techlist.io
KREN

Claude Code

26 posts

figma3 min readCurated summary

How Figma Stays Ahead of Vulnerabilities With Agents | Figma Blog

Figma uses AI agents to prevent, detect, and fix vulnerabilities during code generation, pull-request review, and historical code audits. Its central strategy is a shared security policy combined with continuous measurement of precision and recall. The company began with PR review because developer feedback and replaying known bugs created the fastest improvement loop. ## A Shared Policy Across the Development Lifecycle - The same policy guides agents during: - Code generation - Pull-request review - Full-repository auditing - The policy records: - Trust boundaries - Accepted risks - Security precedents - Improving PR review first helped Figma refine the policy before applying it to other stages. ## Measuring Precision and Recall - **Precision** measures how many reported findings are genuine vulnerabilities; low precision creates false positives. - **Recall** measures how many real vulnerabilities the system detects; low recall creates false negatives. - Figma measures: - Precision through author thumbs-up or thumbs-down feedback on findings. - Recall by replaying the reviewer against commits containing known bugs. - These separate signals allow the team to improve both dimensions rather than optimizing for only one. ## AI-Assisted Pull-Request Review - Every pull request receives an automated review. - Findings are posted directly to the PR, allowing developers to respond and fix issues in context. - Figma currently runs: - Claude Code with Opus 4.8 at extra-high effort - Codex with GPT-5.6 Sol at high effort - The models identify different classes of bugs, so Figma reports a finding if either model detects one. - Reviews cost approximately $0.50 per pull request at the median. The agents have identified both sophisticated and conventional vulnerabilities, including: - A multi-step desktop-client exploit in which an injected sandbox object exposed the host realm’s `Function` constructor and enabled possible code execution. - An insecure direct object reference where an authenticated user could retrieve another organization’s invoice by supplying its ID. ## Building Trust Before Exposing Findings - Figma launched Anthropic’s Claude Code Security Reviewer in August 2025 in shadow mode. - Initial results were strong at reproducing known vulnerability root causes, but only 4 of 27 findings—about 15%—were valid. - The team prioritized precision first because developers quickly lose trust in tools that generate excessive false positives. - Figma set a practical target of at least 70% precision. - Developer-facing comments were withheld until precision exceeded that level over a two-week period without severe false positives. - Security engineers replayed the reviewer across eight weeks of historical pull requests and manually labeled incorrect findings. - Those examples were used to create and refine the shared security policy. ## Continuous Improvement Through Precedents - A **precedent** documents why a finding is valid or invalid in a particular context. - Human feedback and historical vulnerability replays feed back into the policy. - This process lets Figma improve the agent automatically rather than relying only on model changes or one-time prompt tuning. Figma’s approach treats agentic security as an engineering and measurement problem, not simply a matter of asking an AI to scan code. Organizations adopting similar systems should establish feedback loops, measure precision and recall independently, and build developer trust before making automated findings part of everyday development.

Read original(opens in new tab)
Claude CodeAI AgentsCode ReviewMonorepo+3
aws3 min readCurated summary

AWS Security Agent adds threat modeling, Kiro power and Claude Code plugin, and more | Amazon Web Services

AWS Security Agent, now part of AWS Continuum, is expanding into a unified security platform spanning design, development, and deployment. New capabilities include threat modeling, deeper pull-request and repository reviews, compliance validation, and integrations with Kiro, Claude Code, and other AI IDEs through MCP. AWS’s central promise is to find vulnerabilities, verify exploitability, and provide actionable fixes without interrupting developers’ workflows. ## Enhanced Code Reviews - Supports GitHub, GitLab, and Bitbucket, including SaaS and self-hosted installations. - Integrates with Confluence so reviews can use existing technical and security documentation as context. - Performs reasoning-based analysis of pull requests and entire repositories, identifying vulnerabilities beyond pattern matching. - Checks code against organizational security requirements and common security risks. - Validates findings in simulated environments to demonstrate proof of exploitability. - Provides remediation guidance and fix commits directly in the repository workflow. - Supports pull-request scanning, remediation, security requirement packs, and simulated validation. ## Compliance and Design Reviews - Managed compliance packs include: - AWS WAF - NIST CSF - PCI DSS - AWS best practices - Organizations can import their own security requirements from internal documents or Confluence. - Findings are mapped to the organization’s compliance posture, helping teams maintain audit readiness throughout development. ## Threat Modeling - Generates threat models from design documents or source-code repositories. - Builds an application context model covering: - Architecture - Data flows - Trust boundaries - Application components - Identifies likely threat actors, attack vectors, and weaknesses. - Uses the STRIDE framework to classify threats. - Prioritizes risks and recommends mitigations. - Threat models can be generated from the Security Agent console or through supported development tools. ## Kiro, Claude Code, and MCP Integrations - A Kiro power is available, with a Claude Code plugin coming soon. - An open MCP integration enables use from Kiro, Claude Code, or other AI-powered IDEs. - Developers can trigger scans, threat models, and remediation directly from their IDE or CLI. - Kiro commands include: - `Set up AWS Security Agent` - `Run a full security scan on this repo` - `help me remediate my findings` - `Build a threat model for this application` - Findings can be downloaded into the local workspace, prioritized, and used to start bug-fix specification sessions. - Generated threat models are saved at `.security-agent/threat_model.md`. - A Kiro agent hook can automatically evaluate whether a code-review scan should run after an agent turn. ## Lifecycle Coverage and Availability - Design-time security: design reviews and threat modeling, both in preview. - Development-time security: repository and pull-request code reviews, in preview. - Deployment-time security: on-demand penetration testing, generally available. - The features are available in supported AWS commercial Regions, with regional availability and pricing listed in AWS documentation. AWS Security Agent is positioned as a continuous security layer across the software lifecycle. Teams interested in automated, context-aware security analysis can try it through the Security Agent console, while developers can use the IDE and MCP integrations to keep scanning and remediation within their existing workflows.

