Benjamin Houdebert

Description: - Built a toolbox that investigates a running system from its own evidence (logs, metrics, databases, HTTP checks). It runs from the terminal and as an MCP server for Claude Code, Codex and GitHub Copilot, and it never changes the system it reads. - Teams plug in their own connectors (where the evidence is) and playbooks (how they investigate) through a mounted workspace, so nobody edits the core or the Docker image. - Added an optional own-model mode (ops chat, ask, eval) with an evaluation harness. I measured it on local models at temperature 0.7 over 8 runs per scenario. Temperature 0 gave near-identical runs, so I dropped it as a measure. Highlights: - One MCP server, two transports: a shared server factory runs on stdio (local) and Streamable HTTP (one instance for a team). Credentials stay on the server, with sessions bound to the caller, size and session caps, and an audit log that records no inputs or evidence. - Authentication: - Static bearer tokens are stored hashed (SHA-256, constant-time compare). - A company-login layer (OAuth 2.1 resource server) validates JWT access tokens with the provider's published keys, checking issuer, audience and expiry (RFC 9728 resource metadata, RFC 8414/OIDC discovery). - Opaque tokens are validated by asking the provider (RFC 7662 introspection) with short caching. A provider that is down returns 503 retry-after, not 401. - It fails closed at start: no unsafe algorithms, https required off loopback. - An oauth check command explains a token check by check. - Conformance testing: the OAuth path is tested against node-oidc-provider (OpenID-certified) in JWT and opaque formats, an Auth0-shaped fake provider and a real Keycloak. Cases include revocation, expiry, wrong or missing audience, key rotation, provider down and cache behaviour. - Container: hardened image (read-only filesystem, all capabilities dropped, no-new-privileges, non-root user, healthcheck) and a Compose file with a Keycloak try-it, built and smoke-tested in CI. - Process: spec-first development with OpenSpec, architecture decision records, Conventional Commits enforced by hooks and CI, a quality gate (typecheck, lint, format, tests with coverage thresholds), CodeQL, branch and pull-request flow, and a VitePress guide. 255 automated tests, none of which call a model API or a real system. Stack and tools: TypeScript 7, Node.js 24, MCP SDK, jose, OAuth 2 / OIDC (RFC 6749, 7662, 7591, 8414, 8707, 9068, 9728), PKCE, Keycloak, Docker and Compose, GitHub Actions, CodeQL, node:test, ESLint, Prettier, commitlint, VitePress, OpenSpec, Ollama, Claude Code, Codex, GitHub Copilot. One-line version: Built an open-source, read-only incident-investigation toolbox for AI coding assistants (MCP over stdio and HTTP) in TypeScript, with hashed-token and OAuth 2 / OIDC authentication (JWT and RFC 7662 introspection, tested against a certified provider), a hardened Docker image, and a spec-driven, fully tested workflow.

Designed and built agentMotoride, an open-source agentic AI planner that turns a one-sentence request into a motorcycle itinerary built from verified data, usable from the terminal, Claude Code, Codex and a phone. https://bhoudebert.github.io/agent-motoride/ - Architected a multi-agent LLM system: tool calling with structured outputs, and parallel sub-agents that scout candidate regions (in Claude Code, on the client's own subagents). - Built 30+ deterministic tools over open data: routing, road curvature, speed limits, a riding-time model, weather, daylight, traffic, speed cameras, fuel and café stops checked against opening hours; GPX, Markdown and map exports. - Implemented guardrails in code, not in the prompt: every itinerary is checked against distance and time caps, motorways, repeats and roads rated "never again" before it is shown. - Added RAG over past sessions (geospatial + BM25 retrieval, SQLite FTS5) so the agent reuses what earlier plans learnt. - Designed a versioned data model (roadbooks and dated rides, edited with full history) with transactional migrations. - Built LLM evals: rider requests graded by code, recorded once and replayed for free in CI, including a prompt-injection test; plus observability with tracing, cost accounting and OpenTelemetry. - Exposed it all through a Model Context Protocol (MCP) server, with confirmation dialogs for destructive actions. - Run as an open-source project: spec-driven development (OpenSpec), ADRs, CI with coverage gates and CodeQL, automated releases. Stack: TypeScript, Node.js, SQLite, Anthropic API, MCP, OpenStreetMap, Valhalla, Open-Meteo, TomTom, GitHub Actions.

