---
name: ghost-protocol-portfolio
description: |
  Navigate Ryan's 87-repo Ghost Protocol portfolio fluently. Maps repo
  names to product lines (Dragon stack, Wyrm/Phantom Memory, Ghost
  themes, agency clients, creative work), names the canonical "where to
  look" for any concept (constitution, specs, MCP tools, billing), and
  tells you when a repo is a real product vs an intentional spec-kit
  placeholder. Use when Ryan mentions a repo by name, when you need to
  cross-reference how two products fit together, or when proposing
  tooling — default to using something he's already shipped before
  pulling in external dependencies.
argument-hint: "[product-line | repo-name | concept]"
user-invocable: true
---

# Ghost Protocol Portfolio

Ryan Sebastian (GitHub: `ghosts-lk`, org: `Ghosts-Protocol-Pvt-Ltd`) is
the founder of Ghost Protocol (Pvt) Ltd, Colombo, Sri Lanka. 87 repos
across security, AI memory, agency web, and creative work. Read this
once and you'll never need to ask "which dragon-thing is that?" again.

## Product lines

### Dragon stack — security tooling (flagship)

The "7 active repos" per `dragon-platform/README.md`:

- **PhantomDragon AI** (`phantom-dragon-ai`, Python) — AI pentesting framework. The brain.
- **DragonKeep** (Rust, *public*) — defensive backbone, 18 specialised engines (Shield/Patrol/Proof/Respond/Honeypot). Most mature Dragon tool. **DragonKeep-Pro** is the enterprise tier.
- **DragonNet** (TS) — self-hosted OSINT, "Maltego without the licence". `dragonnet-mcp` is the MCP wrapper.
- **PhantomDragon Memory** — see [[wyrm-capabilities]]; `phantom-memory-mcp` is its MCP wrapper.
- **Dragon Console** (TS) — operator GUI. Every CLI module in `dragon-cli` has a corresponding view here. Houses PhantomDragon, Phantom Memory, DragonNet, DragonKeep + commercial modules.
- **dragon-cli** (`@ghost-protocol/dragon@3.6.0`) — unified CLI for ALL Ghost Protocol products. Most mature plumbing.
- **DragonOS** (Shell, Buildroot) — minimal hardened Linux that boots into Dragon Console with DragonKeep as system daemon. "The dashboard is the login."

**MCP wrapper layer:** `phantom-memory-mcp`, `dragonkeep-mcp`, `dragonnet-mcp`, **`dragon-meta-mcp`** (Python — single MCP server fronting all four; configure one server in Claude Desktop instead of four).

**Placeholder / scaffold ring** (spec'd, no code yet — Ryan reserves names early):

`dragonagent`, `dragonbrain`, `dragonchat`, `dragonchronicle`, `dragonlens`, `dragonpilot`, `dragonscribe`, `dragonscansdk`, `dragonseal`, `dragonreef` (TS v0.1.0 — researcher-first bug bounty / PTaaS), `phantomdragon-ptaas` (client-facing buy/scan/report SaaS), `phantomdragon-action` (GitHub Action), `DragonHunt` (enterprise web scraping + B2B lead gen).

**Separate threads:** `DragonForge` (*public*, Shell) — laptop GPU passthrough toolkit (QEMU/KVM/libvirt/Secure Boot/TPM/VirtIO). Not security-related despite the name.

### 🧠 Wyrm / AI memory

- **Wyrm** (`wyrm-mcp` on npm) — persistent memory MCP, 114+ tools, OODA agent loop. See [[wyrm-capabilities]] for full tool taxonomy.
- **wyrm-billing** (JS) — Paddle MOR (chosen over Stripe; Sri Lanka isn't a Stripe merchant country) + Ed25519 license JWTs for Pro/Team/Enterprise.
- **wyrm-saas** — Wyrm cloud surface (uses spec-kit).
- **ghost-license** — self-hosted ED25519 license server (powers Wyrm Pro).

### 👻 Specter — agent runtime

**`ghost-specter`** (TS v1.0.1) — Autonomous AI agent runtime. Self-hosted, Telegram-controlled, security-first. 19 skill packs, ecosystem integration (Wyrm + DragonKeep + PhantomDragon), NL rituals, workspaces, web dashboard. "Built by a cybersecurity company — security isn't a feature, it's the foundation."

### 🎨 Ghost theme system

Nine `ghost-*` themes at v1.0.0, most are **empty placeholders** (names reserved). Two with real content:

- **`ghost-grimveil`** — Dark-Souls-inspired browser RPG. Phaser 3 + TypeScript + Vite. Stamina combat, dodge i-frames, souls recovery. Real game.
- **`ghost-video`** — Remotion MCP server for AI-driven video rendering.

### 🛠 Universal dev platforms

- **`Foundry`** (TS v2.0.0) — "Universal Development Platform — Build anything, ship anywhere." Scaffold/build/run/test/deploy in any language.
- **`GhostForge`** / **`GhostForge-IDE`** / **`GhostForge-Terminal`** — enterprise dev framework + VS Code ext + GPU terminal.