Read original(opens in new tab)
Claude CodeModel Context ProtocolCode ReviewThreat Modeling+3
toss4 min readCurated summary

Designing the Work You Do Every Day

A product designer at Toss Bank transformed her personal task-management routine instead of accepting repetitive manual work as unavoidable. She built an AI-powered desktop widget that collects Slack messages, summarizes them into actionable tasks, preserves their context, and helps her focus on prioritization. What began as a personal solution revealed a broader problem shared across roles and spread throughout her team. ## From Manual Task Tracking to Workflow Design - For two and a half years, she manually copied tasks, feedback, discussion links, and requests from Slack into Notion or Slack lists. - As her responsibilities expanded to three teams, daily tasks grew from roughly 10 to more than 20. - She reframed the issue as a product-design problem: - **User:** herself - **Real goal:** completing the most important work without missing anything - **Main friction:** copying, organizing, and locating context - **Ideal state:** tasks collected automatically, leaving only prioritization to manage - This led to three core requirements: - AI should register tasks directly from Slack. - Each task should retain its source thread and document links. - Priorities should remain visible in an always-present widget. ## Teaching AI to Understand Work Context - Adding a specific emoji to a Slack message sends it to a designated channel. - Claude Code reads the message and converts it into a task with: - A concise summary - The relevant team tag - A link to the original Slack thread - The hardest part was turning long, contextual Slack conversations into one clear action. - For example, a request about an error during a loan-extension application becomes “Check loan-extension error case.” - She created writing guidelines and examples defining: - What qualifies as a good task - How teams should be categorized - Which expressions and sentence structures to use - The goal was for AI-generated tasks to sound like something she would have written herself. - Refining the AI’s output was less about coding than encoding her judgment about what constitutes a real task. ## Designing the Widget Experience - Making the widget feel natural required detailed interaction design and repeated implementation. - She rebuilt the code to refine the expand-and-collapse behavior. - The drag interaction took nearly a week to complete. - Explaining seemingly obvious behaviors to AI forced her to define her own requirements more precisely. - In this sense, working with AI became a process of clarifying thoughts and translating them into explicit language. ## Replacing Anxiety with Prioritization - She no longer needs to open Slack or Notion repeatedly to remember her tasks. - The always-visible widget removed a previously unnoticed source of friction. - AI now handles collecting and organizing work, reducing the mental energy spent on administration. - She can concentrate on deciding what matters most instead of worrying that something has been forgotten. ## A Personal Problem Shared by the Team - Although the widget was initially built for personal use, many colleagues adopted it. - Developers unexpectedly became active users, reporting bugs and suggesting features. - The usual designer–developer relationship reversed: developers raised issues while she fixed and redeployed the tool. - This showed that task collection, prioritization, and context management are common problems across job functions. - The tool spread not because its concept was revolutionary, but because it addressed an existing, widely felt inconvenience. ## Applying the Method - Identify the most frequent “not really work” task from the past week: - Copying information - Searching for context - Organizing lists - Define the problem as a product: - Who is the user? - What are they truly trying to accomplish? - Where is the greatest friction? - What does success look like? - Examine why existing tools do not solve the problem. - Start with the smallest version that can be useful immediately. The practical lesson is to treat repetitive coordination work as something that can be designed away. Instead of searching for a perfect general-purpose tool, build a small solution around the specific context, habits, and judgments that existing products cannot know.

Read original(opens in new tab)
Claude CodeAISlackAutomation+2
kakao3 min readCurated summary

Is a Non-Developer Who Does Vibe Coding a Developer? (3)

AI coding agents have helped a non-developer move from creating small local HTML tools to building shared dashboards, integrations, automations, and repeatable workflows. The major change was not writing more code, but learning to define data, permissions, inputs, outputs, exceptions, and validation criteria. The author concludes that AI is making more kinds of work executable and structured, expanding questions about “development” beyond professional developers. ## From Local HTML to Shared Tools - Early tools were standalone HTML files used locally in a browser. - Sharing them introduced deployment, URLs, version updates, and maintenance concerns. - Once users needed persistent data and changing states, the problem expanded from UI design to: - Data storage - Access and edit permissions - Change history and rollback - Backups and operational responsibility - Google Sheets became a practical lightweight database because it already provided: - Collaboration and familiar interfaces - Permission management - Revision history - The author progressed from manually pasting Apps Script code to using `clasp` and Apps Script APIs for deployment and execution. - The key shift was learning to evaluate where data should live and which tools already work safely within an organization. ## Security as a Daily Habit - Connecting work tools through webhooks introduced the need to protect tokens and webhook URLs. - The author began using `.env` files and `.gitignore` to prevent secrets from entering source code or Git repositories. - Requests to AI agents increasingly included security requirements: - Read secrets from environment variables - Avoid printing sensitive values in logs - Use placeholders instead of real credentials - Small automations connected to external systems naturally required thinking about secret management, execution environments, and access control. ## Turning Manual Tasks into Workflows - Tasks such as copying files, organizing folders, converting documents, editing videos, and extracting audio or summaries were delegated to AI agents. - Delegating these tasks required explicit definitions of: - Input files - Output names and formats - Whether existing files may be overwritten - Failure conditions - Verification requirements - Informal, intuitive actions became structured work specifications. - The author found that understanding completion criteria and input/output formats was often more important than memorizing individual commands. ## Skills and Feedback Loops - Weekly meeting-note preparation revealed recurring editing patterns and implicit business rules. - These rules were encoded into Codex and Claude skills covering: - Note structure - Action-item extraction - PMO-related signals - Situations where the AI should ask questions instead of making assumptions - Skills functioned as stored decision criteria, not merely collections of prompts. - Comparing AI-generated drafts with the author’s final revisions enabled continuous refinement. - Deleting local data for security reasons accidentally removed useful conversation context, temporarily reducing skill quality and demonstrating the importance of preserving relevant operational knowledge. ## Using Outputs as New Inputs - Google Analytics reporting became more frequent and detailed through MCP-based API access and reusable reporting skills. - MCP provided the data connection, while skills preserved the recurring monthly report structure. - The valuable work remained interpreting changes between periods and deciding whether a change was meaningful. - Combining AI-generated metrics with the author’s contextual knowledge helped surface signals requiring further investigation in near real time. The author recommends focusing less on how much code AI can generate and more on how work can be clearly structured for AI execution. As agents become more capable, everyone—not only developers—will increasingly define inputs, outputs, permissions, security controls, repetition, and validation as part of everyday work.

