Project TBD Memory Vault

ai-agentic-prototyping-tooling-2026-06-25

29 min read

AI-Enabled Agentic Software Prototyping — Tooling & Best Practices for 2026

Scope note (read first). This brief is a departure from normal /research. The usual workflow anchors a brief to a customer/expert interview and cross-checks external evidence against what we’ve heard. This topic — agentic dev tooling — has no anchor interview and no internal market sources; the vault’s memory/prototyping/ is all product architecture (ontology, simulation), not dev tooling. So this brief is anchored instead to our actual current stack: the 8 Claude Code skills in .claude/skills/, the MCP memory server, the Telegram bot, vault publishing (Quartz → Cloudflare), the lab/ GPU+Grafana work, and the open-design plugin noted in memory. Confidence labels are therefore almost entirely [Public] and [Synthesis] — by the nature of the topic, not by shortcut. Per RDI, this surfaces evidence and a recommended shape; the human draws the conclusions.

Outline changes (per RDI “revisions are signal”). The approved 7-section outline was kept intact. The only deviation: the anchor-interview slot was dropped (none exists for this topic — see scope note), and the brief is anchored to our current stack instead. No sections were added, split, or dropped during execution. One memory-accuracy flag surfaced and is logged at the end (reference_open_design_plugin.md’s “~139 skills” figure is unconfirmed).

Steers applied: balanced depth on both buckets (import into Claude Code vs. layer alongside) · opinionated recommendation in §7 · OSS-first, commercial flagged where it clearly leads.

BLUF. For a 2-person, AWS-based, Claude-Code-native team, “accelerating prototyping in 2026” is overwhelmingly an import problem, not a build problem: the highest-leverage moves are (1) spec-driven planning (Spec-Kit + Plan Mode), (2) git-worktree agent fan-out (Claude Squad / Vibe Kanban), (3) MCP servers wired to each lifecycle stage (shadcn, Playwright, awslabs/mcp), and (4) a deterministic verification + security gate the agent cannot bypass (Opengrep/OSV/Checkov in CI, OIDC-scoped AWS). The single biggest 2026 shift versus 2025 is that the toolchain itself is now an attack surface — malicious skills/MCP servers, slopsquatted dependencies, and a March-2026 Trivy compromise mean security hygiene of the tools is now load-bearing, not optional.

1. The 2026 agentic-dev baseline

The patterns that consolidated. By mid-2026 the agentic-dev loop has settled into a recognizable shape, and most of it is now table stakes rather than differentiation. Spec-driven development (SDD) is the headline consolidation: versioned, structured specs — not code — are treated as the source of truth, with code generated and re-generated against them. GitHub’s open-source spec-kit is the reference implementation (90k+ stars, MIT, works across 30+ agents via a CLI that scaffolds spec → plan → tasks templates), and the pattern has been independently shipped by AWS Kiro, Claude Code, Cursor, OpenSpec, BMAD, and Google Antigravity — i.e., every major tool now has an SDD flavor, with early adopters reporting ~3–10× higher first-pass success on non-trivial tasks [Public: github.com/github/spec-kit; github.blog spec-kit post]. The 3–10× figure is vendor/early-adopter self-report, not an independent benchmark [Synthesis]. Alongside SDD, the durable patterns are: explicit plan→execute loops (plan mode as a gate before any non-trivial edit), subagent fan-out/orchestration (specialized read-scoped agents running in parallel, results merged by a coordinator), MCP as the universal integration layer (§2), eval/verification loops (lint/test/LLM-judge gates wired in deterministically rather than trusted to the model), and git-worktree isolation for parallel agents. Worktree isolation is now a documented, first-class Claude Code feature: each code-writing subagent can carry isolation: worktree in frontmatter so parallel edits never touch the same files; the practical ceiling teams report is 4–8 concurrent worktrees per developer before review (not the agent) becomes the bottleneck, and worktrees defer merge conflicts into reviewable git conflicts rather than eliminating them [Public: code.claude.com/docs/en/worktrees; mindstudio.ai worktrees playbook].

