AI Engineer · Full-Stack Developer

I build AI systems that actually ship.

LLM agents with human-controlled write paths, privacy-safe AI pipelines, retrieval with citations, and the full-stack products around them. Five years of shipping for clients and startups, a hackathon-winning AI pipeline, and two client products live in production today.

View projects Book a call

Muhammad Afzaal Afzal

AI Engineer & Full-Stack Developer

Status: open to work
Location: Heilbronn, Germany
Studying: M.Sc. AI & Data Analytics
Also at: 42 Heilbronn
Focus: agents · RAG · evals · product

Code on GitHub

5+
years shipping software: 181
freelance orders delivered: 134
five-star client reviews: 1st
place, Campus Founders AI Hackathon

Selected work

Work you can click on

A hackathon-winning AI pipeline, an agent with a human-controlled write path, and two client products with real users. Code, demos, and live sites linked.

All projects

1st place, Raumdeuter AI track · Campus Founders AI Hackathon, Heilbronn, May 2026

Privacy-First Fan Intelligence Pipeline

Football clubs want AI on their fan messages. Every fan message is full of names, emails, and booking IDs.

PII is detected and masked before any LLM call (Microsoft Presidio, spaCy, regex, custom German rules), a second safety gate blocks the call if anything leaks, and only masked text ever reaches the model or the database. Six pluggable LLM providers, a FastAPI and PostgreSQL backend, a Next.js frontend, and 77 pytest tests including PII leak tests. Built in five days; I wrote the entire codebase for our team of three.

Won the track with a working implementation, not a concept: about 100 applicants, 17 teams selected across five tracks. The challenge sponsor followed up with an internship offer.

FastAPI
Presidio
PostgreSQL
Next.js
pytest
Docker

Personal project · agent with a human-controlled write path

AI Support Resolution Agent

A support copilot that can create tickets needs a write path the model cannot execute on its own.

An agent on the LangGraph runtime answers from a pgvector knowledge base with citations and proposes ticket creation. The proposal is interrupted and checkpointed in PostgreSQL, so a human can approve it in a later request on any API instance, even after a redeploy, and the approval is hash-bound to the exact parameters that person saw. LiteLLM routing with a fallback model, Clerk auth, structured logs plus an audit table, and a security suite covering prompt injection through retrieved documents.

On the project’s own eval suite: retrieval Hit@5 of 100 percent, task success 100 percent, zero security failures.

LangGraph
FastAPI
pgvector
LiteLLM
Next.js
Clerk

Recorded demo

Client project, Italy · live in production · sole developer

TMF Backstage, artist portal for Tour Music Fest

A music festival’s team was answering almost 600 artist emails a day by hand.

A self-service artist portal: passwordless email login, a six-step journey status engine derived from Mailchimp merge fields, context-aware next actions, a live audition module with venue data in Postgres, Italian, English, and Spanish localisation, staging and production on Vercel with client UAT, and Clarity analytics.

The client reports daily enquiries dropped to about 5 to 10 after launch.

Next.js
TypeScript
Supabase
Mailchimp API
Vercel

Client project, USA · live with paying subscribers · sole engineer

AK-GAL Designs, subscription platform and brand hub

A founder-run brand with a firm launch date, a website builder that could not carry the design, and Stripe products with nowhere to sell them.

Two live paid subscription products on Stripe Checkout, webhook-driven renewal, failed-payment, and cancellation emails through Resend, a free-first-letter lead funnel that replaced a manual form, Sanity CMS so the owner edits content herself, and a migration off the website builder with 301 redirects that kept printed URLs working.

Next.js
TypeScript
Stripe
Resend
Sanity
Vercel

All projects

Try it

Ask this portfolio anything

A scaled-down version of the retrieval systems I build, running entirely in your browser: keyword scoring over this site's content, a citation on every answer, and a grounded refusal when it does not know.

How I work

A good AI product is not just a model call

It needs structure, safety, evaluation, and a clear user workflow. Five rules I build by:

01
Problem clarity
Define the user, the business goal, and the expected outcome before writing a line of code.
02
Strong architecture
Separate UI, API, AI provider logic, tools, storage, evals, and observability, so each can change without breaking the rest.
03
Grounded outputs
Citations, retrieval checks, refusals, validation, and structured responses. An answer you cannot trace is a liability.
04
Measurable quality
Track latency, cost, retrieval quality, eval scores, and regressions. If it is not measured, it is broken and nobody knows.
05
Production readiness
Logging, retries, timeouts, security checks, deployment docs, and clean READMEs. Shipping is part of the system.

Writing

Notes on AI engineering and the tools I use

All posts

June 12, 2026

Retrieval without generation: how the Ask widget on this site works

The Ask widget answers questions about my work with zero API calls and no LLM. How the scoring works, why the refusal threshold is the real feature, and what carries over to production RAG.

Read post

June 8, 2026