Alejandro Moreno

Summary

AI and backend engineer who designs, ships, and distributes production systems end-to-end, specializing in agent governance and MCP infrastructure: authorization enforced outside the model, tamper-evident attribution of which human directed an agent, and red-team harnesses that prove the enforcement holds. Strongest in Python/FastAPI and LLM systems (routing, RAG, MCP, agentic loops) plus the backend plumbing that keeps them alive, with open-source tools on PyPI and the VS Code Marketplace, a multi-tenant SaaS, and merged pull requests in codebases I did not write.

Skills

AI / LLM: Multi-LLM routing (Groq, Claude, Gemini), MCP (servers + clients), agentic tool loops, RAG, embeddings/semantic memory

Languages: Python (expert), Rust (advanced), TypeScript, SQL, Lua

Backend: FastAPI, async workers, daemon & queue architecture, SQLite, REST/SSE, OAuth2/JWT, Stripe webhooks

Frontend: Next.js, React, Tailwind CSS, App Router

Infra / DevOps: PM2 (multi-service), Cloudflare (tunnels, Pages, CF-for-SaaS), Linux, SSH hardening, multi-tenant isolation

Integrations: Stripe, Groq, OANDA, Alpaca, Meta Graph API, Resend, Cloudflare API

AI Dev Tools: Claude Code (daily driver); ships most code through a self-built MCP tool layer

Selected Projects

Agent-Governance Suite: Warden · Crumb · Siege

Python, FastAPI, MCP, RBAC, OAuth / JWT, Sigstore

warden.alexlaguardia.dev · crumb.alexlaguardia.dev · github.com/AlexlaGuardia/siege

Warden governs: RBAC policy engine authorizes every agent tool call outside the model (region row-scoping, field redaction), so a compromised agent cannot exceed its grants; grounded eval harness and a live enforced-policy demo
Crumb attributes: tamper-evident proof of which human directed an agent's tool call, verifiable across separate identity providers by fetching each issuer's key live (JWKS), never from the log under audit
Siege proves it holds: runtime red-team harness that attacks a live MCP server as real roles, surfacing authz / RBAC bypasses a static manifest scan cannot see

Vigil: Observability & Awareness Infrastructure for AI Agents

Python, FastAPI, MCP, SQLite, Stripe

PyPI: vigil-agent · app.vigil-agent.com · github.com/AlexlaGuardia/Vigil

Open-source package + hosted multi-tenant SaaS: one-line MCP instrumentation (latency p50/95/99, per-tool error rates, silent-failure detection) plus an awareness layer (signal bus, 90s daemon-compiled context, frame-based tool filtering, session handoff)
Hosted tier: per-tenant SQLite isolation with LRU-cached connections, GitHub OAuth, hashed API keys, Stripe billing, ~8,400 lines, 311 tests, 4 PyPI releases

Critik: AI Code Security Scanner

Python, Tree-sitter, Groq / Llama 3.3 70B

PyPI: critik · VS Code Marketplace · GitHub Action · critik.dev

Two-pass scanner: regex + AST flag candidates, then an LLM reviews each finding with full-file context to drop false positives and write fixes, ships as CLI, VS Code extension, GitHub Action, and pre-commit hook
Baseline fingerprinting for legacy-codebase adoption, custom YAML rules, watch mode, ~4,400 lines, 138 tests

Akatskii: Cognitive AI Layer

Python, FastAPI, Groq, Claude, Gemini, fastembed

routing extracted to PyPI: llm-route · github.com/AlexlaGuardia/Akatskii

Hybrid regex + LLM router classifies inputs into 5 thought types and routes by cost/complexity, ~80% resolve instantly and free; agentic tool loop runs up to 15 iterations with parallel calls over MCP
Semantic memory (fastembed/ONNX, hybrid keyword + cosine recall) and a compaction daemon delivering ~3x context compression across sessions

Guardia Content: AI SaaS Platform

Python, FastAPI, Next.js, React, Stripe

Built end-to-end; public launch pending Meta platform approval

Social-media automation pipeline: upload → AI styling (SDXL) → caption (Llama 3.3 70B) → quality gate → schedule → multi-platform post; full Stripe billing, Meta OAuth2, and custom domains via Cloudflare-for-SaaS
Multi-service backend under PM2 with client dashboard, admin HQ, and public per-client microsites

Open Source & Writing

Open source: merged PR into PrefectHQ/fastmcp (25.6k★, e2e test coverage for the CodeMode tool-call path), open resource-leak fixes in hatchet-dev/hatchet (YC), and a merged PR to awesome-mcp-servers · Distribution: 8 packages published to PyPI and a VS Code Marketplace extension · Writing: 8+ technical articles on building MCP servers & AI-agent infrastructure (Dev.to)

Also Shipped

Stampwerk: live AI freelancer SaaS (stampwerk.com) · guardia-mcp: 95+ tools, frame-filtered (50–90% fewer tokens), OAuth 2.1, behind 3 AI interfaces · MCP Server Suite: 262 tools across 4 PyPI servers · Supra: from-scratch 3D FPS engine in Rust (85K lines, 8 crates) · Scionbee: greenhouse WPS-compliance PWA (Next.js, Prisma) · Paradise: 4-agent multi-strategy trading system · mcpcat & llm-route: open-source dev tools (PyPI)