Senior Full Stack Developer · Java / Spring Boot · AI-Native
Ten years of Java and Spring Boot on systems that cannot go down: a public hospital's pharmacy, a government's document management, a provincial council's electronic procedures.
Vitoria-Gasteiz, Álava, Spain
Systems that have to talk to others I cannot modify, and that show it when they fail.
Pharmacy management for a public hospital network present in 80% of Spain's hospitals. A smart-city platform deployed across more than fifteen city councils. The Basque Government's document management model, which has to integrate over SOAP. All of it taught me to care about tests and observability above anything fashionable: here a failure is not an error on a screen, it is a prescription that never reaches the patient who needs it.
The stack I work with daily, ordered by how much I actually use it.
Ten years in production, most of it in systems where the software must not fail.
Sandav·Jan 2025 — present
Eventool·Jun 2024 — Jan 2025
Altia·May 2022 — Jun 2024
Webdreams·Dec 2020 — May 2022
AgmSoft Consulting·Sep 2018 — Nov 2020
Serikat·Jul 2017 — Sep 2018
Altia Consultores·May 2016 — Jul 2017
What I have built on my own, plus client work. Both are below, with the source open where there is any.
A Python MCP server that feeds Garmin training, load, sleep and performance data to LLM agents. Over 120 MCP tools, a multi-user web panel with data isolation, a pytest suite, CI with GitHub Actions and Grafana metrics. Self-hosted with Docker Compose.
A Node.js MCP server for managing shopping lists through AI agents. Separated client and server, agent skill configuration and secure environment variables.
Cultural agenda for Vitoria-Gasteiz: over 263 weekly listings from 15 different sources, refreshed every few minutes. Installable PWA, Android app on Google Play, public API and RSS feed.
Site for David Lanaspa's practice, a criminal defence lawyer with offices in Tarragona and Huesca. Bilingual Spanish and Catalan with hreflang, built for local search in both cities, with a 24 h criminal emergency block.
Everything open on my account, from the most recently touched to the oldest. The four above are the ones with a story behind them; here is the full list.
AI-Native
Two Model Context Protocol servers, one at each end: a remote, multi-user one in Python, and one inside the browser with WebMCP. Both self-hosted, both with their tests.
Server · Python · HTTP
Connects a Garmin Connect account to the assistant and returns the day's analysis: HRV, training load, sleep, fatigue risk, pace zones and race predictions. 120+ MCP tools, deployed with Docker Compose.
Client · Node + React · WebMCP
A shopping list with voice assistant and AI agent. The server is Express using Mercadona's official search plus its own catalogue; the agent lives in the browser on `navigator.modelContext`.
Engineering
This page is both the portfolio and its own case study. Next.js 15 with React 19, Tailwind v4, edge middleware, and a Playwright suite that fails if any of the below breaks.
Content faded in on an IntersectionObserver. If the observer never fired, the section stayed at opacity 0 permanently and the visitor saw a blank gap. No error, no console output: just empty space.
I rewrote it with CSS animation-timeline. There is no observer to fail, so content cannot disappear, and it sits inside @supports so a browser without support shows the text anyway. No JS safety net needed.
To verify it I disabled the protection on purpose: 3 of 6 tests failed, and not only in the artificial case but in ordinary navigation too. A test you have never seen fail is not a test.
English lived behind a useState: one URL, <html lang> pinned to Spanish, and every English word living as a string inside the JS bundle. To a crawler the English version did not exist. Worse, the headline was typed letter by letter, so the prerendered HTML shipped a nearly empty <h1>.
Language moved into the route: /es and /en prerender, each with its own canonical and hreflang pointing at the other. The name is whole in the DOM and the animation is CSS. The crawler gets the same text the visitor does.
A bilingual site on one URL is not bilingual: it is monolingual with a switch. Language has to be in the URL for it to exist.
The whole page was a client component, so six static content sections were being hydrated. Framer-motion handled the entrance animation and a canvas sat behind it. All of that to display a CV.
Sections became Server Components and framer-motion left the project. Scroll animation now runs on the compositor. The heaviest dependency was the one that was never needed: CSS already did the job.
From 165 kB to 117 kB First Load JS, and from 62.6 to 14.7 kB for the page. Selling performance judgement while shipping 165 kB to render text was the site's biggest inconsistency.
The file sat in app/ instead of at the repo root. Next never looked there, so everything in it — rate limiting, bot blocking, host validation, CORS, the body size cap — was dead code. The build said nothing. One missing response header was the only clue.
Moved to the root, where the compiler picks it up and the build reports it as Middleware. The security tests now assert the real headers, not the intention.
A config file in the wrong folder raises no error: it gives false confidence. That is why there is a test that checks the build still reports the middleware.
104 Playwright tests against this very page. Not smoke tests: they check that the CSP is closed, that no secrets leak, that bot blocking responds, that both language versions are served with their canonical, and that content is never left invisible on scroll.
What I do when I'm not in front of a terminal.
Available for projects, collaboration, or new opportunities.
Email me directly
Next.js
TypeScript
PWA
WordPress