Where Claude Code sits. The 2026 field splits into four shapes: IDE extensions (GitHub Copilot, Cline, Continue), AI-native IDEs (Cursor, Windsurf, Zed), CLI/terminal agents (Claude Code, OpenAI Codex CLI, Aider, OpenCode, Gemini CLI), and cloud/async platforms (Devin, OpenHands, Jules, Manus) [Public: opensourcealternatives.to; frontman.sh]. On the public Terminal-Bench 2.1 leaderboard, Codex CLI (GPT-5.5) leads at ~83.4% with Claude Code (Opus 4.8) second at ~78.9%; the recurring qualitative verdict is that Claude Code wins on output quality and whole-codebase reasoning (1M-token context) while Codex wins on distribution/bundling and async cloud sandboxes, and Copilot wins on breadth of IDE/host coverage and GitHub-platform wiring [Public: artificialanalysis.ai/agents/coding; builtin.com comparison]. Benchmark deltas this close are noisy and shift release-to-release; treat the ranking as “roughly co-equal frontier, different strengths” [Speculation]. The most-cited practitioner pattern is hybrid — an IDE agent (Cursor/Copilot) for daily inline editing plus Claude Code for deep agentic refactoring/multi-part tasks [Public: builtin.com; cosmicjs.com].

What “layering on top of Claude Code” realistically means. For a 2-person team already standardized on Claude Code, “layering” almost never means replacing the harness. It means two concrete things [Synthesis]: (1) importing capabilities INTO Claude Code — skills, subagents, hooks, slash-command packs, and MCP servers that ride inside the existing harness (§2); and (2) running a second harness alongside for the jobs Claude Code does less well — e.g., Codex CLI or OpenHands for fire-and-forget async/cloud-sandboxed tasks. The OSS ecosystem has made the alongside option cheap because the artifact formats now interoperate: the SKILL.md format became an open standard (agentskills.io, December 2025), adopted by Claude Code, Codex, Cursor, Copilot, Gemini CLI, Goose, OpenCode and ~40 clients, so a skill library written once is consumed by multiple harnesses [Public: github.com/anthropics/skills; paperclipped.de open-standard guide; github.com/wshobson/agents].

Build-vs-buy-vs-import frame for a tiny team. The 2026 ecosystem strongly favors import over build [Synthesis]. Import (default) when a community skill/plugin/MCP server already exists — the marginal cost is one /plugin install and the maintenance is someone else’s; this covers the majority of prototyping needs given 400+ community plugins and thousands of skills. Buy (commercial SaaS) only where a hosted service clearly leads and self-hosting is a distraction — e.g., vendor-operated remote MCP servers for Sentry/Linear/Stripe where the value is the live backend. Build only for the genuinely proprietary sliver: domain skills (TBD’s vault conventions — exactly the kind of project skill already in .claude/skills/), CLAUDE.md conventions, and hooks that enforce our specific workflow. The cost asymmetry is the whole argument — importing a plugin is minutes and reversible; maintaining a bespoke agent framework is a standing tax a 2-person team can’t carry [Synthesis].

Sources

2. Extending Claude Code directly

The plugin / skill / MCP ecosystem. Claude Code plugins launched in public beta in October 2025 and are now stable; a plugin bundles the lower-level primitives (skills, subagents, slash commands, hooks, MCP server config, docs) into one installable, version-pinned, auto-updating unit, with source backends spanning GitHub, npm, GitLab, and local paths [Public: code.claude.com/docs/en/plugins]. The two Anthropic-maintained marketplaces are anthropics/claude-plugins-official (curated, ~55+ plugins; browsable marketplace.json) and claude-community (public submissions after review); partner plugins come from GitHub, Playwright, Supabase, Figma, Vercel, Linear, Sentry, Stripe, Firebase [Public: github.com/anthropics/claude-plugins-official; claude.com/plugins] (Import into Claude Code). Anthropic’s own skills repo, anthropics/skills (created Sept 22, 2025), is the canonical open reference — demonstration skills spanning creative, technical (MCP-server generation, web-app testing), and enterprise workflows; note the four document-skills (PDF/docx/xlsx/pptx) are source-available, not OSI open-source [Public: github.com/anthropics/skills] (Import into Claude Code).

Notable open-source collections worth importing or mining [Public, all GitHub] (Import into Claude Code): hesreallyhim/awesome-claude-code (the canonical curated list); ComposioHQ/awesome-claude-skills and travisvn/awesome-claude-skills; wshobson/agents (~36.6k stars; ~79 plugins / 184 subagents / 150 skills, granular install to minimize token use, and a three-layer plugin-eval quality framework — static analysis + LLM-judge + Monte-Carlo reliability; the de facto reference for plugin-based agent architecture); rohitg00/awesome-claude-code-toolkit. Larger aggregators (jeremylongshore/claude-code-plugins-plus-skills, sickn33/antigravity-awesome-skills) self-report 400–2,800 artifacts but quality is uneven — treat them as mining grounds, not blanket installs [Synthesis].

