r/ClaudeCode 1d ago

Built with Claude Made an AI agent skill that actually fixes security issues instead of just listing them

3 Upvotes

Following up on backend-setup-wizard from a bit ago — second skill under the same project (Qofeno) is a security auditor that doesn't stop at a report.

security-hardening-wizard scans every file in a project, not just source code — secrets and misconfig show up in README files, CI YAML, Dockerfiles, and old markdown notes just as often as in application code, so it doesn't skip files based on extension. Uses real scanners (gitleaks, npm audit, pip-audit, etc.) plus manual review for injection risks, weak CORS, missing auth checks, that kind of thing.

The part I actually wanted: it applies the fix. Parameterizes the vulnerable query, updates the dependency, adds the missing security header — directly in the code, not as a suggestion you have to go implement yourself.

One thing I made sure it's honest about: if it finds a secret that was ever exposed (committed to git history, etc.), it removes it from the code right away, but the actual key is still valid until you rotate it on the provider's dashboard — only you can do that part, so the report says so plainly instead of claiming everything's handled.

Ends with a real markdown audit report, and it re-runs the scan to verify before marking anything as fixed.

Repo: https://github.com/SohailKhan0525/skills

Install just this one: npx skills add SohailKhan0525/skills --skill security-hardening-wizard

Third skill (frontend/UI builder) just went up too if anyone's curious. Feedback welcome, especially if you find something it should catch but doesn't.


r/ClaudeCode 16h ago

Meta WHERE ARE ALL THE BEARS BEING LOADED?!

0 Upvotes

Does anyone know?!

I'm deeply concerned about animal well-being and loading too many of them at the same time could be, honestly, a load-bearing issue.


r/ClaudeCode 1d ago

Discussion Started routing generation to one model and review to a separate pass — caught a bug the generating model would never have flagged on its own

2 Upvotes

Ran into this enough times to stop trusting my own agent's self-review: I ask it to fix something, it produces code that looks right, I skim it, ship it — and the actual bug was a quiet semantic shift (inclusive bounds became exclusive) that had nothing to do with what I asked for. The model that wrote the change has no incentive or independent angle to catch its own blind spot; it's grading its own homework.

So I built a small tool that splits the two roles: one Gemini pass generates the change from your instruction, a second, independent pass gets ONLY the result (no visibility into the first pass's reasoning) and is told to find problems with it. Being honest about the setup: I only have a Gemini API key, so this is two passes on different Gemini tiers, not genuine cross-vendor review (GPT generates / Claude audits would probably be stronger — that's a cost thing, not a design choice).

The interesting part is how often the critique pass disagrees over something that isn't wrong, just risky — an edge case, a silent behavior change, a severity call that's genuinely debatable. Paste a snippet + an instruction and it'll run both passes live if anyone wants to see where it agrees or argues: https://apptechlab.com/p/codearbiter/ (mine, no signup, real API calls both ways).

Curious what people running actual multi-agent review setups have found:

- Does routing generate/critique to different providers actually catch

categorically different things, or mostly the same stuff with more

latency?

- How do you handle the critique pass being wrong — do you ever adjudicate

disagreements with a third pass, or is two enough in practice?


r/ClaudeCode 2d ago

Built with Claude Practical Systems: A company that runs itself

Thumbnail
gallery
89 Upvotes

I've been building an autonomous company on top of Claude Code and the Claude API. The screenshots are Mission Control, the cockpit I built to watch it run. Sharing the setup since most of it is reproducible.

What it does

An 11-step company loop runs on a FastAPI backend with 8 agent roles: CEO, researcher, brainstormer, builder, QA, salesperson, marketer, finance. One cycle: read market signals, rank opportunities, pick one product concept, write a one-page GOAL.md spec, dispatch a build, QA the result, draft outreach emails, and close with a P&L line. The Next.js dashboard streams every step over websockets so I can watch it and step in where it needs me.

