Blog

Notes on AI engineering, full-stack architecture and the products I build, from LLM pipelines and evals to shipping on web and mobile.

Oct 20, 20263 min read

Sandboxing AI-generated React code: four layers that make it safe to run

When a model writes the React your users see, treat its output as hostile. Here's the defence in depth we use: a shared contract, AST validators, a quality gate and a cross-origin sandbox.

Security AI Engineering

Diagram of four security layers between model output and a rendered card

Oct 13, 20263 min read

Building a production MCP server with OAuth 2.1: lessons from shipping one

What it took to let customers connect Claude and ChatGPT to their own data safely: OAuth 2.1 with PKCE, dynamic client registration, scoped tools, live permissions and rate limits per connection.

MCP AI Engineering Security

Diagram of an AI assistant connecting to an MCP server through OAuth 2.1