MCP servers · AI agents · automation ✺ MCP servers · AI agents · automation ✺ MCP servers · AI agents · automation ✺
Open source · TypeScript · Go · Rust ✺ Open source · TypeScript · Go · Rust ✺ Open source · TypeScript · Go · Rust ✺
02
Work
01
madmcp
MCP server — ~50 tools across 8 connectors: GitHub, Cloudflare, Notion, Mem0, Exa & Gemini
Built and deployed an MCP server exposing ~50 tools across 8 connectors (GitHub, Cloudflare D1/KV/R2/Workers, Notion, Mem0, generic fetch, Exa, Gemini) to any MCP-compatible AI client.
Designed a delegation-first architecture: one tool hands an open-ended, multi-step investigation to a second model that runs its own tool loop server-side, with Redis-backed checkpointing so a rate-limited run resumes from its last step instead of restarting.
Separated tools that touch untrusted external content (web research, fetch) from those that touch internal systems (GitHub, Cloudflare, Notion), so external data can’t reach credentials.
Designed the auth layer: timing-safe key comparison, IP allowlisting scoped to Claude’s connector range, and per-route rate limiting, ordered so a leaked key alone can’t get in. Handled proxy-hop IP trust, large-push body limits, and per-connector token failure; PR-based workflow with GitHub Actions CI, vitest and supertest.
Built a local-first pipeline that turns artwork into ready-to-paste Etsy listings and mockups: optional image analysis, listing generation, PSD-template mockups, and a human-in-the-loop review step (publishing stays manual by design).
Built an LLM provider layer with Gemini primary and Claude fallback, key store, queue and rate limits, plus an embedding-based taste filter in pure JS/WASM (runs on Termux).
Tested every module (unit, idempotency, route-level integration) and added Playwright E2E against a deterministic fixture LLM; shipped a CI-verified Electron Windows installer.
Built a news-to-trade-signal pipeline: ingestion from free sources and custom scrapers, multi-agent LLM analysis, and signal generation, designed around free-tier Worker limits.
Wrote a point-in-time backtester and documented rollout gates (backtest → paper → micro-live); live trading is deliberately off.
Built a multi-key Gemini model-cascade client with KV cooldown state, and a mobile-friendly Next.js 16 ops dashboard served as a Worker with login and a session-gated API.
Built a monorepo where a business owner states a goal and an AI agent generates a loyalty or gamification campaign. Apps: owner dashboard, customer app, staff POS, review console, public microsites, and a backend API.
Shared api-client, UI-kit and campaign-editor packages; JWT auth, D1 migrations, Vitest tests, and CI deploys that provision D1 and KV automatically.
Built and run a production Telegram ordering bot: Gemini voice-order extraction with multi-key fallback, Zarinpal payment links and verification, an admin panel, and a REST API.
Handled concurrency and abuse (per-chat locking, voice flood limits, address de-duplication). Planning and executing a safe split of the ~7,000-line single-file Worker into ES modules, one verified, deployable step at a time.
Built the front-end of a Persian (right-to-left) online clothing shop: home, shop, product, cart, account and content pages, with a mobile tab bar and configurable site, theme and product data. Backend, checkout and payments are planned next.
n8n workflow — LLM agent with RAG and CRM/Sheets/LINE routing
Designed an n8n workflow where an AI agent classifies inbound email across Gmail, Telegram and WhatsApp, answers from a RAG knowledge base, and drafts replies only for non-urgent cases.
Put the safety boundary in the system prompt: escalation-worthy emails are flagged for a human and never auto-replied to. Used an OpenAI → Gemini → Claude fallback chain and forced JSON output so Sheets, CRM and LINE nodes route deterministically; tested on 6 scenarios.
cf-manager: menu-driven Cloudflare admin panel in one bash script: Workers deploy/rollback, KV/D1/R2/Hyperdrive, OAuth2 + PKCE with multi-account switching, GitHub sync.
logger (DOM mapper): maps a live DOM, network traffic and replayable actions via remote Browserless.io, working around Playwright’s lack of Android support.
ezgit (Git helper that redacts secrets before diffs reach an LLM) and openhands-android-client (native client for OpenHands coding agents).
03
Skills
01 / 04Languages
Languages
JavaScript / TypeScript
Node.js
Python
SQL
Bash
Go
Rust
Backend & APIs
Express
REST API design
OAuth2
Rate limiting
IP allowlisting
JWT / PKCE
Webhooks
React / Next.js
Tailwind
Electron
AI / Agent Tooling
Model Context Protocol (MCP)
LangChain
RAG / Vector DBs (Qdrant)
n8n
Multi-provider LLM fallback
Structured output
Prompt design
Infrastructure & Tools
Git
Cloudflare (D1
KV
R2
Workers
Hyperdrive)
Redis
SQLite
Render / Vercel
CI (GitHub Actions)
Vitest / Playwright
Termux / Android
04
Open source
Fixes to widely used infrastructure projects. Select a row for details.
Root-caused a silent-failure bug in loki.source.file / loki.source.journal: when a legacy Promtail positions file existed but couldn't be read (e.g. a permissions error), the reader returned nil — indistinguishable from "file doesn't exist" — so the component silently re-tailed and re-ingested every log from the beginning instead of failing loudly.
Changed the reader to return (*LegacyFile, error) so a genuine I/O error now propagates up as a loud failure at component construction, while still correctly treating a missing file as non-fatal and malformed YAML as non-fatal.
Root-caused a Windows-only crash from non-ASCII paths (Latin-1 header violation) across 5 call sites, verified with a Windows CI run against a real 開発-path repro. (PR #14713 · merged)
Fixed local Images binding transform parity (fit/gravity/background) with production. Open and in review. (PR #14810 · open)
Fixed the Any driver emitting ? placeholders on Postgres by adding a SQL-aware rewrite to $N that skips string literals, quoted identifiers, dollar-quoted strings, and comments, applied on the Postgres path only so MySQL and SQLite are unaffected. CI passes on the fork.
Found that the package-file comparison logic only took the fast, direct disk-listing path when two separate conditions both held, so registry-extracted packages unnecessarily fell back to a slower cargo package --list call.
Relaxed the condition to trigger the fast path whenever a Cargo.toml.orig / .orig.orig marker is present, while still correctly excluding .git, .cargo-ok, and Cargo.lock from the comparison.
Fixed a PDF form-field parser that assumed every choice-field /Opt entry was an [export_value, display_text] pair per spec — a bare single-character string (e.g. "Red") got silently split into value="R", text="e", or crashed outright. (PR #1474)
Fixed a case-sensitivity gap in the xlsx skill's external-link safety check: the regex meant to catch cached external links before recalculation missed case-mismatched formula references entirely, since it wasn't compiled with IGNORECASE. (PR #1471)
Fixed a Python 3.9 import crash in the docx skill (an eager PEP 604 union annotation evaluated at import time) and documented the actual Python 3.10+ / defusedxml requirement instead of leaving it undeclared. (PR #1473)
Declared a missing PyYAML dependency for the skill-creator validator script, which failed with ModuleNotFoundError on a clean environment. (PR #1472)
05
Activity
9247
Commits
752
Pull requests opened
34
Repos contributed to
82
Day streak
8,782 contributions in the last yearBest day 286 · avg ~45/day
Aggregate stats across public and private repositories. Updated 27 Oct 2026.