Skip to content

FOUNDING ENGINEER · FULL-STACK · AGENTIC AI

I build production systems, not demos. — 2,000+ users, real problems to solve .

Took AutoPay from 0 to 2,000+ active users, serving 10K+ production requests in a month as Founding Engineer — owning its privacy-first, on-device architecture end to end. My rule is simple: deterministic systems for decisions, reliable infrastructure for scale, and LLMs for language — nothing more.

TypeScriptNext.jsFastAPIAWS BedrockPostgreSQLRedis
View projectsGet in touch

01 · Experience

Leadership & hands-on ownership.

Founding Engineer

Play Store · 0 → 2,000+ users

AutoPay

  • Owned the full production stack end to end — Android client, Node.js/Express backend, LLM extraction pipelines, and AWS deployment.
  • Designed the privacy-first architecture: on-device SMS parsing with an LLM extraction pipeline structured through Pydantic, so nothing financial ever reaches a server.

2,000+

active users

Web Security Lead

Aug 2025 — Present

Xploit Club, IIIT Bhopal

  • Architected and shipped a CTF platform for 200+ participants — real-time challenge hosting, live leaderboard, and admin tooling on Node.js + PostgreSQL.
  • Delivered 10+ technical sessions to 250+ students covering full-stack development, the OWASP Top 10, and penetration testing with remediation reports.

200+

CTF participants

250+

students mentored

02 · Featured Work

Five systems, five different failure modes solved.

Each one shipped to real users, an independent judge, a hackathon panel, or a real tournament clock — not a portfolio-only demo.

01Founding Engineer

AutoPay

The UPI mandate tracker banks never gave you.

AutoPay reads bank SMS entirely on-device — nothing financial ever leaves the phone — then runs it through a Pydantic-structured LLM extraction pipeline to catch every UPI Autopay mandate before it debits you. Live merchant, amount, and due-date tracking, reminders ahead of every debit, and a one-tap NPCI revoke link when a subscription needs to die. Kapil owned the entire stack solo: Android client, Node.js/Express backend, LLM pipeline, AWS deployment, 0 to 2,000+ users.

KotlinAndroidNode.jsExpressAWSPydantic
Play Store

2,000+

active users

10K+

production requests / month

02magicpin AI Challenge

Vera

A message-composition engine that survives scenarios it's never seen — because the LLM never decides anything.

Built for the magicpin AI Challenge: a from-scratch rebuild of the message engine behind magicpin's assistant, which nudges 7,000–10,000 merchants a day on WhatsApp. Every decision — which trigger fires, which persuasion lever, which CTA shape — is deterministic Python; the LLM (Bedrock Nova Pro) only ever turns an already-decided strategy into grounded prose, checked against 8 fact-grounding gates before anything ships. Two independent Gemini judge passes scored all 30 official test pairs at 42.98/50 (86%, EXCELLENT) with 0 fabrication penalties — up from a 32.97/50 baseline with 3 penalties. 34 production bugs found and fixed along the way, from a bare STOP not registering as opt-out to free category offers leaking into live messages as if they were the merchant's own.

PythonFastAPIAWS Bedrock (Nova Pro)RedisPydantic

86% · 42.98/50

independent judge score

3 → 0

fabrication penalties

03Razorpay Buildathon 2026 · Track 03

MandateOps

A constraint-aware UPI AutoPay retry sequencer.

UPI AutoPay approval rates fell from 50% to 30% between Jan 2024 and Nov 2025 even as volume grew 10x — and NPCI gives every mandate exactly 4 attempts, ever, per cycle. MandateOps spends them with discipline: a deterministic 4-clause eligibility gate (attempt budget, legal non-peak hours, 24h RBI notice, mandate status) decides if an attempt is even legal, an empirical-Bayes scorer picks the highest-probability legal hour, and an LLM — Nira — is only ever allowed to classify, summarize, or explain, never to authorize money movement. Every decision writes to a tamper-evident hash-chained audit log. On a 5,000-mandate simulation: 66.7% recovery vs a 49.7% naive-retry baseline, +17pp, ₹5.17L+ additional rupees recovered.

