Speculynx
Verified domain: speculynx.dev. Engineering lead: Sami Hameg (shameg.pro@gmail.com / contact@speculynx.dev).
✳ CASE STUDY · ARCHITECTURE & ROADMAP
How Claude Architected a Multi-Engine Cybersecurity Suite in 4 Months
A transparent, factual breakdown of how Anthropic's Claude served as our primary systems architect, security reviewer, and engineering force multiplier across 600+ commits, 5 repositories, and our upcoming AI agent security control plane.
01Legitimacy
A production cybersecurity suite built on strict invariants.
Speculynx is a cybersecurity solution built for API Security, AI Agent Capability Governance, and Network Policy Automation. We build for proof, not false confidence.
PyPI: speculynx
Distributed Python package (v0.3.2) providing deterministic, local-first OpenAPI static analysis and agent capability auditing.
Zero False Assurance
Deterministic engines compute facts from code; Claude synthesizes and challenges; the human engineer owns the final release gate.
Local-First Zero-Trust
Customer OpenAPI files are evaluated locally and never uploaded to our backend or third parties during static security analysis.
02Verifiable Metrics
The numbers: 604 commits, 5 repositories, 1 solo builder.
From June 2026 to October 2026, Claude (Claude 3.5 Sonnet, 3.7 Sonnet, and Claude 4.6 via Codex/CLI) operated as our core pair programmer and architecture reviewer.
604
Total Commits
Across 5 interconnected production repositories in the Speculynx suite.
> 85%
Claude-Assisted
Of core architecture and feature commits designed, written, or audited with Claude.
100+
Pull Requests
Structured PRs reviewed with automated CI gates, linting, and regression tests.
< 4 mo
Time to Market
From initial AST prototype to PyPI production releases and live web platform.
speculynx-cli
Core Engine & Scanner · Python 3.10-3.14 · Typer · Pydantic · AST Traversal88 commits (35 PRs)PyPI v0.3.2
- OpenAPI 3.0/3.1 recursive AST visitor resolving complex $ref cyclic dependencies.
- Deterministic Capability Mapper classifying API actions into risk tiers (read, mutation, financial, destructive).
- Integration Gate semantic contract diffing between baseline and candidate Git revisions.
- Vendor-neutral Network Policy Intermediate Representation (IR) compiling to Linux nftables.
- Integration with TypeSafe System One (Jev) and 42Crunch SAST/DAST verification.
speculynx-backend
Identity, Licensing & Control API · FastAPI · SQLAlchemy · PostgreSQL · Alembic · Docker162 commits (18 PRs)Production API
- Strict zero-trust boundary: customer OpenAPI files never touch the backend or cloud.
- Cryptographic offline licensing using asymmetric Ed25519 digital signatures.
- Stripe Checkout integration and signed HMAC webhook idempotency pipeline.
- Clerk & WorkOS authentication bridges with automated session token exchange.
- Privacy-first Sentry observability with zero customer payload transmission.
speculynx-dashboard
Customer & Security Portal · React 19 · TypeScript · Vite · Tailwind · Spectrum UI170 commits (24 PRs)Live WebApp
- Customer onboarding, key generation, and CLI terminal activation workflows.
- Commercial entitlement gating strictly isolating OpenAPI Pro from Agent Security.
- Zero-mock rule: frontend directly binds to live backend contracts without mock fallbacks.
speculynx-web
Public Platform & Knowledge Hub · Next.js 16 App Router · TypeScript · Vanilla CSS Systems178 commits (53 PRs)speculynx.dev
- Interactive AST analysis demo executing client-side with zero remote data upload.
- Clean Swiss minimalist design system with high-craft typography.
- Comprehensive knowledge cluster spanning 12+ deep AppSec and AI agent security guides.
speculynx-windmill
Automation & Worker Orchestration · Windmill · Bun · TypeScript4 commits (2 PRs)Active Workflows
- Pinned CLI container execution for automated scheduled vulnerability scanning.