Read original(opens in new tab)
Claude CodeAI AgentsModel Context ProtocolWebhooks+3
line4 min readCurated summary

ODW #8: A Hands-On Internal Workshop on Accelerating Incident Response and FAQ Generation with Slack MCP

LY Corporation’s Orchestration Development Workshop demonstrated how Slack MCP can turn scattered Slack conversations into structured operational knowledge. Using AI, employees can summarize incidents, generate reports, create FAQs, and publish results to Confluence with minimal setup. The workshop’s central conclusion was that hands-on practice, reusable skills, and human review are essential for turning new AI capabilities into practical workplace tools. ## The Information and Adoption Challenge - Slack contains valuable real-time information from incident response, customer inquiries, and project discussions. - Much of this information remains unstructured because employees lack time to document it. - Documentation quality varies by author, causing useful knowledge to become difficult to find. - Although Slack MCP became available internally in March 2026, adoption barriers remained: - Limited time to explore new tools - Concerns about complex configuration - Slow internal distribution of technical knowledge ## Introducing Slack MCP Through Hands-On Practice - Slack MCP is an internally developed MCP server connected to company authentication. - Employees can access internal Slack data without issuing personal tokens or configuring OAuth. - The workshop began with a simple exercise: - Launch a coding tool such as Claude Code - Ask the AI to post “Hello” in a designated Slack channel - Confirm that the message was actually posted - This immediate success helped participants understand MCP’s practical capabilities. ## Combining Slack MCP with Other MCP Servers Slack MCP supports several core operations: - Reading messages and threads - Posting messages and performing actions - Looking up channels and members - Searching Slack content Combined with other MCP servers, it can support broader workflows: - Slack plus Confluence MCP: Generate and publish project reports or FAQs - Slack plus Jira MCP: Create work tickets from discussions - Slack conversations can be transformed into structured documents rather than remaining isolated in chat history. ## Automatically Creating FAQs from Slack Inquiries The first major exercise converted repeated support discussions into reusable knowledge. - Slack inquiry threads were collected and converted into FAQ-formatted Markdown. - Existing Confluence content was checked to identify duplicates. - New FAQs were published as child pages under an existing Confluence knowledge base. - The output was formatted as a table containing: - Symptoms - Causes - Solutions The workflow was packaged into reusable skills such as: - `slack-to-faq`: Searches recent inquiry threads and generates new FAQ files - `faq-to-confluence`: Converts and publishes the FAQs to Confluence This demonstrated how MCP can automate the entire path from conversation search to knowledge-base publication. ## Supporting Incident Response The second exercise focused on reducing the time needed to understand and document incidents. ### Rapid Situation Summaries Participants could ask the AI to summarize an outage in natural language. MCP searched relevant Slack threads and organized the information into: - Current resolution status - Customer impact - Actions being taken by team members - A chronological timeline This helps managers or newly joining responders understand the situation quickly without reading every thread. ### Automated Incident Reports After resolution, the AI generated reports in a specified format, including: - Incident and detection times - Duration - Root cause - Affected users and features - Whether data was lost - Remediation steps The `slack-incident-status` and `slack-incident-report` skills separated real-time status checking from post-incident documentation. ## Practical Guidelines and Safeguards - Clean and constrain source data before processing it: - Compare results with existing Confluence FAQs - Filter messages using reactions or other markers - Limit searches to relevant channels and threads - Do not publish AI-generated documents without review. - Check for personal information and confirm that the output accurately reflects the source conversations. - Include links or references to the original Slack threads. - Specify the desired output structure, such as a three-column table for symptoms, causes, and solutions. - Convert successful prompts into reusable skills so teams can avoid rewriting complex instructions and maintain consistent output quality. ## Lessons from the Workshop - **Timing matters:** Holding the workshop soon after Slack MCP became available captured user interest and accelerated experimentation. - **Practice is more effective than explanation:** Starting with a simple Slack post and progressing to FAQs and incident reports made the benefits immediately tangible. - **Real work makes training relevant:** Inquiry handling and incident response were chosen because they are common, time-consuming tasks. - **Reusable skills improve adoption:** Prompt patterns were tested manually, refined, saved as skills, and shared with participants for continued workplace use. The recommended approach is to introduce new AI tools through timely, task-focused workshops, then refine successful workflows into shared skills. MCP can greatly reduce the effort of operational documentation, but human validation remains necessary before generated knowledge is published.

