What we actually run.
47 tools across six layers, with the reason for each. Published because a consultancy that will not tell you what it builds on is usually hiding either a preference it cannot defend or a reseller agreement it would rather you did not know about.
This is a default, not a requirement
When you already have an estate, we work in it. These are the choices we reach for when the decision is genuinely ours, and each one is a position we will argue with you about rather than a list we inherited.
Product & Web
The surface users touch. Server-rendered where it matters for speed and search, client-side where it matters for interaction.
Next.js
The default application framework — App Router, server components, static generation for anything that does not need to be dynamic.
Rendering strategy becomes a per-route decision rather than an architecture commitment made once and regretted later.
React
Component model across web and, through React Native, mobile.
TypeScript
Every project, strict mode, no exceptions.
The type system is the cheapest verification layer available, and verification is the constraint.
Tailwind CSS
Styling and design-token enforcement, with tokens defined once and referenced everywhere.
Vercel
Hosting, preview deployments per pull request, edge runtime and analytics for Next.js applications.
A preview URL on every pull request collapses the review transaction cost, which is the whole game.
Cloudflare
DNS, CDN, edge workers, R2 object storage and DDoS protection where a project needs its own edge layer.
Mobile
Cross-platform by default where the shared surface dominates; native where platform fidelity or performance justifies two codebases.
Expo
React Native application framework, EAS Build and Update for over-the-air delivery of JavaScript changes.
Over-the-air updates decouple shipping from store review for everything that is not a native binary change — the single highest-leverage move in mobile delivery.
React Native
Shared application code across iOS and Android, with native modules where the bridge is not enough.
Swift & Kotlin
Native iOS and Android where deep OS integration, performance or platform fidelity makes the second codebase worth its cost.
Fastlane
Build, signing, screenshot and store-submission automation so releasing is a pipeline step rather than an afternoon.
Backend & Data
Managed services by default. We run our own infrastructure where there is a reason to, not as a reflex.
Supabase
Postgres with authentication, row-level security, realtime subscriptions, storage and edge functions.
Postgres underneath means nothing is proprietary at the data layer — you can take the database and leave.
PostgreSQL
The default relational store, self-hosted or managed depending on the estate.
Upstash
Serverless Redis, queues and vector storage — caching, rate limiting, background jobs and retrieval indexes that bill per request.
Per-request billing suits workloads that are bursty, which most AI features are.
Render
Long-running services, background workers and cron jobs that do not fit a serverless execution model.
Node.js & Python
Application services and data or ML workloads respectively.
Rust
Latency-sensitive services and on-chain runtimes, where the performance and safety guarantees pay for the slower development cycle.
AWS, GCP & Azure
Where an enterprise estate, data residency or procurement requires a major cloud, with infrastructure defined in Terraform.
AI & ML
Model-agnostic by construction. Routing between providers is an architectural decision made at the start, not a migration undertaken in a panic.
Anthropic Claude
Long-context reasoning, code generation, agentic workflows and document-heavy tasks.
OpenAI
General-purpose generation, embeddings, structured output and multimodal work.
Google Gemini
Multimodal tasks, very long context and workloads already sitting in Google Cloud.
Open-weight models
Self-hosted inference where data residency, unit cost at volume or offline operation rules out an API.
Model routing & cascades
Cheap model first, escalate on uncertainty or failure. Provider abstraction so a model change is configuration rather than a rewrite.
The provider landscape moves faster than any application should have to. Abstract at the boundary and the churn stops being your problem.
Vector & hybrid retrieval
Embedding pipelines, dense and keyword retrieval together, reranking, and grounding so answers cite a source.
Evaluation harnesses
Golden sets, rubric grading and regression suites that run in CI, so a prompt or model change is measured rather than argued about.
This is the part almost everyone skips, and it is the part that decides whether the system survives its first year.
Tracing & cost telemetry
Per-request tracing, token accounting and unit cost per outcome, so the economics are visible before they become a problem.
Agents & Orchestration
The simplest loop that solves the problem, with the interesting engineering in the tools, the boundary and the ability to stop it.
Model Context Protocol (MCP)
A standard interface for exposing tools and data sources to models, so an integration is written once rather than per application.
Tool interfaces are the part of an agent that actually determines quality. A standard one means they accumulate as assets instead of being rebuilt each time.
Claude Agent SDK
Building agentic applications on Claude — tool loops, permissioning and session handling — where a framework earns its place over a hand-rolled loop.
Hand-rolled agent loops
Most production cases. A plain loop with good tools and explicit termination conditions, because a framework you do not need is a dependency you cannot debug.
The honest default. Reach for an orchestration framework when the problem demonstrates it needs one, not before.
Sandboxed execution
Containerised, network-restricted environments for any agent that runs code or touches a file system, with least-privilege credentials scoped per run.
Durable execution
Resumable, step-level workflow state so a long-running agent survives a restart without repeating side effects.
Multi-step actions fail halfway. Without durable state and step idempotency, recovery becomes a manual data-repair exercise.
Trajectory evaluation & replay
Recorded tool responses replayed in CI, with outcome scoring plus step and cost budgets asserted as tests.
Browser automation
Playwright-driven interaction for systems that expose no usable API, kept behind the same permission boundary as any other tool.
Circuit breakers & cost caps
Per-run step limits, spend ceilings and downstream rate limiting, so a loop that goes wrong stops rather than escalating.
Blockchain & Web3
Defensive by default. Everything upstream of the irreversible step is cheap; the irreversible step itself is small and heavily verified.
Solidity
EVM contract development, written to a defensive standard with invariants stated explicitly.
Foundry
Testing, fuzzing, invariant testing and mainnet forking — the verification loop that runs hundreds of times before anything is deployed.
Fast local iteration is what makes moving the learning upstream economically possible.
Hardhat
Deployment scripting, task automation and TypeScript-side integration testing.
Safe
Multisig custody of deployer keys, admin roles and treasury, with signer topology and thresholds designed deliberately.
Most losses in this space are operational rather than cryptographic. Key handling is where that risk concentrates.
viem & ethers
Typed client libraries for application and service integration with chains.
EVM L2s & rollups
Where transaction cost and throughput make mainnet impractical for the use case.
The Graph & custom indexers
Turning on-chain events into queryable application state.
Slither & static analysis
Automated vulnerability scanning in CI, ahead of human and external review.
Delivery & Operations
The pipeline is the governance layer. Evidence, approvals and provenance are produced by delivery rather than assembled for an audit.
GitHub & GitHub Actions
Source of truth, pull request review, CI pipelines and release automation.
Claude Code
AI-assisted implementation, migration and review inside the repository, with every change going through the same pull request and test gate as any other.
The tool changes who writes the first draft. It does not change who is accountable for the merge.
Resend
Transactional email — enquiries, notifications and product mail — with delivery and bounce visibility.
OpenTelemetry
Vendor-neutral traces, metrics and logs, so observability is not a lock-in decision.
Terraform
Infrastructure as code, so environments are reproducible rather than remembered.
Feature flags & remote config
Separating deployment from release across web and mobile, with kill switches on anything risky.
Where it is applied
Stack follows capability
Tools are downstream of what you are building and of what makes that thing hard. Each capability page lists the layers it draws on.
Disagree with one of these choices?
Good — that is a better first conversation than a capability deck. Every entry above is a position, and positions are worth arguing about.