Claude Code primitives — what each is FOR in a prototyping loop [Public: claude.com/blog steering-claude-code] (all Import into Claude Code):

  • CLAUDE.md — the repo’s “constitution,” loaded at session start; where prototyping conventions, stack choices, and run/test commands live (TBD already uses this heavily).
  • Plan mode — the gate before any non-trivial edit; write tools are blocked at the system level until you approve. The cheapest spec-planning win for a non-technical co-founder to review intent before code.
  • Subagents — specialized Claude instances, each with its own context window, scoped tools, and permissions; the recommended safety pattern is read-only subagents that fan out research while Edit/Write/Bash stays on the parent.
  • Hooks — fire deterministically on events (PreToolUse, PostToolUse, PreCompact); use to wire the verification loop (run linters/tests after edits, block dangerous commands, post to Telegram on completion) so evals aren’t left to the model’s discretion.
  • Output styles — files in .claude/output-styles/ injected into the system prompt; never compacted, highest instruction weight, moderate context cost — use sparingly for rules that must never drift.
  • Slash-command / skill packs — repeatable task playbooks (SKILL.md folders, ~100 tokens to advertise, loaded only on relevance via progressive disclosure) — the right granularity for “prototype-a-new-X” workflows.

MCP servers mapped to lifecycle stages. The official reference repo is modelcontextprotocol/servers — educational reference implementations (Filesystem, Git, Fetch, Memory, Sequential Thinking) [Public: github.com/modelcontextprotocol/servers]. The official MCP Registry launched in preview Sept 8, 2025 and is still pre-GA with explicit no-durability warnings — don’t treat registry entries as stable contracts yet [Public: blog.modelcontextprotocol.io 2025-09-08]. The protocol’s 2026-07-28 RC adds a stateless HTTP core, MCP Apps (server-rendered UIs), and a Tasks extension for long-running work [Public: blog.modelcontextprotocol.io 2026-07-28]. Mapping to lifecycle [Synthesis; servers Public] (all Import into Claude Code unless noted):

  • Filesystem & version control: official filesystem and git reference servers; vendor GitHub MCP server for PRs/issues/Actions.
  • Browser automation (verify/test): microsoft/playwright-mcp is the dominant choice (~34k stars) — drives Chromium/Firefox/WebKit via the accessibility tree (structured, token-efficient, no vision model). The workhorse for the web-prototype verification loop.
  • Database: AWS Labs Aurora/DynamoDB MCP servers and community Postgres MCP servers (Docker-packaged).
  • Cloud (AWS): the awslabs/mcp suite — relevant since TBD already runs on AWS/SSM (see §5).
  • Observability: getsentry/sentry-mcp is the reference connector; the Cloudflare-hosted remote-MCP pattern (Sentry/Stripe/Linear/Asana) is the de facto shape for vendor-operated servers — hosted commercial backends fronted by an OSS-spec connector (Buy/hosted — commercial).

Sources

3. UI/UX design & architecture planning

For a code-first team, the landscape splits cleanly: a handful of MCP servers/registries that import into Claude Code (design work happens where the code already lives) versus full hosted app-builders you layer alongside (great first drafts, weak at staying in sync with a Claude-Code-driven repo). The OSS-first tools are disproportionately the import-into-CC ones [Synthesis].

Part A — Design & design-to-code

Import into Claude Code (the durable layer):

