The Forward Deployed Engineer Tech Stack: 10 Tools for Live Deployments

A forward deployed engineer (FDE) rarely gets to keep one stack. Each customer brings its own cloud, its own data platform, and its own rules about what software may touch production. In 843 FDE job postings we analyzed, the cloud requirement splits almost evenly: AWS 28.5%, Azure 25.6%, GCP 23.6%. The job is to work inside whatever the customer already runs.

This guide picks 10 tools across six deployment phases and shows how often FDE postings name each one. Counts come from 843 postings by 225 companies in the topfdejobs.com database (16 October 2026 snapshot).

Discovery tools (interview and meeting capture) are left out. No tool in that category shows real backing in the postings.

Why the FDE stack differs from a product engineer's

A product engineer builds once for many customers on infrastructure their company controls. An FDE builds for one customer at a time, inside systems someone else owns. Four parts of the stack change:

The last row drives most choices below. For daily work, see FDE vs software engineer.

The 10 tools at a glance

The 10 tools cover six phases of a live deployment, from reaching the customer's systems to keeping the agent healthy after go-live. Each section below shows the share of the 843 postings that name the tool.

Connect: reach the customer's systems

An agent is only as useful as the systems it can reach. These two tools cover two ways in: APIs, and the web apps people already use.

MCP: expose customer systems as agent tools

Named in 10.7% of FDE postings, more than Docker (8.3%).

The Model Context Protocol is an open-source standard for connecting AI applications to data sources and tools. FDEs use it to wrap a customer's ticketing API or claims database as a small set of tools any MCP-capable agent can call. Start with a read-only server so security can approve lookups before any tool writes data.

Watch out for: each MCP server is a new entry point. Tool output can carry prompt injection, so scope permissions per tool and log every call.

Use instead if: you need one integration for one customer. Plain REST calls and webhooks are less to build and less to review.

Webfuse: work inside the customer's web app

Live sessions (co-browsing or screen sharing) named in 1 posting. Disclosure: Webfuse is our product.

Access is the problem here, more than the tool. In Tandem's interviews with nine FDEs, engineers called access "the single biggest frustration of the job," with waits of "weeks to months."

Webfuse is a programmable web proxy. A session opens the customer's web app from a link, with nothing for the customer to install, and several people can share that live session and pass control. The Session MCP Server lets an MCP-compatible agent open URLs, read the page, and fill in forms in the same session. Admins can limit which hosts a session reaches and mask sensitive inputs from the agent.

Watch out for: it reaches the web UI only. The customer's security team still has to approve traffic through a proxy.

Use instead if: you need backend access to databases or servers. A VPN or VDI account is the standard route.

Build: write the agent

These two tools split the build work. One writes code, the other structures agent logic.

Claude Code: write and refactor in unfamiliar repos

Named in 4.4% of FDE postings, spread across companies (Deloitte 5, others 2 to 3 each).

FDEs open a new customer repo every few weeks. Claude Code reads the codebase, runs commands, and edits files from the terminal, which shortens the time to a first working change. It comes with Claude's Pro plan ($20/month) and higher tiers.

Krishna Chheta, a self-described FDE, summed up the mix on X on 19 October 2026:

"codex is great for focused diffs, messy repos still need a human pass. cursor + claude code + tests is how i survive both client work and my own apps"

Watch out for: some customers ban AI coding tools on their code. Ask before the first session, not after.

Use instead if: you prefer an editor. Cursor appears in 5.5% of postings, though 18 of those 46 are Cognition postings naming a rival. Codex sits at 4.9%, with 23 of 41 from OpenAI's own postings.

LangGraph: structure multi-step agent logic

Named in 6.5% of FDE postings, with LangChain at 8.8%.

LangGraph (MIT) models an agent as a graph with explicit state, so cycles, branches, and approval steps are visible in code. That helps when a claims agent must pause for a supervisor's sign-off and resume hours later.

Watch out for: dependencies. The customer's security team will ask about every package you ship, and a framework adds many.

Use instead if: the agent is a simple loop. The model provider's plain SDK is easier to debug in someone else's environment. For jobs that run for hours, Temporal (MIT-licensed) handles retries and durable state.

Data: work where the customer's data lives

FDEs rarely get to move data. These tools query and search it where it sits.

Databricks: query the customer's lakehouse in place

Named in 12.0% of FDE postings, the most-named data platform in our set.

Many enterprise customers already keep their data in Databricks. Running pipelines and batch evals inside the customer's workspace keeps data in their account, which shortens the security conversation.