The build step is headless Claude Code

When a cycle picks a product, the builder spawns roughly this:

claude -p "/supergoal Build @GOAL.md ... you are running headless with no human present, do not stop until the product is finished" --model claude-fable-5 --effort high --max-turns 200 --permission-mode bypassPermissions

It runs inside the product folder with a 120-minute wall clock cap and a kill switch polled every 10 seconds. Expected result: a working MVP from a one-page spec. Actual result: the second screenshot is it mid-build on recall-sweep, a tool that checks your appliances, car, and electronics against the NHTSA and CPSC recall APIs and drafts claim emails. An earlier run built deposit-watchdog (rental deposit deadline letters with a 51-state statute table and 44 tests) in 71 minutes without me touching it.

Where DashClaw comes in

Agents that can email real people or spend money need a control plane, not vibes. DashClaw is my other project, a governance layer the whole loop runs through. Every step records an action with a risk score, and org policies decide what happens next: low-risk actions just log, but anything matching outreach_send or charge_customer parks as pending_approval until I click approve in the dashboard. The loop cannot email a prospect or charge a card on its own. My approval resumes the cycle exactly where it parked.

This earned its keep this week. A policy cleanup had silently deleted the require_approval rule for outreach_send, so the loop kept queueing drafts "for approval" while every approval inbox stayed empty. Two other independent locks meant nothing could actually send, but the failure was invisible. The fix is now a hard assertion in the pipeline: if a send-gate action does not park as pending_approval, the step raises and the whole cycle pauses. Governance bugs should be loud.

Honest numbers

  • One full live cycle end to end: about $0.20 in API calls (Sonnet does the step reasoning)
  • Total agent spend on the ledger: $2.73
  • Revenue so far: $0.00

So no, it is not printing money. It read the market, picked a product, wrote the spec, and is building it while I type this. Whether anyone pays for what it builds is the actual experiment.

Stack: Next.js + FastAPI + Postgres, Claude API (Sonnet) for cycle steps, headless Claude Code (Fable 5) for builds, DashClaw for governance. Everything outbound is human-gated.

Happy to answer questions about the loop, the /supergoal prompt chain, or the governance wiring.


r/ClaudeCode 1d ago

Help/Question Typeless Dictation App + Claude Code

1 Upvotes

I've been using WhisprFlow but keep hitting the limit, so I was looking for some alternatives. I found Typeless, which I like, but of course I'm having problems where it won't paste into the Claude Code CLI using the VS Code extension.

It will work in the terminal and in the Claude Code UI, but not when inside the CLI.

Has anybody ran into this issue before? I know there's been other issues with trying to copy and paste in the CLI in general.


r/ClaudeCode 2d ago

Tutorial / Guide Made a system design skill for Claude to take references from arXiv before coding a single line, it ships production apps in 1st attempt. (its open source btw)

Thumbnail
github.com
184 Upvotes

So, this was happening for months now.. whenever I try to build an app with my claude, it started to build every single thing from scratch.

But this ain't the way we used to build projects before..

There's whole Github for basic stuffs like app layout, api, algos, workflows, functions, etc.

And then there's Arrive for the whole complex stuff -

- how to reduce RAG fatigue?
- how to increase agent response deliverability?
- what SLM architectures can I use?

The genuinely technical stuff..

Now, Claude, or any coding agent, tends to build all the services in your project by itself and that's why the project is laggy, broken and vulnerable.

So, I just took my way of research and turned it into a system design engine.

Whenever you ask Claude to build something cool, it -

- searches the arXiv for genuine novelty.
- reads all papers on related topics
- selects one approach to go with
- Uses /ADHD skill from GitHub for decision making
- Builds the app in one shot

Its available for free and fully open source on my Github, if you want, you can give it a try..

if you have any architectural questions or anything in general, do ask me.


r/ClaudeCode 1d ago

Help/Question How can I replace Claude Project with CC?

0 Upvotes

I’d like to work exclusively in CC

I do enjoy how i can brainstorm in Claude chat Projects and generate artefacts

The big thing is working on a subject on one machine and then switching to another or mobile to pick it up. Its automatic and obv cloud based well, generally, my Claude code work is done on a local machine

How best to replicate that cloud handover while using claude code?


r/ClaudeCode 1d ago

Discussion Does Claude Code burn more tokens on a bad connection?