  • shadcn/ui + its MCP server (OSS, free) — CLI 3.0 rebuilt the MCP server (Aug 2025); works with any shadcn-compatible registry via namespaced @registry/name installs. The agent can search, resolve dependency trees, and install components as real source you own, not a hosted artifact. Highest-leverage primitive for a Claude-Code workflow [Public: ui.shadcn.com/docs/registry/mcp].
  • open-design / nexu-io/open-design (OSS, Apache-2.0) — verified real. The plugin from our memory note: a stdio MCP server installed per-agent (od mcp install claude) backed by a local od daemon on 127.0.0.1, exposing read-only tools (search-files, get-file, skill list) over local design projects. Genuinely Claude-Code-native and self-hostable — worth a trial as an OSS design-system layer. Caveat: the “~139 skills” figure in our memory note is unconfirmed — README says 100+ skills / 142–150 design systems, a snippet says 259+, and v0.11.0 (“The Bazaar,” June 17 2026) emphasizes decks/slide-kits + multi-agent support. Count moves per release [Public: github.com/nexu-io/open-design].
  • Figma Dev Mode MCP server (Figma is commercial; MCP free with a seat) — Figma shipped bidirectional Claude Code integration Feb 2026: design-to-code and code-to-canvas (push a live web UI back into editable Figma layers). Wire this up only if a Figma source-of-truth exists [Public: figma.com/blog/introducing-claude-code-to-figma].
  • screenshot-to-code (OSS, abi/screenshot-to-code) — drop a screenshot/recording → HTML/Tailwind/React/Vue; runs locally with your own Anthropic key; supports Claude Opus 4.5 / Gemini 3 [Public: github.com/abi/screenshot-to-code].
  • 21st.dev Magic MCP (freemium/commercial) — “v0 inside your editor”; useful for component drafts, but maintenance looked stale in early 2026 (npm packages ~11 months old) — not a system-of-record [Public: github.com/21st-dev/magic-mcp].

Layer alongside (hosted builders — fast drafts, weak repo-sync):

  • bolt.diy (OSS, MIT) — the official open-source version of bolt.new; bring-your-own-LLM across 19 providers (incl. Anthropic, Bedrock, Ollama). The OSS-first pick for browser-based full-stack prototyping with your own Claude key [Public: github.com/stackblitz-labs/bolt.diy].
  • Onlook (OSS) — strongest OSS “Figma for code”: a WYSIWYG AI layer that edits live React components (real code, not a separate design file) on an infinite canvas; self-hostable [Public: github.com/onlook-dev/onlook].
  • Lovable / v0 / Builder Fusion (all commercial) — excellent for a first clickable draft (Lovable hit ~$100M ARR / $6.6B valuation Dec 2025; v0 now generates shadcn+Tailwind and exposes custom-MCP support), but each owns its stack — value to a code-first team is as generators you import from, not homes you live in [Public: lovable.dev; vercel.com/blog/introducing-the-new-v0].
  • tldraw “Make Real” (OSS SDK) — origin of the sketch-to-real genre; a rapid-ideation toy + embeddable infinite-canvas SDK [Public: tldraw.dev].

Demo-ware vs. durable, for this workflow: tools that survive contact with a Claude-Code repo are those that emit code you own or expose an MCP the agent drives — shadcn MCP, Figma Dev Mode MCP, open-design, Onlook, bolt.diy, screenshot-to-code. The hosted app-builders are generators to pull from [Synthesis].

Part B — Architecture & spec planning

  • GitHub Spec-Kit (OSS, 80k+ stars, 24+ agents incl. Claude Code) — the OSS-first default (Import into Claude Code). “Constitution” → spec → plan → tasks; integrates via slash commands + a CLAUDE.md that encodes Spec-Kit vocabulary. A 2026 case study generated a working full-stack app (~195 tasks) in ~2 hours, with ~4 days of stabilization/review after — useful expectation-setting [Public: github.com/github/spec-kit; orangeloops.com case study].
  • Claude Code Plan Mode (built-in, free) — enforced read-only; the agent reads/greps/web-searches and proposes a full plan with write tools blocked until you approve. 2026 guidance is unanimous: for multi-file changes this is the single highest-leverage practice; it’s already installed (already in Claude Code) [Public: anyonebuilds.com plan-mode guide].
  • AWS Kiro (commercial) — spec-driven IDE (powered by Claude under the hood), but a separate IDE that competes with rather than imports into a Claude-Code workflow — evaluate only if switching primary IDE (Layer alongside) [Public: kiro.dev/pricing].
  • Tessl Spec Registry (commercial, open beta) — 10,000+ pre-built specs for OSS libraries/APIs so agents avoid API hallucinations/version drift; the differentiated piece worth watching [Public: tessl.io].
  • Diagrams/ADRs (Import into Claude Code) — Mermaid (OSS) is the LLM-native default (Claude generates correct Mermaid most reliably; renders in PRs); D2 (OSS) has nicer layouts but weaker LLM familiarity; Python diagrams (OSS) for cloud-infra diagrams with official provider icons. No dominant AI-native ADR tool emerged — keep ADRs as in-repo Markdown and have the agent emit ADR + Mermaid/D2 from the same spec [Public: infrasketch.net diagram-tools-2026; Synthesis].