Read original(opens in new tab)
Claude CodeGenerative AIModel Context ProtocolSlack+4
aws2 min readCurated summary

Introducing the next generation of Amazon OpenSearch Serverless for building your agentic AI applications | Amazon Web Services

Amazon’s next-generation OpenSearch Serverless is a managed search and vector engine optimized for agentic AI applications. It scales from zero to thousands of requests per second, creates resources in seconds, and can reduce costs by up to 60% compared with clusters provisioned for peak demand. The release is generally available across supported AWS commercial Regions and integrates with tools such as Vercel, Kiro, Claude Code, and Cursor. ## Elastic Scaling and Cost Optimization - Scales capacity up to 20 times faster than the previous generation. - Supports scale-to-zero when idle, minimizing compute costs. - Charges separately for compute through OpenSearch Compute Units (OCUs), storage in GB-month, and GPU acceleration where applicable. - Supports capacity limits for indexing and search, with minimum capacity set to zero and configurable maximums. ## Creating Next-Generation Collections - Collections can be created through the Amazon OpenSearch Service console, AWS CLI, or SDKs. - The console’s **Express create** option automatically applies default settings and matching security policies. - At launch, supported collection types are: - Full-text search (`SEARCH`) - Vector search (`VECTORSEARCH`) - Users who need the existing infrastructure can select the classic OpenSearch Serverless generation. - Collections inherit their generation from a parent collection group. Example CLI workflows create a next-generation collection group with standby replicas and then create a search collection within it. ## Integrations for Agent Development - Vercel users can create or connect OpenSearch Serverless collections directly from the Vercel console. - OpenSearch Agent Skills bring search-specific knowledge, best practices, and multi-step workflows into agents using Claude Code, Cursor, and Kiro. - Kiro’s OpenSearch Launchpad provides guided architecture planning for building search applications. ## Availability - The next generation is generally available in all AWS commercial Regions where OpenSearch Serverless is currently offered. - AWS recommends consulting the OpenSearch Serverless documentation and pricing information for configuration and cost details. The release is intended to let developers deploy production-ready search and vector backends quickly, while avoiding the infrastructure management and peak-capacity costs associated with provisioned OpenSearch clusters.

Read original(opens in new tab)
Claude CodeAI AgentsVector DbAws Cli+4
spotify3 min readCurated summary

Coding Is No Longer the Constraint: Scaling Developer Experience to Teams and Agents at Spotify | Spotify Engineering

Spotify argues that AI has shifted software development’s main constraint from writing code to coordinating people, systems, and decisions. Years of investment in standardized platforms, automation, and developer experience enabled Spotify to adopt AI coding tools at extraordinary scale. The company’s experience suggests that consistent infrastructure and strong feedback loops are essential for making both human developers and coding agents effective. ## Rapid AI Adoption - More than 99% of Spotify engineers use AI coding tools weekly. - 94% report improved productivity. - Pull request frequency has increased by 76%, with most PRs created by developers working alongside AI agents. - Adoption accelerated sharply after the release of Claude Opus 4.5. ## Fleet Management Before AI Agents - Spotify’s codebase was growing seven times faster than its engineering workforce. - Developers increasingly spent time on dependency upgrades, API migrations, and vulnerability fixes. - Fleet Management automated changes across hundreds or thousands of components. - Its orchestration system, Fleetshift, has merged more than 2.5 million maintenance PRs, most without human intervention. - This approach reduced migrations from work taking weeks or months across many teams to centrally managed operations. ## Honk: A Background Coding Agent - Deterministic scripts struggled with complex refactoring and the edge cases found across large codebases. - Spotify created Honk, a background coding agent powered by Claude through the Agent SDK. - Honk runs in Kubernetes pods, allowing many coding sessions to execute concurrently. - It can use trusted tools and run builds in CI across multiple operating systems. - Fleetshift identifies targets, schedules work, and tracks PRs, while Honk performs the code changes. - A recent Java migration across Spotify’s backend services took three days. - Engineers can invoke Honk through Slack, where it uses conversation context to create and return PRs. - Honk v2 adds shared sessions, team projects, and agent orchestration through Chirp. ## Standardization Improves Agent Performance - Spotify’s principle of limiting the number of technologies it supports reduces decisions and improves collaboration. - Consistent service architectures and design patterns also give AI agents better reference material. - Agents perform worse in fragmented codebases with inconsistent conventions. - Backstage provides a unified internal developer portal and catalog for software components. - Spotify exposes Backstage capabilities to agents through MCP integrations and command-line tools. - Agents can discover component ownership, read documentation, and contact responsible teams. ## Guardrails Through Backstage - Backstage’s Soundcheck and “golden state” define recommended technologies and practices. - Teams can assess their components against these standards. - Static analysis and linting provide immediate feedback when developers or agents use unsuitable patterns. - This creates a feedback loop that helps agents correct their work and drives consistency across the organization. Spotify’s experience indicates that scaling AI development requires more than giving engineers access to models. Organizations should invest in standardized platforms, searchable component metadata, automated fleet-wide workflows, and strong validation systems so agents can operate reliably at team scale.

