# wshoffner.dev

> Personal workshop of Wes Shoffner, infrastructure engineer and founder of
> Clocktower and Associates. Writing about AI agents, MCP servers and
> infrastructure, plus open-source projects and a terminal full of retro games.

The site presents itself as WesOS, a three-panel desktop shell, but every page
is server rendered and readable without JavaScript. Structured capabilities,
navigation and access policy are published separately at
https://www.wshoffner.dev/.well-known/agents.json

## Writing

- [I Tried to Prove Agent-Readiness Saves Tokens. 52 Runs Later, I Can't.](https://www.wshoffner.dev/blog/i-tried-to-prove-agent-readiness-saves-tokens-52-runs-later-i-cant): I built a scanner that grades repos on how readable they are to AI agents, then ran a controlled experiment to see if any of it matters. The result is a null, plus three things I did not expect about how agents actually read your code.
- [I Put One Example in a Prompt and It Decided How the Agent Read My Whole Repo](https://www.wshoffner.dev/blog/i-put-one-example-in-a-prompt-and-it-decided-how-the-agent-read-my-whole-repo): I was benchmarking agent-readiness when I noticed the agent never opened a single markdown file. Not the README, not AGENTS.md, nothing. The cause was one helpful sentence I wrote in the prompt.
- [Your Phone as a Terminal: One Command, One QR Code, No SSH Client](https://www.wshoffner.dev/blog/termbeam): A code review of TermBeam, a Node CLI that shares a local terminal to your phone over a QR code — no SSH, no port forwarding, no static IP.
- [htop for Your Git History](https://www.wshoffner.dev/blog/gittop): A code review of gittop, a Go TUI that turns a dozen git log incantations into a seven-tab dashboard — with a participle-based filter language and braille-rendered charts. I wrote the project's first 22 stats tests and opened the PR.
- [What's Actually in Your Docker Image? Reading the Parser That Tells You](https://www.wshoffner.dev/blog/xray): A Rust TUI that inspects multi-gigabyte Docker images using 80 MB of RAM where dive chokes. I read the streaming tar-in-tar parser, wrote the project's first 55 unit tests, and got them merged same day.
- [When AI Writes Your Firewall, Check the Math](https://www.wshoffner.dev/blog/blackwall): An AI-generated eBPF firewall with 8,500 lines of Rust, an LLM honeypot, and a suspicion scoring bug that made its own behavioral engine useless. I read the code, fixed the math, and wrote it up.
- [A Rust TUI for Your UniFi Network That Actually Takes Code Review Seriously](https://www.wshoffner.dev/blog/unifly): A code review of Unifly, a Rust CLI and TUI dashboard that tames Ubiquiti's split API mess into 27 commands and 10 monitoring screens — plus a contributed NAT update feature.
- [Anatomy of a GitHub Actions Supply Chain Attack Targeting MCP Repos](https://www.wshoffner.dev/blog/anatomy-of-a-github-actions-supply-chain-attack-targeting-mcp-repos): A pull request to my MCP server Charlotte led me to uncover a supply chain attack spanning 250+ repos, 64 sockpuppet accounts, and five phases of escalating access — all funneling GitHub OIDC tokens to a single organization.
- [Your Artifact Registry Doesn't Need 2 GB of RAM](https://www.wshoffner.dev/blog/nora): A deep-dive into Nora, a 32 MB Rust binary that replaces Nexus and Artifactory — serving seven package protocols on under 100 MB of RAM.
- [I Renamed All 43 Tools in My MCP Server. Here's Why I Did It Now.](https://www.wshoffner.dev/blog/i-renamed-all-43-tools-in-my-mcp-server-heres-why-i-did-it-now): Charlotte 0.6.0 ships a breaking change, batch form fills, and lazy browser launch. Plus the story of 7 strangers improving code I wrote alone in February.
- [Your System Is Not a State Machine](https://www.wshoffner.dev/blog/your-system-is-not-a-state-machine): State machines can't describe agentic AI systems. The state space is too vast, the behavior isn't stochastic, and the flowchart is a lie. What replaces it?
- [Anthropic Leaked Its Own Source Code and May Not Own It](https://www.wshoffner.dev/blog/anthropic-leaked-its-own-source-code-and-may-not-own-it): The Claude Code leak exposed 500,000 lines of source code. The DMCA takedowns that followed may have exposed something worse — that Anthropic can't legally claim copyright over code its own AI wrote.
- [Your Encrypted Backups Are Slow Because Encryption Isn't the Bottleneck](https://www.wshoffner.dev/blog/concryptor): A look at Concryptor, a Rust CLI that pipelines io_uring and AES-256-GCM to hit GB/s file encryption on commodity NVMe — and the CI cleanup PR that followed.
- [Your Package Manager's Installer Doesn't Know Fish Exists](https://www.wshoffner.dev/blog/parm): A deep-dive into parm, a Go binary package manager for GitHub Releases — and why CLI tool installers keep ignoring fish shell users.
- [The Firewall Between Your AI Agent and Your Filesystem](https://www.wshoffner.dev/blog/greywall): A code review of greywall, a container-free sandbox that isolates AI coding agents with kernel-level enforcement — no Docker required.
- [Why Your SFTP Transfer Is Stuck at 2 MB/s (and the Fix Is a Protocol from 1983)](https://www.wshoffner.dev/blog/cubic): How a 2 MB/s file transfer on localhost exposed a protocol bottleneck in russh-sftp — and why cubic switched to SCP to fix it.
- [Finding Blocking Code in Async Rust Without Changing a Single Line](https://www.wshoffner.dev/blog/hud): A code review of hud, an eBPF profiler that attaches to running Tokio processes and finds blocking code without recompilation.
- [Nobody Reviews Their Agent's Code](https://www.wshoffner.dev/blog/crit): A code review of crit, a Go tool that brings PR-style inline review to AI agent output with multi-round feedback loops.
- [Secrets, Agents, and .env Files](https://www.wshoffner.dev/blog/your-ai-agent-can-read-your-environment-variables): Your AI agent can read your environment variables. It can also commit them. Here's how to make sure it doesn't.
- [Stop Letting Agents Push to Main](https://www.wshoffner.dev/blog/stop-letting-agents-push-to-main): Your AI coding agent is one bad prompt away from force-pushing to production. Here's the five-minute fix.
- [I Let an AI Agent Use My Browser Tool Unsupervised. It Found 3 Bugs in 20 Minutes.](https://www.wshoffner.dev/blog/i-let-an-ai-agent-use-my-browser-tool-unsupervised-it-found-3-bugs-in-20-minutes): Dogfooding Charlotte MCP by watching an agent struggle through a real task, then fixing everything it hit.
- [My MCP Server Was 2x Larger Than Playwright. Now It's 136x Smaller.](https://www.wshoffner.dev/blog/my-mcp-server-was-2x-larger-than-playwright-now-its-136x-smaller): How I took Charlotte from embarrassingly bloated to the most token-efficient browser MCP server available, and what I learned about building tools for AI agents.
- [Your LLM Doesn't Need 200 Lines of Test Output](https://www.wshoffner.dev/blog/tokf): A code review of tokf, a Rust CLI that compresses terminal output for LLM context windows — with 40 built-in filters and Claude Code integration.
- [This CLI Launches Parallel AI Agents. It Didn't Launch on Linux.](https://www.wshoffner.dev/blog/iloom): A deep-dive into iloom's codebase after its parallel AI agent workflow failed on Linux — and the four issues filed to fix it.
- [Your Benchmarks Are Lying to You (And This 148-Star Crate Knows Why)](https://www.wshoffner.dev/blog/tango): A code review of Tango, a Rust benchmarking harness that interleaves baseline and candidate runs to eliminate thermal drift and scheduling noise.
- [Your RSS Feeds Are Broken and This Rust Tool Fixes Them](https://www.wshoffner.dev/blog/rss-funnel): A code review of rss-funnel, a Rust-based RSS processing pipeline that filters, merges, and transforms feeds with a YAML config and web UI.
- [I Read 9,000 Lines of a Stranger's Mergetool](https://www.wshoffner.dev/blog/ec): A code review of ec, a terminal-native 3-way git mergetool in Go that replaces vimdiff with a sane TUI for resolving merge conflicts.