Sources

4. Code generation, testing & automated review

Three layers a 2-person team can adopt incrementally: orchestration (run many Claude Code sessions in parallel), verification (agents self-check before a human looks), and review (a second model on every PR).

Part A — Multi-agent orchestration (git-worktree fan-out)

Every parallel runner does the same thing underneath: spawn N Claude Code instances, each in an isolated git worktree, edit the same repo concurrently, diff/merge the winners. For a 2-person team this turns “wait for the agent” into “fan out three approaches, keep the best” [Synthesis].

OSS, Import into Claude Code:

  • Claude Squad (smtg-ai/claude-squad, MIT) — terminal-native, tmux + worktrees; runs Claude Code, Codex, OpenCode, Amp side-by-side. Lightest self-hostable pick, no SaaS [Public: github.com/smtg-ai/claude-squad].
  • Vibe Kanban (BloopAI/vibe-kanban, OSS) — CLI + web Kanban over agent tasks; cards flow To-Do → In-Progress → Review → Done, each running a real agent in parallel with visual diff review. Best when you want lightweight PM semantics over a fleet [Public: github.com/BloopAI/vibe-kanban].
  • Crystal → Nimbalyst (stravu/crystal, MIT) — desktop app for parallel Claude Code + Codex worktree sessions. Deprecated/renamed to Nimbalyst in 2026 — verify current repo/license before adopting [Public: github.com/stravu/crystal].
  • claude-flow → Ruflo (ruvnet/ruflo) — heaviest: swarm meta-harness, ~87 MCP tools, queen/consensus coordination. Likely over-engineered for a 2-person shop; pin a version (renamed in 2026) [Public: github.com/ruvnet/ruflo].

Native Anthropic primitives (no third-party tool): subagents via the Task tool (parallel child sessions with isolated context) and first-party agent teams docs — the free way to get parallelism without a worktree runner [Public: code.claude.com/docs/en/agent-teams].

Commercial: Conductor (Melty Labs, macOS; $22M Series A 2026) leads on UX if you’ll pay and are Mac-based [Public: oreilly.com orchestration radar].

What orchestration actually rides on: headless mode (claude -p, non-TTY, reuses settings/hooks/permissions), the Claude Agent SDK (Python/TS, renamed from “Claude Code SDK” Sept 2025), and GitHub Actions (anthropics/claude-code-action@v1). Security caveat (verify before enabling): a June 2026 flaw let a single malicious issue hijack repos via the action, which Anthropic states is not hardened against prompt injection — restrict to trusted PRs, require approval for external contributors [Public: github.com/anthropics/claude-code-action; thehackernews.com 2026/06].

OSS autonomous agents to complement Claude Code (Layer alongside): OpenHands (formerly OpenDevin — most autonomous, sandboxed runtime, strongest headless story), Aider (Git-native pair-programmer), SWE-agent (research/benchmark fixes), Cline (~61k stars; IDE sidebar + CLI/SDK), Goose (Block; donated to the Agentic AI Foundation / Linux Foundation Dec 2025 — a durability signal) [Public: openhands.dev; pinggy.io OSS-CLI-agents survey].

Part B — Testing & verification (self-checking loops)

The pattern that matters: agents that verify their own output before a human looks.

  • Playwright Test Agents (Microsoft, OSS, first-party) — the clearest 2026 verification loop: a planner explores the running app and writes a Markdown test plan, a generator turns it into Playwright tests, a healer runs them headlessly and auto-repairs failures (Microsoft cites >75% on selector failures). Driven by the Playwright MCP server, callable from Claude Code directly. Guardrails to copy: persist auth via storageState, hard-cap max_tool_iterations/max_tokens, keep secrets out of the tool loop [Public: playwright.dev/docs/test-agents; testquality.com MCP-architecture-2026].
  • promptfoo (OSS, CLI/YAML) — the standard for evaluating LLM/agent output: assertion-based regression tests, side-by-side comparison, automated red-teaming; distinguishes agent-trajectory evals from input→output evals. Use to gate prompt/skill changes in CI. Alternatives: DeepEval, Giskard [Public: promptfoo.dev/docs/guides/evaluate-coding-agents].
  • Property-based testing via LLM — 2026 research (“Agentic Property-Based Testing”) shows LLM-driven PBT finding diverse bugs with few false alarms; practically, have Claude Code generate Hypothesis (Python) / fast-check (TS) property tests as part of its loop [Public: arxiv.org/pdf/2510.09907]. The durable principle: instruct agents to (1) generate tests, (2) run them headlessly, (3) feed failures back into the same session [Synthesis].

