CAMSCode — Enterprise AI Coding Assistant

Built an internal, secure, private alternative to GitHub Copilot deployed entirely within CAMS infrastructure. Autonomously converts PRDs and HLDs into production-ready full-stack applications using 80+ custom tools and MCP servers — reducing development time by ~80% while ensuring regulated financial data never traverses public endpoints.

• Role: AI Engineer & Solo Developer
• Timeline: 2026
• Team: Independently designed, built, and deployed within CAMS infrastructure
• Technologies: AI/ML, Agentic AI, MCP Servers, Ollama, RAG, Google Cloud, Vertex AI, Cloud Run, Python, FastAPI, Azure AD
• Link: https://drive.google.com/file/d/1PTXG45x_DptJQvzL3Nozgnn_fGjLXl71/view?usp=drivesdk
• Live demo: Talk to the open-source twin — CAMSCode can't leave the CAMS network. Jarvis is the same agent architecture, open source and running live — ask it about its own code.

Problem

CAMS developers had no access to AI coding assistants like GitHub Copilot due to enterprise data security constraints — sending source code and business logic to external LLM APIs was prohibited in a regulated financial environment. Teams were losing significant productivity with no compliant alternative.

Solution

Built CAMSCode, a fully internal AI coding assistant that orchestrates Gemini 2.5 Flash via a zero-trust GCP identity pipeline (Azure AD → Workload Identity Federation → Service Account Impersonation), ensuring no data leaves the CAMS network. The system autonomously converts PRDs and HLDs into production-ready full-stack applications including frontend, backend, DB schema, REST APIs, auth, and UI.

Impact

• Reduced end-to-end development time by ~80% from making POC to production-ready full-stack web apps
• Eliminated long-lived credentials — all access via short-lived federated tokens
• Validated by autonomously building QInspect Pro a full stack web app in a single session
• Regulated financial data never traverses public endpoints
• Sandboxed execution environment with zero risk of code leakage

Key features

• PRD/HLD to production-ready full-stack app generation
• Sandboxed file system operations and shell command orchestration
• Automated dependency management and background process control
• Live log monitoring, automated testing, and Git version control
• Zero-trust LLM access: Azure AD → Workload Identity Federation → Service Account Impersonation
• CMEK encryption and VPC-restricted Cloud Run deployments
• Token caching with automatic refresh for seamless developer experience

Tech stack

• Frontend: React JS, Javascript (ES6), TailwindCSS
• Backend: Python, FastAPI, SQLite
• Ai: Vertex AI (Gemini 2.5 Flash), LLM Tool Orchestration
• Cloud: Cloud Run, Workload Identity Federation, Azure AD, GCP VPC, CMEK

System architecture

Trust boundary — CAMS private network. Source code, PRDs and regulated financial data never leave CAMS-controlled infrastructure. No public LLM endpoint is ever called.

Developer surface — A requirement goes in, a working application comes out

• CAMS developer — Internal engineering team. Developers on the internal team use CAMSCode the way they would use Copilot — except it runs entirely inside CAMS infrastructure, so nothing they type leaves the network.
• PRD / HLD intake — Requirement document as the prompt. Instead of completing a line of code, CAMSCode takes a whole product or high-level design document as its goal and drives it to a running application. (PRD, HLD)

↓ Authenticated request + requirement doc

Zero-trust identity — No long-lived credentials anywhere in the chain

• Azure AD — Corporate SSO. Every request is tied to a real corporate identity. There is no shared service key and no personal API token in the system.
• Workload Identity Federation — Azure AD → GCP, no static keys. The Azure AD assertion is federated into GCP rather than exchanged for a stored secret. This is what removes long-lived credentials from the architecture entirely.
• Service Account Impersonation — Short-lived, scoped tokens. The federated identity impersonates a narrowly-scoped service account. Tokens are short-lived, cached, and silently refreshed on a 401 so the developer never sees an auth interruption. (Token cache, Auto-refresh, Corporate proxy)

↓ Short-lived, scoped access token

Orchestration core — FastAPI on VPC-restricted Cloud Run

• Agent loop — think → act → observe → repeat. The reasoning engine. Each turn the model either answers or requests a tool; results are fed back into the conversation so it sees the consequence of its own action before deciding the next step. This is what separates it from single-shot code completion.
• Context budget manager — warn → trim → compact. Long build sessions outgrow any context window. Conversation size is checked before every request: warn, then silently prune the oldest tool results, then summarize and replace history — so a multi-hour run never dies on a context-limit error.
• Tool router — Task-relevant schema subset. Exposing 80+ tool schemas on every call degrades tool-choice accuracy and wastes tokens. The router narrows the surface to what the current task needs, with an escape hatch for the model to request more.
• Sub-agent supervisor — Parallel delegation. Independent sub-goals are delegated to child agents running the same loop engine, then their results are collected — so wide tasks fan out instead of running end to end in one thread.

↓ Prompt + task-relevant tool schemas

Inference plane — Both paths stay inside the network

• Vertex AI — Gemini 2.5 Flash(South Asia) — In-tenant, reached via the WIF chain. The primary reasoning model, called inside the CAMS GCP tenant through the federated identity chain — not over a public API with a bearer key.
• Ollama — on-prem — Fully local inference path. A local open-weight path for the most sensitive work and for continuity when the managed endpoint is unavailable. Inference happens on CAMS hardware, so the data never even leaves the building.

↓ Tool call requested

↺ Tool result → next reasoning step

Tool & integration plane — 80+ custom tools exposed over MCP

• MCP servers — Standardised tool transport. Tools are exposed over the Model Context Protocol rather than hard-wired into the agent, so capabilities can be added or revoked per environment without touching the reasoning loop.
• Sandboxed file operations — Read, write, surgical edit. Full CRUD over the workspace — including precise string-level edits rather than whole-file rewrites, which is what makes generated changes reviewable.
• Shell & dependency orchestration — Guarded command execution. Installs packages, runs build steps and manages long-running dev servers — every command passing the destructive-pattern blocklist first.
• Test runner & Git — Verification loop. The agent runs the project's own test suite and reads structured pass/fail counts back, so it verifies its work instead of declaring success. Changes land through normal version control.

↓ Every invocation checked & recorded

Governance & safety — Autonomy is bounded, inspectable and reversible

• Destructive-command blocklist — Blocked before execution. Recursive deletes, disk operations and fork bombs are rejected before they reach a shell — not caught afterwards.
• Workspace sandbox — Path-scoped writes. Writes and deletes are confined to the active workspace while reads are permitted more broadly — a deliberate least-privilege boundary rather than an all-or-nothing switch.
• Stuck-loop guard — Repeat & call-count limits. A repeated identical tool call, or an excessive number of calls in one turn, triggers an intervention instead of burning tokens on a dead end.
• Append-only audit log — Every tool call recorded. Each tool invocation is written to an append-only log. In a regulated environment, being able to reconstruct exactly what an autonomous system did is a hard requirement, not a nice-to-have.
• CMEK + VPC restriction — No public endpoint exposure. Customer-managed encryption keys, and Cloud Run services reachable only from inside the VPC.

↓ Verified, auditable change

Output — Validated end to end on a real internal build

• Production-ready full-stack app — Frontend, backend, tests, version control. The deliverable is a running application, not a snippet — reducing end-to-end development time by roughly 80% from POC to production-ready.
• QInspect Pro — Built autonomously in a single session. The proof case: a 20-parameter AI scoring engine for call centre calls with RBAC, audit trails and Excel export, generated end to end in one session — the evidence that the pipeline works on a real internal product. (RBAC, Audit trails, 20-parameter scoring)

Deliberately outside the boundary

• Public LLM APIs — Never called — the reason this exists. Sending CAMS source code or business logic to an external model provider is prohibited in a regulated financial environment. Every design decision above follows from that single constraint.
• GitHub Copilot — The tool this replaces. Unavailable to CAMS developers for exactly the reason above. CAMSCode delivers the productivity gain without the data-egress risk.

Control loops

• Observe → decide — Tool results re-enter the conversation, so the model reacts to real output rather than to its own assumptions.
• Self-correction — Malformed tool-call JSON is repaired in place; transient failures retry with exponential backoff before the turn is escalated.
• Context compaction — History is summarized and replaced rather than blindly truncated, so long autonomous builds keep their earlier decisions.

Architecture highlights

• Identity pipeline: Azure AD → Workload Identity Federation → Service Account Impersonation
• Sandboxed execution: file ops, shell orchestration, dependency management all isolated
• Token layer: caching + auto-refresh with corporate proxy compatibility
• VPC-restricted Cloud Run — no public endpoint exposure
• Validated via QInspect Pro: 20-parameter AI scoring engine, RBAC, audit trails, Excel exports

What K Laxman learned

• Designing zero-trust LLM access pipelines in regulated enterprise environments
• Building sandboxed AI execution toolchains with production-grade safety guarantees
• Orchestrating LLMs as autonomous developers rather than code completion tools
• Implementing short-lived federated identity flows to eliminate credential risk
• Balancing developer productivity with strict enterprise security constraints

← All 27 projects by K Laxman

Explore more

• Home — overview, skills and a built-in AI assistant
• Experience — roles at Think360 AI (CAMS), CAMS Mutual Funds and IIT Delhi
• Projects — GenAI, LLM, RAG and full-stack builds
• Education — IIT Delhi, M.Tech & B.Tech Computer Science
• GitHub Activity — open-source contributions
• Contact / Hire me

GitHub · LinkedIn · Email