Swanand Kadam — Senior AI / Full Stack Engineer

Selected Work

Eight projects. Real outcomes.

P.01

Gaslight — Automated Pentest CLI for MCP AI Agents

Physical proof · 17 attacks + 7 auth probes · No API key required · A/B/C/F grading · v0.2.4 on PyPI

Physical proof only — never opinions. A finding is CONFIRMED only when something physically happened: a unique canary token arrived at a local HTTP sink gaslight controls, real out-of-bounds data returned, or a tool's own state contradicted its own description. No second model grades the first. 5 real confirmed findings against a 136-server registry-verified corpus.
17 core attacks + 7 auth probe checks. Core suite: 14 model-free, runs with zero API key. Auth probes attack the HTTP front door (no-credential, alg:none JWT, audience passthrough, cleartext transport) — a separate threat model from the tool layer. OWASP MCP Top 10 — 7 fully covered, 1 partial, 2 out of scope by design.
A/B/C/F grading + auto-discovery. F = proven exploit (data crossed a boundary). C = disclosed but not exfiltrated. B = internal info gap. A = nothing fired. Multi-language auto-discovery (Python/Node/Go/Rust) + interactive wizard + self-healing venv retry means one command, no flags, no guessing. v0.2.4 on PyPI — Trusted Publishing, explicit sdist whitelist guards scan results from accidental publish.

Attack Pipeline — v0.2.4 · Two-Layer Architecture

Auto-Discovery
+ Wizard

py/node/go/rust
.gaslight.json

→

Target
MCP Server

stdio · HTTP
SSE auto-detect

→

17 Attacks
(fresh conn each)

+ SSRF encoding
evasions

→

Canary Sink
port 0 stdlib

physical proof
binary verdict

→

A/B/C/F
+ Blast Radius

severity-tiered
3-ring diagram

Auth Probe Layer — HTTP targets only (front door, before tools)

No credential
honored → F

critical

alg:none JWT
accepted → F

critical

Audience
passthrough → F

critical

Cleartext
transport → C

high

JWT no exp/
audience → B

medium

Model-vs-code 2×2 per tool: GENUINELY DEFENDED · DEFENSE-IN-DEPTH · FRAGILE (no backstop) · CRITICAL. Scope-creep baseline v2 tracks per-tool capability fingerprint (file/net/code) for CI — only flags privilege growth, never shrinkage.

Python asyncio MCP Security Anthropic Ollama pytest

P.02

CodeMas — AI Coding Assessment Platform

Masai School · Owned end-to-end, worked directly with the CTO · Up to 10K simultaneously active learners · Typical results under 10s

Three-Stage Architecture Evolution — Redis/Celery workers + Docker sandboxes + SSE → separate web and worker tiers → PostgreSQL transactional outbox → relay → SQS → Lambda with client polling. The submission row and its job commit in one transaction, so a crash can never lose a job or run a ghost one. Bursty exam-deadline execution scales with the queue; Postgres stays the single source of truth.
Safe Execution Path — SQS carries only a signed job reference; Lambda claims a lease from Django, gets test inputs (never expected outputs), runs each test in a bounded child process, and Django does the grading. Leases expire and requeue; dead after 3 attempts. Executor can't see answers or forge results.
Plagiarism Engine — Phase 1 scores behaviour (paste ratio, speed vs difficulty, tab switches, submission surprise); Phase 2 compares only suspects against the full cohort with TF-IDF cosine on normalised code (K×N, not N²). Cheating-ring detection, versioned policy, instructor confirm/dismiss, one appeal per exam. Reframed from "are submissions similar" to "did this student write this." 19× more cheating cases detected.
AI Exam Authoring — context → plan → instructor approves → generate → validate → publish. Deterministic checks own marks, schema, duplicates and executable tests. ~80% less exam-authoring effort.
AI Feedback, off the grading path — single structured GPT-4o-mini calls for rubric scoring (4 dimensions, 0–2), Socratic hints on failed submissions, plagiarism-pair explanations, exam summaries and weekly recommendations. Tests decide correctness; AI only explains. Idempotent, and the platform runs fine with AI switched off.
AutoEval — Cypress automation evaluating 500+ student web apps per cohort. Turnaround ~1 week → ~1 day, ~500 instructor hours saved.
Business Impact — automation eliminated manual exam oversight, making multi-cohort scale operationally viable. Each cohort = 400 students × ₹3L = $2M+ in revenue per cohort unlocked for Masai.

