Available for Industrial Attachment · 2026

Paul
Wambugu

Software Developer · Systems Engineer
Security Practitioner

Building security tooling, systems infrastructure, and open-source developer libraries from Kenya. I run a full offensive security lab on real hardware, maintain a cluster of purpose-built security MCP servers, and ship production code across Python, JavaScript, and C++.

8
Security servers
155+
Security tools
11
MITRE tactics
4th
Year undergrad
~/toolBOX — zsh
ls toolBOX/
kali-mcp/ web-mcp/ recon-mcp/
forensics-mcp/ pwn-mcp/
crypto-mcp/ rev-mcp/ ops-mcp/

docker ps --format "{{.Names}}"
KALI_CTF # running

echo $MITRE_COVERAGE
11/13 tactics · enterprise-grade

01 / About

Who I Am

I'm a software developer and security practitioner in my fourth year at Chuka University, pursuing a BSc in Applied Computer Science. I've been writing code for over six years across systems programming, backend engineering, infrastructure automation, and offensive security tooling.

My security work is grounded in a real lab — a Kali Linux container wired to a cluster of eight discipline-specific security servers covering reconnaissance, web exploitation, binary analysis, cryptography, forensics, and reverse engineering. The tooling is used to compete in CTF challenges and develop practical skill across the MITRE ATT&CK framework.

My open-source work includes ssh-shell-mcp — a 57-tool Python SSH orchestration library — and headscale-mcp, a server for managing self-hosted VPN infrastructure. Both are production-deployed and actively maintained.

I'm looking for an Industrial Attachment placement where I can contribute immediately — in security, systems, backend engineering, or infrastructure.

PythonBashC++ JavaScriptDockerLinux Kali LinuxCTFTailscale OWASPnmapBurp Suite
// identity.json
NamePaul Wambugu
LocationKenya 🇰🇪
UniversityChuka University
ProgrammeBSc Applied Computer Science
Year4th Year · 2022–Present
Daily MachineUbuntu 24.04 LTS
StatusOpen to IA / Roles
02 / Expertise Domains

Four Deep Specialties

Not a generalist who dabbles — these are the four areas I go deep in, every day.

🐚
Shell · Systems

Bash / Shell Engineering

Production-grade Bash and Zsh scripting — cron pipelines, daemon scripts, signal handling, process orchestration. If it runs on Linux, I can automate it. Shell is my first language.

Bash 5Zshcron tmuxawk/sedsystemd
⚙️
Infrastructure · Tooling

Systems & Infrastructure

Building developer tools and infrastructure that runs in production. SSH orchestration libraries, self-hosted VPN control planes, media processing pipelines, and communications servers.

PythonNode.jsDocker TailscaleFastMCPAsyncSSH
🔐
Security · CTF

Offensive Security

Running a full offensive security lab with a Kali Docker container, 8 discipline-specific security servers, and 155+ tools covering 11 of 13 MITRE ATT&CK tactics. Active CTF competitor.

Kali LinuxOWASPBurp Suite nmapsqlmapWireshark
🎨
Graphics · Design

Graphics & Visual Design

Vector illustrations, UI mockups, system architecture diagrams, and design systems. Design thinking applied to technical communication — making complexity legible.

InkscapeGIMPSVG CSS ArtUI/UXDiagrams
03 / Projects

What I've Built

Real systems. Real problems. Real code.

Full-Stack · Node + React + Python

Habitat

A songwriting application built around structured identity reasoning. Three-tier stack: React 18 frontend, Node.js/Express backend with 15 engine modules, Python/Flask ML microservice. 23 REST endpoints, Kiswahili and Sheng language support, lyric analysis toolkit.

ReactNode.jsPython/FlaskML
Open sourceGitHub →
Infrastructure · Python

headscale-mcp

MCP server for managing a self-hosted Headscale control plane — user and node management, pre-auth key lifecycle, subnet route control, and DERP map inspection via the Headscale REST API.

PythonFastMCPHeadscaleTailscale
Open sourceGitHub →
Academic · C++ · Algorithms

Spaghetti Sort

Multi-threaded simulation of the spaghetti sort algorithm in C++ — a physical sorting thought experiment implemented with concurrent threads. Demonstrates thread synchronisation and unconventional algorithm design.

C++17ThreadingAlgorithms
Open sourceView →
04 / Security

Offensive Security Lab

Not a course. A working lab built and maintained on real hardware — used daily for CTF competitions and security research.

The lab is structured around toolBOX — a private repository housing a cluster of eight discipline-specific security servers, each running independently with its own tools and Kali Linux Docker container as the execution backend.

The architecture mirrors how real security operations teams are structured: web exploitation, reconnaissance, binary analysis, cryptography, forensics, and reverse engineering each have their own server and mental model. The cluster covers 11 of 13 MITRE ATT&CK tactics at enterprise depth.

