I build AI systems that are grounded, evaluated, and secure: retrieval that cites its sources, evaluations that catch regressions before users do, and agents with guardrails that keep a human in control. Every finished project has tests and documentation, all but one run in CI, and AI work comes first.
Skills: Agent tool design with MCP, AI guardrails, Microsoft Graph integration, and identity security.
What it shows
- Exposes five tools, a resource, and a prompt over MCP so agents such as Claude Desktop and VS Code Copilot Chat can run a full posture scan in one call.
- Stays read-only against Microsoft Graph: remediation tools generate dry-run Azure CLI and PowerShell commands instead of calling write endpoints.
- Validates agent input at the schema boundary with Pydantic, so an invalid severity fails loudly instead of returning zero findings.
- Validated against a live test tenant, with ruff and pytest running in CI.
- Python
- FastMCP
- Microsoft Graph
- MSAL
- Pydantic
- pytest
Skills: LLM application development, retrieval-augmented generation, evaluation, and prompt engineering.
What it shows
- Implements AST-aware chunking, Okapi BM25, a cosine-similarity vector index, and Reciprocal Rank Fusion without retrieval libraries.
- Grounds answers with citation and abstention instructions, and never writes retrieved text into conversation history.
- Measures retrieval quality with Recall@k and mean reciprocal rank, and scores prompts with rule-based checks and an LLM judge.
- Ships with 122 tests and CI on every push.
- Python
- Anthropic API
- Voyage AI
- RAG
- pytest
Skills: Enterprise RAG, access control and data governance, event-driven data pipelines, and LLM evaluation.
What it shows
- Fails closed on every path: records without ACL tags or a classification go to a counted quarantine, and SQL tools run as the user under PostgreSQL row-level security.
- Propagates deletes and permission changes in seconds through MinIO bucket events and Redpanda, with a scheduled Airflow job that removes orphaned index entries.
- Combines BM25 and vector search in OpenSearch with a cross-encoder reranker, and applies access filters inside the k-NN query instead of after it.
- Proves each control with 14 security regression tests and 10 end-to-end scenarios, and fails the CI build if a 19-question golden-set evaluation drops below its thresholds.
- Python
- FastAPI
- OpenSearch
- PostgreSQL
- Redpanda
- Airflow
- Ollama
- Prometheus
Skills: Supply chain security, policy as code, DevSecOps automation, and security for AI-written code.
What it shows
- Promoted lodash 4.18.1 and blocked 4.17.4 for a critical vulnerability. Installing from the approved registry, only 4.18.1 installs.
- Treats missing data as a denial, so newly registered lookalike packages with no OpenSSF Scorecard are blocked by default.
- Scans the whole dependency tree from a lockfile with install scripts disabled, so it never runs untrusted code.
- Runs 8 of 8 policy unit tests, opa fmt, and ShellCheck in CI, and records three evidence files for each request.
- Open Policy Agent
- Rego
- Trivy
- Sonatype Nexus
- Dependency-Track
- Docker Compose
Skills: OAuth 2.0 and OpenID Connect, token security, API design, and access control.
What it shows
- Supports the authorization code flow with PKCE for single-page and mobile apps, plus the password flow for first-party clients.
- Issues RS256-signed JWTs and publishes signing keys through a JWKS discovery endpoint.
- Rotates refresh tokens with database-backed session tracking and automatic revocation.
- Enforces role-based access control with audit logging for administrative actions.
- Python
- FastAPI
- SQLAlchemy
- PostgreSQL
- OAuth 2.0
- OIDC
Skills: Microsoft Entra ID integration, certificate-based authentication, layered API design, and automated testing.
What it shows
- Pairs a Flask client using MSAL Python with a FastAPI API that validates RS256 tokens against JWKS.
- Uses delegated scopes so access tokens represent the signed-in user.
- Separates the API into repository, service, and dependency injection layers.
- Covers both apps with 107 tests: 95% coverage on the client and 86% on the API.
- Python
- MSAL
- FastAPI
- Flask
- Microsoft Entra ID
- pytest
Skills: Data engineering, entity resolution, data quality, and pipeline design.
What it shows
- Resolves customers with fuzzy name matching combined with normalized email and phone signals.
- Quarantines every row it can't confidently resolve, with a reason code, instead of guessing.
- Matched all 197 customers in a seeded 2,478-record run and scores results against a ground truth answer key.
- Re-runs idempotently and optionally loads results into Postgres.
- Python
- Polars
- Pydantic
- RapidFuzz
- PostgreSQL