I build the systems language models sit on — tool surfaces with real permission boundaries, retrieval that does not leak tenants, and metering that treats tokens as a cost centre.
0
Production systems
0
MCP agent tools
0
LLM providers
0
SSE / agent paths
I work on the parts of an AI product that quietly decide whether it can be trusted — tool permissions, retrieval boundaries, and the machinery that keeps a model inside the caller's own authority.
I'm a TypeScript engineer specialising in AI infrastructure: Model Context Protocol servers, retrieval-augmented memory, prompt compilation, and the auth boundaries that keep an agent from becoming a superuser. I have shipped production systems both as sole engineer and as a named owner on small teams, spanning NestJS backends, Next.js dashboards, and a React Native app.
The work I am proudest of is giving a language model real write access that is still provably scoped. For a WhatsApp-native commerce platform I built a dual-endpoint MCP server with twenty tools across two trust boundaries, RAG on pgvector with HNSW indexing, Anthropic prompt caching with per-tenant data excluded from the cached prefix, and per-feature token metering.
The same instinct shows up off the model path. I work server-first on the frontend — React Server Components and Server Actions, so credentials stay in HTTP-only cookies — and I treat webhooks, queues and ledgers as systems that must survive retries, not happy-path demos. I am looking for backend and AI-platform roles at companies in the US, UK, Germany, UAE and Australia, remote or on-site.
operator.spec
Four areas where I have shipped something real, not read a tutorial.
Model Context Protocol servers and clients, RAG on pgvector with HNSW indexing, prompt caching with deliberate per-tenant exclusion, stage-aware prompt compilation, structured tool output, and per-feature token metering.
Tool surfaces that inherit the caller's credentials instead of a service key. Two trust boundaries on one MCP server, Zod-validated tool input, destructiveHint annotations, and DNS-rebinding protection on Streamable HTTP.
Modular NestJS and Express services, GraphQL code-first APIs, isolated PostgreSQL databases, BullMQ and Agenda job pipelines, Socket.IO and SSE streaming, and layered auth with JWT rotation.
Next.js App Router with React Server Components and Server Actions, React Native via Expo, and Turborepo monorepos. Accessibility and reduced-motion treated as requirements, not polish.
Flagship AI systems first — then the platforms around them. Open a dossier for the problem, the approach, and the decisions I would defend in review. Team work is labelled as such.
The rules I apply before anyone asks me to.
An AI tool surface is an authorisation surface. I forward the caller's own token rather than a superuser key, so the agent can only do what the human could.
Prompt caching is a cost win until a cached prefix contains another customer's data. Shared instruction blocks are cached; per-tenant context is not.
The model never sees a database. It sees Zod-validated tools with readOnlyHint and destructiveHint annotations, so a hallucinated UUID cannot become a write.
Server Components and Server Actions with HTTP-only cookies. If client JavaScript can read your credential, so can an injected script.
Tools I have used in production, grouped by where they sit in the system.
Languages
Backend
Frontend
Data
AI & Agents
Auth & Payments
Infrastructure
open channel
Open to backend, AI-platform and full-stack roles — remote or on-site in the US, UK, Germany, UAE and Australia. I read everything that comes through.