Read original(opens in new tab)
Claude CodeAI AgentsKubernetesCI/CD+4
line3 min readCurated summary

ODW #6: The Pros and Cons of MCP and Agent Skills from a Git Automation Perspective

The post presents agent skills as a simpler, more practical alternative to building MCP servers for many AI-agent workflows. It demonstrates how to use Anthropic’s `skill-creator` to build a Git release automation skill that analyzes commits, updates a changelog, bumps versions, commits, tags, and pushes releases. The author emphasizes that precise requirements and explicit constraints are essential for preventing unintended agent behavior. ## Why Agent Skills Are Practical - Agent skills can simplify both implementation and architecture compared with custom MCP servers. - Although online examples explain the concept, the post focuses on a practical, work-oriented use case. - The tutorial assumes familiarity with the basic concept of skills and concentrates on building and applying one. ## Git Smart Release Automation The example skill automates releases for a Git project in the current working directory. - Reads the Git history after the most recent tag. - Summarizes changes and adds them to the top of `CHANGELOG.md`. - Creates `CHANGELOG.md` if it does not exist. - Updates the version in `pyproject.toml`. - Commits the changelog and version changes. - Creates a corresponding Git tag. - Operates based on the terminal’s current `pwd`. ## Using `skill-creator` - Anthropic’s official `skill-creator` skill is used to generate the new automation skill. - The user provides a detailed requirements specification rather than implementing everything manually. - Explicit workflow steps and constraints help keep the agent focused on the correct directory and avoid unnecessary complexity. - The development process is demonstrated with Claude Code. ## Clarifying Requirements Before generating the skill, the agent asks questions to resolve ambiguous behavior. - Support patch, minor, and major version bumps. - Use `v0.1.0` for the first release when no prior tag exists. - Follow a structured changelog format. - Push both commits and tags to the remote repository. - Abort with an explanation if the working directory contains uncommitted changes. ## Generated Skill Structure The completed skill contains: - `SKILL.md` — instructions and metadata for the agent. - `scripts/smart_release.py` — a local Python script that performs Git operations and file modifications. - `evals/evals.json` — evaluation cases for testing the skill. The skill also includes: - Keep a Changelog-style updates. - Dirty working-directory checks. - Automatic remote pushing. - Commit categorization such as `feat`, `fix`, and `docs`. ## `SKILL.md` and the Python Script - The frontmatter in `SKILL.md` acts as a concise discovery description that helps the agent decide when to load the skill. - The Markdown body provides the detailed execution workflow. - `smart_release.py` handles operations requiring deterministic file and Git manipulation, reducing the need for the language model to process raw data directly. - The post then begins testing the skill with a simple Python calculator project. A practical approach is to define release behavior, edge cases, and safety constraints before asking an agent to generate the skill, while delegating file and Git operations to a local script.

Read original(opens in new tab)
Claude CodeModel Context ProtocolPythonGit+3
figma3 min readCurated summary

What the Design-to-Code Loop Unlocks | Figma Blog

AI is bringing design and engineering into a more continuous, bidirectional workflow. Instead of treating code as an expensive final step, teams can use functional prototypes, editable designs, and AI assistance to explore behavior and visuals together. The result is broader participation, faster learning, and a shift from mechanical translation between design and code toward more semantic collaboration. ## AI Makes Code Part of Design Exploration - Code was traditionally costly and difficult to revise, while design allowed cheap, broad exploration. - AI reverses that relationship by making functional wireframes easier to create and iterate. - Designers can explore interaction and behavior—not just static layouts—then move work between code and canvas. - AI can translate between the two mediums in a way that preserves intent and structure rather than simply converting files or syntax. ## A More Bidirectional Collaboration Model - Code-based workflows tend to move in one direction and are often constrained by the patterns already present in a codebase. - Figma’s canvas gives teams space to reconsider assumptions and explore radically different directions. - Designers and developers can work from the same evolving artifact instead of repeatedly handing work off. - AI lowers participation barriers: people without access to an internal design system can import a live product into Figma as editable frames and begin contributing. ## Lower Learning Curves for Designers and Developers - AI turns steep technical learning curves into gradual ramps by providing a capable starting point. - People can learn frameworks, routes, React, and other concepts in the context of real work rather than abstract exercises. - Designers can extend beyond previous technical limits into areas such as shaders, 3D, and custom tools. - Deeper specialization remains possible, but the initial investment is much smaller and learning becomes more contextual. ## Curiosity as the New Differentiator - When AI tools become broadly available, access to technology alone is less likely to distinguish practitioners. - Curiosity and taste become more important: people who actively experiment can discover new possibilities. - AI functions as a patient tutor, reducing the friction of learning tools, frameworks, syntax, and development environments. - Staying effective requires continually exploring what can be built rather than relying only on existing technical expertise. The design-to-code loop is therefore less about replacing designers or developers and more about making experimentation and collaboration accessible across disciplines. Teams should treat AI as both a creative medium and a learning partner, moving freely between canvas and code while preserving room to question the initial direction.

Read original(opens in new tab)
Claude CodeFigmaDesign SystemsGenerative AI+2
line3 min readCurated summary

ODW #5: Building a RAG System with a Vector DB and Agent Skills

The workshop demonstrated how a lightweight RAG system can make large collections of technical documentation easier for developers and AI agents to use. Using ChromaDB, Swift Evolution proposals were indexed locally and exposed to Claude Code through MCP. Agent skills then simplified searches by teaching the agent which collection, metadata, and query practices to use. The approach improves document discovery and can support code generation and review. ## Why RAG Is Needed - Large application teams maintain extensive documentation and architectural guidelines. - Developers often spend significant time searching for information about: - Introducing dependencies - Resolving build errors - Following architectural rules - Asking experts can solve problems, but consumes time for both the questioner and the responder. - RAG provides AI agents with structured, searchable knowledge so they can answer questions more accurately using internal documents. ## Building a RAG System with ChromaDB - The workshop used ChromaDB, an open-source local vector database with Python and JavaScript client libraries. - Swift Evolution proposals served as the sample dataset: - Approximately 500 Markdown documents - Consistent structure and proposal IDs such as `SE-0400` - Metadata including implementation status and authors - Participants indexed the documents locally and connected the database to Claude Code through an MCP tool. - This allowed the coding agent to retrieve and reference Swift language proposals during conversations. ## Improving Search with Agent Skills - MCP exposes the available database tools, but the agent still needs to know: - Which collection contains the relevant data - Which metadata fields are useful - How to formulate effective queries - A dedicated `searching-swift-evolution` skill encoded this knowledge, including: - The `swift-evolution` collection name - Proposal ID formats such as `SE-0255` and `ST-0001` - Metadata such as `Status` and `Authors` - A recommendation to query in English - With the skill, users could issue simple requests such as “Investigate SE-0500” without explaining the database structure or MCP workflow. - The workshop also covered skill mechanics, authoring best practices, and practical skill development. - Participants later indexed their own Markdown documents, created search skills, and learned how to deploy the database to LY Corporation’s internal Flava cloud for sharing. ## Potential Applications - Natural-language document search can make internal technical knowledge significantly more accessible. - Coding agents can retrieve relevant documentation automatically before: - Generating code - Reviewing code - Checking compliance with architectural or implementation guidelines - Combining RAG with agent skills or Claude Code sub-agents can embed organizational knowledge directly into development workflows. ## Workshop Design and Results - The online workshop used demonstrations by instructors and mock participants. - More than 1,000 people attended. - Its structure balanced lectures and hands-on exercises: - Lectures explained the core concepts concisely. - Practical demonstrations showed how to apply the system to real work documents. - This balance helped participants understand both the underlying ideas and their practical use. Overall, the workshop showed that a local vector database plus MCP and well-designed agent skills can provide a simple, effective foundation for searchable engineering knowledge and AI-assisted development.

Read original(opens in new tab)
Claude CodeAI AgentsModel Context ProtocolRAG+4
aws3 min readCurated summary

The AWS MCP Server is now generally available | Amazon Web Services

The AWS MCP Server is now generally available as a managed way for AI agents to access AWS securely through IAM-authenticated tools. It combines live AWS documentation, access to more than 15,000 API operations, and sandboxed scripting so agents can produce more current, efficient, and production-ready results. The post concludes that this solves major limitations of model-only AWS assistance without granting agents unrestricted credentials. ## Why AI Agents Struggle with AWS - Models may lack knowledge of recently launched services such as Amazon S3 Vectors, Aurora DSQL, and Bedrock AgentCore. - Agents often default to the AWS CLI instead of AWS CDK or CloudFormation. - Generated IAM policies are frequently broader than necessary. - The resulting infrastructure may work in demos but fail production standards. ## Core AWS MCP Server Tools - `call_aws` can execute more than 15,000 AWS API operations using the user’s existing IAM credentials. - `search_documentation` and `read_documentation` retrieve current AWS documentation and best practices at query time. - The compact tool set reduces model context usage and is intended to support newly launched APIs within days. ## General Availability Improvements - IAM context keys allow fine-grained access control through standard IAM policies without requiring a separate server permission. - Documentation retrieval no longer requires authentication. - Reduced token consumption improves complex, multi-step workflows. - The `run_script` tool executes short Python scripts in a server-side sandbox. - The sandbox inherits IAM permissions. - It has no network access or access to the user’s local filesystem and shell. - It can combine multiple API calls, filter results, and calculate outputs in one round trip. ## Skills and AWS Best Practices - Skills replace Agent SOPs with curated guidance for common AWS tasks. - AWS service teams contribute and maintain the Skills. - They help agents avoid mistakes, use validated patterns, reduce hallucinations, and consume fewer tokens. - Keeping the tool list small makes agent behavior more predictable. ## Enterprise Security and Observability - IAM policies and Service Control Policies can separate human permissions from agent permissions. - For example, a user may perform write operations while the MCP server is restricted to read-only access. - CloudWatch metrics under the `AWS-MCP` namespace distinguish agent activity from direct human calls. - AWS CloudTrail records all API calls for auditing and compliance. ## Demonstration with Claude Code - Without the MCP Server, Claude Opus 4.6 suggested several valid ways to store embeddings on S3 but missed Amazon S3 Vectors because the service launched after its training cutoff. - With the MCP Server, Claude Code searched current AWS documentation and correctly identified S3 Vectors. - Claude Code can connect through the open-source `mcp-proxy-for-aws`, which bridges local IAM credentials and MCP’s OAuth 2.1 requirement. - The server works with Claude Code, Kiro, Cursor, Codex, and other MCP-compatible clients. ## Availability and Cost - The service is available in US East (N. Virginia) and Europe (Frankfurt). - It can make API calls across AWS Regions. - There is no additional charge for the MCP Server; users pay for AWS resources and applicable data transfer. The AWS MCP Server is a practical foundation for giving agents current AWS knowledge and controlled operational access. Teams should pair it with narrowly scoped IAM policies, read-only defaults where possible, and CloudWatch or CloudTrail monitoring.