Watch out for: compute runs on the customer's bill. A forgotten scheduled job or idle cluster becomes your problem at the next review.

Use instead if: the customer runs Snowflake (3.8% of postings). Match the platform they already pay for.

pgvector: add vector search to the Postgres they already run

RAG named in 19.1% of postings; any vector database in 8.2%.

pgvector is an open-source Postgres extension for vector similarity search. Most customers already run Postgres, so adding an extension means far less for security to review than a new database vendor. It supports HNSW and IVFFlat indexes, and vectors sit next to the rows they describe.

Watch out for: scale limits. At very large vector counts, index builds get slow and memory-hungry.

Use instead if: you need search over very large collections. Pinecone or Qdrant (Apache 2.0) are built for that load.

Prove: show the agent works

On FDE teams, evals do the job QA does for product teams. Evals appear in 22.2% of postings, more than Kubernetes.

LangSmith: run evals on the customer's real queries

Named in 3.7% of FDE postings, the most-named eval tool in our data.

LangSmith traces agent runs, stores eval datasets, and scores outputs with LLM-as-judge metrics. Fits teams already on LangChain or LangGraph. The free Developer plan covers one seat, and Plus costs $39 per seat per month.

Watch out for: self-hosting is limited to the Enterprise plan. Traces carry customer prompts and data.

Use instead if: data must stay in the customer's VPC. Langfuse is self-hostable with an MIT-licensed core. Braintrust and Promptfoo (MIT) are other options.

Ship: deploy into the customer's environment

This is where the customer's rules matter most. Regulated customers push toward self-managed clusters and infrastructure as code.

Kubernetes + Docker: run the same build in any customer's cluster

Kubernetes named in 15.8% of FDE postings; Docker in 8.3%.

One container image runs in any cloud or a bank's own data center. Kubernetes appears almost twice as often as Docker, so employers expect FDEs to deploy into clusters, beyond packaging code. In many banks and insurers, the platform team hands you a namespace and a list of approved base images.

Watch out for: overkill. A single agent service for an unregulated customer does not need a cluster you have to maintain.

Use instead if: the customer has no compliance rules about hosting. Modal or a managed platform such as Cloud Run gets you live faster.

Terraform: rebuild the customer's environment from code

Named in 5.5% of FDE postings.

Terraform describes cloud resources as code, so an FDE can rebuild a whole customer environment from a repo. Separate state per customer keeps environments apart and leaves the customer something to run after you go. Since version 1.6, it uses the Business Source License.

Watch out for: state files. They can hold secrets and must live in the customer's storage, not your laptop.

Use instead if: licensing is a concern or the customer prefers a general-purpose language. OpenTofu (MPL 2.0) is the open fork. Pulumi or the customer's own IaC works too.

Run: keep it healthy after go-live

After launch, the FDE is often the first person paged. The goal is to show up in the alerts the customer already watches.

Datadog: monitor through the customer's paging tool

Named in 2.3% of FDE postings.

Pick the tool the customer's on-call team already gets paged from. Datadog's LLM tracing records each agent request as spans and scores responses for quality and safety, with alerts landing in dashboards the team already reads.

Watch out for: costs grow with data volume. Full prompt traces add up fast and may hold sensitive data, so redact before sending.

Use instead if: the customer runs open-source monitoring. Grafana and Prometheus appear in 2.5% of postings.

How to pick the stack for your next customer

Postings show what employers name. The customer decides what you can use, and three questions settle most choices:

1. What does the customer allow? If AI coding tools are banned on their repo, drop Claude Code for that engagement. If no new vendors are allowed, pgvector beats a hosted vector database.
2. What do they already run? Snowflake over Databricks, Grafana over Datadog, their IaC over Terraform. Matching their stack means their team can own it after you leave.
3. Are they regulated? Banks and healthcare customers usually mean self-managed Kubernetes, self-hosted Langfuse over LangSmith, and Terraform in their account. Unregulated customers can take Modal and hosted tools.

Python and one of the three clouds cover the base. Everything above that changes per customer, so FDE teams keep two or three options per phase. For how the FDE role compares with adjacent jobs, see FDE vs solutions architect and FDE vs sales engineer.

Methodology and sources

• Data: 843 published and expired FDE postings from 225 companies in the topfdejobs.com database, local snapshot taken 16 October 2026. Shares are case-insensitive keyword matches in job descriptions. A match shows a tool is named, not that it is required.
• Vendor facts: licences, plans, and prices read on official sites or repositories on 22 October 2026.
• Interviews: access quotes come from Tandem's FDE stack guide.
• Disclosure: Webfuse is our product.