Gil Ferolino Forward Deployed AI Engineer
Menu

Portfolio map

Explore systems, engineering capability and current AI thinking.

A production-focused view of the systems I build, the controls behind them and the research shaping what comes next.

Melbourne, Australia · Available for selected engagements Start a conversation ↗
← Selected systems

AI infrastructure · Amazon Bedrock · AgentCore · MCP · Security

MCP Postgres Scout

Safe, structured database introspection for AI coding agents, implemented with Amazon Bedrock and Amazon Bedrock AgentCore without granting permission to modify production data.

Architecture: Amazon Bedrock + Amazon Bedrock AgentCore

EngagementConfidential freelance project under NDA
My roleSole End-to-End AI Platform Engineer and Solution Architect
TechnologyAmazon Bedrock · AgentCore Runtime · Gateway · Identity · Policy · PostgreSQL · TypeScript
Proof signalRead-only access, deterministic policy and audited tool calls
MCP Postgres Scout interface showing safe PostgreSQL metadata exploration

The challenge

Coding agents need accurate database context to make architecture-aware changes, but direct production access creates unacceptable risk. The system needed to expose useful schema intelligence while enforcing a non-destructive boundary.

My end-to-end ownership

I independently delivered this engagement from discovery to completion. I owned requirements, product and solution design, the MCP contract, PostgreSQL introspection, permission boundaries, guarded tools, structured outputs, testing, security controls, deployment, auditability, documentation and handover.

  • Discovery and requirements
  • Product and solution design
  • Architecture and engineering
  • AI and data workflows
  • Cloud, security and CI/CD
  • Testing, observability and handover

System design

A TypeScript MCP server exposes allow-listed tools for schemas, tables, columns, relationships, indexes, permissions and query-plan inspection. Responses are structured so agents can reason with less ambiguity.

AWS agent architecture

Amazon Bedrock provides model inference while AgentCore supplies the governed runtime around the agent. The database remains behind a narrow read-only capability boundary, not directly inside model context.

01 / ReasoningAmazon Bedrock

A qualified foundation model interprets intent and reasons over typed PostgreSQL metadata returned by tools.

02 / Agent runtimeAgentCore Runtime

Hosts the TypeScript agent and MCP service with isolated sessions, scaling and OpenTelemetry-compatible traces.

03 / Tool boundaryAgentCore Gateway + Policy

Publishes allow-listed MCP tools and deterministically blocks undeclared schemas, write operations and unsafe arguments.

04 / IdentityAgentCore Identity

Provides workload identity and short-lived access to the database secret without exposing credentials to the model.

05 / Data planeAmazon RDS or Aurora PostgreSQL

Uses a read-only role or replica, statement timeouts, result limits and catalog-only access where appropriate.

06 / EvidenceAgentCore Evaluations + CloudWatch

Measures tool selection, SQL safety and answer usefulness while retaining audit, latency and failure evidence.

Amazon VPC networking, AWS PrivateLink where supported, IAM, Secrets Manager, KMS, CloudTrail and CloudWatch complete the security and operating boundary.

Production controls

Read-only credentials, SQL classification, statement restrictions, timeouts, result limits, explicit tool schemas, audit records and safe failure behaviour preserve the trust boundary.