Read original(opens in new tab)
Claude CodeModel Context ProtocolPythonAWS+4
gitlab3 min readCurated summary

Claude Code and GitLab: Three workflows that ship

Claude Code accelerates coding, but writing code is only one part of shipping software. The post argues that GitLab complements Claude Code by handling CI/CD, security scanning, code review, approvals, and auditability. It presents three workflows: fixing bugs locally, enriching Claude with GitLab context through MCP, and using a Claude-powered external agent to resolve merge request feedback. ## The Gap Between Coding and Shipping - Agentic tools can quickly understand unfamiliar code, propose fixes, and scaffold features. - Faster code generation can leave teams with: - Larger bug backlogs - More pipeline failures - Accumulating security vulnerabilities - Bottlenecks in review and approval - GitLab manages the downstream software lifecycle after Claude Code produces a change. ## Prerequisites and Project Setup - Claude Code must be installed and configured. - A GitLab project containing bug reports and feature proposals is required, such as the Tanuki IoT Platform. - Optional workflows require: - The GitLab MCP Server - GitLab Duo Agent Platform with external agents - The example project uses CMake, Make, and GCC or Clang for C++ builds. - Developers clone the repository, launch `claude`, and can ask it to explain the project before making changes. ## Workflow One: Fix a C++ Bug and Ship It Through GitLab - The Arduino IoT Collector crashes when `/dev/ttyACM0` is unavailable. - The failure can be reproduced by building and running the application with CMake: - `cmake -S . -B build` - `cmake --build build` - `./build/arduino_iot_collector` - Claude Code examines `sensors/arduino-iot-collector/src/main.cpp` and identifies an uncaught `std::runtime_error`. - The recommended behavior is to log a clear configuration error and continue running instead of terminating. - After the fix, Claude Code can create a branch, commit the changes, and push them, or the developer can run the Git commands manually. - Opening a merge request triggers: - Build and test pipelines - Security scanning - GitLab Duo Code Review Flow - Checks against project style guides and custom review instructions ## Workflow Two: Add GitLab Context with MCP - Local repository files may not contain the full history behind a bug. - GitLab issues, debugging discussions, previous merge requests, and related fixes provide valuable software development lifecycle context. - The GitLab MCP Server connects Claude Code to this information. - It can be added over HTTP with a command such as: `claude mcp add --transport http GitLab https://gitlab.example.com/api/v4/mcp` - In a new Claude Code session, `/mcp` starts OAuth authentication through the browser. - Developers can verify the integration by asking Claude which GitLab MCP tools and server version are available. - MCP uses the developer’s existing GitLab identity: - It does not grant elevated permissions. - Claude can access only projects, issues, merge requests, and other data already visible to that user. ## Workflow Three: Resolve Review Feedback with an External Agent - The third workflow uses a Claude-powered external agent in GitLab Duo Agent Platform. - Rather than requiring a developer to manually interpret review comments, the agent can address code review feedback directly in the merge request. - This extends Claude Code’s implementation abilities into GitLab’s review and delivery workflow. ## Overall Recommendation Use Claude Code for investigation and implementation, then use GitLab to provide the context, automated validation, security checks, review, and approval process needed to ship those changes safely.

Read original(opens in new tab)
Claude CodeGitlabCode ReviewC Plus Plus+4
figma2 min readCurated summary

Workflow Lab: Expanding the Canvas with Figma MCP | Figma Blog

Figma’s workflow demonstrates how the Figma MCP server can reconnect design and implementation as features evolve. By reading coded states and generating editable frames on the canvas, an agent exposes product behavior that was invisible in the original design. This lets designers improve real edge cases and compare the shipped experience with design intent earlier. ## The problem: Code creates new product states - Astra, a fictional AI video platform, ships features rapidly with agentic coding tools. - An initial export flow covered sequence selection, format choice, settings confirmation, and export. - As development progressed, additional states appeared: - Encoding errors - Rendering and loading progress - Empty selections - Unsupported formats - These states were not necessarily design oversights; they emerged from real code and data. - When the canvas represents only the initial flow, designers cannot fully address the experience users will encounter. ## Expanding the canvas with Figma MCP - The Figma MCP server allows an agent to read implementation details and write results to the Figma canvas. - Using `use_figma`, the agent identifies coded states and creates editable frames using the team’s design-system components. - Astra’s canvas expands from four original frames to fourteen frames representing the broader product reality. - This replaces a slower task-and-ticket feedback loop with a direct conversation between design, code, and the agent. ## Designing better edge cases - The designer can immediately work on states that previously remained hidden: - Adds recovery guidance to the encoding error state. - Enhances the render loading state with progress information and an estimated completion time. - Adds copy and personality to the empty-selection state to encourage feature adoption. - Designers spend less time discovering missing requirements and more time shaping actual product behavior. - The canvas becomes a shared workspace for reviewing the full experience, not merely documenting the initial concept. ## Comparing design and implementation - The workflow also places the coded version beside the original Figma design for visual comparison. - A findings panel surfaces discrepancies by severity. - Example differences include: - A larger modal title - An additional “Post share link” button - A removed settings-panel surface - A demoted settings header The practical recommendation is to use Figma MCP as an ongoing design-code feedback loop: bring real implementation states onto the canvas, refine them with design expertise, and use visual comparisons to catch drift before it becomes part of the shipped product.

