I build AI agents that hold up in production, plus the evals, guardrails and observability that let you leave them running unattended. Live Demo: Describe your agent problem to my agent and get real-time answer how I'd build it. → lillyguo.pages.dev 🌐 Currently CTO of an AI-agent security startup. Previously Senior AI Engineer at QESTIT, where I built the platforms their teams used to take agents from prototype to production. Ten grand prizes at international hackathons. What I do: - Agents and multi-agent systems. Orchestration (LangGraph, LangChain), MCP server integrations, streaming architectures for long-running agents, human-in-the-loop approval steps, session management. Most recently built an internal agent IDE end to end. - Evals. Frameworks that make it measurable whether a change made your agent better or worse: trace parsing, deterministic quality metrics, and parallel LLM judges whose ranking is validated against contrastive tests. - Observability and cost control. What the agent did, what it read, and why it decided that, in a form your users can inspect. Token and cost accounting with up-front estimates validated against real API usage. - RAG and retrieval. Hybrid pipelines over Weaviate: BM25 plus dense vectors, query expansion, recency-aware reranking. Fine-tuned quantised extraction models for consistent structured output at a fraction of the per-request LLM cost. - Guardrails. Prompt-injection defense at the point of execution, spotlighting, input gating, output validation. AI Agents · Multi-Agent Systems · LLM · Agent Orchestration · AI Evaluation · LLM-as-a-Judge · LLM Observability · RAG · Prompt Engineering · MCP · LangGraph · LangChain · LangSmith · Vector Databases · OpenAI · Claude · Gemini Engineering: Python · TypeScript · Rust · Go · FastAPI · PostgreSQL · Docker · AWS · GCP · Playwright Web3: Solana · Solidity · Smart Contracts · EVM & L2s · Agentic Payments (x402) · Cross-chain…

Lilly Guo

I build AI agents that hold up in production, plus the evals, guardrails and observability that let you leave them running unattended. Live Demo: Describe your agent problem to my agent and get real-time answer how I'd build it. → lillyguo.pages.dev 🌐 Currently CTO of an AI-agent security startup. Previously Senior AI Engineer at QESTIT, where I built the platforms their teams used to take agents from prototype to production. Ten grand prizes at international hackathons. What I do: - Agents and multi-agent systems. Orchestration (LangGraph, LangChain), MCP server integrations, streaming architectures for long-running agents, human-in-the-loop approval steps, session management. Most recently built an internal agent IDE end to end. - Evals. Frameworks that make it measurable whether a change made your agent better or worse: trace parsing, deterministic quality metrics, and parallel LLM judges whose ranking is validated against contrastive tests. - Observability and cost control. What the agent did, what it read, and why it decided that, in a form your users can inspect. Token and cost accounting with up-front estimates validated against real API usage. - RAG and retrieval. Hybrid pipelines over Weaviate: BM25 plus dense vectors, query expansion, recency-aware reranking. Fine-tuned quantised extraction models for consistent structured output at a fraction of the per-request LLM cost. - Guardrails. Prompt-injection defense at the point of execution, spotlighting, input gating, output validation. AI Agents · Multi-Agent Systems · LLM · Agent Orchestration · AI Evaluation · LLM-as-a-Judge · LLM Observability · RAG · Prompt Engineering · MCP · LangGraph · LangChain · LangSmith · Vector Databases · OpenAI · Claude · Gemini Engineering: Python · TypeScript · Rust · Go · FastAPI · PostgreSQL · Docker · AWS · GCP · Playwright Web3: Solana · Solidity · Smart Contracts · EVM & L2s · Agentic Payments (x402) · Cross-chain…

Available to hire

I build AI agents that hold up in production, plus the evals, guardrails and observability that let you leave them running unattended.
Live Demo: Describe your agent problem to my agent and get real-time answer how I’d build it.
→ lillyguo.pages.dev 🌐

Currently CTO of an AI-agent security startup. Previously Senior AI Engineer at QESTIT, where I built the platforms their teams used to take agents from prototype to production. Ten grand prizes at international hackathons.

What I do:

  • Agents and multi-agent systems. Orchestration (LangGraph, LangChain), MCP server integrations, streaming architectures for long-running agents, human-in-the-loop approval steps, session management. Most recently built an internal agent IDE end to end.
  • Evals. Frameworks that make it measurable whether a change made your agent better or worse: trace parsing, deterministic quality metrics, and parallel LLM judges whose ranking is validated against contrastive tests.
  • Observability and cost control. What the agent did, what it read, and why it decided that, in a form your users can inspect. Token and cost accounting with up-front estimates validated against real API usage.
  • RAG and retrieval. Hybrid pipelines over Weaviate: BM25 plus dense vectors, query expansion, recency-aware reranking. Fine-tuned quantised extraction models for consistent structured output at a fraction of the per-request LLM cost.
  • Guardrails. Prompt-injection defense at the point of execution, spotlighting, input gating, output validation.