Part C — Automated code review (a second model on every PR)

Import into Claude Code, free with your subscription, OSS-published: /security-review + the anthropics/claude-code-security-review GitHub Action (diff-aware, language-agnostic, inline comments, false-positive filtering), and general @claude PR review via claude-code-action. A 2-person team gets competent AI review with zero new vendors [Public: github.com/anthropics/claude-code-security-review]. (TBD already has a local security-review skill and /code-review.)

OSS / self-hostable PR bots (Layer alongside): PR-Agent / Qodo Merge (Codium-ai/pr-agent, ~8.5k stars, self-hostable with your own Anthropic key) — the strongest fully-self-hosted pick for a privacy-sensitive repo; Sourcery (Python refactoring, partially free) [Public: dev.to Qodo-vs-CodeRabbit-2026].

Commercial bots that clearly lead (Layer alongside, GitHub-app installs): CodeRabbit (best all-around; ships a free CLI + self-hosted VS Code option — most OSS-adjacent), Greptile (full-codebase RAG; highest bug recall ~82% but ~11 false positives/run), Diamond/Graphite Agent (low false positives in a stacked-diff flow), Ellipsis (best for large-PR summaries) [Public: greptile.com; coderabbit.ai; graphite.com].

Sources

5. Deployment to AWS & cloud environments

The 2026 default for a Claude-Code-centric AWS shop is a layered stack: real-language IaC, the official AWS MCP servers imported into Claude Code for synthesis/validation, OIDC-federated CI for the actual apply, and policy-as-code as the hard gate the agent cannot bypass. Treat the agent as a drafter of infrastructure and a reviewer of plans — never as the holder of long-lived AWS credentials [Synthesis].

IaC engines. AWS CDK (OSS, Apache-2.0) synthesizes to CloudFormation, the AWS-native default. Terraform (now BSL-licensed) vs OpenTofu (OSS fork, CNCF Sandbox Apr 2025, with state encryption + for_each on providers) — OpenTofu is the recommended OSS-first HCL path [Public: pulumi.com terraform/opentofu comparison; Synthesis]. Pulumi (OSS core, commercial backend) and SST v3 (OSS, TypeScript-first on Pulumi/Terraform, cleanest Next.js→AWS path via OpenNext with first-class per-PR preview envs) round it out [Public: sst.dev/docs]. Recency flags: CDKTF was deprecated/archived Dec 2025 — don’t start new work on it [Public: encore.dev terraform-alternatives].

AWS MCP servers (Import into Claude Code). awslabs/mcp is a real, actively maintained OSS suite (Apache-2.0). Relevant servers: the AWS IaC MCP Server (CDK + CloudFormation + Terraform, with CloudFormation Guard policy validation + integrated Checkov scanning — it replaces the deprecated cdk-mcp-server) and the AWS Pricing/Cost Analysis MCP Server (scans CDK/Terraform projects to estimate monthly cost before deploy — a direct cost/blast-radius guardrail) [Public: github.com/awslabs/mcp; awslabs.github.io/mcp]. Best practice: run these read-only/documentation-scoped and let CI do the privileged apply [Synthesis].

AWS-native AI dev tools — mind what’s commercial and what’s dying. Kiro (commercial, on Bedrock) and Amazon Q Developer (commercial; leads on AWS-account-native security scanning) are alternative harnesses, not necessary for a Claude-Code-first team — Q Developer is the only one worth layering alongside. Amplify Gen 1 enters maintenance May 2026 (EOL May 2027) — use Gen 2. AWS Copilot CLI is end-of-support June 12 2026 — do not adopt [Public: aws.amazon.com end-of-support announcements].

