Software agents can operate
Everything on this page is running, not described. The MCP endpoint accepts real connections; the skills are files in the repository; the boundary those calls pass through is covered by tests you can read.
Portfolio data over Model Context Protocol
A stateless JSON-RPC 2.0 endpoint implementing initialize, tools/list and tools/call. Tool definitions and JSON Schema are generated from the same Zod schemas that validate incoming calls, so the published contract cannot drift from what actually runs.
POST https://www.albertgorgori.com/api/mcp
{
"mcpServers": {
"albert-portfolio": {
"type": "http",
"url": "https://www.albertgorgori.com/api/mcp"
}
}
}curl -s https://www.albertgorgori.com/api/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"search_projects",
"arguments":{"query":"agent tools"}}}'A GET to the same URL returns the server descriptor. Only the 14 public tools are listed or callable — an MCP caller is granted exactly the public access level, and the boundary enforces it again at call time.
- get_candidate_summaryreadOnly
Get candidate summary
- get_cvreadOnly
Get CV
- get_profilereadOnly
Get profile
- search_projectsreadOnly
Search projects
- get_projectreadOnly
Get project
- get_architecturereadOnly
Get architecture
- compare_projectsreadOnly
Compare projects
- get_experiencereadOnly
Get experience
- search_experiencereadOnly
Search experience
- get_skillsreadOnly
Get skills
- search_engineering_decisionsreadOnly
Search engineering decisions
- get_engineering_decisionreadOnly
Get engineering decision
- get_github_activityreadOnly
Get GitHub activity
- search_articlesreadOnly
Search articles
Boundaries for autonomous callers
Every tool call takes the same path through the same checks, in the same order — whether it arrives from an MCP client or the test suite.
Allowed path
- Tool exists in the registryunknown_tool otherwisestep 1
- Arguments parse against the Zod schemainvalid_input otherwisestep 2
- Access level satisfiedforbidden otherwisestep 3
- Handler runs against the data layerread-only querystep 4
- Structured result returned and recordedname, outcome, durationstep 5
Refused
- A tool that does not existthe model cannot invent capability
- Arguments that fail validationno handler sees unparsed input
- A tool above the caller's access levelowner tools refuse web and MCP callers
- Any write, send or store requestno such tool exists to call
A refusal is a typed result, not an exception: the caller's model sees the error code and can recover, while the handler never ran.
Least privilege
Every tool is read-only and declares an access level. There is no write tool and no query language, so there is nothing to escalate to.
Validate, then authorize
Arguments are parsed against the tool's Zod schema before the access check, so no handler ever sees unparsed input and a refusal never leaks what exists.
Data, not instruction
Results come back as structured JSON. Portfolio content is never returned as a directive, and nothing a caller sends can change tool policy.
Engineering knowledge, encoded
I don't just use coding agents. I encode engineering knowledge into reusable skills — versioned in the repository, loaded by agents working on real code.
agentic-nextjs/
536 wordsBuild an LLM agent inside a Next.js App Router application — tool registry, validation and authorization boundary, streaming to the client, and the failure modes that matter. Use when adding tool-calling, an MCP endpoint, or any model-driven feature to a Next.js app.
The shape · Rules · Route handler · Client · Degrade honestly
SKILL.mdreferences/streaming.mdnextjs-architecture/
366 wordsStructure a Next.js App Router application — where the server/client boundary goes, how data access is layered, and which decisions to make once instead of per route. Use when starting a Next.js app or when a codebase has started leaking client components.
The boundary is the architecture · Layer data access · Cache deliberately · Metadata belongs to routes · Keep configuration where it is discoverable
SKILL.mdreact-performance/
403 wordsDiagnose and fix React performance problems — measure before optimizing, fix the cause not the symptom, and know which of memo, useMemo and virtualization actually applies. Use when a React UI feels slow, janky, or re-renders more than it should.
Measure first · Move state down before memoizing · Stabilize what you pass · Selectors, not whole stores · Keep server data out of client state
SKILL.mdsupabase-patterns/
382 wordsUse Supabase safely from a server-rendered application — row level security as the real authorization boundary, key handling, query layering, and migrations. Use when adding Supabase to a Next.js or Node application, or when reviewing one.
Row Level Security is the boundary · Keys · Layer the queries · Migrations · Errors
SKILL.mdtypescript-testing/
364 wordsDecide what to test in a TypeScript codebase and how to write tests that survive refactors — boundaries over internals, behaviour over implementation, and what the type system already covers. Use when adding tests to a project, reviewing a test suite, or deciding whether a test is worth writing.
What to test · Behaviour, not implementation · Validation deserves real tests · Mock at the edge only · Non-deterministic systems
SKILL.md
These are read straight from the skills/ directory at build time, so this list cannot describe a skill that is not in the repository.
How the work actually flows
A human writes the task and owns the review gate. Agents fan out across implementation, tests and architecture, and everything converges on a person before it reaches CI.
What gets recorded
Enough signal to debug and cost the system, and nothing that identifies who called. Arguments and results are never stored.
- Tool latencyper call, recorded on success and failure
- Tool outcomeok, or the error code that stopped it
- Tool call countper caller kind — web, mcp, owner
- Failure rateaggregated across the recent window
Telemetry is itself an owner-level capability: the get_agent_telemetry tool exists and works, and is refused for MCP callers by the same authorizer that guards everything else. That refusal is covered by a test.
Interview me
Real technical questions across seven topics. Answer in your own words, then reveal the rubric and how I would answer — a way to read my judgement on specifics rather than summaries.