Proof, not a repository dump.

Node.js and Next.js development middleware that checks security headers, CORS, and npm dependencies and reports findings through logs or a browser overlay.

Problem

Security checks are often separated from the place where a developer is making the change, so findings arrive late and without context.

Work

BlueDot built middleware that checks headers, CORS, and npm dependencies and reports findings through logs or a browser overlay during development.

Evidence

The public TypeScript repository contains the middleware, checks, and developer feedback path for inspection.

Result

A class of application-security concerns becomes visible while the person who can fix it still has the relevant code and context.

Operational safeguards: Development middleware surfaces issues; it is not a substitute for a complete security review or production control set.

Beta security-focused MCP server for authorized assessments with policy-guarded tools, curated scanners, workflows, dashboards, scheduling, and audit logging.

Problem

An agent that can call useful tools can also create side effects. Permission, approval, credential, and audit decisions need to be explicit.

Work

GhostMCP combines policy-guarded tools, curated workflows, scheduling, dashboards, and audit logging for authorized security assessments.

Evidence

The public beta repository documents the server, tool controls, workflows, and audit trail. It is not presented as a universal safety guarantee.

Result

The design makes tool authority and operator oversight visible enough to review before an agent is allowed into a real workflow.

Operational safeguards: The repository describes a beta release; restricted deployment, operator control, and written authorization remain necessary.