Submission Flow — Outbox → SQS → Lambda (typical < 10s)

Browser

→

Django API

one transaction:
submission + outbox row

→

Relay

SKIP LOCKED
every 0.5s

→

SQS + DLQ

signed job
reference only

→

Lambda

claim lease →
bounded child process

Browser

Submit → Queue →
Execute → Grade

←

Poll w/ backoff

1s → 2s → 3s → 10s
resumes after refresh

←

Postgres

Django grades,
writes results

Supporting (off critical path)

Redis

Celery broker
+ cache

→

Celery Workers

plagiarism · rubric · hints
summaries · weekly recs

GPT-4o-mini

after commit,
never blocks grading

Two-phase plagiarism at exam close: Phase 1 behavioural O(N) → suspects K (risk ≥ 0.35 or 3+ signals) · Phase 2 TF-IDF cosine ≥ 0.80, O(K×N) against the whole cohort. Instructors confirm — the system never auto-accuses. 19× more cases caught.

Django AWS Lambda SQS Outbox GPT-4o-mini PostgreSQL

System Design Submission Flow Plagiarism AI Features

P.03

the01.dev — AI Tutor for Deep CS Courses

Co-founder · Owned architecture end-to-end · Guided two engineers · 10 deep CS courses · Observe → Model → Personalize

Course-Aware Tutor — course lookup always runs in code, never left to the model: hybrid vector + BM25 retrieval fused with RRF, scoped to the learner's own courses, then a GPT-4.1-mini reranker grades every candidate and picks a coverage case (enrolled match / related / no match / in-lecture). No match → it answers from general knowledge without inventing a citation. Coverage accuracy 0.75 → 0.99, zero false citations.
LangChain Agent + Server-Bound Tools — one tutor for the Ask page and the video player; 9 tools (course search, strengths, concept confidence, history, find-moment…) with the student id bound from the verified Firebase token, never from the request. Answers stream over SSE and deep-link to the exact lecture moment. The model can't read another learner's data.
Personalization Loop — quiz attempts and validated chat observations update a per-learner skill graph; prerequisites gate hard questions until they reach 70%; the next answer reads the learner's weak concepts and memory. Backend code updates mastery — the LLM never writes it. Every answer is tuned to what this learner actually knows.
Lab — LangGraph Workflows — interactive quiz flow with human-in-the-loop interrupts (plan objectives → approve → quiz → submit → loop → summarize), plus parallel notes / flashcards / study-plan generation via Send fan-out. Design rule: agent when the AI decides its next move, workflow when every step is known. Each problem gets the right engine.
Governed by default — PII scrub and intent routing before any model call; an audit row (model, provider, risk level, prompt fingerprint) for every AI turn; versioned retrieval evals gate changes. Replaced an earlier agent runtime and fixed similarity threshold after evals showed the threshold misjudged coverage. Answer faithfulness 71% → 92%; ~30% lower repeat-query embedding cost.

Tutor Pipeline — Retrieve · Rerank · Personalize · Stream

Question

Ask page or
video player

→

Token + Guard

Firebase identity
PII scrub · intent

→

Audit Row

every AI turn

→

Hybrid Search

vector + BM25
fused with RRF

→

LLM Reranker

grades coverage
answers / partial / no

Browser SSE

sources → tokens →
navigate → done

←

LangChain Agent

GPT-4.1-mini
9 bound tools

←

Context

course facts · weak
concepts · memory

←

Coverage Case

match / related /
no match / in-lecture

LangChain · Tutor Agent

Reason

→

Tool

→

Observe

↩

Open-ended → AI Tutor

LangGraph · StateGraph

Plan

→

HITL ⏸

→

Grade

Known steps + HITL → Lab

Retrieval v2, measured on a versioned eval set (~1,000 cases): coverage accuracy 0.81 → 0.99 (player) and 0.75 → 0.99 (Ask) · recall@1 0.76 → 0.85 · correct source in top-3 0.64 → 0.94 · false citations 0.