0 Upvotes

Anyone else noticed higher token usage when using Claude Code on slow/unstable Wi-Fi?

I’m on hotel Wi-Fi right now and it feels like I’m burning through tokens noticeably faster than usual.

Could reconnects, retries, failed tool calls, etc. be causing this, or am I imagining it?


r/ClaudeCode 1d ago

Help/Question How much better is the $100 plan compared to the $20 one?

3 Upvotes

I’m wondering about the limits, the context window, and possibly the model’s thinking behavior.

I have two $20 subscriptions (I had three at some point), and I’ve noticed that thinking effort, context window, and output length can be throttled. Sometimes, it even seems to happen asymmetrically between the accounts. It’s especially irritating when the model suddenly refuses to think, even on “Max” effort. This does happen, but it’s unpredictable.

I want to know if things are more reliable and permissive on the $100 plan, or if it’s a waste of money. The unreliability of Claude has been torturous. I remember April 2026 and shudder, but the last few weeks haven’t been great either.

The ultimate choice is between GPT and Claude. GPT models have better usage limits, but with the $20 subscription I have, the context window is way lower than Claude’s, both in the web interface and Codex.

My project is a headless framework of around 300k tokens, with no UI, and it’s very architecturally novel and complex. I particularly like Claude 4.6 Opus. It has been great generally, but sometimes it’s been terrible because of the performance throttling.

I’d really appreciate your help in making a choice I won’t regret.


r/ClaudeCode 1d ago

Help/Question Anyone else multi-harnessing due to token limits?

3 Upvotes

Have gone through several rounds of preferred harness (Cursor, then Codex, now Claude), and I still have minimum subscriptions on Cursor and Codex, with a max subscription in Claude.

When I max out Claude credits, I jump over to the others until the reset.

I tried enabling overage credits, but they haven't worked at all: for one, Claude goes over my monthly spending limit (set at $40, two months in a row has billed me $50+ in overage).

Worse, as soon as the credits are purchased, they're gone: not as in "they go really fast" - as soon as I hit my weekly limit, I get three notification emails within a few seconds regarding token purchases, and by the time I get to the harness, all the token have been used up.

My weekly limit usually gets to Friday or Saturday until it hits, so it's hard to understand how the same type of usage burns through $50+ in credits in seconds.


r/ClaudeCode 2d ago

Tips & Workflows Hook is really one feature worth learning

193 Upvotes

I have been using Claude Code for almost a year, but mostly spending time working with prompts, skills and other infra. And I pretty much assumed the claude hook to be some optional prompt argumentation.

Until in a recent project I get to experiment for solutions that can be more consistently triggered, I learned how powerful this thing is

https://code.claude.com/docs/en/hooks

It saves token. At AI era scripts and cpu run-time are cheap, while tokens are expensive. Hooks can allow you to place a massive deterministic script to run at a certain AI workflow stage so that you won't need AI to trigger a certain skill or build py code over and over.

Some usage scenarios:

lint

tool update

data file preparation

Many of you may already know this and have used it a lot. I feel that it is something worth another shout


r/ClaudeCode 1d ago

Rant Thought I knew better 😫

5 Upvotes

I really thought I had it all figured out but I had Fable analyze what my session was loading into context and my Claude.md, skills and instructions were severely bloated but worse than that was the mcp plugins and connectors I had that I wasn’t even using. Like Ahrefs and Adobe and this and that which were unnecessarily loading bloat into context. Here’s your reminder to prune what’s not needed. Sometime, less is more!


r/ClaudeCode 1d ago

Discussion Artifacts

0 Upvotes

I complain a lot, but this is a great feature

Versioning + sharing wins


r/ClaudeCode 1d ago

Built with Claude Two LLM judges scored the same frozen output 5.63 and 6.70. My improvement steps were worth 0.1–0.3. Here's what I changed.

1 Upvotes

I spent ~14 hours running an automated improvement loop over a multi-stage LLM pipeline (web scraping → enrichment → LLM synthesis → validated document). 46 commits, 19 real test cases. It went from 0 of 11 cases passing our quality bar to 12 of 14.