FastAPIReact 19SQLite (WAL)GeminiGemma fallback
Source

66.7% vs 49.7%

recovery rate vs naive baseline

₹5.17L+

additional recovery, 5K-mandate sim

04

FTPX

Turns any Android phone into a local HTTP/FTP file server — no cloud, no sign-in, no cables.

FTPX hosts a local HTTP or FTP server directly from an Android device so files move over Wi-Fi instead of through a cloud intermediary. Point a browser, FTP client, Windows/macOS/Linux machine, or smart TV at the phone's local IP and pull photos, videos, or documents straight off it — connect faster with an on-screen QR code, or keep transfers alive in the background with a foreground service and status notifications. Everything stays on the local network: no accounts, no sign-in, no data leaving the device.

KotlinAndroidHTTP/FTP serverForeground services
Play Store

400+

active users

100%

offline file transfers

05

PulseBoard

A real-time incident command center that watches your infrastructure so you don't have to.

PulseBoard is a self-hosted uptime platform built to skip enterprise weight: a Redis-coordinated distributed scheduler with leader election runs HTTP and WebSocket checks on an interval, auto-opens incidents on failure, and fans alerts out to Email, Slack, Discord, and webhooks with cooldown and dedupe so nobody gets paged twice for one outage. The standout piece is a from-scratch OWASP-style WebSocket security scanner — 10 checks, CWE references, 0–100 risk scoring — built because most uptime tools only tell you a service is up, not whether it's exposed. Public branded status pages ship out of the box.

NestJSReactPrismaPostgreSQLRedisSocket.IO
SourceLive

10+

security checks with CWE refs

0–100

risk scoring range

06

RangRage

Booked 42 tournament slots in under 30 seconds. Zero double-bookings.

Built to survive a live 300+ team college paintball tournament, not a demo. Atomic slot booking runs through PostgreSQL FOR UPDATE row locking so two teams can never claim the same slot under concurrent load, guarded by a multi-step auth flow — reCAPTCHA, phone OTP, then a JWT — and Supabase Realtime pushes availability changes to every screen instantly. On tournament day: 42 slots filled in under 30 seconds, zero race conditions, zero conflicts.

Next.js 14SupabaseTailwind CSSFramer Motion
SourceLive

42 in <30s

slots filled

0

booking conflicts

The receipts.

Numbers from production, not from a pitch deck.

0+active users on AutoPayPlay Store, on-device privacy-first UPI tracker
+0ppmandate-recovery lift66.7% vs 49.7% naive baseline, MandateOps
0+team registrations handled42 slots filled in <30s, zero conflicts
0+students mentored10+ sessions on OWASP, pentesting, full-stack

03 · Skills

A stack built for shipping, not slides.

Grouped by what each tool is actually for — not a flat wall of badges.

Agentic AI & LLM Systems

Where the deterministic-core philosophy lives in code.

01
  • LangGraph
  • MCP
  • RAG
  • Tool / Function Calling
  • ReAct
  • Multi-Agent Systems
  • Structured Output (Pydantic / Zod)
  • AWS Bedrock

Cloud, Security & DevOps

CTF platforms, pentesting, and shipping to production infra.

02
  • AWS (EC2, S3, Lambda, RDS, Bedrock)
  • CI/CD
  • GitHub Actions
  • OWASP Top 10
  • JWT / OAuth 2.0
  • Penetration Testing

Backend & APIs

The layer that makes decisions, never the model.

03
  • Node.js
  • Express
  • NestJS
  • REST
  • WebSockets

Data & Infrastructure

State, persistence, and the scheduler underneath it all.

04
  • PostgreSQL
  • MongoDB
  • Redis
  • Docker

Frontend

Interfaces for dashboards, not marketing pages.

05
  • React
  • Next.js
  • Tailwind CSS

Languages

What everything above actually gets written in.

06
  • TypeScript
  • JavaScript
  • Python
  • Kotlin
  • SQL

04 · Try It

Poke around. It talks back.

A scripted terminal, not a real shell — type help to see what it knows.

kapil@portfolio — zsh
0+

DSA problems solved

LeetCode, CodeChef, Codeforces

0+

CTF participants

platform architected & deployed solo

Certifications & coursework

View DSA profile on Codolio