Systems I've designed and built

I designed the architecture of a stateless microservice that registers MCP tools and routes calls to them, plus mcp-kit, the library services use to plug in. Tools live in a Postgres registry, and agents search them by meaning through pgvector.

Key decisions

• Push-based self-registration. Services announce their own tools, so the gateway works on any runtime — no Kubernetes CRDs.
• Deterministic WorkItem hook engine. Covers the event flow we needed without running Kafka.
• Stateless gateway, state in Postgres. Scale by adding replicas.
• Dual-write notifications for change events.

The Keycloak-based identity layer shared by the Advensis products: federation with LDAP / Active Directory, Entra ID brokering, silent SSO, MFA, and custom login themes.

Key decisions

• Kerberos/SPNEGO for silent SSO — users on a domain machine sign in without a login screen.
• Each service ships its own permissions manifest. Roles and permissions are seeded per tenant from those manifests, not hand-maintained.
• Broker, don't migrate. Customers keep AD or Entra ID as the source of truth.

A React console for attribute-based access control (ABAC) that bridges SVT and svc-intellix. It went through several iterations as the permission model settled.