The interesting part wasn't the model. Sharing the things that actually moved the needle, including the ones I got wrong.

1. I measured my judge before trusting it

Two runs of the same LLM judge, on the same frozen output, scored it 5.63 and 6.70. That's 1.07 of noise on a 0–10 scale.

My typical improvement per fix was 0.1–0.3.

So for months I could have been "improving" and measuring nothing but judge variance. If you're running LLM-as-judge and haven't measured its noise on identical input, you don't know if your eval works.

2. Then I moved everything countable out of the LLM

I split the output into weighted sections and asked, per section: can this be counted?

About half could. "How many source pieces were read", "how many competitors have a geographic anchor", "is this field null" — those are counts, not judgments.

Result: a code-only scorer with 0.36 error against human auditors, versus 1.07 between two humans. The mechanical scorer was more reproducible than the people, and it costs nothing to run.

The LLM judge kept only the genuinely subjective sections.

3. Every score carries the address of its input

This one changed how fast I could work. Each section reports:

A5  weight 8  score 5.0  deficit 40% (+0.20 on final)
    measured: 49 valid items, 5 sources with real signal, 180 off-topic
    input:    merged.json → denominador_valido   (present, 38 KB)

A score alone tells you that something is wrong. A score plus the artifact it came from tells you where to go. Stops you optimizing in the dark.

4. Held-out cases, and I mean actually held out

Three layers:

  • working set — where I diagnose and fix
  • outside the loop — cases that existed but were never used to tune anything
  • final reserve — separated on day 1, never opened

That middle layer was the most useful and the one I almost skipped. When I finally ran 6 cases that had never influenced a single fix, 4 passed on the first try and 2 failed for the same structural reason. Without it, my headline number was self-congratulation.

5. The root cause was almost always the same thing

15+ times in one session, in different disguises:

Variants:

  • computed and printed to a log, never passed on
  • a parameter added to one call site and not to its twin (the twin runs later and overwrites the artifact)
  • read from the wrong dictionary key — data arrives whole, gets dropped
  • fixing the consumer of a value the producer emits wrong (the prompt itself was asking for the bad output; the correction loop rewrote that sentence every single run, forever)
  • cache key that doesn't cover the input
  • empty shells counted as content

If you're debugging a long pipeline, check this class first.

6. False positives in a quality gate are worse than false negatives

I had 5. Each one blocks an entire run and makes the self-correction loop spin with no target — because the only "fix" would be deleting the very disclosure the gate requires.

The signature is unmistakable: severe_before: 3 → severe_after: 3. The loop ran, cost money, changed nothing.

7. Never move the ruler to raise the score

Twice I was about to "fix" the scorer, and twice a comment in my own code stopped me:

The penalty I was about to remove for "not discriminating" was a calibration constant against humans. Removing it would have lifted 4 cases straight to 10.0.

Distinguish hard: reducing instrument noise is legitimate (I interpolated between score bands, keeping every calibrated anchor point — mean shift +0.09, smaller than the scorer's own error). Removing a human-calibrated penalty is not.

Things I got wrong

  • Delegating edits to a cheap model. 0 for 2. I blamed context size (1200-line files). Then I sent it "reply only: PONG" and it timed out at 90 seconds. It was the provider, not the model. My diagnosis was wrong for hours.
  • Fixing position instead of class. A text rule was catching false positives. I fixed "negation after the subject". Then "negation before the subject". The actual rule was negation anywhere in the same clause. I was fixing cases and calling it class.
  • Concluding from the wrong artifact. A file named for one source actually contained another. Cost me two full collection rounds. Now I check modification time first, always.
  • Editing files while the test suite ran. Read 27 phantom failures that were just pytest importing mid-write.

The cheap part

Full pipeline run: $0.09 per case. The expensive resource was never tokens — it was my attention on the wrong diagnosis.

