Przemysław Zalewski

Building AI agents since 2024

An AI developer who puts agents in production and keeps them there

For teams that need an AI feature or agent live in production: tool calling, MCP servers, evals, prompt-injection defense and a hard cost cap. Ask my agent below whether I fit your stack, then book a call.

Book a free 30‑min call Email me instead

Want a number first? See hours, price and start date →

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
~2/3of merged PRs in 2026 built with AI coding agents, nearly all through my review or merge
260+merged PRs of my own in 2026, plus 300+ reviews of other engineers’ PRs
10,000+affiliate programs cataloged, ~97% found automatically
~3×more GitHub contributions in 2026 than in 2025, 8,500+ by October, with agents under enforced rules

Sound familiar?

AI agent problems I fix in 2026

Can a prompt injection make our AI agent leak data?

Yes. On 18 August 2026 NVD published CVE‑2026‑75130: poisoned custom instructions served through the Context7 MCP server could make a connected AI coding agent send credentials from environment files to an attacker during a routine documentation lookup. VulnCheck rated it CVSS 9.0.

I treat every email, document and web page as untrusted input: kept apart from instructions and read by narrow tools that get no wider access than the user they act for. I built it that way as principal engineer of Patriot Mail, an AI email client where every incoming message is written by a stranger. In May 2026 I red‑teamed a product’s AI assistant with prompt-injection patterns, got a fresh session to reveal its context, and set the rule that its system prompt counts as public, so nothing secret goes in it.

Our Claude model is being retired. Will the feature still work?

Anthropic retires Claude Sonnet 4.5 on 30 November 2026 and recommends Claude Sonnet 5.5 instead; requests to a model past its retirement date fail (model deprecations). The promised notice is at least 60 days.

I run your real cases against the replacement before the date and score both models with fixtures and LLM‑as‑judge, so you switch on a number, not a hunch. In August 2026 I built Korpo Tłumacz to run on several models, including a local one, so swapping a retired or pricier model is a setting, not a rewrite.

Sound like you? Book a free 30‑min call →

AI agent works in the demo, fails in production

In a VB Intelligence survey published 8 October 2026, 61% of respondents whose organizations test AI before release had seen an AI agent or LLM feature pass internal testing and then cause a customer-facing failure in the previous 12 months.

Before a feature ships, its quality is a score on your real cases, rerun on every prompt or model change. The agentic content platform I co‑built in a two‑person team shipped thousands of articles on that loop. In September 2026 an in‑app AI assistant could chat but not act; in one day I traced three separate faults across two teams’ code, fixed ours and handed the other team an exact list.

How do I stop an AI feature from running up a huge API bill?

In Harness’s State of AI in FinOps report (29 July 2026, 700 engineering leaders and practitioners), 72% had an unexpected AI cost spike in the past year, and only 20% could find the cause of a doubled bill within hours.

I add per‑IP and global rate limits plus a cost cap the app enforces itself, kept in a Durable Object. Four of my side projects on this domain run that way, so a traffic spike or abuse has a known maximum cost. When an AI content pipeline burned money on runs that failed at the last step, I capped it per hour, so a bad batch now costs a few dollars.

Facing one of these? Book a free 30‑min call →

Why me

Measured, never vibes

Before a feature ships, its quality is a number on a dashboard, scored on test cases by an LLM judge. When a new model comes out, the same tests decide whether to switch.

Cost caps, not surprise bills

Every model call runs under per‑IP and global rate limits and a cost cap the app enforces itself. The agent below runs under the same kind of limits, so a spike or abuse has a known maximum cost.

Untrusted text never gives orders

An email client where every message is untrusted input taught me to wrap user text, keep tools narrow and let an agent see no more than the person would.

MCP that people actually use

I took an MCP server to its first external users. An agent gets no wider access than a person, and PostHog shows which clients use it.

Live demo

Ask my agent about me

This chat runs on Workers AI with three tools: check_availability, match_stack and list_case_studies. Every tool call shows up in the trace before the answer streams in.

Demo loading…

Got a job ad? Paste it into the chat and ask what I am missing.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

An AI coding agent as a team member, under enforced rules

The problem
Coding agents write code faster than a team can review it. A team of four wanted the speed without a slop swamp on main.
What I did
I authored the rule set shared by Claude Code and Codex: mechanical checks over written rules, lint and test gates for security, API surface and CSP, agents working on main with hooks, every PR reviewed by a human, AI‑assisted content disclosed as such.
Result
In 2026 about two thirds of merged pull requests across two products were built with coding agents, and nearly all went through my review or merge. I merged 260+ PRs of my own and reviewed 300+ of other engineers’. My commits across those two products went from under 1,000 in 2025 to 7,500+ by October 2026.

~2/3 PRs with agents 300+ reviews 7,500+ commits in 2026

See also: Full‑stack & custom software · AI in your company

Offer: AI engineer for your team (Node.js, LLM agents)

AI content platforms: R&D and an agentic content platform, quality measured not assumed

The problem
Thousands of articles were needed, with AI disclosure built in and without publishing slop.
What I did
Late 2024 I built the agent driver: enforced stop conditions, tool‑call limits, parallelization, delegation chains. Quality came from best‑of‑n, LLM‑as‑judge, scoring against fixtures and plagiarism checks, with many models evaluated across their releases.
Result
Thousands of articles shipped through the platform. Content deployed automatically across 300+ generated sites with git‑backed bulk operations and reputation monitoring. From November 2023 to May 2025 it was a two‑person team. Invented author bylines came off all 300+ sites within a week, and one measured weekend in production saw about 94% of runs succeed at roughly a dollar per article.

thousands of articles 300+ sites LLM‑as‑judge

See also: AI in your company

An MCP server from first merge to first external users

The problem
Users of Sandtime.io, the time tracker I built at Sanddev, used by 4,000+ freelancers and teams, wanted to log time from their AI assistants. The API existed, the agent surface did not.
What I did
I set the tool surface, removed destructive tools, routed every operation through the existing REST controllers so an agent gets no wider access than a person, and instrumented adoption per client in PostHog from day one.
Result
First external users. A bot-protection rule that rejected MCP clients by user agent was found and removed the same day because the dashboard showed it.

