Cabling, NICs and servers
Cabling plans, NIC choice and server hardware, through to how each NIC is virtualized for your VMs.
We check what the switch sees on each port, not what the label says.
Every machine answers. We know what to ask.
With Claude we take on infrastructure and software work of any size. We are strongest on our own ground, from L1 to L7: Proxmox and Ceph clusters, the networks under them, and moves from VMware to Proxmox. We have worked these layers as a duo since 2012: that is how we know what to ask, and how to check the answer against your running systems.
Read-only first. One approval per change.
› Is this cluster safe to patch this week?
$ pvecm status
$ pvesh get /cluster/resources --type node
$ ceph osd df
ASK Can a node drain, rest under 70% RAM?
ANSWER yes: node-4 drains first
CHECK rule: drain under 70% RAM · arithmetic
ASK Can Ceph rebuild if a node fails?
ANSWER not safely: osd.31 is at 89%
CHECK ceph osd df · backfillfull 90%
ANSWER not yet: reweight osd.31, then patch
plan ready · waiting for your approval
2012as a duo in virtualization, software-defined storage and networking
Oct 2025with Claude, every working day
From the cable to the code.
Below are our own layers, from L1 to L7, and the software we build around them. Larger work means more phases, never fewer checks. In every layer the split is the same: Claude reads and drafts, we judge and check against your running systems, and you approve every change. Infrastructure work starts with a health check.
Networks
Switching and LACP, routing, VXLAN overlays and software-defined networking, firewalls and redundant uplinks.
We check what the device is running, not what the config says it should run.
Storage and virtualization
Proxmox and Ceph clusters, expansions and upgrades that keep quorum. VMware to Proxmox in waves, each with a way back that we test before the wave runs. Predictable workloads brought back from public cloud onto your own hardware.
We ask what the second failure does, not only the first.
Services and redundancy
The databases, proxies and identity services inside your VMs, and the failover around them.
A failover nobody has tested does not count.
Security and incidents
What answers from outside your allowlist, which filters are actually applied, and incident response when something is already wrong.
We test an allowlist from outside it, never from inside.
MCP servers and Claude Code rollout
We build MCP servers that give Claude read-only access to your systems. We roll out Claude Code to your team, with a rules file that holds your estate's facts and your red lines.
Every write waits for a named person's approval.
Software development
Internal tools, automation and the software around your operations, built with Claude Code from a written brief. Our instruments and this site are built the same way.
Tests check what the software must and must not do; we decide what ships.
We do not train models.
Health checkFixed scope, read-only, price agreed up front.
ProjectMigrations, builds, MCP servers and software, in phases, each with a way back.
RetainerMonthly hours for operations, upgrades and capacity, with the same gate on every change.
We ask. We check. You approve.
Searching the web was once a skill worth hiring for. Today the skill is talking to machines: the right question, the right context, and knowing which answers to distrust. For the past year we have done it with Claude. A search engine returns pages; Claude returns a plan or a command, and only someone who knows the layer underneath can judge whether it is safe to run. This is how we judge it.
Measure
Claude collects configuration, logs and metrics with read-only access. We read the output ourselves before anyone forms an opinion.
Plan
We put the findings to Claude with your estate's facts and our rules, and check every answer against the live system. What survives, we write as a step with a check and a rollback.
Approve
You see each step, its check and its way back. You approve one step at a time; an approval does not carry over.
Change and verify
Only the step you approved runs: through the machine, or by our hand for anything physical. We check the result and record it, including when it fails. If the check fails, we roll back.
Hand over
You keep the scripts, the runbooks and the rules file. No lock-in.
Claude answers. We answer for it.
A rules file per estate
It holds your estate's facts and its red lines. Claude reads it before we ask anything.
Scoped tools
We give the machine scoped tools: read-only by default, every write behind your approval, every call logged.
What the machine never gets
Passwords and keys never enter the machine's context. They go straight to the command that needs them and never reach a log.
This is how we run our own systems.
Infrastructure Health Check
We run it on your estate, read-only, and change nothing.
A fixed-scope review of your Proxmox, Ceph, VMware or network estate. Claude reads and drafts, we judge every finding, and you get the report and the plan.
What the machine reads
- Servers
- Hardware health and firmware levels, through the management controller (BMC).
- Clusters
- Quorum, HA state, and version drift between nodes.
- Ceph
- Health, PG and OSD state, fill and balance, and the capacity trend.
- VMware
- Hosts, VMs, datastores and their networks, read through vCenter: the inventory a move to Proxmox starts from.
- Backups
- Job results for the last 30 days. Not restore tests.
- Network
- Switch and firewall configuration, including where each filter is actually bound, and link aggregation (LACP) and loop protection on both ends of each link.
- Exposure
- What answers from outside your allowlist, tested from outside it. The probe needs your written OK on scope and source addresses.
What we need
Accounts you create for us and revoke when we are done, all read-only: an audit role on Proxmox and Proxmox Backup Server, a vCenter user, a Ceph key, a user on your switches and firewalls, and a BMC account. We never ask for an administrator password.
What leaves your estate
What leaves your estate is agreed in writing before the check starts: which output reaches Claude, what we mask, and that passwords and keys never reach Claude.
What you get
- Findings ranked by risk, each with the output line it came from
- A plan in which every step has a check and a rollback
- A walk-through call with your team
Where it stops
It changes nothing, tests no restores, and is not a penetration test.
If you want us to carry out the plan, each step waits for your approval.
Ask for a health checkfindings.md · 4 findingsillustrative
HIGHceph osd.31 at 89%ceph
MEDnightly-db backup failingpbs
MEDmixed kernel versionspve
LOWBMC firmware behind on 2 nodesbmc
Machines you can question.