LangChain LangGraph Hybrid RAG GPT-4.1-mini React 19 FastAPI Neon Postgres

System Design Tutor Pipeline Multi-Agent Live ↗

P.04

Munshi — Sovereign GST & Trade Compliance Agent

Bharatvarsh Arts · Local-first · Hermes runtime · Human-in-the-loop · ₹5Cr revenue scale

Fuzzy Invoice Reconciliation — AI adjudicates messy purchase invoices against government GSTR-2B records; deterministic Python computes every rupee. Recovers input tax credit (ITC) that exact-matching forfeits.
Sovereign Architecture — GST side fully local-first, nothing leaves the machine. Model only judges ambiguous matches; all tax arithmetic is exact Decimal computation. Privacy-safe for sensitive financial data.
Analytics Data Platform — Snowflake + dbt ELT pipeline unifies 4 disconnected systems (Shopify, GoKwik, NimbusPost, WhatsApp B2B). GPT-mini extracts structured B2B orders from Hinglish/Marathi chat. 247 actionable exceptions surfaced from ~2,100 orders; ₹15.4L revenue reconciled across channels.
Human-in-the-loop + PII Governance — consequential actions require approval; Snowflake Dynamic Data Masking governs customer PII at mart level; AGENT_READER role sees masked data in ad-hoc queries. Agent queries are auditable and PII-safe by default.

Agent Loop — ReAct + MCP Tool Calls + HITL Gate

Owner Query

plain English

→

Reason

Hermes + SOUL.md

→

MCP Tool Call

JSON Schema
validated

→

Observe

result into
context

→

request_approval()

HITL pause before
consequential action

↩ loop back to Reason until answer complete

Fuzzy Invoice Matching — 4-Signal Score

GSTIN match

weight 0.40

Name token ratio

weight 0.35

Amount ±5%

weight 0.15

Date ±7d

weight 0.10

≥ 0.70 → Auto Match (~80%)

0.50–0.69 → Model Judgment

< 0.50 → No Match

Python Decimal for all tax arithmetic — exact base-10, matches GSTN portal to the paisa. Approved verdicts stored in SQLite and reused month-to-month.

Analytics ELT Pipeline — Snowflake + dbt + Agent Tools

Shopify CSV
GoKwik CSV
NimbusPost CSV

4 sources,
no shared ID

→

WhatsApp B2B
→ GPT-mini
extraction

Hinglish/Marathi
→ structured

→

Snowflake RAW
VARIANT

schema-on-read
no brittle DDL

→

dbt staging
(views)

clean · normalize
fix grain

→

dbt marts
(tables · tested)

37 tests green
PII masked

→

7 Agent
Analytics Tools

order_status
exceptions
revenue

Key Marts

xref_order_identity

identity bridge

fct_order

Order-360

b2c_exceptions

247 issues

dim_vendor_contract

SCD Type 2

fct_revenue

₹15.4L unified

"AI decides, deterministic code computes" — LLM extracts WhatsApp price intent; all ₹ arithmetic is SQL. AGENT_READER role masks PII in ad-hoc queries.

Hermes MCP FastAPI Ollama Snowflake dbt Python ELT Docker

System Design

P.05

Trade Compliance Researcher — Multi-Agent Hermes System

Nous Research Hermes runtime · Researcher → Writer workflow · Open-weight & hosted models

Two-agent pipeline — Researcher agent gathers trade-compliance data via MCP tools; Writer agent synthesises findings into structured reports. Memory persists across turns. Collaborative multi-agent workflow on a single runtime.
Model-agnostic — switches between Ollama open-weight models (Qwen, Llama) and hosted cloud endpoints by changing one config line. Zero code changes to swap model providers.
SOUL + config architecture — agent identity and capabilities declared in SOUL.md + config.yaml; no agent plumbing written from scratch. Fully Dockerised.

