BUILD WITHATHAR
I build production-grade SaaS systems — from AI agent tooling (Model Context Protocol) and RAG pipelines to config-driven rendering engines, multi-tenant DNS automation, and self-hosted captcha infrastructure. Engineering work across ten platforms in five years.
▸ NEW · INSIGHT“you type 'ultracode' and Claude stops working alone”↗Engineering that ships to production.
Senior Full-Stack Engineer with 5 years of experience building production-grade SaaS platforms — spanning generative-AI systems (AI agent tooling via Model Context Protocol servers, RAG knowledge-retrieval pipelines, grounded domain-restricted AI chatbots), real-time communication systems, no-code website builders with automated DNS infrastructure, security/captcha infrastructure, embeddable developer tooling, and internal enterprise tooling (CRM, HRMS, Financial systems). Comfortable across the full surface of a product: system architecture, monorepo design, cloud infrastructure provisioning, multi-tenancy, and payment integrations.
Practitioner of AI-augmented engineering — uses Claude Code and AI agent workflows as an engineering force multiplier. Not as a code generator, but as a collaborative layer: breaking down complex system designs, validating architecture decisions, and accelerating delivery of production-grade platforms such as the RAG pipeline, the real-time communication platform, the config-driven rendering engine, and the MCP knowledge server.
Stack & competencies.
Experience & platforms.
Hashcash Consultants LLC
Engineering across ten production platforms — AI agent tooling (Model Context Protocol), AI knowledge retrieval (RAG), domain-restricted AI chatbots, real-time communication, security/captcha infrastructure, embeddable developer tooling, CRM, HRMS, financial reporting, and no-code website publishing. Work spans architecture, backend, frontend, and cloud infrastructure. Product names withheld under company policy.
- A cross-platform Model Context Protocol (MCP) knowledge server that lets developers query a large API surface in plain language from any MCP-capable AI assistant (Claude Code, Cursor, Codex, Gemini) — returning correct, auth-aware integration code. Read-only by design: it serves documentation only, and never executes live calls, moves funds, or reads balances.
- A normalization pipeline distills a large published API surface into one clean, queryable model — deduplicating overlapping operations and resolving each operation's auth scheme and request schema, so the assistant emits the right call the first time.
- Intent-based routing: the server asks the developer what they're building and scopes results to the relevant product area, so a request never resolves against the wrong API.
- White-label base-URL handling and per-operation auth — it emits a developer-supplied BASE_URL and exact request shapes rather than hardcoding hosts or guessing nested bodies.
- Shipped as two published packages from one source of truth — Python on PyPI (FastMCP) and TypeScript on npm (@modelcontextprotocol/sdk) — backed by a shared generated model and a regression test suite.
- A full no-code website builder with a Studio editor and a separate generic rendering engine, enabling users to visually build, publish, and host websites end-to-end.
- Section registry pattern — a shared component runtime across editor and renderer — so the same section definitions power both live preview and production render.
- Config-driven pages: page structure, sections, and layout stored as JSON, consumed by a generic SSR/CSR hybrid renderer supporting both server-side and client-side data fetching per section.
- Undo/redo editor state engine and real-time preview system, giving users a WYSIWYG experience with full state reversibility.
- Theme variable abstraction layer supporting dynamic theming across all published sites without CSS duplication.
- Automated domain lifecycle: availability check → registrar purchase → AWS Route53 records → SSL provisioning → site deployment — all triggered from the UI.
- Multi-tenant DNS architecture with per-tenant subdomain isolation, custom-domain CNAME mapping, and middleware-driven request routing.
- PayPal Subscriptions + Webhooks for plan management with idempotent webhook processing across activation, cancellation, and renewal events.
- Turborepo monorepo with shared packages: UI library, section definitions, config schemas, and cross-environment SSR-safe utilities.
- A Slack-like internal communication platform supporting real-time messaging, channels, threads, and presence indicators via Socket.io.
- Audio/video calling initially built on raw WebRTC with Google STUN for NAT traversal; scalability limits surfaced for group calls, and the media layer was migrated to LiveKit — an open-source WebRTC SFU — for multi-participant calls with lower client-side media load.
- LiveKit rooms, participant tracks, and server-side room management APIs integrated to handle dynamic join/leave, audio/video publishing, and subscriber management.
- Real-time event model — message delivery, read receipts, typing indicators, online/offline state — with fault-tolerant Socket.io room management.
- A multi-tenant Retrieval-Augmented Generation (RAG) platform where each tenant configures a private knowledge base, accessible via an embedded chatbot widget.
- Ingestion pipeline: web crawler → HTML parser → text chunker → OpenAI text-embedding-3-small → vector storage in MongoDB Atlas M10 (vector search cluster), with per-tenant namespace isolation.
- Semantic retrieval: query embedding → Atlas Vector Search → top-K context retrieval → GPT-4 prompt assembly → response with cited source links.
- Multi-tenancy at the data layer: tenant-scoped vector collections, API key auth per tenant, and usage tracking for plan enforcement.
- A production AI chatbot backend that answers strictly in-domain product questions using OpenAI ChatGPT, hard-wired to refuse off-topic and code-generation requests through deliberate system prompt design.
