I study Data Science and Cognitive Science at UC Berkeley. I build tools and guardrails for AI agents — what they cost, where they break, and what stops them from doing damage.
Outside of that, I build tooling around my own training data, because I ride a lot and Garmin gets more wrong than you'd think.
🛡️ Agent guardrails • 🤖 AI agent tooling • 🚴 Endurance data • 🔓 Open source
fly-brain — a fruit fly's whole central nervous system (166,700 neurons, male CNS v1.0 connectome) run as a spiking network in PyTorch, learning to ride a road bike in side gusts. The simulator reproduces Shiu et al. (Nature 2024) spike for spike against their Brian2 code, then batches many flies on one GPU.
token-counter — audits monthly AI coding-agent spend across Claude Code, Codex, Cursor, and Gemini, and flags every run that would have been fine on a cheaper model.
fitpet — a Claude Code status-line companion that grows from real Garmin training load.
vibeapply — an AI-native job-application copilot: a browser extension that rides along on job boards, backed by a structured candidate profile and evidence bank. Scaffolded with agents, then audited — all nine findings fixed before any feature work.
cal-dining-scanner — watches UC Berkeley dining menus for the foods you care about and emails you when they appear. One command to set up, runs free on GitHub Actions. A friend spun it off into Cal-Bite, a full-stack version.
magene-garmin-fix — Garmin inflates climb 10–70× for third-party bike computers by throwing away barometric altitude. This fixes it.
analyze-cycling-hr-thresholds — a Codex skill that reconciles Garmin field data with raw CPET gas-exchange data into heart-rate thresholds, Garmin-ready zones, and labeled FTP proxies. It analyzes each source on its own and refuses the tempting shortcuts — no converting heart rate straight to watts, no treating a lab report's conclusion as raw evidence.
bay-area-venture-map — interactive map of the Bay Area venture cluster; filter by AUM, stage, sector, and check size.
qosmic-audit-harness — contracts-first agent harness: every claim in a generated audit must cite a real crawled page, enforced by a validator that the writer and the evaluator share.
Taxuspt/garmin_mcp — 1.3k ★, listed contributor
Garmin's API returns explicit null for sections you have no data in, so resp.get(k, {})
yields None — the default only applies when the key is absent. Most of my merged work
there is that bug and its relatives.
| #253 ✅ merged | Five unguarded null-section crashes — HRV baseline, progress-summary .items(), the sleep-score chain, body-battery event iteration, and a GraphQL {"data": null} that slipped past the existing guard. Each fix ships a regression test feeding the explicit-null payload. |
| #254 ✅ merged | Garmin occasionally stalls a request indefinitely; because every tool calls the client synchronously, one stalled call hung the whole MCP server until the client's ~4-minute timeout fired (issue #248). Bounds each proxied call on a daemon worker thread, surfacing a retry-able TimeoutError instead. Configurable via GARMIN_MCP_CALL_TIMEOUT. |
| #250 ✅ merged | Gear notes never appeared, because the pinned client reads the legacy filterGear endpoint and Notes only exists on /gear/v2/list. Joins the two — the v2 response hyphenates its UUIDs and the legacy one doesn't, so the join normalizes them first. |
| #334 | An agent could delete Garmin workouts in one call, with no gate. Now the first call returns a preview and needs_confirmation; the delete only happens on a second call with confirm=true, and each deletion is logged for an audit trail. |
| #375 | Garmin Coach plans came back without their race or schedule — surfaces race name and date, weekly workout count, and remaining workouts, and still omits fields cleanly when athleteRace is missing or malformed. |
| #170 | There's a Dockerfile but no published image, so everyone builds locally. Publishes multi-arch (amd64 + arm64) images to GHCR on release — no extra secrets, just GITHUB_TOKEN. |
| #167 | The security workflow had a # Add pip-audit here if desired placeholder where the dependency scan should be. Wires up pip-audit and clears the one CVE it flags — h11 request smuggling (CVE-2025-43859). |
NousResearch/hermes-agent — 251k ★
- #64036 — reasoning-visibility
leak on Gemini/Vertex: with
show_reasoning: false, users still got dozens of raw thought-summary blocks. Two causes — effort and visibility were coupled in the request builder, and Vertex returns summaries untagged unless you setthought_tag_marker, so nothing downstream could key on them. Splits the two knobs to match Google's own API. - #68524 —
web_extracthad one backend; expired credits or a rate limit meant total failure plus a gateway restart. Adds a configurable fallback chain.
SpencerLiang0114/RouteCraft — route planner for running, hiking, and cycling
- #15 ✅ merged — session auth, saved routes owned by the user who created them, and share links that expire.
- #14 ✅ merged — imperial conversions next to every metric route value.
Berkeley, CA — usually on a bike when I'm not here.