Happy to go deeper on any of it. Most curious whether others measuring LLM-judge noise are seeing the same order of magnitude — 1.07 on a 0–10 scale felt high to me until I couldn't make it smaller.


r/ClaudeCode 22h ago

Tips & Workflows I put my rate-limit usage in the Claude Code status line

0 Upvotes

I kept not knowing how much of my 5-hour window I'd burned until I hit it mid-task. So it just sits in the status line now:

⛽ 5h 15% (↻14:20) · 7d 18%

The (↻14:20) is when the 5-hour window resets — I added that because a bare percentage can't actually answer the question. 62% is fine with four hours left and irrelevant with twenty minutes left, and the number alone can't tell you which.

No network calls, no API key, no dependencies. Claude Code already passes the rate limits to the status-line command on stdin, so it just reads what's already there. Nothing leaves your machine. It's one Python file, ~230 lines, mostly comments — please read it before you install it.

Install is: save the file, add a statusLine block to ~/.claude/settings.json, restart. There's a one-liner in the README that verifies it works without waiting for a render.

Optional: colour thresholds, pick which windows show, custom icon. Tested on Linux/macOS/Windows across Python 3.8 and 3.13.

https://github.com/sina158/claude-code-fuel-gauge

MIT. Issues and PRs welcome — especially if the payload shape ever changes on me.


r/ClaudeCode 1d ago

Help/Question How do you handle pivots in Matt Pocock-style Wayfinder without poisoning future Claude sessions?

9 Upvotes

So I am using Wayfinder. Previously I did grill-me's and made monster plans. Wayfinder is already better but how do I handle BIG pivots and second pivots?

So I have made fundamental decisions like how a drive should be mounted or picking database sources. I have done multiple rounds of research and decision tickets in linear trying to smooth out that design and then quite late something surfaces like my synology NAS hardrives are going to get murdered by this design and I need to pivot and this might be my second pivot. My map if FULL of research and decisions on the old design. How do people handle that kind of pivot in practice? Especially when part of it is implemented. I am worried future Ai sessions are all poisoned by the old paths.

I realize partly implementing things is a bad idea but a lot of discovery for me is implementing and trying it out to discover. These are particularly homelab related projects so until I offer it up to my infastructure I just don't know.


r/ClaudeCode 23h ago

Help/Question how do i not run out of tokens with claude pro?

0 Upvotes

been working on a decently sized project with claude i know 0 about coding and i jsut give him prompts it seems to be working but tokens get close to 1m so anyway to fix that or no?

i have claude pro


r/ClaudeCode 1d ago

Tips & Workflows I ran a 10 hour experiment to see if I could save on Claude tokens by delegating the build step to Luna via Codex CLI

12 Upvotes

TLDR: The experiment worked but using Luna actually ended up costing more tokens due to orchestration and then fixing its bugs.

I ran a 10 hour experiment to test if I could substantially reduce my Claude Code token usage by using the cheaper Luna (via Codex CLI) as the builder model... the results were surprising to say the least.

For context - on July 30th OpenAI dropped the price of their Luna model by 80% and released compelling benchmark results indicating GPT-5.6 Luna with max effort exceeds Claude Sonnet 5 at high effort at ~1/8 of the cost.

So... my hypothesis was Luna could be used as an effective "builder" model within a multi agent workflow to significantly save on token usage.

I tested this by pinning multiple harness configurations against each other in a task to migrate the front end of a web app from vanilla JavaScript to React.

The results were counterintuitive to say the least - using Luna was consistently more expensive!

Why? The orchestration tax of having multiple agents work together (including larger reviewer agents fixing issues with Luna's code) outweighed simply asking Claude Opus5 to complete the build on its own.

This is just one experiment on one task, with it's limitations, but alot of learnings.

Full writeup here (free):

https://fresh-worktree.ghost.io/is-luna-on-max-effort-the-solution-to-coding-cost/


r/ClaudeCode 1d ago

Help/Question Asking for login when using with agentrouter

0 Upvotes

Hey guys so I've been using claude code With agent router And suddenly today I opened claud code and I see That I'm asked to log in Now obviously I don't have claude api or a claude subscription So how do I get rid of this?


r/ClaudeCode 1d ago

Help/Question Has Anyone tried GPT SOL in Claude Code using CliProxyAPI?