- Data layer designed around a structured JSON knowledge base, injected as context into every chat completion — keeping responses grounded and reducing hallucination on pricing, plans, and product features.
- Production hygiene: per-endpoint rate limits (50/15min on /api/ask vs 100/15min on read endpoints), input validation/sanitization, structured Winston logging, and dedicated health and data-verification endpoints.
- Clean services / controllers / middleware split so the model layer (chatService) is swappable independently from the data loader (dataService) — enabling future model upgrades without touching business logic.
- A self-hosted captcha service built to replace a leaky npm slider-captcha package — moving all puzzle state server-side so positions and salts never reach the client, eliminating client-side forgery.
- Cloudflare Turnstile / hCaptcha-compatible integration surface: customer apps embed a script tag; customer backends call POST /v1/siteverify with secret + token — a drop-in shape any team already familiar with reCAPTCHA can adopt without retraining.
- Token lifecycle designed as JWT issue + atomic single-use consume against Redis, so a verification token can only be exchanged once even under race conditions.
- Iframe-based challenge UI: only the iframe ever talks to /v1/internal/{generate,solve}; the loader on the host page never sees puzzle state — preventing reverse-engineering through DevTools.
- Layered defense: origin enforcement against per-site allowed_origins, IP allowlists, per-site rate limits, and pluggable abuse rules. MySQL for sites/audit/abuse, Redis for sessions/tokens.
- Internal admin dashboard for managing customer apps, sitekeys, secrets, abuse rules, and usage metrics, with full audit logging.
- A multi-tenant feedback collection service where any client app drops in a ~10KB JS widget via a single script tag and routes feedback/bug reports into a central triage dashboard.
- Dual-auth architecture: x-feedback-app-key header for public widget submissions (per-application keys, no user login required), JWT in httpOnly cookies for the dashboard side — keeping the two attack surfaces fully isolated.
- The embeddable widget is a standalone ES5 script with no build step or framework — exposes window.FeedbackWidget.{open, close, configure} so host apps control placement entirely.
- Per-app status workflows (new → open → in_progress → resolved / wont_fix), type filters (feedback / bug / suggestion / other), full-text search, and per-application stats for dashboard cards.
- Idempotent SQL migration runner with a _migrations tracking table — safe to re-run, no destructive sync.
- Stack: Node.js + Express, MySQL 8 (mysql2 pool), EJS + Tailwind CDN, bcryptjs, JWT cookie auth, single-process deploy.
- A full CRM covering lead pipeline, deal stages, contact management, activity tracking, and sales reporting dashboards.
- Role-based access control (RBAC), multi-stage pipeline views, and automated follow-up task creation on deal state transitions.
- A full-featured HRMS covering employee onboarding, attendance tracking, leave management, payroll calculation, and organizational hierarchy.
- Approval-workflow engine for leave requests, integrated with the financial reporting layer for payroll output.
- A dynamic Profit & Loss system that aggregates financial data across departments and produces configurable P&L statements, cost-center breakdowns, and trend reports in real time.
- Formula engine for dynamic line-item computation, plus export pipelines for management reporting.
Architecture highlights.
Monorepo + Turborepo
Structured multi-product codebases with shared packages, incremental builds, and cross-package type safety — enabling reuse across editor, renderer, and API layers without coupling.
Generic Rendering Engine
A config-driven, section-agnostic engine that consumes a page JSON schema and dynamically resolves registered section components — SSR, CSR, and hybrid data fetching per section.
Domain Lifecycle State Machine
Domain provisioning modeled as an explicit state machine — available → purchased → DNS configured → SSL issued → deployed → active — with automated transitions and rollback handling.
Multi-tenant Middleware
Request-time tenant resolution via subdomain / custom-domain matching, injecting tenant context into downstream handlers without per-route tenant checks.
WebRTC → LiveKit Migration
Real-time calling evolved from raw WebRTC P2P (STUN) to a LiveKit SFU — unlocking scalable multi-party calls, server-side track routing, and reduced client bandwidth.
RAG Ingestion Pipeline
An async, queue-based ingestion pipeline supporting large site crawls with retry logic, duplicate URL detection, chunk-overlap tuning, and per-tenant embedding namespacing.
Captcha Token Lifecycle
JWT issue + atomic single-use consume against Redis so a verification token can only be exchanged once even under race conditions — server-side puzzle state, iframe-isolated UI.
Embeddable Widget Pattern
Standalone ES5 widgets (Feedback Central, captcha loader, RAG chatbot) with zero build step — host apps drop in a script tag, widget posts to a dual-auth API surface.
Editor State Engine
Command-pattern undo/redo for the website builder editor — granular reversibility of section edits, reordering, style changes, and content updates.
OpenAPI → AI Knowledge Model
Normalization pipeline that merges and deduplicates a large published API surface into a single queryable model, served through a Model Context Protocol server (read-only Resources, Prompts, and Tools) — published to both PyPI and npm from one shared source of truth, with intent-based routing so AI assistants resolve the correct product area.
AI-Augmented Engineering
Claude Code and AI agent workflows as a collaborative layer across system design, validation, and implementation — compressing the path from architecture to production.
Visitors from across the world.
Every visit is geolocated and pinned. Updates every 60s. Disclosed in our privacy notice.
Get in touch.
Contact details below. You can also find my writing in the Insights section.