### 🇱🇰 Sri Lankan agency clients

- **`visionworkslk` / -v2 / -redesign** (TS v2.0.0) — Vision Works production house. v2 uses spec-kit.
- **Upali's restaurant ecosystem** — `DragonScale` (PHP, "Upali's Premium Ordering Portal"), `upalis-website`, `Upalis-Deployment`, `upalis-cpanel-deploy`, `Upalis`.
- **`DragonLair` / `lair`** (TS, Next.js 14, PostgreSQL, Prisma) — "Hotel Operating System" PMS + ERP + Distribution. 50+ data models. Built for Mapakada Village.
- **`dankotuwa` / `dankotuwa-porcelain`** — Noritake/Dankotuwa porcelain brand.
- **`moye-moye-ella`** — boutique hotel.
- **`biofuellanka`**, **`ves-muhunu`**, **`oshi-card`**, **`kerstin-card`** — smaller client work.

### ✍️ Ryan's creative work

- **`below-the-wire`** — Tech-noir tabletop RPG. *"Tech-noir tabletop. Colombo, tonight."* Forged in the Dark engine. Crew called Ghost Protocol — five operators in a basement off Justice Akbar Mawatha.
- **`below-the-wire-mobile`** — Godot 4.6 mobile companion. WIP.
- **`office-hours`** — *Literary crime novel by Ryan Sebastian.* Autofictional, first-person past tense, present-day Colombo.
- **`FairyAlmanac`** (JS) — manga/anime companion.
- **`wave.crafter`** (Rust) — sound wave crafting GUI.
- **`NexusAI / Ravenmoor / Dungeon-Drifters / Dragon-egg`** — earlier experiments.
- **`zumi`** (JS) — Streaming Claude proxy with three personas: Drogo, Berlin, Sumair.

### 🔍 Scraping / data

- **`ghost-scraper`** (`@ghosts/scraper@1.0.0`) — Enterprise-grade web scraper.
- **`SpectralScraper`** — placeholder.
- **`DragonHunt`** — see Dragon stack section above.

### ❤️ Social-good

- **`project-raksha` / `Raksha`** — *"Give a voice to the voiceless. Stop the cycle."* Digital safety platform combating online sexual violence in Sri Lanka. Raksha = "protection" in Sinhala (රක්ෂා). Anonymous reporting + awareness education + law enforcement coordination.

### 🔧 Infrastructure / org

- **`Ghost-Protocol`** (TS) — public web presence at `ghosts.lk`
- **`ghosts-lk.github.io`** — personal site
- **`copilot-skills`** — backup of all 91 Copilot skills (this one's master archive)
- **`midday`** — self-hosted Midday.ai (finance ops)
- **`.github`** (org) — org profile
- **`dragon-platform`** — *no code* — umbrella spec-kit for the Dragon stack. See [[dragon-spec-author]].

## Naming conventions

- `dragon-*` / `Dragon*` → security stack
- `ghost-*` / `Ghost*` → themes, scaffolding, agency tooling
- `wyrm-*` → memory product line
- A repo with **no README** is intentionally a placeholder ("Spec-kit
  scaffold pending. Placeholder for a Ghost Protocol product."). Ryan
  reserves the name first and fills in later.

## Spec-kit adoption

At least 10 repos use `.specify/`: `dragon-platform`, `dragonnet`,
`dragonreef`, `dragonscribe`, `dragonseal`, `phantomdragon-ptaas`,
`wyrm-saas`, `below-the-wire-mobile`, `visionworkslk`, `visionworkslk-v2`.
Ryan applies SDD beyond just security work — even his Godot game and
agency client redesigns use the constitution/spec/plan/tasks workflow.

## Cross-product topology

```
spec-kit (workflow)  →  dragon-platform (constitution + specs)
                              │
                              ▼ specs reference repos
                       Dragon stack code repos
                              │
                              ▼ exposed via
                       *-mcp wrappers → dragon-meta-mcp
                              │
                              ▼
                       Wyrm (memory layer, used by every product)
                              │
                              ▼ monetized via
                       wyrm-billing + ghost-license
                              │
                              ▼ operator surface
                       dragon-cli / dragon-console / dragon-os
```

## How to use this skill

- **Ryan mentions a repo by name** — recognize the prefix, infer the
  product line, know whether it's shipped or a placeholder.
- **You're choosing a tool** — default to something Ryan has shipped
  (`dragon-cli`, Wyrm, Foundry, `ghost-license`, `dragon-meta-mcp`)
  before suggesting external dependencies.
- **You need to navigate** — paths are under `~/repos/personal/` (his
  personal account) and `~/repos/org/` (Ghosts-Protocol-Pvt-Ltd org).
- **You're proposing changes that cross repos** — that's ≥2 repos,
  invokes Constitution rule VI: spec first. See [[dragon-spec-author]].