Welcome to John Turner's Blog

Professional headshot of John Turner, a cybersecurity professional with 20+ years of experience

I build security tools and open source infrastructure. Right now I'm working on trust registries and market data for AI agents, Bitcoin payment rails for inference, supply chain provenance, and on-device AI in the browser. By day I lead product security at Bose. By night I write Rust and ship side projects.

This is where I share what I'm building, document lessons learned, and explore the intersection of security, privacy, and practical software engineering.

3goodsources: Trust Registry for AI Agents (Rust/MCP): A cryptographically-signed trust registry that helps AI agents identify reliable information sources. Built with Rust and the Model Context Protocol (MCP), it signs the registry with the curator's PKARR key, keeps a signed, hash-chained audit log of every change, and lets curators run their own nodes and endorse each other. When an AI agent needs to know which sources to trust, 3goodsources delivers ranked, verifiable recommendations. Trust infrastructure for the AI agent ecosystem.

Selected Projects

A focused look at the security and AI-agent infrastructure I'm building:

  • 3goodsources: Trust registry for AI agents (Rust/MCP)
  • tokenstats: Live inference price and quality feed in USD and sats, with price history (Rust)
  • cclink: Encrypted Claude Code session handoff between machines over the Mainline DHT (Rust)
  • arbstr: LLM routing proxy with Bitcoin inference settlement (Rust)
  • Sealedge: Cryptographic provenance for edge data and SBOM attestation (Rust)
  • cipherpost: Serverless, accountless handoff of keys and secrets with signed receipts (Rust)
  • blindjoin: Bitcoin CoinJoin coordinator using blind signatures, signet/testnet only (Rust)
  • more eyes: Sourced notes on what evidence a security claim needs
  • Chat Signal: On-device AI for YouTube and Twitch live chat (Chrome)
  • ... and more projects

Recent Blog Post

more eyes: Open Is Not the Same as Looked At more eyes is a set of sourced, versioned notes. Each one takes a common claim about software or bitcoin custody, states what evidence would support it, and reads the public record against that. Eight notes so far, on custody, multisig, releases, packages, confidential AI, fallbacks, and vulnerability reports. CC BY 4.0, and corrections are wanted. Published November 2, 2026

Explore my projects, read about my experience, or get in touch.