Joe Alfaro

Full-stack engineer

I build applications end to end, many with AI at the core: the agent, the guardrails around it, and the evaluations that show whether it works.

Projects, built end to end

Each one is a working app with the guardrails and evaluations around the model, not just a prompt.

AgentForge

A Gauntlet AI project

A clinical co-pilot inside OpenEMR that answers a covering physician's questions about the patient whose chart is open.

Built into the open-source OpenEMR health record as a module, with the agent in its own TypeScript service. Every clinical claim must cite a record in that patient's chart, and rules enforced in code plus a second model check remove any claim they can't verify instead of hedging it. The agent can only read the one chart already open, through a short-lived scoped token, and its traces stay in self-hosted Langfuse.

Built with

  • OpenEMR (PHP)
  • TypeScript
  • Node.js
  • Claude API
  • Langfuse (self-hosted)
  • MySQL
  • Docker
  • Railway

Week 2 of @gauntletai ⚔️ This week I built on the OpenEMR software from week 1 with some improvements and new features. Here’s a quick demo of what I built, how it works, and some of the decisions I made along the way. On to week 3. 🚀#GauntletAI #AI #BuildInPublic

View on X (from Sep 27, 2026)

AgentForge Adversary

A Gauntlet AI project

A red team for the clinical co-pilot that attacks it every night and on demand.

A multi-agent adversarial evaluation platform for the OpenEMR Clinical Co-Pilot. It generates and mutates attacks, has an independent judge rule on each one, files confirmed exploits as tickets, writes vulnerability reports and re-tests fixes as regressions, all inside a nightly budget. Its test suite is mapped to OWASP categories, and operators queue work and track tickets from a dashboard.

Built with

  • TypeScript
  • Node.js
  • PostgreSQL
  • React
  • TanStack
  • JSON Schema + Ajv
  • Claude API
  • Vitest
  • Railway

Week 3 @GauntletAI 🛡️ ⚔️ I built a team of AI agents that red-team other AIs. Pointed them at the medical Co-Pilot I built weeks 1. This week's AI attacking last week's AI, hunting PHI leaks & prompt injection at night. 150+ attacks, it held up. Demo 👇

View on X (from Oct 2, 2026)

AI Agent Orchestration Platform

A Gauntlet AI project

Build multi-agent workflows in a web UI, with a human approval before any side effect.

Configure AI agents (prompt, model, tools, limits) and wire them into multi-agent workflows in a visual builder, with no code changes. Agents run on the open-source Goose runtime, but every control lives in the platform: tool allowlists, spend and step limits, cancellation, and an approval gate that runs an approved action exactly once. Every run is traced and streamed live, quality is measured by an offline evaluation harness, and an agent can be chatted with from Telegram.

Built with

  • Go
  • PostgreSQL
  • React
  • TypeScript
  • Tailwind CSS
  • React Flow
  • Goose
  • MCP
  • Claude API
  • Server-Sent Events
  • Telegram Bot API
  • Docker
  • Railway

Plays from YouTube when you press play.

AI Onboarding Assistant

A Gauntlet AI project

Guided sign-up that swaps long forms for a conversation and retyping for a photo of your ID.

A chat assistant collects what the service needs and saves it as a structured assessment, a photo of an ID pre-fills identity fields for the user to confirm, and a scheduler books the first appointment. ID images are read by self-hosted OCR and never sent to an LLM, and consent, data minimisation and verifiable deletion are built in. The LLM provider is swappable and was chosen by running the same evaluation on every candidate.

Built with

  • Ruby on Rails
  • Next.js
  • React
  • TypeScript
  • Supabase (Auth, Postgres, Storage)
  • Tesseract OCR
  • Claude Haiku
  • Groq
  • Playwright
  • Railway

Plays from YouTube when you press play.

AI Call Center Agent

A customer-service chat agent that answers from the company's own documents, books appointments, and hands everything else to a person.

Built for a residential heating, cooling and plumbing company. Answers about plans, warranties and policies must cite the documents they came from, or the agent hands the conversation to a human with a note they can act on. It books, moves and cancels appointments in the scheduling database, looks up balances, and screens every message for safety issues like a gas smell before the model sees it, while an evaluation harness replays held-out real calls to measure it.

Built with

  • Python
  • FastAPI
  • Claude API
  • Tool use
  • RAG (BM25 + embeddings)
  • SQLite
  • React
  • TypeScript
  • Vite
  • Docker
  • Railway

Plays from YouTube when you press play.

Where I learned to build

Twice I chose to start over as a beginner. Both times the same habits got me through: show up every day, ask for the hard feedback, and fix what it finds.

  1. Lambda School

    Where I became a software engineer

    I came to change what I did for a living, so I treated the program like the job. I built full-stack apps, asked for code review early, and rewrote whatever didn’t hold up until it did.

  2. Gauntlet AI

    Where I became an AI engineer

    I went back to being a student to learn a new kind of engineering. Each project started from someone else’s requirements and had to end as a working AI app, with the evaluations to show it worked. When a review found a gap, I closed it and shipped again.

Videos

Walkthroughs and demos on YouTube.

New videos coming soon

Latest posts

What I’m sharing on X and LinkedIn.

Let’s talk

Hiring, building something with AI, or curious how one of these apps works? Send a message and I’ll get back to you.

Plain text, up to 5,000 characters.

I only use your email to reply.