# Amir Pournasserian

> Serial entrepreneur and hands-on AI architect. I build AI and platform systems that have to keep working once they meet production, compliance and scale.

## Pages

- [Amir Pournasserian — Serial entrepreneur, hands-on AI architect, open-source lover, always learning](https://pournasserian.com/index.md)
- [About](https://pournasserian.com/about.md): Amir Pournasserian has spent over twenty years architecting systems that aren't allowed to fail, from banking software to defence R&D to multi-agent AI.
- [Experience](https://pournasserian.com/experience.md): Career timeline of Amir Pournasserian: founder of Tajan and uBeac, architect for Trip Support and DND, now a Principal AI Engineer/Architect.
- [Case Studies](https://pournasserian.com/case-studies.md): Case studies from Amir Pournasserian: multi-agent AI, banking software, defence R&D, travel platforms and IoT hardware.
- [Open Source](https://pournasserian.com/open-source.md): Open-source projects by Amir Pournasserian: FluentCMS for .NET, YeSvelte for Svelte, mcp-my-site for websites that answer AI agents, and the uBeac IoT platform.
- [R&D & Collaborations](https://pournasserian.com/rd-collaborations.md): R&D by Amir Pournasserian: beacon hardware, indoor positioning, IoT pipelines and Blazor performance, plus academic collaborations.
- [Expertise](https://pournasserian.com/expertise.md): Amir Pournasserian's expertise: AI and agent engineering, enterprise platforms, IoT, applied ML, regulated banking systems and technical leadership.
- [Writing](https://pournasserian.com/writing.md): Notes from Amir Pournasserian's research: MCP servers, AI tooling for codebases, and the IoT and machine-learning work that came before.
- [Ideas](https://pournasserian.com/ideas.md): Startup and open-source ideas from Amir Pournasserian, shared for anyone who wants to build them.
- [For AI agents](https://pournasserian.com/agents.md): Connect Claude, ChatGPT or any MCP client to this site's MCP server and search API, one index of every page rebuilt on each deploy, and see how they are built.

## Case Studies

- [DevGuardian AI — Multi-Agent Code Review & Architecture Governance Platform](https://pournasserian.com/case-studies/devguardian-ai.md): DevGuardian AI is a multi-agent code review platform with Architect, QA and Security agents and code-aware retrieval. I architected and built it.
- [MayAI — A Consumer AI Agent for Household Tasks, Starting with Food](https://pournasserian.com/case-studies/mayai.md): MayAI is a consumer AI agent for households in the UAE. I co-founded it, designed the agent and led the build of a prototype that orders food by chat.
- [Valco AI — A Real Estate Intelligence Platform for Dubai](https://pournasserian.com/case-studies/valco-ai.md): How I built Valco AI, a real estate intelligence platform for Valco Properties: Dubai Land Department data, forecasting models and a conversational assistant.
- [Tajan — Building a Banking Software Company from Three People to Fifty](https://pournasserian.com/case-studies/tajan.md): How I founded Tajan in 2002 and built it from three people to fifty, with software products in use at 12 major Iranian banks. Acquired in 2021.
- [Momentrack — Real-Time Tracking of Emergency-Response Resources for Canada's Department of National Defence](https://pournasserian.com/case-studies/momentrack.md): How Momentaj built Momentrack for Canada's DND: tags, a vehicle gateway and a private cloud on a live incident map, proven in ten tests.
- [Trip Support — Building the Booking Platform for a Canadian Online Travel Agency](https://pournasserian.com/case-studies/trip-support.md): How I built the booking platform for Trip Support, a Canadian online travel agency, as fractional CTO from 2019 to 2022 and grew the team to 14.
- [Private Lending Platform — Funding Installment Plans with Investor Capital](https://pournasserian.com/case-studies/private-lending-platform.md): How I architected a lending platform for a private investment firm: investor wallets, automatic funding of installment invoices and a duplicate-proof ledger.
- [Tingslab — Building a Cellular GPS Tracker from Circuit Board to Cloud](https://pournasserian.com/case-studies/tingslab.md): How I co-founded Tingslab in 2018 and led engineering for Tings, a 23-gram LTE-M and NB-IoT GPS tracker, from device firmware to cloud. Stopped in 2020.

## Open Source

- [FluentCMS — A Blazor CMS Built on Its Own API](https://pournasserian.com/open-source/fluentcms.md): FluentCMS is an open-source .NET CMS built on ASP.NET Core and Blazor. It works as a page-building or headless CMS, with both running on the same API.
- [YeSvelte — Svelte Components With Swappable Themes](https://pournasserian.com/open-source/yesvelte.md): Open-source Svelte UI components with semantic markup. Switch between Tabler (Bootstrap 5) and daisyUI (Tailwind) themes by swapping one stylesheet.
- [mcp-my-site — Make Your Website Answer AI Agents](https://pournasserian.com/open-source/mcp-my-site.md): An open-source indexer and MCP server: point it at a website and Claude, ChatGPT and any MCP client can search and read it, and the site gets a search API too.
- [uBeac IoT Platform — From a Gateway on the Shelf to a Live Dashboard](https://pournasserian.com/open-source/ubeac.md): uBeac was an IoT platform I founded and built from 2017 to 2020. I've now published the platform's source code under the MIT license.

## Writing

- [What an MCP server actually does in 2026](https://pournasserian.com/writing/series/mcp-2026.md): What an MCP server does under the 2026-07-28 spec: three roles, how duties differ from features and extensions, one request traced through, and a one-tool Python server.
- [MCP for buyers and CTOs](https://pournasserian.com/writing/series/mcp-buyer.md): The questions to put to an MCP server vendor before you sign, drawn from the 2026-07-28 specification's own requirements and the tests a server should pass, with what a good answer looks like.
- [How MCP extensions work](https://pournasserian.com/writing/mcp-2026-extensions.md): What MCP extensions are, which exist in October 2026, how clients and servers negotiate them per request, and how a server falls back when the client lacks one.
- [MCP Apps: how interactive UI gets into the conversation](https://pournasserian.com/writing/mcp-2026-apps.md): What MCP Apps adds over a link, how the server, the host and the sandboxed view share the work, and the messages from tool discovery to the app's first render.
- [Building an MCP App: declarations, sandbox and text fallbacks](https://pournasserian.com/writing/mcp-2026-apps-building.md): What an MCP App's server declares, how its view talks to the host, how web hosts sandbox it, and a Python tool with a text fallback plus a TypeScript view.
- [MCP Tasks: long-running work without holding a connection](https://pournasserian.com/writing/mcp-2026-tasks.md): How the MCP Tasks extension lets a server answer a tool call with a task the client polls: its states and methods, durable storage, security, and a Python Task type.
- [Skills over MCP: shipping workflows with your server](https://pournasserian.com/writing/mcp-2026-skills.md): How an MCP server publishes Agent Skills: skills/list and skills/get, the SHA-256 manifest hosts verify, when approval applies, and a manifest builder in Python.
- [Enterprise-managed authorization and client credentials for MCP](https://pournasserian.com/writing/mcp-2026-enterprise-auth.md): How the two official MCP authorization extensions work: enterprise-managed access through an ID-JAG from the company's IdP, and client credentials for jobs with no user.
- [Experimental and vendor-specific MCP extensions](https://pournasserian.com/writing/mcp-2026-experimental-extensions.md): What vendor _meta keys like anthropic/alwaysLoad do, why they must stay optional, what the Interceptors and Variants proposals add, and how to design your own extension.
- [One request through an MCP server, end to end](https://pournasserian.com/writing/mcp-2026-end-to-end.md): Follow one MCP request through seven phases, from server/discover to the app's teardown, then test the whole sequence in Python with a fake host and a wire recorder.
- [Which AI hosts support which MCP features (October 2026)](https://pournasserian.com/writing/mcp-2026-host-support.md): Which MCP features Claude, Claude Code, ChatGPT, VS Code, Cursor, Gemini CLI and Microsoft 365 Copilot support as of October 2026, and what that means for your server.
- [MCP server design patterns and anti-patterns](https://pournasserian.com/writing/mcp-2026-design-patterns.md): Four MCP server design patterns that hold up in practice, from search plus fetch to layered surfaces, and the twelve anti-patterns behind most production problems.
- [Should you put an AI agent behind an MCP tool?](https://pournasserian.com/writing/mcp-2026-agent-behind-a-tool.md): When an inner agent behind an MCP tool helps, when plain search and fetch tools serve the calling model better, and eleven design rules if you build one.
- [A reference architecture for MCP servers in production](https://pournasserian.com/writing/mcp-2026-reference-architecture.md): How the 2026 MCP duties shape a production deployment: a generic architecture, one way to host it on Azure, and a build pipeline for schemas, skills and conformance.
- [The MCP server author's checklist](https://pournasserian.com/writing/mcp-2026-server-checklist.md): A one-page checklist for MCP server authors under the 2026-07-28 spec, from server/discover to deprecations, each item linked to the series article that explains it.
- [What to require from an MCP server vendor: a buyer's checklist](https://pournasserian.com/writing/mcp-buyer-vendor-requirements.md): The questions to put to an MCP server vendor before you sign, drawn from the 2026-07-28 specification's own requirements and the tests a server should pass, with what a good answer looks like.
- [An MCP governance checklist for the CTO](https://pournasserian.com/writing/mcp-buyer-governance-checklist.md): What a CTO has to decide before MCP servers reach a company's AI tools: who controls each primitive, where the trust boundaries lie, which authorization model fits, and what the host must enforce.
- [MCP maturity in October 2026: what's stable, what's deprecated, what's still a bet](https://pournasserian.com/writing/mcp-buyer-maturity-map.md): Which parts of MCP a buyer can rely on in October 2026: the five revisions of the specification, what 2026-07-28 removed, how long a deprecated feature lasts, and the status of every extension.
- [MCP host coverage: will the server work in the AI apps your company uses?](https://pournasserian.com/writing/mcp-buyer-host-coverage.md): Before you buy an MCP server, check it against the hosts your company runs: which features Claude, ChatGPT, Copilot, VS Code, Cursor and Gemini CLI support in October 2026, and what to require as a result.
- [Your MCP server is an OAuth resource server: what it must do](https://pournasserian.com/writing/mcp-2026-oauth-resource-server.md): The first four duties of an MCP server as an OAuth 2.1 resource server under the 2026-07-28 spec: publish its metadata, send the 401, check every token, forward none.
- [MCP authorization in practice: step-up, no passthrough, Entra ID](https://pournasserian.com/writing/mcp-2026-oauth-step-up-and-entra.md): How an MCP server asks for more scope with a 403 step-up, calls other APIs without passing tokens through, and works with Microsoft Entra ID under the 2026-07-28 spec.
- [Tracing MCP calls with OpenTelemetry](https://pournasserian.com/writing/mcp-2026-opentelemetry.md): How an MCP server continues a trace from traceparent in _meta, which spans and attributes to emit, what to measure, and what the Python SDK traces for you.
- [An MCP threat model: what to defend, and where](https://pournasserian.com/writing/mcp-2026-threat-model.md): The threats an MCP deployment faces, from tool poisoning to token passthrough, its three trust boundaries, what the 2026-07-28 spec requires, and the layers of defence.
- [Serving two MCP protocol eras: deprecations and a migration checklist](https://pournasserian.com/writing/mcp-2026-migration-two-eras.md): How one MCP server serves 2025-era and 2026-07-28 clients at once, what is deprecated and until when, what is already gone, and a checklist for your migration.
- [Multi round-trip requests: how a stateless MCP server asks for more](https://pournasserian.com/writing/mcp-2026-multi-round-trip-requests.md): How an MCP server asks for a confirmation without a session: the input_required result, the retry, the rules for both sides, and a deploy example in Python.
- [requestState: sealing the state your MCP server hands to the client](https://pournasserian.com/writing/mcp-2026-request-state.md): Why an MCP server must seal the requestState it hands the client, what to bind into it, what the Python SDK seals for you, and how to build a multi-step wizard on it.
- [Elicitation in MCP: asking the user with a form or a link](https://pournasserian.com/writing/mcp-2026-elicitation.md): How an MCP server asks the user for input in 2026: form and URL elicitation inside multi round-trip requests, capability checks, and a sign-in link in Python.
- [Progress, cancellation and timeouts when nothing can resume](https://pournasserian.com/writing/mcp-2026-progress-and-cancellation.md): How an MCP server reports progress, honours cancellation on stdio and Streamable HTTP, and lives with timeouts when a dropped stream can't resume, with Python.
- [subscriptions/listen: change notifications in MCP](https://pournasserian.com/writing/mcp-2026-subscriptions-listen.md): How an MCP server streams change notifications with subscriptions/listen under the 2026-07-28 spec: the filter, acknowledgement first, reconnects and fan-out.
- [Open-source AI chat apps in 2026: 51 mapped, 12 compared, and which fits what](https://pournasserian.com/writing/open-source-ai-chat-apps-2026.md): Fifty-one open-source alternatives to the ChatGPT and Claude apps, mapped by GitHub stars, activity and platform, with twelve compared feature by feature and a pick for eight uses. As of 18 October 2026.
- [Making a website AI friendly: what the bots actually fetched from mine](https://pournasserian.com/writing/ai-friendly-website-2026.md): Every door this site opens to AI crawlers and agents, from robots.txt and llms.txt to Markdown copies, feeds and an MCP server, and what the bots actually fetched in its first 18 days.
- [An LLM-friendly website checklist: eight steps and a test for each](https://pournasserian.com/writing/llm-friendly-website-checklist.md): Eight steps to make a website easy for AI crawlers and agents to read, in the order the bots actually fetched them, each with a command you can run to check your own site.
- [Designing an MCP tool: the definition and the result](https://pournasserian.com/writing/mcp-2026-tool-definitions.md): What an MCP tool definition and its result carry under the 2026-07-28 spec: naming rules, annotations, content and structuredContent, with a Python weather tool.
- [MCP tool errors, and tools that models use well](https://pournasserian.com/writing/mcp-2026-tool-errors-and-design.md): When an MCP tool should return isError and when a protocol error, what the Python SDK does with exceptions, the security duties, and how to design tools models use well.
- [MCP resources: context the application decides to use](https://pournasserian.com/writing/mcp-2026-resources.md): How an MCP server lists and reads resources and URI templates under the 2026-07-28 spec, the error a missing resource gets, and what hosts and the Python SDK do.
- [MCP prompts: slash commands your server ships](https://pournasserian.com/writing/mcp-2026-prompts.md): How MCP prompts work under the 2026-07-28 spec: how hosts invoke them, prompts/list and prompts/get, argument completion, safe arguments and a Python example.
- [Tool, resource or prompt? Choosing the right MCP primitive](https://pournasserian.com/writing/mcp-2026-choosing-a-primitive.md): How to choose between an MCP tool, resource and prompt: who decides when each is used, where instructions, Skills, Apps and Tasks fit, and a procedure to follow.
- [What an MCP server does in 2026: much more than a list of tools](https://pournasserian.com/writing/mcp-2026-what-a-server-does.md): What an MCP server does under the 2026-07-28 spec: three roles, how duties differ from features and extensions, one request traced through, and a one-tool Python server.
- [MCP goes stateless: what changed in the 2026-07-28 specification](https://pournasserian.com/writing/mcp-2026-what-changed.md): The 2026-07-28 MCP specification drops the handshake, sessions and server-initiated requests: what replaces them, what else changed, and what is now deprecated.
- [server/discover: the one method every MCP server must implement](https://pournasserian.com/writing/mcp-2026-server-discover.md): What server/discover returns under the 2026-07-28 MCP spec, how a client negotiates a version or falls back to initialize, and how to read it with the Python SDK.
- [Server instructions: the paragraph every model reads first](https://pournasserian.com/writing/mcp-2026-server-instructions.md): What MCP server instructions are under the 2026-07-28 spec, how hosts such as Claude Code load them, and what to write and what to leave out, with a Python example.
- [Stateless MCP requests: _meta, resultType and explicit handles](https://pournasserian.com/writing/mcp-2026-stateless-requests.md): How a 2026-07-28 MCP request carries its version and capabilities in _meta, how a client branches on resultType, and how a server keeps state with explicit handles.
- [Caching hints and pagination in MCP](https://pournasserian.com/writing/mcp-2026-caching-and-pagination.md): How an MCP server marks its results with ttlMs and cacheScope, why its tool order should stay stable, and how cursor pagination works under the 2026-07-28 spec.
- [MCP transports in 2026: stdio and Streamable HTTP](https://pournasserian.com/writing/mcp-2026-transports.md): How MCP's two transports work under the 2026-07-28 spec: stdout on stdio, the headers that route a Streamable HTTP request, x-mcp-header, and proxy timeouts.
- [MCP servers for websites in 2026: 44 tools, sorted by who runs them](https://pournasserian.com/writing/mcp-servers-for-websites-2026.md): Forty-four ways to let any AI agent search and ask a website over MCP, from Wix, Shopify and GitBook to NLWeb and CMS plugins, sorted by who runs the server. As documented on 7 October 2026.
- [AI tools that document a codebase in 2026: 17 compared, and what none of them does yet](https://pournasserian.com/writing/ai-code-documentation-tools-2026.md): Seventeen tools that turn a repository into documentation, from DeepWiki and Google Code Wiki to CodeWiki, OpenDeepWiki and Swimm, compared on access, outputs and audiences, with the gaps they leave. As of 1 October 2026.
- [Observed, documented, inferred: a design for codebase documentation you can audit](https://pournasserian.com/writing/evidence-labelled-code-documentation.md): A design for documentation generated from code where every fact carries its evidence and one of three labels, observed, documented or inferred, so managers, business readers and coding agents can tell what was read from the code and what a model inferred.
- [Testing MCP servers in 2026: 31 tools compared and the gaps between them](https://pournasserian.com/writing/mcp-server-testing-tools-2026.md): Thirty-one tools that inspect, test, audit, secure or load test an MCP server, compared on twelve capabilities, and the gaps none of them fills. As documented on 1 October 2026.
- [One MCP server, eight rulebooks: what the spec, Claude, ChatGPT, Codex, VS Code, Windsurf, Kiro and Gemini CLI require](https://pournasserian.com/writing/what-ai-hosts-require-of-an-mcp-server.md): The checkable rules each AI host applies to an MCP server, from tool-name length to mandatory annotations and timeouts, where they conflict, and which tools validate against them. As of 1 October 2026.
- [Getting IoT device data to the cloud: webhooks, device management and testing](https://pournasserian.com/writing/iot-webhooks-device-management-testing.md): How a webhook carries sensor data, what managing a fleet of IoT devices involves, and what to test before a full deployment. From 2018.
- [Bluetooth Low Energy fundamentals: how it saves power and reaches the internet](https://pournasserian.com/writing/bluetooth-low-energy-fundamentals.md): How Bluetooth Low Energy saves power, which devices can talk to which, how a sensor reaches the internet, and what mesh adds, as the technology stood in 2018.
- [BLE beacons in practice: protocols, sensors, layout and transmission power](https://pournasserian.com/writing/ble-beacons-in-practice.md): The four decisions in a Bluetooth beacon deployment: iBeacon or Eddystone, which sensors, a point or grid layout, and how much transmission power. From 2018.
- [Indoor location: RTLS, asset tracking, beacons and ultra-wideband](https://pournasserian.com/writing/indoor-location-rtls-beacons-uwb.md): What makes a tracking system a real-time location system, which technologies it can run on, and when to choose Bluetooth beacons or ultra-wideband. From 2018.
- [Recognizing handwritten digits: six neural networks on MNIST, from 92% to 99.4%](https://pournasserian.com/writing/mnist-handwritten-digit-recognition.md): Six TensorFlow models for the MNIST handwritten digits, from one softmax layer at 92% to a convolutional network with batch normalization at 99.4%. From 2017.
- [A first try at sentiment analysis: TextBlob on a Twitter stream](https://pournasserian.com/writing/twitter-sentiment-textblob-tweepy.md): A weekend experiment from January 2017: reading a live Twitter stream with Tweepy and scoring each tweet with TextBlob, in about thirty lines of Python.

## Ideas

- [Sites that speak for themselves: an agent endpoint for every small website](https://pournasserian.com/ideas/sites-that-speak-for-themselves.md): An idea for an open-source tool that lets a small website answer AI agents, its own search box and a chat window from one index built when the site is published.
- [An OS for AI agents: not the one on your laptop](https://pournasserian.com/ideas/an-os-for-ai-agents.md): An idea for running a fleet of personal AI agents: not an operating system per agent, but one small host that holds what each agent may call, spend and do.
- [An AI-first CMS: AI operates, people govern](https://pournasserian.com/ideas/ai-first-cms.md): An idea for a CMS built the other way round: the AI does the work by default, and people write the rules and review what matters before it goes live.
- [MCP is in its Yahoo era](https://pournasserian.com/ideas/mcp-is-in-its-yahoo-era.md): An idea for the ranking era of MCP: one service an agent asks "who can do this?" and gets the best servers back, and why the time to build it is now.