An agent you can question
before you hire the engineer.
This site sells AI agents, so it should let you talk to one. The demo at /lab/brain is a public slice of my personal RAG assistant: ask it about my services, pricing, or how I build, and it answers with citations to the documents it actually read. Ask it something its corpus doesn't cover and it says so — including questions about its own infrastructure, on purpose.
Every AI site says "agents". Almost none will show you one.
The strongest objection to anyone selling AI engineering is also the simplest: show me. A portfolio of case studies is testimony; an agent you can open in a tab and interrogate is evidence. I wanted a demo a skeptical visitor — or an AI assistant researching on their behalf — could poke at directly, without a sales call in the way.
The hard part is not the chat. It is that a public demo of a personal knowledge system is a security exercise: the corpus, the port, the model, and the budget are all attack surface. Most demos die here — either locked behind a form, or open and leaky. This one is designed to be neither.
Grounded by contract. Contained by construction.
Two properties carry the demo: every claim traces to a retrieved source, and the corpus it serves cannot leak what it was never given.
No source, no claim
Retrieval comes first — Qdrant hybrid search over a curated corpus — and the model answers only from what came back, with numbered citations rendered in the UI. When the corpus is silent, the agent declines instead of improvising. Ask it what my infrastructure looks like: the honest answer is that its context does not say.
The demo cannot leak what it cannot see
The public collection is seeded from an allow-list, and the first thing removed from it was the demo's own deployment plan — the corpus a demo serves must never document the demo. Owner credentials are simply not present in the deployment, anonymous callers get 401 at the origin, and the serving process rate-limits per visitor even though every request arrives through one proxy.
A Vercel zone in front, my own hardware doing the thinking.
The site rewrites /lab/brain to a separate Next.js project; from there every hop inward is authenticated, tunneled, and running on machines I own.
Retrieval
Qdrant · vector + keyword hybrid
Guardrails
401 anonymous · per-visitor rate window · 15-message cap
Degradation
lab asleep → recorded answers, labeled as recorded
Kill switch
unset one env var → the route 404s, nothing else moves
The choices that made it safe to leave running.
Each of these closes a specific way a public AI demo goes wrong — cost, leakage, or quiet dishonesty.
Local inference, on purpose
Answers are generated by a local model on my own GPU through a LiteLLM gateway, so an abusive burst costs electricity, not an API bill. The quality lever stays one environment variable: point CHAT_MODEL at Claude and nothing else changes. A narrow curated corpus, low temperature, and visible citations are what keep a small model honest in the meantime.
The corpus was curated by subtraction
The seed allow-list originally included the web deployment plan — hostnames, ports, tunnel names. Retrieval over that corpus would have recited the network map to anyone who asked. It was removed with a comment explaining the rule, and the leak question became a regression test that runs against the live API.
Rate-limit where the counter is real
The Vercel proxy's in-memory limit is advisory — every instance counts alone. The origin is one process, so its sliding window is the enforceable one. Behind the proxy all visitors share a few egress IPs, so the proxy declares the real visitor per request, and the origin trusts that declaration only from the caller holding the service token.
Anonymous means turned away
The tunnel makes the origin port world-reachable, so the origin refuses anonymous callers outright rather than trusting the front door to filter them: curl gets 401, the health pulse stays open for the uptime monitor, and in this mode sessions are minted by nobody. The proxy is the only party holding a token.
Fail closed, degrade honestly
Production without a Turnstile secret refuses to serve rather than serving unverified. When the home lab sleeps, the demo switches to recorded answers behind a banner that says exactly that — a degraded demo that admits it beats a live one that lies about being live.
Open the demo and try these yourself.
- Ask what a custom AI agent costs — the answer cites the pricing document and matches the anchor this site publishes.
- Ask about its infrastructure — it declines: the corpus it serves does not document the system it runs on, and there is a regression test holding that line.
- Every answer renders its sources; the retrieval is Qdrant hybrid search over a deliberately narrow corpus.
- Inference costs $0 per request on local hardware; the upgrade path to a frontier model is one environment variable.
- 141 automated tests pass in the repo behind it, covering auth modes, corpus isolation, and the rate window.
The leak that never shipped
The first corpus draft included the demo's own deployment plan. One test question — "what does your infrastructure look like?" — would have returned hostnames, ports, and tunnel names with citations. The document came out of the allow-list before anything went live, the rule got written down where the next seed script edit will read it, and the question now runs as a regression test against the deployed API.
What's next
A replayable run of the IFTA agent inside its own case study is next, so the second demo costs as little as this one. The corpus grows as new work ships; the model swap to Claude is waiting on nothing but a reason.
Want a cited-answers agent over your own documents?
The demo is a narrow public slice of a system I use every day. If your team needs an assistant that answers from your docs with citations — scoped, contained, and honest about what it does not know — that is a project I build end to end.