The lab also runs an isolated Docker network hosting OWASP Juice Shop, DVWA, and WebGoat — accessible only via private Tailscale mesh — for safe web exploitation practice.

MITRE TacticServerCoverage
Reconnaissancerecon-mcpFull
Initial Accessweb-mcpFull
Executionkali-mcpFull
Privilege Escalationpwn-mcpFull
Credential Accesscrypto-mcpFull
Collectionforensics-mcpFull
Defense Evasionops-mcpFull
Lateral Movementops-mcpRoadmap
Exfiltrationops-mcpPartial
kali-mcp
14 tools
Container Gateway
web-mcp
16 tools
Web Exploitation
recon-mcp
15 tools
OSINT / Recon
forensics-mcp
17 tools
DFIR / Forensics
pwn-mcp
9 tools
Binary Exploitation
rev-mcp
12 tools
Reverse Engineering
crypto-mcp
13 tools
Cryptography
ops-mcp
12 tools
Red Team Ops
toolBOX is a private repository. The public-facing servers — forensics-mcp, kali-mcp, recon-mcp, web-mcp, pwn-mcp, rev-mcp — are available on GitHub and actively used in CTF competition environments.
05 / Roadmap

2026 Portfolio Blueprint

Three projects in active development — designed to prove full-stack, infrastructure, and open-source competency for both Kenyan and global markets.

● In Development

PesaFlow

A real-world fintech application integrating the Safaricom Daraja API for M-Pesa STK Push, C2B, and B2C payment flows. Includes transaction ledger, SMS notifications via Africa's Talking, and an offline-first PWA for low-bandwidth areas.

Stack: Next.js · Node.js · PostgreSQL · Daraja API · AT SMS
Target: Safaricom · Equity Bank · Kenyan Fintechs
○ Planned · Q3 2026

EdgeCache

A benchmarking and observability project for distributed caching. Measures Redis vs in-process caching under load, with a live dashboard showing hit rates, latency distributions, and memory usage.

Stack: Go · Redis · Docker · Grafana
Target: Performance-focused engineering roles
⬡ Open Source

daraja-sdk

A typed, modular Node.js/Python SDK for the Safaricom Daraja API — the M-Pesa integration layer every Kenyan developer has had to re-implement from scratch. Full ISP compliance, retry logic, and webhook signature verification.

Stack: TypeScript · Python · npm · PyPI · GitHub Actions
Target: Kenyan dev community · Open Source
06 / Engineering Philosophy

SOLID by Design

Every project in this portfolio is architected around these principles — not as theory, but as working code decisions.

S
Single Responsibility
Each module does one thing. In ssh-shell-mcp, file ops, tunnelling, and fleet tools are split across isolated Python modules. In toolBOX, each security discipline has its own server.
O
Open / Closed
New payment providers in PesaFlow extend a base PaymentGateway interface — no existing code is modified. The Strategy pattern makes this natural.
L
Liskov Substitution
Any CacheBackend implementation (Redis, in-memory, file) is fully substitutable in EdgeCache — same interface, no surprises at the call site.
I
Interface Segregation
ssh-shell-mcp's 57 tools are grouped into focused interfaces: FileOps, SessionManager, TunnelManager — consumers depend only on what they use.
D
Dependency Inversion
High-level modules depend on abstractions. daraja-sdk's HTTP layer is injected — swap the client or mock it in tests without touching business logic.
07 / Tech Stack

Tools of the Trade

Bash / Zsh
Python 3.12
Node.js / ESM
C++17
PHP 8
TypeScript
React 18
Go (learning)
Docker
Docker Compose
Linux · Ubuntu
Tailscale / WG
Caddy
PostgreSQL
FastMCP
AsyncSSH
Git · GitHub
Kali Linux
Burp Suite
nmap · sqlmap
Wireshark
Ghidra · radare2
binwalk · hashcat
Inkscape
GIMP
Redis
08 / Local Edge

Built for Kenya

Understanding the local tech ecosystem is a competitive advantage. These are the competencies that matter for Kenyan engineering roles — from Safaricom to early-stage startups.

M

Daraja API (M-Pesa)

STK Push, C2B, B2C, and account balance integrations. The payment layer behind nearly every Kenyan product — I'm building a typed SDK to make it accessible to every developer.

📡

Africa's Talking

SMS, USSD, and voice integrations for low-bandwidth, feature-phone-first markets. Building for real Kenyan network conditions, not ideal ones.

🔒

Security Culture

Kenya's growing fintech and data sectors need security practitioners who understand local threat models. My lab and CTF practice are directly applicable to this gap.

🌍

Open Source for Africa

Building reusable SDKs and tooling that other Kenyan developers can use — reducing duplicated work across the ecosystem and raising the baseline for everyone.

09 / Contact

Get in Touch

I'm actively looking for Industrial Attachment opportunities in security, systems engineering, backend development, or infrastructure. If you're building something real in Kenya or globally — let's talk.