Muhammad Mustafa

Multi-service FastAPI backend powering a self-hosted multi-provider AI workspace (OpenAI, Groq, Ollama, any OpenAI-compatible endpoint) with SSE-streamed responses.

Key highlights:

• MCP client layer supporting stdio and HTTP transports plus OAuth2 for remote servers — one-click connections to Notion, GitHub, and custom tool servers.
• Vector-backed persistent memory via ChromaDB scoped per user session; agent mode with tool calling (file I/O, bash, Python execution, web search) and a goal/verifier feedback loop with automatic retry.
• Streaming multi-provider core delivering sub-second first-token response across local and cloud LLM providers.

Open-source desktop app that turns any WhatsApp number into a brand-voiced AI responder — WhatsApp login, LLM key, knowledge base, live in under 5 minutes.

Key highlights:

• Local-first architecture with multi-provider LLM routing (Anthropic / OpenAI / Groq), SQLite persistence, and full conversation memory — no data leaves the device.
• FastAPI sidecar handles on-device inference; shipped as a single .msi installer for non-technical users.
• Baileys WebSocket engine paired with LangGraph orchestration for reliable, production-grade conversation memory.

Karachi's first interactive public transport routing platform — Dijkstra-based trip planning over real geographic data.

Key highlights:

• Dijkstra routing: Converted raw Google Earth geographic data into GeoJSON and implemented a Dijkstra shortest-path routing service for city-scale transit queries.
• City-scale impact: Served 1,600+ unique users with sub-second route response across the Karachi network.
• Team leadership: Co-led a 2-person team, owning the routing backend while the partner owned the map UI layer. Won the Design & Development Hackathon at FAST NUCES DevDay 2026.

MCP server that connects Claude (or any MCP-compatible client) directly to WhatsApp — send, receive, store messages with secure authentication.

What it is: A Model Context Protocol server that bridges Claude / GPT / local models into your WhatsApp account. Built on Baileys (the unofficial WhatsApp WebSocket library) with a focus on local-first architecture.

What's inside:

• Secure auth + QR code pairing on first run, then session is encrypted and stored locally. Reconnects automatically on restart.
• Send & receive messages to/from contacts and groups, read message history, search messages, list chats.
• Queue-based sending so you don't hit WhatsApp's rate limits even under heavy agent traffic.
• Messages indexed locally for fast search across your full chat history. Your data stays on your machine — nothing touches a remote server.

Why it matters: This is what makes Claude actually do things in WhatsApp instead of just talking about it. Read receipts, group management, scheduled messages — all become agent capabilities. It's also the same Baileys-based WebSocket client that powers Recluze's WhatsApp side, generalized into a standalone MCP tool.

Architecture note: Server runs as a local Node.js process; MCP clients connect via stdio. The WebSocket session is persistent (survives restarts via encrypted local storage) so there's no re-pairing friction during development.

Student-facing Android app of The Bridge of Hopes (TBOH) — a learning platform for children with special needs. Students log in with an ID issued by their school, see announcements from their teacher, comment on them, and complete assigned learning activities — tracing English letters, digits, and Urdu letters on a drawing canvas that is scored on-device by TensorFlow Lite models.

What it does:

• Login / session — JWT auth with automatic, transparent token refresh (central auth interceptor + 401 authenticator in OkHttp).
• Announcements — classroom feed, detail view, and class comments.
• Classwork — assigned activities with New / Incomplete / Completed tabs (server status combined with live local progress).
• Tracing activities — capital & small alphabets, digits, and Urdu letters; Easy/Medium/Hard difficulty, 5 scored attempts, auto-submission of results.
• Practice mode — the same tracing screens without an assignment.
• Reset password.

Architecture — MVVM, end to end: ViewModel → Repository → Retrofit API, with Hilt wiring through every layer. Tokens in EncryptedSharedPreferences, profile + activity progress in Preferences DataStore. Four TFLite models in app/src/main/assets/ score tracing attempts locally — no PII leaves the device for grading.

My role: Frontend dev on this codebase at The Bridge of Hopes (per the resume). This is the production app the students actually use, not a demo.

Quantizing GLM-4 9V (vision-language) to INT4/INT8 with bitsandbytes, then fine-tuning the quantized base on a custom OCR corpus.

What it is: A small deployable vision model that beats off-the-shelf OCR APIs on noisy real-world scans, runnable on a single consumer GPU.

