Runworthy
The agent operations scanner: pip install runworthy, point it at a repo, read the graded report — what's confirmed, what to verify, what only you can answer.
Phase 1 shipped — scans now come back graded. Next: the web report.
Geoff "Lava" LavagninoObsidicore · Firebase / GCP
Are your AI agents safe to run? I'm building the answer.
Runworthy reads your repo, asks the questions code can't answer, and gives a plain verdict: GO or NO-GO, and what to fix first. The framework behind it is free for anyone.
Current work
RUNWORTHY
V0.2 · ON PYPI
engine + AFR grade — pip install runworthy, scan a repo, read the verdict
AGENT FLIGHT RULES
v0.2.0
29 controls · the Boldface · CC BY 4.0
LF-01
Now building
in workResearch Cascade
A progressive deep-research engine that plugs into any MCP client — persistent knowledge graph, source trust scoring, and it tells you when to stop. 78 tests, dogfood-validated.
The framework
Agent Flight Rules
The rubric Runworthy grades against: 29 operational controls across six domains, ten of them non-negotiable. Free under CC BY 4.0, and written to sit alongside OWASP's agentic Top 10.
LF-02
About
I build agent systems on Firebase and Google Cloud at Obsidicore, and safety tooling for anyone else running agents. Before that I led engineering at an EdTech company, shipping RAG pipelines for K-12 school districts on Vertex AI.
The Air Force is where I learned the operational side: security operations, contingency planning, checklists written for the day something breaks. Lava was my callsign. It stuck to the domain, and the rest shows up in how I build.
I think in systems, not silos. Father of three.
USAF veteranSecurity ops & contingency planning
Systems, not silosBehavioral counseling background meets systems engineering
Father of threeThree good reasons to log off on time
LF-03
What I got wrong
Two companies' worth of things I'd do differently, written down while they still sting.
Built for scale too early
Architected multi-tenant infrastructure for dozens of school districts when we had three. That engineering time should have gone to features that drove adoption.
Validate demand before scaling infrastructure.
Automated too soon
20+ CLI commands and four content pipelines before the strategy was validated. A pivot wrote most of it off.
Automate after the workflow is proven, not before.
Breadth over depth
Range is my strength for novel problems, but it can underestimate depth work. Now I pair with specialists instead of fumbling through alone.
Know when to bring in experts.
LF-04
Shipped work
AI research platform
Company900+ assets/month across four automated pipelines — Gemini analysis, summarization, knowledge-graph construction on Cloud Functions.
Multi-brand content automation
CompanyMulti-brand publishing pipeline: X API distribution, Cloud Scheduler timing, 20+ operational CLI commands.
K-12 RAG pipeline
CompanyCurriculum processing on Vertex AI embeddings + vector search; multi-tenant Firestore serving school districts.
Research Cascade
Open — repoMCP research engine — knowledge graph, trust scoring, self-regulation. MIT.
LF-05
Follow the build
Most of what I make ends up on GitHub, mistakes included.
I take a few Firebase, GCP, and agent-safety engagements a year.