John Wellard // Senior Agentic AI Developer & Smart-Contract Auditor

This is the GitHub mirror of jw3b.dev. The real thing hands you the controls: paste a contract and watch it get screened, talk to a concierge grounded in a verified evidence register, or drain a live vault on a testnet. Everything here is a pointer to that.

#About

John Wellard (Johno), known as JW3B and AgileGypsy. Senior Agentic AI Developer and Smart-Contract Auditor, founder of AgileGypsy Labs in the UK.

• Ships agentic AI end-to-end. Multi-agent pipelines, graph retrieval, edge RAG, delivered as running products rather than decks.
• Audits smart contracts autonomously, backed by a competitive audit record. The product is KTHULHU, live at kthulhu.co.
• Delivers long-horizon work across borders. Scope it, size it honestly, name the risks.
• Lives in the terminal. Local LLMs, edge backends, and the Linux box this site was built on.

#Audit Record

Every number on jw3b.dev routes through an evidence register with a source pointer, and the build fails if unsourced copy appears. The citable record is:

Sample findings from the competitive record, reproduced on jw3b.dev/work:

• Critical unauthorized withdrawal in withdrawAllFailedCredits().
• Reentrancy in claimFaucetTokens allowing double token claims.
• Deposit slips causing investor funds to be accepted without minting shares.
• Battle-arena denial of service via non-rapper NFT token injection.
• Pseudo-randomness exploit in go_on_stage_or_battle().

There are deliberately no "TVL secured" or "protocols protected" figures. They cannot be evidenced, so they are not claimed. Also hunting on Immunefi, with a focus on protocol invariants and fuzzing.

#Live Surfaces

Try the portfolio instead of reading about it.

Every live surface degrades honestly. When a backend, wallet or chain is unavailable you get a labelled recorded run or a book-a-call floor, never a dead end. That property is tested, not hoped for.

#Labs

Active architectures under AgileGypsy Labs.

• KTHULHU. AI-powered smart-contract security as a service: continuous protection with a competitive audit record behind it. Live at kthulhu.co.
• Director OS. A deterministic fly-by-wire orchestration cockpit for autonomous software engineering: an 845-task DAG on Cloudflare Durable Objects, an MCP bridge of 13 strictly typed tools, headless local PTY daemons, cross-session RAG, and an automated Git worktree pattern.
• Nano-Bot-Trader. High-frequency crypto trading infrastructure scaling a 15-strategy MEV matrix across ephemeral GCP VMs and Durable Objects, with a three-tier AI orchestration model air-gapped under a strict "never hold keys" principle.
• Kointel. An edge-native crypto tax engine for South African SARS compliance and CARF enforcement: Next.js 15, Cloudflare Workers and D1, automated capital-versus-revenue classification, ZAR FIFO lot matching, POPIA-compliant encryption.

#Selected Repositories

#Stack

agents      Claude · multi-agent pipelines · graph retrieval · edge RAG · MCP · local LLMs (Ollama)
web         TypeScript · React 19 · Next.js · Vite · Tailwind · Cloudflare Workers, Durable Objects, D1, KV, R2, Workers AI · GCP
chain       Solidity · Yul · Foundry · Hardhat · ethers / viem / wagmi · Uniswap v2/v3 · Curve · Base and Base Sepolia · XMTP
voice       Whisper on WebGPU → WASM → server, disclosed when it switches
security    competitive audits · invariant fuzzing · deterministic heuristics · claims gating · secret scanning

#Certifications

• SSCD+, Cyfrin Updraft Solidity Smart Contract Developer certification.
• Smart Contract Security, Cyfrin.
• Advanced Foundry, Cyfrin.
• Advanced Web3 Wallet Security, Cyfrin.
• Neo4j Certified Professional, credential.

#Hire Me

Engagements start at jw3b.dev/hire-me: pick the shape of the work, size it honestly, and it ends in a booked call rather than a form that goes nowhere.