back to writing
Tag: claude-code
10 posts
- The Missing Layer: Static Security Analysis for CLAUDE.md and AGENTS.mdOWASP LLM Top 10 risks live in your instruction files. Runtime evals don't lint them. Here's what static security analysis catches — with a concrete finding.
- Scoring My Own MCP ContributionA CLAUDE.md I wrote was merged into modelcontextprotocol/servers. My own scorer returned 59.2/100. Where it was right, where it was structurally unfair, and what the gap to 80 would cost.
- The blindspot, fixedEarlier today I published a self-audit that named a blindspot in schliff. Hours later, the fix is up as a PR. The same CLAUDE.md now scores 61.0 instead of 59.2.
- Your CLAUDE.md Is an Agent HarnessYour CLAUDE.md is an agent harness. Skills are tools, hooks are guardrails, memory is persistence. How to stop configuring and start designing.
- Hydra: A Multi-Model Code Review CouncilA code review council built on Karpathy's LLM Council — six advisors across Claude Opus and Codex, cross-examined and synthesized into one verdict.
- Claude Code vs. Codex in 2026: What the Benchmarks MissI stopped comparing Claude Code and Codex last Tuesday. That's when Codex started reviewing Claude's code — from inside Claude Code.
- The Most Useful Claude Code Skills You Should InstallA curated guide to the Claude Code skills that actually save time — from automated debugging to spec-driven workflows.
- Claude Code Hooks: Automating Your AI WorkflowClaude Code hooks are shell commands that fire on events inside the agent loop. A working guide to the schema, the full event list, and the four traps people keep hitting.
- Skills Are the New DotfilesHow Claude Code skills became the new dotfiles — a personal developer identity layer that defines not just your tools, but how you think.
- MCP Servers That Actually Improve Your Dev WorkflowA practical look at Model Context Protocol servers — which ones matter, how to configure them, and what they enable.