Each instrument runs one of our checks on an example estate: you ask, the machine answers, and you check its answer. Cabinet 3D is in testing and not public yet.
In testing
Ask a rack what happens when feed A fails.
Cabinet 3D
Built with Claude Code from a written brief; 59 tests check its behaviour. They caught an out-of-band cable routed through the wrong switch; six visual review rounds caught what the tests could not.
- No approval, no change, enforced by a test.
- Scripted run: no language model runs in the instrument.
Planned: Fabric, to ask your switches what is actually plugged in, and a failure-domain lab, to ask a Ceph pool what it survives.
Lab · built with Claude Code
The long way from A to B
A 3D Enigma I you can type on. Plugboard, rotors, reflector and the daily key sheet are all modelled, and every keystroke is traced through thirteen stages.
It has nothing to do with infrastructure. It shows how far we take a machine apart before we say we understand it.
Try the live demoKEYH
PLUGN
ETWN
IIIX
IIV
II
UKWP
IT
IIN
IIIY
ETWY
PLUGY
LAMPY
One keystroke, 13 stages: H leaves the machine as Y.
In a health check, the same checks run on your estate, read-only.
Ask for a health checkAcme Corp (name changed). Work by the founding couple, Q3 2026. All figures measured.
The servers were clean. The code was not.
At Acme Corp, a multi-tenant web platform, passwords stolen elsewhere opened at least 10 real user accounts: 374 successful logins in 908 attempts. From those sessions an attacker pulled other tenants' records through an endpoint that never checked who owned the record. We worked with Claude Code, read-only first. We asked the logs where the theft came from: commercial VPN and hosting ranges only. 36 minutes into the work we blocked the attacker's addresses at the application and the load balancers, and temporarily closed the leaking endpoints. Every VM we scanned came back clean.
We asked the code which endpoints took the tenant ID from the request body: 50. We put one ownership guard into 229 files: 0 false positives in 219 legitimate requests after the patch. We made direct calls to internal paths return a 404. Every change had a backup and a way back. Login and verification codes needed a rate limit, but nginx had been built without the module, so we swapped in the official package binary of the same version, live, with USR2. Not one request dropped during the swap.
- 36 minfrom the start of our session to the attacker blocked
- 0 of 94,000+attacker requests that got through after the block
- 16 of 16VMs clean in a read-only scan: no new users, no web shell, no unexpected file changes
- 4 of 5root causes closed in under three hours, in the code and in nginx; we handed the fifth to Acme Corp's own team
On your estate we start the same way, read-only, and every change waits for your approval. The health check reads your infrastructure; for code or an incident, book a call.
How this site is built.
The same way we work on your estate: Claude Code drafts from a written brief, tests check what the page must and must not say, and we decide what goes live.
Three parts of it are on this page: who decides, what the page is allowed to load, and the files machines read.
Machine-readable files
- llms.txtThis site as plain text, in English, for people and for language models. It says nothing the site does not.
- robots.txtWhat crawlers may read.
- sitemap.xmlThe language pages and the legal pages.
- security.txtWhere to report a security problem.
A person decides
When decisions pile up, our agent stops and writes a decision form with a recommended answer for each item. In one form we answered 23 of 26 decisions and went against the agent's recommendation on 4.
What this page loads
Nothing from third parties. A Python script generates it from one file per language, and a single Cloudflare Worker serves it with a content security policy that starts with default-src 'none' and allows no outside connections. The Enigma demo is the exception: it loads three.js and its fonts from outside hosts.
Check it yourself
curl -sI https://ada-ai.nl/en/ | grep -i content-security-policyThe page's content security policy: default-src 'none', and no outside host.
curl -s https://ada-ai.nl/en/ | grep -oE '(src|href)="https?://[^/"]+' | sort -uEvery address the page loads or links to with a full URL: only ada-ai.nl itself.
curl -sI https://ada-ai.nl/en/ | grep -ci set-cookie0: the server sets no cookie. The language cookie is set in your browser, and only when you pick a language.
curl -sI https://ada-ai.nl/lab/enigma/ | grep -i content-security-policyThe Enigma demo's policy, with the outside hosts it loads three.js and its fonts from.
A family company, small on purpose.
ADA AI was founded in Breda in September 2026 by a couple who have worked on infrastructure as a duo since 2012, layer by layer: networks from L1 to L7; the NIC, from choosing the physical card to virtualizing it; the services inside the VMs and their redundancy; and security incident response.
Machines have always answered us. A management port answers a probe with a reset or with silence. A Ceph cluster answers HEALTH_WARN. A bridge that unexpectedly elects itself root is telling you nobody else speaks its protocol. We learned what to ask a machine where mistakes are expensive: in cabinets, on switches and during incidents.
Claude is the newest machine in that conversation, and the first we can talk to in plain language. With Claude, the two of us take on infrastructure and software work of any size; we are strongest in our own layers, from L1 to L7. We ask Claude; Claude reads your servers with read-only access. You talk to the people who do the work, and they talk to the machines.
M. TokgözoğluThe founding couple
A duo since 2012 in virtualization, software-defined storage, hyperconverged infrastructure, VXLAN and software-defined networking. With Claude every working day since October 2025.
- FoundedSeptember 2026
- Based inBreda, the Netherlands
- Chamber of CommerceKvK 42162759
- Works inEnglish, Turkish, Dutch
Tell us what you run and what keeps breaking.
You talk to the two of us, not to a bot. A 30-minute call is enough to tell whether a health check fits or what a project needs. We reply within one working day.
Book a 30-minute call Or write to hello@ada-ai.nl