- Bounded JSON artifact generation and team alerting workflows.
03System Design
How Claude functioned as an architectural partner.
We did not use Claude for generic boilerplate. We engaged Claude on deep algorithmic challenges, formal invariant definitions, and strict security isolation.
1. The Deterministic vs. Probabilistic Boundary
In cybersecurity, hallucination is a vulnerability. Together with Claude, we formalized the rule: deterministic Python AST engines produce undeniable facts from the OpenAPI contract, while Claude & AI models synthesize blast radiuses, interpret human intent, and suggest remediations. The human engineer always takes the final deployment decision.
2. Recursive OpenAPI Traversal & Cycle Resolvers
Enterprise OpenAPI specs frequently contain recursive schemas and circular $ref links. Claude designed a cycle-safe AST graph traversal engine in speculynx-cli that bounds traversal depth and computes schema footprints in linear time without stack overflows.
3. Agent Capability Mapping & Blast Radius Calculation
Before connecting an LLM agent to tool APIs, what operations could it theoretically execute? Claude co-designed the Capability Mapper algorithm, mapping OpenAPI endpoints into five permission categories (READ, STATE_MUTATION, FINANCIAL_TRANSACTION, PRIVILEGED_ADMIN, DESTRUCTIVE) to reveal exposure before integration.
4. Declarative IR to Linux nftables Compilation
For our Network Policy engine, Claude synthesized a vendor-neutral Intermediate Representation (IR). Instead of maintaining brittle firewall scripts, Speculynx translates high-level network contracts into provably correct, fail-closed Linux nftables rule sets with dry-run verification.
5. Adversarial Red-Teaming & Code Review
Prior to every major release, Claude acted as an adversarial reviewer: searching for SSRF bypass vectors in URL parsers, checking timing consistency in Stripe webhook verification, and ensuring zero leaks in offline Ed25519 license validation.
04Anthropic Roadmap
What we plan to build with Claude next.
Our engineering journey with Claude is accelerating. As autonomous agents become core enterprise infrastructure, Speculynx is building the runtime and pre-flight security layer powered by Anthropic models.
1. Official Speculynx MCP Server for Claude
We are developing a first-class Model Context Protocol (MCP) server for Anthropic Claude (Claude Desktop & Claude Code). This enables Claude to run static capability audits on external APIs before connecting tools, preventing prompt-injection-driven privilege escalation at runtime.
2. Autonomous Sandboxed Canary Execution
Pairing Speculynx's deterministic Capability Mapper with Claude's advanced reasoning to run synthetic canaries: Claude agents autonomously execute bounded test payloads against mock sandboxes to verify that live API authorization enforces declared contracts.
3. Automated Security Patch & Overlay Generation
Leveraging Claude 3.7 / 4.6's extended thinking capabilities to automatically generate OpenAPI Overlays and gateway firewall rules (Envoy, Kong, nftables) that fix discovered vulnerabilities directly via pull request.
4. Centralized AI Agent Capability Control Plane
A dedicated governance portal allowing AppSec and compliance teams to visualize, audit, and gate every API capability exposed to enterprise Claude agents across microservices.
05Founder Note
An unfair velocity advantage without sacrificing security rigor.
“Building a full cybersecurity suite—spanning low-level Linux nftables compilation, Python AST static analysis, asynchronous FastAPI licensing, and React portals—usually demands a team of 6 to 10 senior engineers. With Claude acting as our architecture co-pilot, adversarial auditor, and pair programmer, we delivered 5 interconnected production engines in under four months with rigorous test suites and zero compromise on security invariants.”
— Sami Hameg, Founder & Lead Engineer, Speculynx (shameg.pro@gmail.com)
SPECULYNX / CLAUDE ECOSYSTEM
Inspect your API contracts before handing them to an agent.
Start with our free local CLI analysis, or deploy Agent Security to govern autonomous LLM tool calling.