CredentialHQ

I ran HR at a home health agency. Our system was paper files in a cabinet and a spreadsheet on a shared drive that nobody trusted because it disagreed with itself. Things expired and we missed them.

My first try at fixing it was an AI agent that emailed people when their credentials were close to expiring. It broke constantly. About half the messages went out, and the other half failed silently, with nothing to tell them apart from the ones that landed. The agency stopped trusting it within a month.

So I wrote an app for our team instead. A month in, my boss saw it working and asked when she could put another agency on it.

CredentialHQ tracks dates. It knows which credentials a position requires, whether each one is on file, and when it lapses. It does not hold medical records, test results, or clinical files.

Keeping PHI out of the product means no BAA, a much smaller breach surface, and a simpler system. Most competitors store documents first and track dates second, and their pricing reflects that.

The product decides who is out of compliance, and a wrong score fails silently, so most of the testing goes there.

Every pull request runs 1,233 API tests against a real Postgres 17 instance. The append only audit triggers and row level tenant scoping live in the database, so a mock would skip them. The suite includes cross tenant tests that check one workspace cannot read another's rows, and the test setup refuses to run against any database URL without "test" in it.

The most useful bug it caught was arithmetic. The employee page and the roster page computed compliance two different ways, so the same person could be compliant in one view and not the other. The fix split "expiring soon" out of "needs work" everywhere and stopped docking the score for a credential that is close to its date but still valid.

Version 1.4 added an MCP connector, so an AI assistant can query the workspace: who is out of compliance, what lapses in the next thirty days, which requirements a position carries. It is on by default and the docs are public.

Most of the work went into what the connector returns. Every credential, position, and employee name is free text someone typed into a form, so it is untrusted input arriving inside a tool response. If a credential is named to look like an instruction, the connector reports it as data and never acts on it, and the docs say so.

Dates needed care too. Expiry buckets are whole calendar days, so every tool that returns a date based status takes the caller's local date instead of using the server's timezone. Otherwise "expires in 3 days" would be off by one for half the country.