLE keyboard for driving AI coding agents without touching a laptop. Built on a Seeed XIAO nRF52840 Sense — half experiment, half daily driver.
Research & papers
Sovereignty is your alpha
Palantir's Institutional Sovereignty in the Age of AI makes the enterprise case for the argument this site is built on — structural assurance, model liquidity, owned compute.
Vulnerability research
Coordinated disclosures across the AI/agent and developer-tooling ecosystem — MCP clients, browser automation, and beyond. Each finding ships with a runnable proof of concept.
Field notes
Less formal than the papers — the problem, the approach, and the decisions behind each tool I've built: STAX, Theriac, Delvix, mdl, and FingerKeys.
Elsewhere
- GitHubtrickyfalcon
- LabsByteBunker Labs
- Email[email protected]
- X@bytebunkerlabs
When I'm not building, I'm usually deep in my homelab or wandering somewhere stranger — local LLM rigs, robotics, and the older ideas at the edges of cosmology and consciousness. I like things that make me think.