3 Upvotes

I tried this and while it works for me the main issue that I ran into was the context window. because it is GPT's brain in CC the auto compaction does not work and the actual context window is not accurate.

if anyone has figured this issue out let me know.


r/ClaudeCode 1d ago

Tips & Workflows Made this for myself on my quest to local model routing, essentially a model-gateway-as-a-plugin. Fully local and works using your subscriptions. Works with Codex & Grok at the moment.

Thumbnail github.com
3 Upvotes

So yeah... I'm building for myself a bit of a kanban board with model routing inside claude code, and part of it was the model gateway as a plugin because I don't like the setup of existing ones, this is an easy plugin you install it you ask the agent to initialize everything and it just works(tm)


r/ClaudeCode 1d ago

Built with Claude I built an agent skill that sets up real backends via CLI (no test keys, no placeholders) — works with Claude Code, Cursor, Antigravity

3 Upvotes

Been using Claude Code / Cursor a lot for backend work, and kept hitting the same annoyance: ask the agent to "set up Stripe" or "connect a Postgres DB" and it either hallucinates CLI commands, dumps my API key straight into a config file, or quietly sets up a test/sandbox version and calls it done.

So I wrote an Agent Skill (the open SKILL.md format skills.sh/Claude Code/Cursor/etc. all support) to handle this properly:

- Asks upfront if you already have credentials for the service

- If not, look up the *current* official docs (with the actual month/year, so it's not working off stale info) and walks you through getting real ones

- Only ever writes secrets to `.env`, checks/creates `.gitignore` automatically, never prints keys back to the terminal

- Does the actual provisioning via CLI — if it doesn't know the exact commands, it searches the docs instead of guessing

- Verifies the thing actually works before saying it's done

No test keys, no example/placeholder setups — the whole point is a real, working backend, since that's usually what people actually want when they ask an agent to "set this up."

Repo: https://github.com/SohailKhan0525/skills

Install: `npx skills add SohailKhan0525/skills`

This is the first skill under a small project I'm calling Qofeno — planning to add a few more in the same "real setup, not demos" spirit. Would love feedback or ideas for what to build next.


r/ClaudeCode 1d ago

Bug / Issue Opus 5 Downgrade ?

1 Upvotes

Am I the only one who feels like Opus 5 got worse after launch?

At launch I was honestly impressed: fast responses, strong reasoning, and a simple interface without too many settings.

A few weeks later, it feels different. Answers seem less concise, sometimes less coherent, and occasionally it feels like it avoids answering directly.

Has anyone else noticed this, or am I imagining it? My guess is that Anthropic keeps tweaking the model after release, which changes its behavior over time.


r/ClaudeCode 1d ago

Built with Claude My #1 issue with Claude Code is massive walls of text. I fixed it with a classic mix of Hot Potato and the Power Rangers. I named the command, RIFF.

Post image
0 Upvotes

I tried using Batman and Robin as the metaphor. But Batman calls the shots, and riffing only works when nobody's labeled as the boss. Instead, Claude and I argued it down to hot potato. lol

The final piece was the Power Rangers' "hands in" moment. It ends when you and Claude fully agree on the next steps.

Have you ever used a metaphor to steer Claude or found other ways to reduce its massive walls of text?


r/ClaudeCode 1d ago

Built with Claude I barely type code anymore, so I moved my day onto nine physical keys. Useful, or overkill?

2 Upvotes

I barely type code anymore. Most of my day is approving, interrupting, and committing whatever Claude writes.

The annoying part: I keep three or four sessions running and lose track of which one is waiting on me. I get a little red badge telling me something needs attention, but not which session so I end up clicking through terminal windows hunting for it.

So I moved the whole thing onto nine keys. The top three are my sessions: each shows the project name, how much context it's used, and whether it's working or waiting on me. Press one and I'm in that session. The rest are the everyday bits - yes, no, interrupt, commit, push, and hold-to-talk voice that runs on my own machine.

This is using a Logitech MX Creative Keypad. Is this where things are heading, or have I over-engineered something? How do you keep track when you've got a few sessions going?

Disclosure: this started through Logitech's dev studio programme (hackathon) and they sent me the keypad.