Why it matters: Built as the running example for my AI Season Fine-Tuning + LLM Generation session. The pipeline covers quantization-aware fine-tuning, PEFT/LoRA adapters, and export to GGUF for Ollama inference — the full path from a 9B base model to a production-ready OCR service.

Training corpus: Printed and handwritten receipts and prescriptions across multiple scripts, simulating the kind of noise you'd see in a real deployment in Pakistan and South Asia.

Agentic voice banking system routing queries to RAG (policies/fees) or MCP tools (balance checks, transfers) via LLM-based intent classification.

What it is: A modular FastAPI + LangGraph backend with real-time MCP tool execution, ChromaDB vector retrieval, and local Whisper for voice input. Semantic search via Nomic embeddings.

Why it matters: Covers both RAG + Vector DBs and voice agent patterns in a single demo — two of the most-requested AI Season lecture topics — and was the project that convinced me tool routing via LLM intent classification is more reliable than fine-tuning a small classifier for banking-domain intents.

5-agent PR reviewer (intent, diff, security, verifier, decider) with a verification gate that filters hallucinated findings before they reach the developer.

What's inside:

• 5 CrewAI agents running in sequence with a verifier gate — the decider only emits a finding if the verifier confirms it.
• Real Semgrep SAST integrated as a subprocess tool call, not LLM-pretending-to-be-SAST.
• Three LLM tiers (free / paid / local Ollama) so the same code ships for solo devs and enterprise teams.
• SQLite-backed audit log of every agent's reasoning for post-hoc review.

Why it matters: Born from a felt pain at a 10Pearls internship where PR review latency was blocking deploys. It's the running example for my AI Season multi-agent orchestration discussion.

Cloudinary-style media service backed by Discord mega-drive storage, exposing an S3-compatible API.

What it does: Any boto3 / aws-sdk / rclone client can PUT and GET objects directly while the backend chunks, hashes, and shards uploads across Discord channels.

Why the deployment track matters here: DiscordDB is a teaching example of how the deployment-track primitives (Nginx, Certbot, Cloudinary) generalize to weird substrates — Discord channels as object storage, free tier as a design constraint, channel-fan-out as a primitive.

Production hardening:

• Graceful degradation when a channel goes read-only (auto-failover to next channel in shard).
• Idempotent retries with content-hash dedup so a retried PUT never duplicates storage.
• Structured logs across upload stages (chunk → hash → fan-out → ack → cleanup).

Main goal: Learn backend proper — auth, presigned URLs, multipart uploads, dedup, rate limiting, fan-out, retries.

Turns an Android phone into a persistent always-on VPS using Termux plus a proot-distro Debian/Ubuntu userland.

What it is: Exposed publicly via cloudflared or Tailscale Funnel. Process supervision and wake-lock handling so services survive screen lock, battery saver, and app backgrounding on commodity mobile hardware.

Why it matters: Built as a free-tier deploy example for AI Season students without cloud credits — the same cron jobs and self-hosted APIs you'd run on a $5/mo VPS, running on hardware you already own. Targets the operational layer (network, power, sleep, scheduling) that desktop dev hides.

Surprisingly capable: Used as the deploy target for a portfolio cron + webhook demo in production for 4+ months. Cheap, always-on, different-shape story for backend / DevOps interviews.

Full-stack cricket tournament management with team and player tracking, match scheduling, and live scoring.

What's inside:

• Secure REST APIs in Spring Boot with Hibernate/JPA.
• Live match updates delivered through Supabase Realtime over PostgreSQL — score changes propagate to all connected clients in under 200ms.
• Type-safe frontend in Next.js with TypeScript.

Why it matters: My first serious Spring Boot project — built to learn Java enterprise patterns (DAO, service layer, transactional boundaries) by shipping something a hackathon audience could actually use.

Hyper-local marketplace with H3-spatial-indexed geolocation, real-time messaging, and a reputation engine.

What's inside:

• H3 spatial indexing for sub-kilometer geo queries at national scale.
• 3-stage geo pipeline (cell-bucket → neighbour-cells → distance-filter) with Upstash Redis caching on hot cells.
• Real-time messaging for buyer-seller conversations.
• Reputation engine that aggregates ratings across transactions.

Why it matters: Built to understand how spatial indexes work at production scale — same pattern Uber / Careem use for dispatch, applied to a hyper-local marketplace that fits a Pakistani neighborhood.