MCP OAuth adoption dashboard

See also: PostHog & product analytics · AI in your company

Offer: Your company systems inside Claude and ChatGPT (MCP)

Facing something similar? Book a free call →

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week AI and agent code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Measured, not assumed

PostHog in every project from day one. A tracking plan per feature, and dashboards leadership reads instead of asking me for numbers.

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Good to know

LLM API details that decide cost and reliability

Short prompts are silently not cached

Each Claude model has a minimum cacheable length, from 512 to 4,096 tokens. Below it, the request runs without caching and returns no error (prompt caching).

The cache clock starts with the request

The 5‑minute cache lifetime counts from the start of the request, not the end of the response, so a long streamed answer uses up the window (prompt caching).

Cache reads skip the input rate limit

On most Claude models only uncached input tokens count toward input tokens per minute, so a high hit rate multiplies throughput (rate limits).

max_tokens works the opposite way at OpenAI

Anthropic ignores max_tokens for output rate limits. OpenAI counts the larger of max_tokens and the estimated input against tokens per minute (Anthropic, OpenAI).

Tools add a hidden system prompt

Any Claude request with tools carries an extra tool‑use system prompt, billed as input tokens (pricing).

Structured outputs reject numeric limits

Claude structured outputs return a 400 for minimum, maximum, minLength and maxLength. A refusal or a max_tokens cut can still break the schema (structured outputs).

FAQ

Questions people ask before they book

How do I know a prompt change did not break my assistant?
Run the same test cases before and after, several times each; a case that passed before and fails now is a prompt regression. Eval Desk does it for free on Claude models: it shows which cases regressed, which got fixed, which are unstable, and the prompt diff.
How do you defend against prompt injection?
User text goes into the prompt as data, wrapped and escaped, with a standing instruction that it is never an instruction. Tools are narrow and read‑only unless the product needs more. Outputs are filtered before they reach the screen. The agent on this page works that way.
Which models and providers?
Claude, OpenAI and open-weight models on Workers AI, picked per task and swapped when a release changes the picture. I keep evaluations so a model change is a measured decision.
What will the model calls cost us?
As much as we agree before launch: per‑IP and global rate limits plus a cost cap the app enforces itself, like the agent on this page. Prompt caching and the right model per task lower the bill, and evaluations show whether a cheaper model is good enough.
What does the one‑week code audit cover for agents and MCP?
It is the same one‑week code audit as on every page, focused on agents: I read your code, API, auth, tool surface, evaluation data and analytics by hand, then hand you a report with what an agent could safely do today, what needs work and a plan. It is the cheapest way to find out whether to build. The audit is the first rung on the offer ladder.
Do you use coding agents in client work?
Yes, under enforced rules and with disclosure, as in the case study above. You get the output, I keep the responsibility. If you forbid AI tools, I write by hand. The same rules apply when I run a project as fractional tech lead.
Can you make our product usable by other people’s agents?
That is what an MCP server is for. I have shipped one to external users, removed destructive tools from it and measured adoption per client. Same approach for your product.
How soon can you start?
3 November 2026. Book the call and we start with the one‑week code audit. If it ends in a no‑go, you have spent one week, not a quarter, and you keep the report.
Why is my Claude prompt not being cached?
Usually the cached prefix is shorter than the model’s minimum, and the API skips caching without an error. Also remember the 5 minutes count from the start of the request (prompt caching).
Can structured outputs still return invalid JSON?
Yes, on a refusal or when max_tokens cuts the answer. Numeric ranges are not enforced by the schema, so validate them in code (structured outputs).
What happens when the Claude API hits its monthly spend limit?
It returns a 429 without a retry-after header, and automatic retries keep failing until access resumes (rate limits). Alerts and a fallback path belong in the design.
Can a prompt injection make our AI agent leak data?
Yes. On 18 August 2026 NVD published CVE‑2026‑75130: poisoned custom instructions served through the Context7 MCP server could make a connected AI coding agent send credentials from environment files to an attacker during a routine documentation lookup. VulnCheck rated it CVSS 9.0. I treat every email, document and web page as untrusted input: kept apart from instructions and read by narrow tools that get no wider access than the user they act for. I built it that way as principal engineer of Patriot Mail, an AI email client where every incoming message is written by a stranger. In May 2026 I red‑teamed a product’s AI assistant with prompt-injection patterns, got a fresh session to reveal its context, and set the rule that its system prompt counts as public, so nothing secret goes in it.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

What’s the most expensive painting?Punchline

A Claude Monet. Priced per token. Ba‑dum‑tss.

Why did the AI agent forget the meeting?Punchline

It ran out of context. Ba‑dum‑tss.

What kind of dance do AI engineers like?Punchline

The algo-rhythm. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

AI in your companyAdoption plans, custom agents, MCP, skills and rules for coding agents.Live demo PostHog & product analyticsTracking plans, first‑party proxy, dashboards leadership reads.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack