Ninad Malvankar is an Architect at Upstox, one of India's largest discount brokerages, and an AI-native platform engineer. 12+ years shipping production systems, from Walt Disney World enterprise software to fintech infrastructure on AWS. Today he builds and open-sources tooling for AI agents: MCP servers, Claude Code plugins and agent red-teaming.
Ninad Malvankar (alias elninad, his first name reversed) is an Architect at Upstox, one of India's largest discount brokerages. He joined in July 2018 and has been promoted four times: Technology Lead, Principal Engineer, Senior Principal Engineer, Architect (2026). He works AI-native: he builds with coding agents daily and open-sources agent tooling, including harness-gauntlet (AI agent red-teaming), MCP tool annotations for Upstox's MCP server, a Claude Code plugin for Upstox, and the interactive examples suite in Upstox's Python SDK. He speaks at GDG MAD community events in Mumbai, holds an M.S. in Computer Science from UT Arlington and is AWS Certified.
| Current Role | Architect at Upstox (2026–present) |
|---|---|
| Company | Upstox, one of India's largest discount brokerages |
| Location | Mumbai, Maharashtra, India |
| Experience | 12+ years (2012–present) · 7+ years at Upstox (July 2018–present) |
| Career at Upstox | Technology Lead (2018–2021) → Principal Engineer (2021–2022) → Senior Principal Engineer (2022–2026) → Architect (2026–present) |
| Education |
M.S. Computer Science — University of Texas at Arlington (2011–2013) B.E. Computer Engineering — University of Mumbai (2007–2011) |
| Certification | AWS Certified Cloud Practitioner — Amazon Web Services (2023) |
| Open source | Creator of harness-gauntlet and bareslides; contributor to Upstox's Python SDK, MCP server and Claude Code plugin marketplace |
| Speaking | GDG MAD (Google Developer Group Mumbai) :: Mumbai Community Afterparty, 25 Jul 2026 |
| Expertise | AI agents & MCP tooling, agent security, platform engineering, FinTech systems, AWS (CloudFront, WAF, S3), system design, engineering leadership |
| Online aliases | elninad (GitHub) · @el_ninad (X/Twitter) · @el_nino (YouTube) · ninad.malvankar23 (Medium) |
| Previously | Software Engineer at enSYNC Corp, USA (2013–2017); Programmer Analyst at Swift Pace Solutions / Walt Disney World (2017–2018) |
I'm an Architect at Upstox, India's leading discount brokerage. With an M.S. in Computer Science from the University of Texas at Arlington and a B.E. from the University of Mumbai, I combine deep technical expertise with a product-first mindset.
"It's not about how much code you write — it's about how many people you help move faster, safer, and smarter."
I work AI-native: agents are part of how I design, code, review and ship every day, and I open-source the tooling that makes that safe, from MCP integrations to red-teaming agent harnesses. Underneath sits a decade of platform work on AWS, Node.js, React and Angular, and a habit of bridging engineering decisions to business outcomes.
A battle-tested platform stack from 12+ years of production systems, now driven AI-first.
A decade-long path of learning, building, and leading — across continents, industries, and scales.
Built the foundation in algorithms, data structures, operating systems, and software engineering principles.
Advanced studies in distributed systems and web technologies. Relocated to the US, broadening both technical and professional horizons significantly.
First professional role — built and maintained university web applications while pursuing the Master's degree. Developed a strong full-stack foundation on live systems.
Built enterprise-grade .NET web applications. Honed backend development, database design, and client-facing application architecture across multiple business domains.
Contributed to a major project for Walt Disney World, building and maintaining mission-critical software at entertainment enterprise scale.
Joined India's leading discount brokerage. Established a private npm registry via Nexus Repository Manager and created a unified deployment pipeline for React, Angular, and Node.js apps — drastically reducing manual setup overhead.
Worked closely with the architect team to add AWS WAF ACLs protecting against web exploits, configured AWS CloudFront caching, and debugged complex API latency issues through Cloudflare edge routing.
Led cross-functional engineering at India's top discount broker. Drove platform reliability, developer productivity, and cloud-native architecture. Mentored engineers, shaped technical strategy, and influenced without authority.
Setting technical direction and system design standards across Upstox engineering, leading the shift to AI-native development, and shipping Upstox's developer and agent tooling in the open: MCP server, Claude Code plugins and SDK examples.
I write about engineering leadership, system design, and building teams that last.
Embracing ambiguity, driving clarity, and working through influence — not authority. It's not about how much code you write, it's about how many people you help move faster, safer, and smarter.
Outgrowing formal mentorship can feel isolating. Treating yourself like a system — running personal retrospectives each quarter and building your own feedback loop — is how growth continues at the principal level.
Many backend engineers upgrade to the latest Java and Spring versions for performance gains — but overlook deeper security implications. A closer look at how Spring Security's firewall controls behave in a Java 21 environment.
Misconfigured bundlers don't always throw errors — sometimes they just make your app slower in ways that are hard to detect. A deep dive into the subtle ways webpack config mistakes can silently kill frontend performance.
Tooling for the AI-agent era, shipped in public: agent security, MCP integrations and developer experience for Upstox's trading APIs.
Lint and red-team the loop your AI coding agents run.
A static auditor plus a live red-team for AI coding-agent harnesses. It scans Claude Code agent configs for missing guardrails, then rebuilds each agent in a throwaway sandbox and fires 20 attacks across 9 families (prompt injection, secret exfiltration, destructive actions, scope escalation, SSRF, supply chain) mapped to the OWASP LLM and Agentic Top 10. A PreToolUse deny-and-log tripwire measures what the agent actually attempted, producing defense and resilience scores that can gate CI.
View sourceRunnable recipes for the official Upstox Python SDK.
Started the interactive_examples suite in Upstox's official Python SDK (about 9,700 lines across 2 PRs): runnable scripts for instrument search, market data, options analytics, futures basis, arbitrage, historical analysis and market information. The suite now holds 55 examples and is wrapped by a Streamlit app the team built on top of it.
View sourceUpstox's Model Context Protocol server.
Added MCP tool annotations to every tool in Upstox's MCP server (PR #14), so AI clients can tell read-only market-data tools from state-changing ones before calling them, and removed dead legacy code.
View sourceUpstox plugins for Claude Code.
Packaged the Upstox MCP server as a Claude Code plugin in Upstox's official plugin marketplace (PRs #2 to #4), fixed its MCP config, and set plugin authorship, so developers can install Upstox trading tools with a single /plugin command.
View sourceAnimated presentation slides that run in your terminal.
A dependency-free terminal presentation engine. It renders slides into an in-memory cell buffer, emits 24-bit truecolor ANSI with flicker-free frame diffing, supports transitions, build-ins and live on-stage commands, and exports frames straight to SVG. Published under the Upstox GitHub organisation.
View sourceFeatured speaker at GDG MAD (Google Developer Group, Mumbai) :: :: RUDRA Cybersecurity, BKC, Mumbai. Open to talks on AI agents, agent security, developer platforms and staff-plus engineering.
Engineering is what I do — but it's not all I am. When I step away from the keyboard I'm either deep in a game, chasing apexes on a racing circuit, or filming car content.
A gamer at heart — from strategy epics to fast-paced competitive titles. Gaming has sharpened my systems thinking, pattern recognition, and ability to make quick decisions under pressure. Skills that transfer surprisingly well to production incidents at 2 a.m.
My love for cars goes well beyond fandom — I've trained in professional racing. Understanding vehicle dynamics, braking points, and finding the optimal line on a circuit demands the same precision and discipline I bring to engineering architecture.
There's something meditative about assembling a Gunpla kit — every runner, every gate, every panel line demands patience and attention to detail. Building Gundams is my offline mode: deliberate, precise, and deeply satisfying.
I document my car and racing journey on YouTube — track sessions, car reviews, and everything in between. Still in the early chapters with a couple of videos live, but the engine is definitely running.
Visit ChannelWhether you're looking for technical leadership, architecture consulting, or just want to talk engineering — I'd love to hear from you.
LinkedIn Medium GitHub X / Twitter YouTubeQuick answers about my work, open source, AI and speaking.
Ninad Malvankar is an Architect at Upstox, one of India's largest discount brokerages, based in Mumbai. He has 12+ years of engineering experience across fintech, cloud infrastructure and developer platforms, works AI-native (he builds with AI agents every day), contributes to Upstox's open-source SDKs and MCP tooling, and speaks at GDG MAD community events. He holds an M.S. in Computer Science from the University of Texas at Arlington.
As Architect (2026 to present) he sets technical direction and system design standards across Upstox's engineering teams. He joined in July 2018 as Technology Lead and was promoted to Principal Engineer (2021), Senior Principal Engineer (2022) and Architect (2026). Along the way he set up Upstox's private npm registry on Nexus Repository Manager, built a unified deployment pipeline for React, Angular and Node.js apps, and configured AWS WAF and CloudFront for the trading platform's web edge.
He created harness-gauntlet (an AI coding-agent security auditor and red-team) and bareslides (a dependency-free terminal presentation engine, published under the Upstox org). He started the interactive examples suite in Upstox's official Python SDK (now 55 runnable examples), added MCP tool annotations to every tool in Upstox's MCP server, and packaged that server as a plugin in Upstox's Claude Code plugin marketplace. All are public on GitHub under github.com/elninad and github.com/upstox.
harness-gauntlet is Ninad Malvankar's open-source tool for testing the guardrails of AI coding agents. A static scan reads Claude Code agent and harness config for missing protections; a dynamic red-team rebuilds each agent in a sandbox and runs 20 attacks across 9 families (prompt injection, secret exfiltration, destructive actions, scope escalation and more), mapped to the OWASP LLM Top 10 2025 and Agentic Top 10 2026. It reports defense and resilience scores and can fail a CI build. Source: github.com/elninad/harness-gauntlet.
AI is part of his everyday engineering. He builds with coding agents such as Claude Code, ships Model Context Protocol (MCP) integrations that let AI assistants work with the Upstox trading APIs, distributes them as Claude Code plugins, and works on the safety side too: harness-gauntlet red-teams agent configurations before they reach production. His focus is applied AI engineering (agents, tooling, guardrails, developer workflows) on top of a long platform and cloud background.
Yes. He is a speaker with GDG MAD (Google Developer Group, Mumbai) and was featured at the Mumbai Community Afterparty (kinda) on 25 July 2026 at RUDRA Cybersecurity, Bandra Kurla Complex, Mumbai. He is open to speaking on AI agents, agent security, developer platforms and staff-plus engineering.
Web Developer at the University of Texas at Arlington (2012 to 2013); Software Engineer at enSYNC Corp, USA (2013 to 2017); Programmer Analyst at Swift Pace Solutions on a Walt Disney World project, USA (2017 to 2018); then Upstox in Mumbai from July 2018: Technology Lead, Principal Engineer, Senior Principal Engineer and, since 2026, Architect.
M.S. in Computer Science, University of Texas at Arlington (2013); B.E. in Computer Engineering, University of Mumbai (2011); AWS Certified Cloud Practitioner (2023); academic credentials verified by World Education Services (WES).
On Medium (medium.com/@ninad.malvankar23) he writes about staff-plus engineering and technical depth: leadership without authority as a Principal Engineer, growing past formal mentorship, Spring Security firewall controls on Java 21, and how webpack misconfiguration silently hurts frontend performance.
AI agents and tooling (Claude Code, MCP, agent guardrails), AWS (CloudFront, WAF, S3), Cloudflare, Docker and CI/CD, Node.js/Express, TypeScript, React, Angular, Python, .NET/C# and microservices architecture.
Yes. elninad is his first name spelled backwards and is his GitHub username (github.com/elninad). He is @el_ninad on X, ninad.malvankar23 on Medium and @el_nino on YouTube (cars and motorsport). His site moved from elninad.github.io to ninadmalvankar.com.
LinkedIn (linkedin.com/in/ninadmalvankar) is the best channel. He is interested in principal and distinguished engineering roles, conference and meetup talks, and founder or investor conversations about AI-native platforms and fintech infrastructure.