Backend-focused developer who builds the infrastructure layer AI agents actually run on — auth, rate limiting, multi-service integrations — rather than just wiring prompts together. Comfortable owning a project end-to-end: designing the API surface, hardening it (timing-safe auth, IP allowlisting, proxy-aware rate limiting), and documenting the reasoning so someone else can maintain it. Recent focus: Model Context Protocol (MCP) servers and agentic workflow automation (n8n + LangChain), plus root-causing bugs in real-world open-source infrastructure.

• Built and deployed a single MCP server (Node/Express) exposing tools across 8 connectors — GitHub, Cloudflare (D1/KV/R2/Workers), Notion, Mem0, generic fetch, Exa research, and Gemini — to any MCP-compatible client.
• Built a delegation-first architecture on top: a `delegate_gemini` tool hands an entire open-ended, multi-step investigation to a second model, which runs its own tool-use loop server-side across GitHub/Cloudflare/Notion and returns one synthesized answer — instead of the primary agent chaining every tool call itself.
• Added Redis-backed checkpointing after every step of a delegated run, so a failed or rate-limited investigation resumes from its last completed step instead of restarting (and re-paying for) the whole task.
• Isolated the delegation boundary by design: tools that touch live external content (web research, generic fetch) are kept separate from tools that touch internal systems (GitHub, Cloudflare, Notion), so untrusted external data can't reach internal credentials.
• Reflexive by construction, not by accident: the GitHub connector's write/PR tools default to this project's own repo, so a connected agent can read its own source, diagnose a gap, and commit the fix — the same tools it'd use on any other repo, no special-cased admin path. This README and this portfolio page were both edited this way.
• Designed the auth layer myself: timing-safe shared-key comparison, IP allowlisting scoped to Claude's published connector range, and per-route rate limiting — applied in the correct order so a leaked key alone can't reach the server from an untrusted network.
• Handled real deployment-platform edge cases: correct `X-Forwarded-For` trust depth per reverse-proxy hop, request body limits raised for large file pushes, and graceful per-connector token failure (one missing credential doesn't take down the whole server).

• Designed an n8n workflow where an AI agent classifies inbound support email (category + priority), grounds factual answers in a RAG-searched knowledge base, and drafts replies only for non-urgent cases.
• Built a deliberate safety boundary directly into the system prompt: escalation-worthy emails (angry customers, payment failures, security reports) are flagged for a human and never get an auto-generated reply — the boundary lives before generation, not as a filter after.
• Forced structured JSON output from the agent so downstream nodes (Sheets logging, CRM ticket creation, LINE alerts) route deterministically instead of parsing free text.
• Documented and tested against 6 representative scenarios, weighting test coverage toward the costliest failure mode (an urgent email misclassified as routine).

• Built a single self-contained bash script that gives Cloudflare a full menu-driven admin panel — Workers deploy/rollback, KV/D1/R2/Hyperdrive management — usable entirely from a phone terminal, no dashboard tab or laptop required.
• Implemented OAuth2 + PKCE login (the same flow wrangler login uses) with multi-account storage and switching, so no API tokens need to be manually pasted or rotated by hand.
• Added one-tap rollback by backing up every deploy locally before it goes out, plus a GitHub sync step that pushes a worker's source straight to a linked repo branch on deploy — deploy and version control in one action.
• Worked around workerd having no native Android build by driving wrangler tail inside an auto-installed proot-distro Ubuntu container, so real-time log tailing still works from Termux.

• Built a tool that walks a live page's DOM after JS execution into a structured tree (bounding boxes, ARIA roles, stable-ish CSS selectors) and flags interactive elements for later reuse.
• Captured full network traffic (requests, responses, failures, timing) alongside each DOM snapshot and rendered everything into a single tabbed HTML report (tree / interactive elements / network / actions).
• Solved a real platform blocker: playwright-core refuses to load at all on Android by checking process.platform — added a narrowly-scoped platform spoof around just the require() call, safe because the tool never launches Android-specific binaries and instead always attaches to a remote Browserless.io session.
• Supports replaying recorded actions (clicks, uploads, text input) against a page in a fresh session, including correct file-chooser interception for upload buttons that only open a native OS dialog on click.