Architecting a Code Security Auditor Agent
Design the agent and its loop on the Claude Agent SDK, and meet the deliberately-vulnerable demo target we’ll audit across the series.
Read article →
← Back to home
Blog
Writing
Two deep technical series, one on agentic engineering and one on digital trust, alongside field notes, opinion, and how-tos.
Building a Code Security Auditor with Claude · 6-part build-along
Giving the Agent Eyes: Custom Tools and MCP
Equip the auditor with custom scanning tools via the @tool decorator and an in-process MCP server. The model orchestrates; the tools do the precise work.
Read article →Low-False-Positive Findings: Structured Output & Adversarial Verification
Force findings into a strict schema, then run a skeptical verification pass so confident-but-wrong findings get filtered out.
Read article →Prioritisation and Multi-File Reasoning
Turn a flat list of verified findings into a triaged report: severity scoring, deduplication, and connecting a secret to where it’s used.
Read article →Running the Auditor in CI: Headless, Gated, Cost-Controlled
Run the agent unattended on every pull request, covering headless execution, pre-declared permissions, exit-code gating, and cost control.
Read article →Hardening the Auditor: Prompt Injection, Sandboxing & Evals
Defend the agent against injection from the code it reads, sandbox its blast radius, and measure precision and recall against ground truth.
Read article →Engineering with Claude Code · 7-part series
Beyond Autocomplete: What Agentic Coding Changes
Inline completion and an autonomous agent are different tools. The agent loop, what it’s good and bad at, and the new skills it demands.
Read article →Context Is the Product: CLAUDE.md and Steering the Agent
Output quality is bounded by context quality. Using CLAUDE.md and disciplined context engineering to make the agent reliable.
Read article →Trust, Permissions, and Safe Autonomy
An agent that edits files and runs commands needs real guardrails. Least privilege, permission modes, and trust boundaries for a non-deterministic actor.
Read article →Extending the Agent: MCP, Custom Tools, and Your Stack
The Model Context Protocol lets the agent reach your real systems. Local vs remote servers, custom tools, and doing it safely.
Read article →Automating Your Workflow: Skills, Slash Commands, and Hooks
Three automation layers, and the difference between guidance the model may follow and hooks the harness enforces.
Read article →Orchestration: Subagents, Parallel Work, and When to Fan Out
Multiple agents cover more ground, but coordination has a cost. When to fan out in parallel, and when one focused agent wins.
Read article →From Tool to Teammate: Headless Mode, CI, and the Agent SDK
Agentic coding as infrastructure: headless runs in CI, automated reviews, and building custom agents on the SDK, with guardrails.
Read article →Architecting Digital Trust · 7-part series
Anatomy of a Modern PKI
What PKI actually delivers, how an X.509 certificate is built, and how chains of trust are assembled and validated, and where they bite you in production.
Read article →The Certificate Lifecycle: Issuance, Renewal, and Revocation
A certificate is a state machine. Walking enrolment, validation, issuance, renewal, and revocation, and why most PKI pain is lifecycle pain.
Read article →Automating Certificates at Scale with ACME
Why manual certificate management collapses at scale, ACME (RFC 8555) in depth, and how to architect an automation platform that fails safely.
Read article →Designing for Crypto-Agility
Crypto-agility is a design property, not a migration. The post-quantum transition, harvest-now-decrypt-later, and building for the algorithm change after this one.
Read article →Machine & IoT Identity
Machines outnumber humans by orders of magnitude. Bootstrapping, hardware roots of trust, birth vs operational certificates, SPIFFE/SPIRE, and constrained IoT.
Read article →Operating Trust at Enterprise Scale
Running a PKI as a decade-long discipline: governance, key ceremonies, audit, observability, and a rehearsed answer for the day a trusted key isn’t trustworthy.
Read article →Signing Reality: C2PA and Content Provenance
Content provenance is a PKI signing problem in disguise. How C2PA signs media with COSE and X.509, its claim-signing certificate profile, and where it breaks.
Read article →More writing · field notes, opinion & how-tos
Adding BDD Acceptance Tests to FastAPI with behave
Layer behave BDD acceptance tests onto the Full-Stack FastAPI template: readable Gherkin specs for auth, item ownership, and password recovery, run against the real API alongside pytest and Playwright.
Read article →Rebuilding My Site with an AI Agent: A Field Report
An honest account of rebuilding this site with an agentic tool: what worked, what needed human judgement, and the authenticity line I wouldn’t cross.
Read article →Will Agentic Coding Replace Engineers? A Pragmatic Take
The honest answer to the question everyone’s asking: what changes value in engineering work, and what doesn’t.
Read article →Your First MCP Server in 20 Minutes
A hands-on walkthrough: build a minimal MCP server, expose a custom tool to your agent, connect it, and apply the security basics.
Read article →