Abhishek Rajput
Backend & Systems Engineer
Robotics & AI Infrastructure
Building from R&D to Production
./hello.sh
Hey, I'm Abhishek 👋
Backend & Systems Engineer with 1.5+ years building AI platforms, autonomous robotics systems, and industrial software. I solve problems around distributed systems, real-time infrastructure, and taking products from R&D to production.
Recently Shipped:
- Production RAG Platform (intelligent routing, 30% cost reduction)
- Robot Control System with 3× lower latency
- Multi-Tenant IIoT Platform processing 60,000+ sensor tags
./experience-log
- Architected a production-grade RAG platform enabling conversational interaction with user-uploaded documents through semantic retrieval and source-aware responses.
- Built an end-to-end retrieval pipeline spanning OCR extraction, semantic chunking, TEI embeddings, Qdrant vector search, cross-encoder reranking, and Llama 3 generation.
- Implemented distributed ingestion and retrieval workflows using Django, Celery, Redis, and WebSockets for asynchronous processing and real-time updates.
- Designed intelligent query orchestration through intent routing, contextualization, and query expansion, achieving ~1.5–2s end-to-end response latency.
- Django
- Qdrant
- Llama 3
- Celery
- Redis
- Next.js
- TypeScript
- Supabase
- TEI
Nexus Automech
- Python
- Django REST Framework
- ROS2
- WebSockets
- Modbus TCP
- YOLOv8
- Redis
- Celery
- PostgreSQL
Rapidops
- React.js
- Next.js
- JavaScript
- html
- CSS
- Tailwind CSS
BISAG-N
- Python
- Deep Learning
- Computer Vision
- OpenCV
- TensorFlow / PyTorch
./projects (4)
AI agents are routinely handed long-lived GitHub personal access tokens that sit in .env with far more scope than any single action needs. Broker replaces that pattern with capabilities: narrow, short-lived credentials minted at the moment of use, governed by policy, and recorded to a tamper-evident audit log. If a requested action falls outside policy, Broker refuses without ever minting a token.
What it does
- Policy-first authorization: Every request is evaluated against an allowlist before any credential exists — a denied action never touches a token.
- Ephemeral GitHub tokens: Signs a GitHub App JWT and exchanges it for a per-repo installation access token (~1h server-side TTL) scoped to a single permission.
- Token never leaks: The raw token lives in a private field and is stripped from everything returned to the caller — the agent receives only a public capability receipt.
- Full audit trail: policy decision → mint → use → outcome, each appended as a JSON line; tokens are never written.
Engineering Highlights
- MCP-native: Exposes the pipeline as a Model Context Protocol server, so Claude Desktop discovers and calls
github_create_issueas a tool — the security boundary is the tool interface itself. - Small, legible core: Policy is a single pure function; the credential exchange and the append-only audit sink are each one focused module.
- Extensible provider layer: The same mint-on-use pattern is designed to extend to AWS STS and other short-lived-credential providers.
- Python
- Model Context Protocol
- GitHub Apps
- JWT (RS256)
- FastMCP
- Ephemeral Credentials
- Least Privilege
- Audit Logging
- Django
- DRF
- Celery
- Redis
- PostgreSQL
- Qdrant
- TEI
- Cross-Encoder
- Groq
- Llama 3
- Django Channels
- Next.js
- ROS2
- Django
- Redis
- WebSockets
- Modbus TCP
- YOLOv8
- OpenCV
- UWB
- 3D LiDAR
- Django
- PostgreSQL
- Celery
- Redis
- WebSockets
- Modbus TCP
- RBAC
- Multi-Tenancy
./publications (5)
systems.hashnode.dev
Replacing GitHub PATs with Ephemeral Installation Tokens
A Successful Payment That Never Became a Booking: Building a Fault-Tolerant Payment Pipeline
Building a Production-Grade RAG System: Architecture, Trade-offs, and Lessons Learned
Modernizing Defense Robotics: From PLC-Heavy Control to a Sub-150ms Web-Orchestrated HMI
