Skip to content
hugo.pessoni

AI ENGINEER · GENAI

Agents that prove what they do.

I'm an AI intern at Ideen and a Software Engineering student at UTFPR. I build agents, MCP servers and RAG pipelines that run in production, with tests, gates and security from the first commit.

Hugo Pessoni in front of the Google Cloud sign
Google Cloud office in São Paulo, TD SYNNEX & Google AI Mastery Journey program

Featured cases

Completed~5 min

Fábrica: from request to verified system

Claude Code skills that take a PEDIDO.md to a running system, and a script, not the agent, approves every stage.

5/5 requests with 100% of acceptance criteria met, 4 of them unseen

AI engineeringAgents & MCP
Production~5 min

One MCP gateway for every agent

A single MCP server with per-user permissions and auditing that became the front door to the company's agent tools.

560+ automated tests in the gateway

Agents & MCPLLM security
See all cases

How I work

  • Spec before code

    Every serious project starts with a spec and a plan versioned in the repo, including this site.

    See example
  • Tests before implementation

    In Fábrica, acceptance tests are sealed by hash before any code. The MCP gateway has more than 560.

    See example
  • LLM security by design

    Model output is untrusted input: structural gates, format validation and no critical rule living only in a prompt.

    See example

Stack

AI
Google ADKVertex AI (RAG, Agent Engine)GeminiLangGraphMCPA2AClaude CodeChroma
Backend
PythonFastAPIPydanticpytestTypeScriptNode.js
Cloud and DevOps
GCPCloud RunEventarcTerraformDockerKubernetes (GKE)Cloud BuildGitHub Actions
Security
OAuth 2.0JWTHMACArgon2idAES-GCMbanditsemgrepPrompt-injection defense
Data and frontend
PostgreSQLFirestoreSQLiteReactViteFlutter

Beyond AI

Infrastructure as code, CI/CD, Kubernetes and security in other teams' repositories.

  • Merged PR

    Cloud Build connected to the GitHub organization

    Connected Cloud Build to GitHub at the organization level and unblocked an internal app deploy pipeline with least-privilege permissions.

    TerraformCloud BuildIAM
  • Merged PR

    CI/CD migrated to Cloud Build

    Migrated deploy and tests of an internal app from GitHub Actions to Cloud Build with remote state, and updated spec and README to match reality.

    Cloud BuildTerraformGitHub Actions
  • Merged PR

    Staging outage diagnosed

    With the site in private mode, the root returned 302, the GKE health check marked the pod unhealthy and the gateway served 503 everywhere. A HealthCheckPolicy on an always-200 endpoint fixed it.

    GKEGateway APIGhost
  • Merged PR

    Security for an AI-generated HR app

    Merged an AI-generated version with a secure one: Argon2id, AES-256-GCM for personal data, rate limiting, four-role RBAC, bootstrap-only admin and no made-up KPIs on the dashboard.

    FastAPIFirestoreArgon2idAES-256-GCM
See contributions

Let's talk

If your team builds with LLMs, I'd love to help.

Message me on LinkedIn