CI/CD + ephemeral preview environments (Layer alongside). The official anthropics/claude-code-action@v1 runs the full Claude Code runtime headlessly in a GitHub Actions runner and authenticates via direct API, Amazon Bedrock (keeps model traffic inside your AWS boundary), Vertex, or Foundry [Public: code.claude.com/docs/en/github-actions]. For preview envs, SST/OpenNext and Pulumi both support per-PR ephemeral stacks torn down on PR close.

Guardrails — non-negotiable when an agent can touch a live account [Synthesis; Public: atlantsecurity.com]: (1) OIDC, not static keys — GitHub Actions assumes a short-lived IAM role via web-identity federation; no long-lived secrets in the repo or the agent’s context. (2) Least-privilege IAM — explicit action lists, IAM Access Analyzer to prune, SCPs the agent’s role cannot exceed. (3) Policy-as-code as a CI gate (all OSS): Checkov (graph-based, Terraform/CFN/CDK-synth/OpenTofu/K8s), cfn-nag, OPA/Rego or CloudFormation Guard, Trivy for IaC misconfig (it absorbed the tfsec rule library in 2024 — tfsec is frozen). (4) Cost blast-radius — AWS Pricing MCP pre-deploy + a CI cost-diff gate. The architectural rule: the agent proposes a plan/diff; a human or policy engine approves; OIDC-scoped CI applies.

Key tools (§5): CDK · OpenTofu · Pulumi · SST + OpenNext · awslabs/mcp (IaC + Pricing servers) · anthropics/claude-code-action@v1 (Bedrock auth) · Checkov · cfn-nag · OPA/CloudFormation Guard · Trivy (IaC) · GitHub OIDC + IAM least-privilege + SCPs. Avoid: CDKTF (archived), AWS Copilot CLI (EOS June 2026), Amplify Gen 1 (EOL 2027).

Sources

6. Security — vulnerability scanning & dependency management

In 2026 the toolchain itself is part of your attack surface — the scanner, the MCP server, and the AI-suggested package are all viable supply-chain entry points. The winning posture for a small shop: an OSS-first SCA/SAST stack pinned by digest, plus disciplined hardening of the agentic toolchain.

SCA & dependency hygiene (Layer alongside). Update automation: Renovate (OSS, self-hostable) is more configurable than Dependabot (free, GitHub-only) — the OSS-first pick. Vulnerability matching (all OSS): OSV-Scanner (Google; fronts OSV.dev aggregating 20+ advisory sources; v2.0 added container scanning), Grype + Syft (Anchore; SBOM-first, faster on pure vuln scans), Trivy (Aqua; single-binary all-rounder). Malicious-package detection (distinct from CVEs): Socket (commercial; behavioral analysis of install scripts catches intentionally malicious packages CVE scanners miss) and Phylum. Snyk (commercial) leads on advisory freshness + reachability analysis but is paid per-dev. Recommended OSS-first base: OSV-Scanner + Grype/Syft + Renovate, with Socket (commercial) layered on for malicious-package detection [Public: rafter.so sca-comparison; appsecsanta.com; Synthesis].

Critical 2026 caveat on Trivy. Trivy is excellent and still recommended, but on March 19 2026 the aquasecurity/trivy-action, setup-trivy, the v0.69.4 binary, and Docker Hub images were compromised (threat actor “TeamPCP,” credential-stealer injected; confirmed by Microsoft, Wiz, CrowdStrike, Palo Alto). Lesson, not a ban: pin every CI action and scanner to a commit SHA/digest (never floating tags) — your security scanner needs the same supply-chain hygiene as your app deps [Public: aquasec.com/blog/trivy-supply-chain-attack; microsoft.com/security/blog 2026/03/24; Synthesis].

SAST / agentic review (mix of Import and Layer). Semgrep (OSS CE + commercial) moved cross-function taint analysis behind its commercial license in Dec 2024, prompting a 10+ vendor consortium to fork CE into Opengrep (LGPL-2.1, Jan 2025), restoring cross-function taint tracking across 12 languages — for fully-OSS taint-aware SAST, Opengrep is now the pick over Semgrep CE [Public: socket.dev/blog/opengrep-forks-semgrep; Synthesis]. CodeQL (free for OSS via GHAS) adds semantic query-based analysis; Bearer and Bandit (Python) round out OSS options. Agentic review (Import into Claude Code): the /security-review command + OSS GitHub Action — diff-aware, aligned to OWASP 2025 incl. the LLM Top 10, severity×confidence scoring, parallel Haiku sub-agents for false-positive filtering. Best practice: agentic review augments, never replaces, deterministic SAST — run Opengrep/CodeQL as the gate and Claude’s review as a semantic second pass [Public: github.com/anthropics/claude-code-security-review; Synthesis].

