Must have
- 5+ years Python; strong async (asyncio), typed code, pytest, ruff; comfortable subclassing abstract backends and mapping exceptions to structured results.
- Shipped tool-using LLM agents on the Claude Messages API or Agent SDK; understands prompt caching mechanics and why static-prefix bytes matter.
- Built or integrated MCP servers (streamable HTTP) and put authentication in front of them; understands that a model can skip a tool call and enforcement must live server-side.
- JWT/JWKS verification, OAuth client credentials, secrets handling; can call a real-time risk API inside a latency budget and reason about fail-open vs fail-closed.
- Reads an unfamiliar, unmaintained open-source codebase quickly and cites module and line in every claim; works from written acceptance criteria without supervision.