AI Agents · Multi-Agent Systems · LLM · Agent Orchestration · AI Evaluation · LLM-as-a-Judge · LLM Observability · RAG · Prompt Engineering · MCP · LangGraph · LangChain · LangSmith · Vector Databases · OpenAI · Claude · Gemini

Engineering: Python · TypeScript · Rust · Go · FastAPI · PostgreSQL · Docker · AWS · GCP · Playwright

Web3: Solana · Solidity · Smart Contracts · EVM & L2s · Agentic Payments (x402) · Cross-chain

See more

Language

English
Fluent
German
Fluent

Work Experience

CTO at Compass
June 1, 2026 - Present
CTO of Compass, an agent-security startup for the moment AI agents start moving real money. The risk is simple: one manipulated input, and an agent pays out in a way its owner never intended. I build the safety layer that stops that - the engine that traces where an agent's instructions actually came from, and the check that allows, flags, or blocks a payment before it is signed.
Senior AI Engineer at QESTIT DACH
September 1, 2025 - March 31, 2026
Built QESTIT's internal AI platforms for taking agents from prototype to production: a three-layer eval framework (trace parsing, deterministic metrics, LLM-as-judge validated against human ranking), an agent IDE with multi-agent orchestration + streaming + human-in-the-loop, and an LLM workflow platform with token/cost/latency analytics. Coached the team on AI adoption.
Freelance AI Engineer at Self-employed
October 1, 2024 - August 31, 2025
Independent AI engineering for clients. Built a personal-assistant pipeline that turns unstructured email and calendar data into a prioritised task list: hybrid retrieval over Weaviate (BM25 plus dense vectors, query expansion) with a time-decay and priority reranker, so recency outranks a stale but similar match. Cut per-request cost by replacing prompted LLM calls with a fine-tuned T5 extractor (4-bit quantised, serverless GPU) that emits a fixed task/date/priority schema - more consistent than a general model and a fraction of the cost. Also engineered a real-time automation backend (GraphQL/Apollo, PostgreSQL, Redis) that turned live events into alerts and automated workflows in under 200ms.
Software Developer at Civic Technologies
March 1, 2024 - October 31, 2024
Led end-to-end development of a secure credential-sharing application (Rust, TypeScript, Node.js, React). Delivered the first production deployment built with the client's core technology; designed a CI/CD pipeline automating testing, cross-platform compilation and deployment.
Software Developer at Sunrise Stake
May 1, 2023 - July 31, 2023
Independently owned the mission-critical integration for a cross-platform sustainability app, from technical research and architecture through to implementation. High-performance, resource-optimised app handling critical financial operations on a high-availability distributed system.
Developer Relations Engineer (Intern) at Parity Technologies
October 1, 2022 - February 28, 2023
Authored technical documentation for cross-chain messaging and Rust-based developer tools. Selected for the Polkadot Academy on core protocol development. Presented technical solutions to 100+ professionals at DevRelCon 2022.

Education

B.Sc. Computer Science at Freie Universität Berlin
October 1, 2020 - September 30, 2023

Qualifications

1st Prize (Circle) - AI Agents Hackathon
June 1, 2026 - June 30, 2026
Built Proprietor: an AI agent that runs a business end to end - it sells a Company Enrichment API, prices its own product, pays suppliers and settles every invoice in USDC through a Circle Agent Wallet. Every payment passes a spend gate enforced in code (daily cap, runway floor, fail-closed human approval), it declines work it cannot do profitably, and a per-job P&L ledger logs each decision with its on-chain transaction hash and the agent's own reasoning.
Ten wins at international hackathons
May 1, 2022 - June 30, 2026
Including ETHGlobal New York (Best DeFi App on Mantle), ETHPrague (1st prize, cross-chain facilitator for the Aave GHO stablecoin), ETHGlobal Istanbul (Most Original; Best use of Halo), NFTBerlin (three first prizes) and ETHGlobal Paris (Finalist, from a field of 1000+ hackers).

Industry Experience

Software & Internet, Computers & Electronics, Financial Services
    Proprietor

    An AI agent that runs an entire business end to end - it sells a Company Enrichment API, prices its own product, pays suppliers, and settles every invoice in USDC through a Circle Agent Wallet. CEO and CFO of its own company.

    The point wasn’t proving an agent can run a business. It was making one you’d actually trust to leave alone - because unsupervised, an agent overspends, takes on work it shouldn’t, and gives you no idea why. So Proprietor runs unsupervised on purpose:

    • A single spend gate every payment must pass, enforced in code rather than left to the model: daily cap, runway floor, and fail-closed human approval above a threshold.
    • Decline-before-charge, so it turns down work it cannot do profitably.
    • Dynamic repricing to stay viable when costs rise.
    • A per-job P&L ledger where every decision is logged with its on-chain transaction hash and the agent’s own reasoning.

    What turns an autonomous agent into something you can actually leave running is not that it can act. It is that it acts within the limits you set, and shows its work.

    Won 1st prize (Circle) at the AI Agents hackathon.

    Repo: https://www.twine.net/signin

    Autonomous Acquisition Agent

    An agent that runs a complete multi-step workflow on its own: it pulls candidate opportunities from live sources, qualifies each against hard rules, drafts the tailored documents, renders them to a finished one-page PDF, and fills out the real web form in a real browser. Work that is normally hours of repetitive research, writing and data entry runs unattended - and a human is needed only for the final click.

    The value is not that it can do the steps. It is that you can leave it running: every stage is built to fail safely rather than guess.

    How it works

    • Qualification is hard predicates, not a score. Each returns pass, fail, or unknown, and unknown routes to a human instead of being guessed either way.
    • Drafting runs in a stripped-environment subprocess that drops privileges and refuses to start if the drop fails. It reads its state back from written artifacts, never from the model’s transcript.
    • The document render is deterministic: structured edits to a region-marked LaTeX master, compiled, exiting non-zero unless the PDF is exactly one page. The model picks which content goes in, never what it says.
    • The browser layer handles forms that fight back: taxonomy autocompletes, comboboxes whose selection lives outside the input, editors that don’t exist until you click them, with a submit guard armed throughout.
    • Unrecognised controls are skipped, not guessed: 317 controls audited across 13 fixtures, anything the categorizer cannot name fails closed, and a 1340-test suite holds the line.

    The agent does everything except take the irreversible action. That last click belongs to a human.