2026-specific supply-chain risks + securing the agentic toolchain:

  • Slopsquatting / hallucinated dependencies. LLMs invent plausible-but-nonexistent package names; a March 2025 study found ~20% of packages across 576k generated samples didn’t exist, and USENIX Security 2025 found the hallucinations are repeatable (hence weaponizable). Mitigation: gate every AI-suggested dependency through Socket/OSV before install; never install a name the agent produced without verifying it resolves to a real, established package [Public: bleepingcomputer.com ai-hallucinated-dependencies; aikido.dev slopsquatting; Synthesis].
  • Malicious MCP servers, skills, and tool poisoning. Real 2025 CVEs: CVE-2025-54136 (MCPoison) and CVE-2025-54135 (CurXecute) — attackers controlling an MCP server write unsanitized directives into tool descriptors; plus command-injection CVEs in community servers. Tool poisoning = hidden instructions in a tool’s name/description/schema (OWASP 2026 Agentic Top 10, ASI01 Goal Hijack). Scale: ~10,000+ published MCP servers by April 2026, ~38% from unofficial sources; the OpenClaw “ClawHub” crisis saw 1,184 confirmed malicious skills — the largest confirmed AI-agent-infra supply-chain attack to date [Public: truefoundry.com mcp-tool-poisoning; csoonline.com claude-code-mcp-security; arxiv.org/abs/2602.06547].
  • Claude Code’s own CVEs. Check Point disclosed (Feb 25 2026) CVE-2025-59536 (CVSS 8.7; RCE via pre-trust hook execution + MCP consent bypass — code runs before the trust dialog) and CVE-2026-21852 (API-key exfil via ANTHROPIC_BASE_URL manipulation). Keep Claude Code patched; treat malicious project files as untrusted [Public: research.checkpoint.com 2026 cve-2025-59536].

Best-practice guidance for securing the agentic toolchain (Import into Claude Code) [Public: labs.cloudsecurityalliance.org agentic-mcp; code.claude.com/docs/en/permissions]: (1) Allowlist + pin + scan MCP servers — approved-server allowlist, verify hashes so an approved tool can’t be silently swapped (“rug pull”), run Invariant Labs’ OSS mcp-scan to detect poisoned descriptions. (2) Least privilege per server. (3) Claude Code permission model (~/.claude/settings.json): deny-rules evaluated first and un-overridable, scoped allow/ask/deny over Bash/Write/WebFetch/MCP, path-restricted Write to keep credential files out of reach, PreToolUse hooks for runtime enforcement; autoApprove only inside isolated CI containers with a network deny-list. Anthropic’s March 2026 auto mode uses classifier-based approvals as a safer middle ground than --dangerously-skip-permissions. (4) Reference frameworks: NSA MCP Security CSI (May 2026), CSA Agentic MCP Best Practices v1, OWASP Agentic Top 10 (2026).

Key tools (§6): OSV-Scanner · Grype + Syft · Renovate · Trivy (pin to digest post-March-2026) · Socket (commercial) · Snyk (commercial) · Opengrep · CodeQL/GHAS · Bearer · /security-review + anthropics/claude-code-security-review · Invariant mcp-scan · Claude Code permission rules + PreToolUse hooks + auto mode.

Sources

7. Recommended layered architecture for TBD + adoption sequence

This is the opinionated section you asked for. Framed as “this suggests” per RDI — the picks are concrete, but the final calls are yours. Tuned for: 2 people, AWS, Claude Code as the core harness, privacy-sensitive deep-tech, prototyping both this ops repo and the ~/tbd-product digital twin.

The proposed stack, by lifecycle stage

StageOSS-first pick (import/layer)Why this one for TBDCommercial escape hatch
Plan / specClaude Code Plan Mode + Spec-Kit (import)Free, already installed; spec discipline a non-technical co-founder can review before codeKiro (only if switching IDE)
UI/UX designshadcn MCP as component source-of-truth + Onlook / open-design (import)Components land as code you own; OSS visual edit on real Reactv0 / