11 JC Lab Ideas to Film, Test and Write Today: Local-First AI, Agent Tools and a Crypto Attention Check (2026)

Start with Ambient Context, onlymusic.ai, or Tblue. Each one gives you a visible result in a short session: a local work log, a generated song, or a security scan with a maintenance warning you can investigate. The rest of the pack adds four fresh tool reviews, two crypto attention checks, and one privacy article.

Video topics to film

Ambient Context: can a local work log give an AI agent useful memory?

Format: How-I-tested

Shoot: Build the macOS app from the repository, grant Accessibility permission, and choose a folder outside ~/Documents. Open three ordinary work windows, pause capture, open a password field, then inspect the day's Markdown file. Ambient Context says it reads text from the focused window through the macOS Accessibility API, writes one file per day, skips password fields, scrubs credentials and card-shaped numbers, and keeps the files on the machine. The repository also says the current release is early and unsigned, with macOS 14+ on Apple Silicon required. 1

Hook / verdict frame: "Can an agent remember what I worked on without receiving screenshots or a cloud upload?" Show the permission prompt, the recording toggle, the raw Markdown, and the lines that were skipped.

Check before publishing: Use a disposable macOS account and harmless text. The tool reads the focused window, so do not open private messages, credentials, client data, or financial records during the test.

onlymusic.ai: one prompt, your own lyrics, or an instrumental track?

Format: Review

Shoot: Create the same short brief three ways: text to music, lyrics to song, and instrumental. Play each full result, compare the hook, vocal clarity, arrangement, and revision time, then check which downloads and rights appear on the account. onlymusic says users can start without an account, hear a complete result, and create free songs each day after signing in. Paid plans include MP3 and WAV downloads and a commercial license; the site says free results may not include commercial rights. 2

Hook / verdict frame: "Does the free path make a usable creator track, or only a convincing preview?" End with a three-column comparison: input, result, and permission to publish.

Check before publishing: Use lyrics you wrote yourself or have permission to use. The service says AI-generated music can share phrases, rhythms, structures, or sounds, so listen to the complete result before putting it in a monetised video. 2

Tblue: does a 614-check website scanner deserve a place in your workflow?

Format: Scam check

Shoot: Read the maintenance notice before installing anything. Run the default scan only against a staging site you own, save the HTML and JSON reports, and compare one finding with the actual response headers. Tblue's README claims 614 passive scanners, local execution, HTML/JSON/SARIF output, and an MCP server. The same page currently tells users to avoid --cookie, --header, --bearer, and --auth because those values are passed to third-party lookup services; it also says the PyPI releases are yanked and the default scan probes more than the documentation previously suggested. 3

Hook / verdict frame: "A big module count is a claim. Can the report explain one real issue without creating a new credential risk?" Show the README warning before showing the scan.

Check before publishing: Keep the test passive and authorised. Tblue's own documentation says findings need manual validation and that the optional --active flag sends crafted requests; leave that flag off unless the staging environment is yours and the test is approved. 3

Headless Tools: can an AI agent handle the small web utilities a creator uses every day?

Format: How-I-tested

Shoot: Connect the MCP endpoint in a disposable agent workspace. Create one short link, one private paste, one test inbox, one scheduled reminder, and one temporary file. Headless Tools lists URL shortening with click tracking, private or burn-after-read pastes, an inbox that can read OTPs and send replies, scheduled email to yourself, and one-time file uploads up to 10 MB. Its site also documents MCP connections for Claude Code, Codex CLI, Cursor, and OpenCode. 4

Hook / verdict frame: "Does one MCP connection remove five small chores, or does it create five new places to leak data?" Record the exact permission, expiry, deletion, and public-link behaviour for every primitive.

Check before publishing: Use a throwaway email address and dummy text. Do not put real OTPs, customer files, API keys, or private URLs in a service that creates shareable links.

Tools and apps to review

Memoria: local camera-roll search versus ten minutes of scrolling

Format: Review

Shoot: Load a small test set containing a screenshot with a known phrase, a video with a spoken word, a face, and an object. Search each term, record whether the result appears, and watch the device while indexing. Memoria's launch page says its on-device AI transcribes video audio, reads screenshot text, and recognises faces and objects. The page says the first 250 media are free to test and that the unlimited version uses a one-time purchase during its launch period. 5

Hook / verdict frame: "Can a local search engine find the exact clip without uploading my camera roll?" Show the test files, search terms, result time, battery use, and the point where the free allowance ends.

Check before publishing: Use copies of non-sensitive media. Treat "100% offline" as a product claim to check in the app's network permissions and connection log, rather than as proof supplied by a launch page. 5

Flare: can a file graph make agent-written code easier to review?

Format: How-I-tested

Shoot: Open a small repository, ask Claude Code, Codex, or OpenCode to make one change, and capture the graph before and after. Trace the imports touched by the change, inspect the attributed writes, open the local snapshot, and revert one file. Flare's launch page describes files as nodes, imports as edges, live graph updates, local snapshots, diff-and-revert, an MCP task board, and a no-account, no-telemetry, MIT-licensed local workflow. 6

Hook / verdict frame: "Does the graph expose a risky dependency that the chat transcript hides?" Use one intentionally small change and show the file, its importers, the agent's edit, and the revert path.

Check before publishing: Work in a copy of the repository. Confirm whether the local snapshot can restore the whole tree, and keep API keys out of the test because the product says it runs the agent in a real terminal.

session-indexer: can old Claude Code decisions be found without a shared server?

Format: Review

Shoot: Create three short Claude Code sessions with different decisions about the same project. Index them, ask one question using the wording from a fourth session, and compare semantic retrieval with the keyword fallback. The launch page says session-indexer stores a per-project index in local SQLite, uses bge-m3 embeddings through Ollama, falls back to FTS5 BM25, and injects relevant context through Stop and SessionStart hooks. The project claims Apache 2.0 licensing, 75 passing tests, and no deployment step. 7

Hook / verdict frame: "Can I retrieve why a decision was made three weeks ago, or only match the words I remembered?" Show the original decision, the paraphrased query, the retrieved lines, and the fallback result.

Check before publishing: Use a test repository with invented credentials and fictional customer names. Inspect the SQLite file and hook configuration before claiming that the workflow keeps every session private.

Hacktron Automations: can an AI security tool fix a finding without hiding the mistake?

Format: Scam check

Shoot: Put one deliberately vulnerable toy project in a disposable repository. Ask the tool to validate a finding, produce a patch, and run the relevant test. Keep the original code, the finding, the proposed change, and the test output side by side. Hacktron's launch page says its automation validates issues dynamically, removes false positives, and hands developers a ready-to-review fix. Those are product claims to test, not a substitute for a human review. 8

Hook / verdict frame: "Did the patch remove the vulnerability and preserve the feature, or did the agent merely make the alert disappear?" Require a failing test before the patch and a passing regression test after it.

Check before publishing: Use a toy repository with no deploy keys and no production endpoint. A clean-looking patch is a review candidate; it is not proof that a real application is secure.

Zano / ZANO: can a search spike survive a liquidity check?

Format: Trend react

Shoot: CoinGecko's 24-hour trending return placed Zano second, with a market-cap rank of 220. The morning snapshot recorded a price of $8.52, a 24-hour move of +11.45%, and roughly $1.90 million in 24-hour volume. 9 Refresh the page while filming, then record the live price, volume, spread, order-book depth, and the timestamp from one liquid venue.

Hook / verdict frame: "Did attention arrive with enough liquidity to make a paper trade measurable?" Apply one written paper rule, include estimated slippage, and compare the result with a fixed holding period.

Check before publishing: The trend list measures search attention. It does not establish a trade, a catalyst, or a future price. Use paper trades only and label every market number with the capture time.

Aethir / ATH: can a trending name pass the same liquidity check as Zano?

Format: Comparison

Shoot: CoinGecko's 24-hour trending return included Aethir and gave it a market-cap rank of 260. 10 Refresh the page while filming, then record the live price, 24-hour volume, spread, order-book depth, and timestamp from one liquid venue. Put the Aethir card beside the Zano card and apply the same paper-trading rule to both.

Hook / verdict frame: "Does the smaller trending name offer enough liquidity for a clean test, or does the spread dominate the result?" Keep the rule, time window, slippage estimate, and exit condition identical.

Check before publishing: CoinGecko's trend position and market fields move during the day. Re-capture both screens immediately before filming, state the local capture time, and avoid a buy, sell, or price target.

Article idea

GlassBox: what a browser fingerprint can reveal, and what a local test still sends out

Format: Article

Write: Test the same browser in a clean profile, a privacy-hardened profile, and a second browser. Record which signals stay stable across sessions, which signals only identify the browser family, and which signals change after a restart. GlassBox says its fingerprinting probes run locally with no analytics beacon, while its IP-intelligence option calls public geolocation APIs. The page also displays a third-party tracking-pixel example with IP, referrer, screen size, and user-agent fields. 11

Reader promise: Explain the difference between a site identifying a browser, linking sessions, and learning an IP address from a network request. Show the network panel with Geo on and off, compare the three profiles, and treat the page's identifiability percentage as a model output from that test environment rather than a universal score.

Check before publishing: Do not paste a real fingerprint report containing a public IP, account identifier, or private browser details. The article should separate what the page measures in the test from what a third-party tracker could infer in another context. 11

Film in this order

Run Tblue first, because its maintenance notice changes the safe test plan.
Build Ambient Context while the macOS machine is available, then inspect the Markdown output.
Make the three onlymusic.ai versions and record the full playback before choosing a hook.
Test Headless Tools with disposable data, then review Memoria on a small camera-roll sample.
Use one small repository for Flare, session-indexer, and Hacktron Automations.
Refresh CoinGecko, capture Zano and Aethir, and paper-trade the same written rule.
Write the GlassBox article after the three browser profiles and network-panel captures are ready.