Alexcesar Available for hire Remote · Rio de Janeiro · UTC−3 PT / EN Available
From a keystroke to a grounded answer.
Every hop on one machine.
Type a questionRetrieve three chunksAnswer locally
THIS MACHINE — OLLAMA + CHROMADB ON DISK INGESTION — RUNS ONCE, BEFORE ANY QUESTION IS ASKED WSTG DOCS THE CORPUS CHUNKS 2000 CHARS · 300 OVERLAP VECTORS all-MiniLM-L6-v2 LOCAL INDEX chromadb QUESTION EMBED RETRIEVE “How do I test a login form for SQL injection?” AGENT DECIDES: SEARCH THE CORPUS NOTHING TYPED LEAVES THIS MACHINE SAME MODEL USED ON THE CHUNKS all-MiniLM-L6-v2 384 NUMBERS · MEANING, NOT WORDS chromadb THE 3 NEAREST CHUNKS, NO MORE QUESTION VECTOR LANDS AMONG THEM OBSERVATION HANDED BACK TO THE AGENT CONTEXT PROMPT ANSWER WSTG · INPUT VALIDATION …submit a single quote and observe… WSTG · ERROR HANDLING …verbose database errors reveal… WSTG · AUTHENTICATION …login forms accept crafted input… CONTEXT — THE 3 CHUNKS USER — THE QUESTION ASSEMBLED IN MEMORY, ON THIS MACHINE llama3.1:8b RUNNING UNDER OLLAMA, OFFLINE GROUNDED IN THE 3 CHUNKS ABOVE NO EGRESS STACK, CHUNK SIZE AND RETRIEVAL COUNT ARE THE REAL ONES — CHUNK TEXT AND VECTOR SHAPES ILLUSTRATIVE THIS MACHINE INGESTION — ONCE, BEFORE ANY QUESTION WSTG DOCS THE CORPUS CHUNKS 2000 · 300 OVERLAP VECTORS all-MiniLM-L6-v2 LOCAL INDEX chromadb QUESTION “How do I test a login form for SQL injection?” AGENT DECIDES: SEARCH THE CORPUS EMBED all-MiniLM-L6-v2 SAME MODEL AS THE CHUNKS RETRIEVE THE 3 NEAREST CHUNKS, NOTHING ELSE chromadb CONTEXT WSTG · INPUT VALIDATION WSTG · ERROR HANDLING WSTG · AUTHENTICATION PROMPT CONTEXT — THE 3 CHUNKS + THE QUESTION ANSWER llama3.1:8b · ollama STACK, CHUNK SIZE AND RETRIEVAL COUNT ARE REAL CHUNK TEXT AND VECTOR SHAPES ILLUSTRATIVE

Lab · AI · Security

Security Agent.

Kind
AI · Security
Role
Code
Stack
Python · LangChain · ChromaDB · Ollama
Started
2025

A retrieval-augmented pipeline over the OWASP Web Security Testing Guide, running end to end on one machine — no cloud, no API key, no data leaving the box. The diagram above follows a single question through it.

An index built once

Before any question is asked, the OWASP WSTG corpus is split into 2000-character chunks with 300 characters of overlap, so a passage cut mid-sentence still survives whole in its neighbour. Each chunk is embedded with all-MiniLM-L6-v2 and the vectors land in a local ChromaDB index. This happens once; after that the corpus is never read again at question time.

A question takes the same path

A typed question is embedded by the same model, matched against the index, and the three nearest chunks come back. They are assembled into a prompt alongside the question and answered by llama3.1:8b running under Ollama. The answer cites the retrieved material instead of improvising from the model’s training — which is the point of retrieval: the model explains, the corpus grounds.

Where the pipeline sits

Retrieval is one half of the agent. The other is a set of 14 deterministic OWASP patterns that flag vulnerabilities in Python code instantly; the RAG path supplies the context and the suggested fix for what they find. The pipeline itself started life as a retrieval assistant over pharmaceutical PDFs — swapping the corpus for security material re-pointed the whole system without changing its shape.

Source on GitHub ↗