Served as technical lead on a large-scale multi-tenant Delivery Management System used across multiple business units. • Led architecture and delivery of a multi-tenant backend platform supporting document-centric workflows across multiple business units. • Defined domain models, service boundaries, and engineering standards, ensuring implementation consistency and long-term maintainability. • Designed and implemented document ingestion, validation, and audit-ready retention workflows, embedding compliance and traceability from early stages. • Acted as technical lead for a team of 6, implementing scalable operations through asynchronous orchestration and background processing. • Partnered with product owners and stakeholders to align technical decisions with business goals and delivery priorities for a team of 6 developers. • Stack: Java 25, Spring Boot, Python, PostgreSQL, Kafka, Docker, Kubernetes, TypeScript, Vue.

Designed and built modular backend platforms, set technical direction, and led four teams across mobile, SaaS, platform, and blockchain engineering. • Owned backend architecture and service design across modular platform domains, including payments, KYC, messaging, image moderation, and digital receipts. • Defined an API-first architecture using REST, gRPC, and GraphQL to support interoperability across services. • Implemented secure platform foundations through cryptographic workflows and passwordless authentication. • Built event-driven and asynchronous pipelines to improve platform scalability and resilience. • Deployed and operated backend services on Kubernetes with automated delivery pipelines. • Built a complete OAuth2 server aligned with certification requirements and centered on cryptographic authentication flows. • Built an API-first governance platform for non-sovereign funds, integrating blockchain services into the broader platform architecture.

ADA Finance vision is to be the first DeFi Ecosystem on the Cardano blockchain, offering the known DeFi features and introducing innovative passive income opportunities to the P2P Finance community. • Development of smart contracts with Haskell/Plutus over Cardano Blockchain allowing end users to stack or swap their tokens • Stack: Haskell, Servant, Katip, Feer, Nix, Postgres, Kafka, Docker, Kubernetes, GCP, Azure / AWS

Built a platform to normalize product, model, taxonomy, and attribute data and expose unified catalog information across countries through APIs and messaging. Stack: Haskell, servant (rest API), polysemy, katip, persistent, conduit, Nix, Kafka, Postgres traditional column and JSON, NodeJS / VueJS / Typescript, Kafka, Docker, Kubernetes, GCP

Built a central integration platform to consolidate SaaS data, manage versioning and conflicts, and resynchronize systems with up-to-date records. • Built a unified customer-data layer to provide a 360-degree view for individuals relocating across countries. • Defined master-data and conflict-resolution rules across SaaS systems, including master/master and master/slave synchronization patterns. • Stack: Java 15, Spring Boot microservices, Vavr, Gradle, Kafka, PostgreSQL, Docker, GCP. • Built a workflow platform to support international employee relocation processes. • Implemented REST APIs, Keycloak-based identity and access management, Vue.js and TypeScript frontend integration, Kafka synchronization, CircleCI, Docker, Kubernetes, and GCP.

Led CI/CD improvements across the company, combining delivery enablement, developer support, and platform practices. • Enhanced workflows with Docker. Automated deployment via Swarm, Jenkins. Implemented webhooks, documentation-as-code. Achieved end-to-end automation using Consul for secret management. • Coached developers and operations teams on Jenkins and Docker, including Java migration to LTS JDK versions, Dockerfile creation, and Sonar quality metrics. • Supported project delivery on a Java 12, Spring WebFlux, R2DBC, and Angular stack.

Team manager of a dedicated development center, of 4 people: • Creation of the development service center • Methods: Scrum/Kanban • Perimeter: 40 applications to maintain in production • Define SLA • Stack: java, PHP, JavaScript, shell, rpm, git • New projects with architect/tech lead role: FAQ application for the hotline and some mobile applications, Booking a Room web application, Application to handle quantity in store seeing by client from store reserve, Stack: AngularJS, Scala, symfony, java, JSF, PHP, nuxeo, play, android, iOS

Project management for small projects up to 120 man days and up to 4 people including hands on for frontend and backend. • The most important: Monascope: first tool in France to provide categorisation of expenses in your bank account management • Some other tools: online trading, passbook savings, dynamic survey, PDF framework, mortgage calculator … • Stack: Spring, Java, JavaScript, Cobol, SQL

• Creation of a "devkit" for designing template of invoice/billing to real documents • Development of web services providing authentication to Leroy Merlin stores • Stack: Unix, java, jboss/tomcat, SQL, maven, LDAP

Two projects: • Evolution on an application displaying railway geometry: Swing application + backoffice importing 150 Go of data per night • Web Application to help SNCF to maintain the railroad in good condition: System expert providing advice to maintain the railway (pull, cut, add new rail bar ...) • Stack: java, JavaScript, SQL