Read original(opens in new tab)
Claude CodeDesign SystemsAI AgentsDesign To Code+1
spotify3 min readCurated summary

Building a Natural Language Interface to the Spotify Ads API with Claude Code Plugins | Spotify Engineering

The post describes an open-source Claude Code plugin that lets users manage Spotify advertising campaigns through natural-language requests. It translates high-level intent into validated, multi-step Spotify Ads API calls, handling targeting lookups, budget conversions, entity dependencies, and missing information. The authors favor a Markdown- and CLI-based design over MCP because it keeps the system transparent, lightweight, customizable, and grounded in Spotify’s OpenAPI specification. ## Natural-Language Campaign Creation - Users can request campaigns conversationally, such as creating an audio campaign targeting a specific age range and location with a daily budget. - The agent orchestrates the campaign lifecycle: - Creates the campaign. - Creates an ad set with targeting and budget. - Creates the ad and attaches creative assets. - It handles implementation details automatically: - Looks up geographic targeting IDs. - Converts dollar amounts into API micro-units. - Validates audience size. - Passes entity IDs between dependent API calls. - Prompts for missing required information. ## Claude Code Plugin Architecture - **Skills** provide slash commands, with each command defined in Markdown alongside its endpoints, request formats, and output behavior. - **Agents** interpret freeform requests and decompose them into the necessary API operations. - **Hooks** intercept tool calls to refresh OAuth tokens and inject HTTP headers. - **Settings** store local user configuration, including credentials, ad accounts, and environment preferences. - Because all components are human-readable Markdown, the plugin has no compilation, bundling, or package-management step. - API behavior can often be corrected by updating documentation or instructions rather than changing compiled code. ## CLI and OpenAPI Instead of MCP - The authors avoided MCP because the Spotify Ads API has more than 30 resource types and complex nested schemas. - Defining every endpoint as an MCP tool would create a large static registry and consume context even when most tools were irrelevant. - The plugin loads only the API documentation needed for a particular task. - API calls are issued as visible `curl` commands, allowing users to inspect, copy, modify, and reproduce them. - Spotify’s roughly 8,600-line OpenAPI v3 specification serves as the single source of truth. - Updating one bundled specification file is simpler than maintaining a separate translation into MCP schemas. ## Domain-Specific Agent Behavior - The request-builder agent is defined in `agents/spotify-ads-request-builder.md`. - It teaches the model Spotify-specific conversions, including: - Dollar values to micro-amounts. - Natural-language dates to ISO 8601. - Platform names to API enum values. - It performs multi-step orchestration for campaign, ad set, and ad creation. - It resolves locations such as “Connecticut” through geo-targeting search endpoints and builds the required `geo_targets` structure. - It performs pre-flight audience estimates to ensure targeting meets minimum size requirements. - It is designed to control execution carefully and validate requests before making changes that could affect advertising budgets. ## Practical Implication The plugin demonstrates that a large advertising API can be made approachable without hiding its mechanics. A Markdown-based Claude Code integration, backed by the official OpenAPI specification and transparent CLI requests, offers a practical balance between natural-language convenience, developer control, auditability, and maintainability.

Read original(opens in new tab)
Claude CodeDatabase DesignPythonNatural Language Processing+4
line3 min readCurated summary

ODW #3: Boosting Development Efficiency by Safely Utilizing MCP Servers

LY Corporation is expanding AI use across its engineering organization through MCP servers, which connect AI assistants with internal and external tools through a common protocol. The company combines this flexibility with allowlists, automated security checks, and internal standards to reduce risk. Its Orchestration Development Workshop demonstrates practical applications such as Jira ticket automation and multi-agent code reviews, while emphasizing shared learning and experimentation as AI practices evolve. ## MCP Servers and Their Benefits - MCP servers act as translators between AI assistants and external systems. - Before MCP, each assistant required a separate integration for every tool. - With MCP, a tool can implement one standardized interface and work with multiple compatible assistants. - This improves interoperability, scalability, and the ability to combine different AI tools. ## Security Risks and LY Corporation’s Controls - A 2025 Astrix Security report found that: - More than 5,200 public MCP servers were analyzed. - 53% relied on long-lived static API keys or personal access tokens. - Only 8.5% used newer authentication methods such as OAuth. - LY Corporation manages externally developed MCP servers through: - An allowlist permitting only approved servers. - Automated security verification based on internal standards. - Internal MCP servers for groupware and business systems are built to meet the company’s security requirements. - Centralized infrastructure lets teams focus on applying AI rather than independently rebuilding integrations and controls. ## Workshop Applications The Orchestration Development Workshop taught participants how to understand, configure, and safely apply MCP servers with AI assistants. - Topics included MCP fundamentals, security risks, internal policies, development rules, and configuration in Claude and Cline. - The internal plugin marketplace was introduced as a way to distribute MCP configurations. - Participants practiced using Claude Code with the internal groupware MCP server to: - Generate a Jira ticket title and summary. - Create the ticket automatically. - The exercise showed how AI can remove repetitive administrative work and free time for higher-value tasks. ## Multi-Agent Code Review Demonstration - A demonstration combined Claude Code, Codex CLI, Context7 MCP, and Codex MCP. - A Sonnet-based agent first analyzed a pull request, including: - Technical stack and relevant documentation. - Code changes and repository context. - Security, performance, and code-quality concerns. - GPT-5 then validated the initial review, identifying missed issues and checking the prioritization of findings. - Using different models provided more varied and potentially objective perspectives on the same code. ## Results and Organizational Learning - Around 1,600 people attended the workshop in real time. - 31.5% had already applied related techniques before the event. - Another 55.7% planned to try them soon. - LY also created “Help LY MCP,” a GPTs-based tool that explains internal MCP rules and helps teams assess whether proposed uses are suitable, including for global subsidiaries. - The workshop’s broader purpose was to create a shared understanding of: - What AI and MCP can currently do. - What risks and pitfalls exist. - How to use the technology meaningfully. ## Continuing to Experiment The article concludes that rapidly changing AI technology makes shared experimentation more valuable than simply announcing new tools. MCP may eventually be surpassed by other approaches, such as skills, so teams should continually reassess the best solution. LY recommends creating a culture where employees can safely try small ideas, learn together, and adapt as new practices emerge.

Read original(opens in new tab)
Claude CodeDatabase DesignGithubGit+4