Two-Agent Pipeline — Choreography, Independent SOULs

Query

HS code · origin
destination

→

Researcher Agent

Hermes + SOUL.md A
search_regulations
fetch_tariff_db
fetch_document

→

Findings

duties · FTAs
restrictions · docs

→

Writer Agent

Hermes + SOUL.md B
zero tools by config
synthesis only

→

Report

citeable
source-attributed

max_iterations=10 circuit breaker on Researcher. Choreography: Writer coupled only to the findings artifact — either agent upgrades independently. Config swap = model or SOUL change with zero code changes.

Hermes MCP Ollama Docker Python

System Design

P.06

Kalaam — India's First Hindi Programming Language

Open Source · TEDx Bangalore · npm · kalaam-core · 500+ monthly users

Multi-language Architecture — 5 languages (Hindi, Marathi, Bengali, Telugu, Odia) via centralized keyword configuration; adding a new language is one map entry, zero parser changes. Infinitely extensible without touching the interpreter core.
Fully Offline PWA — zero API calls, service-worker cached, runs in the browser on a budget Android phone with no internet. Reaches tier-3 city students locked out of every other coding tool.
Open-Source Community — led 10+ contributors through structured releases. 500+ monthly active users on kalaamlang.in.
TEDx Bangalore — invited to speak on "Why we should be able to code in our own languages." Recognised as a meaningful intervention in CS access for non-English speakers.

5-Phase Interpreter Pipeline — Pure JS · Zero Dependencies

Source

हिंदी / मराठी
বাংলা / తెలుగు...

→

① Cleaning

keyword map
→ normalized tokens

→

② Scanning

char-level scan
→ cleaned_sourcedata[]

→

③ Tokenization

20 Push* functions
→ typed tokens[]

→

④ Interpretation

walk tokens[]
→ memory{} + ExecutionStack[]

→

⑤ Output

kalaam{}: output
trace · timing

Learning Mode: ExecutionStack[] replays every step in the student's language — the trace is the product. New language = 1 keyword map entry, zero parser changes. npm package `kalaam` v2.3.3.

Custom Lexer Interpreter Vue 2 Quasar PWA npm

System Design

P.07

stringy-core — JavaScript String Utility Library

npm · 50+ pure functions · 9 modules · 19 forks · zero dependencies

ESM with named tree-shakeable exports and a unified _s namespace. Open-source contribution platform — stub functions invite community PRs.
19 forks. Published on npm.

9-Module Architecture — 50+ Functions · Zero Runtime Dependencies

textCaseManipulation

camelCase · snakeCase · titleCase

textCleaning

trim · normalizeWhitespace

textFormatting

Intl API — date · currency · relative

textMaskingAndSecurity

maskEmail · maskPhone · moderate

textMetadataAndExtraction

URLs · IPs · emails · hashtags

textAnalysisAndValidation

isPalindrome · matchesPattern

textTransformations

shorten · wordWrap · shuffle

textSpecializedOperations

levenshteinDistance · isBalanced

textGeneration

randomString · loremIpsum

Two import patterns: import { maskEmail } from 'stringy-core' (tree-shakeable) · import { _s } (namespace convenience). Husky + lint-staged pre-commit.

ESM Zero deps Jest 9 modules

System Design

P.08

Bharatvarsh.art — D2C E-Commerce Platform

Indian cultural wall art · Built and led engineering end-to-end

Architecture, payments, inventory, and delivery integrations from scratch.
₹2Cr+ in revenue.

E-commerce Payments Full-stack

Systems that scale.
AI that ships.
Code that matters.

Eight projects. Real outcomes.

Let's build
something.

Systems that scale. AI that ships. Code that matters.

Eight projects. Real outcomes.

Let's buildsomething.

Systems that scale.
AI that ships.
Code that matters.

Let's build
something.