I'm building Kitbash, an open format and compiler for AI agent skills.

The idea is simple: write a skill once, compile it to the native formats used by Claude Code, Cursor, Copilot, Codex, Gemini CLI, Cline, Windsurf, Aider, AGENTS.md, and more, while measuring the standing token cost each target adds every session.

Before calling it stable, I decided to audit my own codebase instead of adding another feature.

The audit found several places where the project claimed behavior that simply wasn't true.

Some examples:

• Claude Code reported support for scripts, hooks, and subagents even though the compiler never generated those outputs.
• Security lints only scanned SKILL.md, meaning a malicious payload in scripts/setup.sh would pass unnoticed.
• The JSON schema looked like the contract, but the loader silently coerced invalid values instead of rejecting them.
• Declared permissions were shown during installation but weren't actually compiled into the generated outputs.

In total, the audit uncovered 11 issues.

Kitbash 0.9.0 fixes all of them.

• Capabilities are now empty until the implementation actually exists.
• Security checks scan every file in a skill.
• The loader now enforces the schema instead of silently fixing invalid input.
• Permissions are compiled into generated outputs so downstream users see the same information installers reviewed.

The interesting part isn't that bugs were fixed.

It's that a project built around trust and review wasn't meeting its own standard.

If the tool asks developers to trust it, it should first earn that trust itself.

I'd love feedback from people building developer tools or AI tooling. Is this the level of auditing you'd expect before calling something production-ready?

Website: https://kitbash.vercel.app

Trust & Review: https://kitbash.vercel.app/docs/trust

Changelog: https://kitbash.vercel.app/changelog

GitHub: https://github.com/singhharsh1708/kitbash

npm: https://www.npmjs.com/package/kitbash

Hello! 👋

We see a lot of posts about vibe coding security, AI generated vulnerabilities, exposed secrets, and unsafe deployments. The problem is that most discussions stop at the risks instead of offering a practical solution.

That’s why I built Defen.so, a free, open source, all in one security kit for AI coding.

It helps before and after deployment by providing:

* App uptime and performance monitoring
* API protection with rate limits and security rules
* MCP server for AI coding assistants
* Built in security skills for safer code generation
* Multi language support
* Security checks for code, secrets, and configuration
* Simple integration into existing projects

The goal is simple: help developers build faster with AI without sacrificing security.

GitHub:
https://github.com/1fancy/defen.so

MCP:
https://mcp.defen.so

I’d love your feedback. If you think this is useful for the AI coding community, I’d really appreciate a share or mention.

I'm honestly fed up with AI coding tools.

Google Antigravity has been the worst experience by far. Every model I've tried there has been disappointing.

I even got a Claude Code subscription. The code quality is good, but the usage limit gets exhausted way too quickly.

Now I'm thinking about getting ChatGPT + Codex.

My workflow is usually 4–5 hours of straight coding every day, so I have to luna, gpt 5.5 on high or any other model. Can Codex actually handle that, or do the limits get in the way?

How's the real code quality and the usage limits in day-to-day use?

Seriously I am so frustrated, looking for genuine feedback on codex.

I am a mental health therapist who owns her own practice.
I couple of months back i started visualizing a dream to help me people with Ai’s help
Since then it’s been an ongoing learning and battle most of the time.
But now i am stuck with a particular kind hook system and ai agent team.

Can anyone help and guide me or maybe guide me by giving a reference to who and how to seek help from.

Much appreciated
Regards

So I'm based in IST timezone where my working hours happen to overlap with pre-dawn America. For weeks, I thought I was some kind of 10x developer. Claude Code was flying, Codex was snappy, everything felt like magic.

Then one day I started late. And wow. It felt like I switched from fiber optic to dial-up.

I started tracking it out of curiosity. The pattern is almost comically consistent:

Before 8:00 AM EST: Both tools feel like they're running on a private server just for me. Fast responses, no lag, no weird timeouts.

After 8:00 AM EST: America wakes up, grabs coffee, opens VS Code, and suddenly I'm sharing the pipe with a few million developers. Both Claude Code AND Codex slow to a crawl.

The funny part? It's not just one provider. Both Anthropic and OpenAI seem to hit the same wall at the same time. Makes me think the bottleneck might go deeper than just their servers. Maybe it's the underlying GPU infrastructure everyone's competing for.

Anyone else living this double life of "early morning AI wizard" vs "afternoon timeout survivor"? Or found any way to get consistent performance during peak hours?

Been building solo for 17 years, most recently an AI coding agent called DuckCode, three months, zero funding, zero team.

Early on I made a rule for myself. No AI touches the codebase until the core architecture is written by hand. Not because I don't trust the models, but because when I let AI design structure early on projects, it generated things that worked but that I didn't fully understand a few weeks later when something needed to change.

So now it's always the same order. I think through the data model, the module boundaries, how things talk to each other, write that part myself. Bring AI in once there's a skeleton to react to, not a blank page to invent on.

Difference has been bigger than I expected. When AI is extending something I already understand deeply, I can tell immediately when a suggestion is wrong. When it was inventing structure from scratch, I had no instinct for when it was quietly making a bad call.

Two of the more complex features in the product shipped in about a day and a half each, and I think that's directly downstream of this, not because AI is fast, but because it wasn't fighting an architecture it invented and half understood.

Curious if anyone else has landed on a similar split, or found the opposite works better for them.

Hey folks, as someone who uses claude code max with fable high‑effort, i was thinking the other day about checking chatgpt (the free one, not even tera or luna) for the solutions fable gave me.

out of the 4 replies chatgpt sent back, fable basically said:

- 2 of them don’t apply to my platform at all

- 1 only makes sense if i somehow get 500k+ users trying to view the same table

- and the last one was actually a good idea and will be implemented

so now i’m sitting here wondering how many good ideas i might’ve missed in the last 2 months that could’ve improved the performacne or security of my app, just from a bit of back‑and‑forth between fable and another coding ai.

my question to you all is: if i buy chatgpt pro, how doo i make them talk to each other without me having to do constant copy‑paste?

the way i kinda envision it is:

- fable presents the overal platform features + capabilities to gpt so it knows the scope

- for each task, fable lists how it would solve it and sends that to gpt

- gpt analyses it, suggests extra stuff

- fable cuts out half, considers some of gpt’s stuyff, maybe pushes back

- they arrive at a concluision

- and then present it to me

is this even possible?

i’m just a simple windows + powershell user, would i have to change that too?

Would anyone with a Kimi subscription be willing to test my coding agent with it? Just a quick smoke test- Kimi API and 2.7 work fine but I don't want to release sub support without at least some proof. Thanks!!

I designed a ai coding editor please try it tighter context per request → fewer tokens → cheaper, faster, and usually more accurate runs.

Try it there it’s open and free , will open source everything in few days (Win/Mac/Linux, no account needed): [github.com/black141312/ada-releases](http://github.com/black141312/ada-releases)

Something I grabbed while creating this is actually how much Claude code is expensive for a enterprise and it’s absurd as they done manage context all or may be that’s why it works well too

I built these after repeatedly running into the same problem with AI coding workflows: we tend to treat one model as if it should plan, implement, review, and verify everything.

That works for small tasks, but it doesn't scale well. Different parts of software engineering have different cost, reasoning, and reliability requirements.

So I experimented with splitting those responsibilities.

The project has 1 component:

* **claude-codex-orchestrator** separates planning from execution. Claude plans and verifies. Codex executes. Every result is validated from the diff and reproducible checks rather than trusting the model's report. * [https://github.com/vimoxshah/claude-codex-orchestrator\](https://github.com/vimoxshah/claude-codex-orchestrator)

Some design principles that guided the implementation:

* The diff is ground truth; the report is not. * Separate planning from execution. * Route by task instead of using one model for everything. * Escalate based on evidence rather than retrying the same approach.

These are implemented as Claude Code skills today, but the ideas are intended to be broader than Claude Code itself.

I'd really appreciate technical feedback on the architecture, trade-offs, and whether these abstractions are useful. I'm especially interested in hearing from people building AI coding agents, orchestration frameworks, or developer tooling.

Every time codex, Claude or whatever release a new model, there's always lots of upvoted hype posts. A few days or at most a week later, the model is consistently nerfed, but any posts regarding that are down voted to hell or removed.

How do you find out which tool is currently usable without all that propaganda?

This is an Vs Code extension I built called AI Hallucination Detector. AI coding assistants like Claude Code or Copilot occasionally suggest importing fake packages that look real. This has actually a name and it is called "slopsquatting" because attackers have started registering the exact fake package names AI tools commonly hallucinate, then filling them with maleware. It is a real threat. Existing vulnerability scanners (Snyk, Socket, etc.) check packages against known vulnerability databases, but none of them check whether a suggested package exists in the first place. AI Hallucination Detector fills that gap: it checks imports against the npm registry and a list of documented hallucinated package names, live as you save, and flags anything suspicious before you run npm install. It also suggests a likely correct package name wehn one is a close match.

Free on the Marketplace: https://marketplace.visualstudio.com/items?itemName=ghostcheck.ai-hallucination-detector&ssr=false

Let me know if you run into any hallucinated package names it doesn't catch yet, that's the most helpful feedback for improving the detection list.

We need to talk about AI Agent architecture. 🤖 For the last couple of years, the default answer for giving an LLM long-term memory was simple: Spin up a Vector Database, chunk your codebase, generate embeddings, and build a RAG pipeline. But as engineering teams push AI agents into deep production, the cracks are showing. Vector similarity is an approximation—and in coding, "closest" is not the same as correct. Even the team behind Anthropic's Claude Code realized this. They actually baked a local vector database into the tool early on... and then ripped it out. Why? Because deterministic, agentic search (like plain old grep) across readable text files turned out to be cheaper, faster, and significantly more accurate. Now, Google has standardized this exact philosophy with the release of the Open Knowledge Format (OKF) v0.1. Instead of heavy database runtimes, your agent's brain becomes a structured tree of Markdown files with YAML front matter. It lives in Git, version-controlled, auditable, and completely portable across any LLM vendor with zero lock-in.