## Series

- [Charlotte MCP](https://www.wshoffner.dev/blog/series/Charlotte%20MCP): 4 posts
- [Guardrails](https://www.wshoffner.dev/blog/series/Guardrails): 2 posts
- [Review Bomb](https://www.wshoffner.dev/blog/series/Review%20Bomb): 17 posts

## Projects

- [Charlotte](https://github.com/TickTockBent/charlotte): MCP server that renders web pages into structured, agent-readable representations using headless Chromium. The web, readable.
- [VIMES](https://github.com/TickTockBent/vimes): Agent-first remote IDE for Claude Code. A daemon owns every Claude Code process on a dev box and streams structured state to any browser, so a phone is a full peer of the desk rather than a degraded view of it. Deterministic core, append-only event log, replay proven by byte comparison in CI.
- [ASM, ACP and LEAN](https://github.com/TickTockBent/agentic-web): Three open specs for the agentic web, delivered by a single /.well-known/agents.json. ASM describes a site, ACP describes its services, and LEAN is the design philosophy that keeps both small enough for an agent to actually read.
- [REPRAM](https://github.com/TickTockBent/repram): Distributed ephemeral coordination for AI agents. Lightweight key-value store designed for multi-agent workflows.
- [Johnny](https://github.com/TickTockBent/johnny): Lightweight, project-agnostic semantic memory for RAG. Get your eighty gigs of wet-wired recall.
- [gridrender](https://github.com/TickTockBent/gridrender): ASCII grid rendering system for React, with buffers, snapshots and diffing. Every terminal game on this site draws through it.
- [rogue-ts](https://github.com/TickTockBent/rogue-ts): A faithful TypeScript port of Rogue 5.4.4, the 1980 dungeon crawl. Type 'rogue' in the terminal to play the copy running on this page.
- [spectrum-display](https://github.com/TickTockBent/spectrum-display): ZX Spectrum 48K and 128K ULA display renderer, packaged as a React component.
- [Flynn](https://github.com/TickTockBent/flynn): Random arcade game SVG for your GitHub profile README. Welcome to Flynn's Arcade.

## Elsewhere

- [About](https://www.wshoffner.dev/about): who Wes is and how to make contact
- [Showcase](https://www.wshoffner.dev/showcase): all projects with status and links
- [GitHub](https://github.com/TickTockBent): source for everything listed here
- [Clocktower and Associates](https://www.clocktowerassoc.com): the practice, which audits sites for accessibility, technical SEO and agent readiness