---
title: "Tommaso Bertocchi (@SonoTommy) | Hashnode"
description: "Tommaso Bertocchi (@SonoTommy) writes on Hashnode. Read their latest articles and follow their work."
url: "https://hashnode.com/@SonoTommy"
---

@SonoTommy

# Tommaso Bertocchi

@SonoTommy · Joined February 2026

### [How to Build an Autonomous OSINT Agent in Python Using Claude's Tool Use API](https://freecodecamp.org/news/build-autonomous-agent-in-python-using-claude?utm_source=hashnode&utm_medium=feed)

When I started studying OSINT, I always felt I was just putting random values into software without deeply understanding what I was doing. After months in the field, I realized I wasn't really investi

13 min read · [freecodecamp.org](https://freecodecamp.org/news/build-autonomous-agent-in-python-using-claude?utm_source=hashnode&utm_medium=feed)

[May 15](https://hashnode.com/posts/build-autonomous-agent-in-python-using-claude/6a06669ebaf09db7a64df6cf)

### [How I designed an AI agent where hallucination in tool results is structurally impossible](https://sonotommy.hashnode.dev/how-i-designed-an-ai-agent-where-hallucination-in-tool-results-is-structurally-impossible?utm_source=hashnode&utm_medium=feed)

Most AI agents have a problem: when they call a tool, you're never 100% sure if the result you're reading is real or inferred. The model might hallucinate a plausible-looking username, a fake subdomai

7 min read · [sonotommy.hashnode.dev](https://sonotommy.hashnode.dev/how-i-designed-an-ai-agent-where-hallucination-in-tool-results-is-structurally-impossible?utm_source=hashnode&utm_medium=feed)

[May 11](https://hashnode.com/posts/how-i-designed-an-ai-agent-where-hallucination-in-tool-results-is-structurally-impossible/6a01e324fca21b0d4b2dd833)

### [Add Virus Scanning to Your Node.js App in 5 Minutes](https://sonotommy.hashnode.dev/add-virus-scanning-to-your-node-js-app-in-5-minutes?utm_source=hashnode&utm_medium=feed)

https://giphy.com/gifs/siliconvalleyhbo-silicon-valley-hbo-l0HlNQ03J5JxX6lva File uploads are everywhere. Profile pictures, PDF invoices, CSV imports, document management systems. Every one of them i

5 min read · [sonotommy.hashnode.dev](https://sonotommy.hashnode.dev/add-virus-scanning-to-your-node-js-app-in-5-minutes?utm_source=hashnode&utm_medium=feed)

[May 7](https://hashnode.com/posts/add-virus-scanning-to-your-node-js-app-in-5-minutes/69fc91743d9a9c1019c00a22)

### [How We Built Framework Plugins for an npm Library](https://sonotommy.hashnode.dev/how-we-built-framework-plugins-for-an-npm-library?utm_source=hashnode&utm_medium=feed)

pompelmi started as a single function. scan(filePath) — that was the entire API. Nine months later it ships with dedicated plugins for NestJS, Fastify, Next.js, and Hono. Here's how we approached buil

7 min read · [sonotommy.hashnode.dev](https://sonotommy.hashnode.dev/how-we-built-framework-plugins-for-an-npm-library?utm_source=hashnode&utm_medium=feed)

[May 6](https://hashnode.com/posts/how-we-built-framework-plugins-for-an-npm-library/69fb45f750ecad453331cb3f)

### [Stop Accepting Dangerous File Uploads. Here's How to Fix It in Node.js.](https://sonotommy.hashnode.dev/stop-accepting-dangerous-file-uploads-here-s-how-to-fix-it-in-node-js?utm_source=hashnode&utm_medium=feed)

Someone is uploading malware to your app right now. Not maybe. Not eventually. File uploads are one of the top attack vectors in web applications, and most Node.js tutorials show you how to accept t

4 min read · [sonotommy.hashnode.dev](https://sonotommy.hashnode.dev/stop-accepting-dangerous-file-uploads-here-s-how-to-fix-it-in-node-js?utm_source=hashnode&utm_medium=feed)

[May 5](https://hashnode.com/posts/stop-accepting-dangerous-file-uploads-here-s-how-to-fix-it-in-node-js/69f9b25846610fd6068e7b22)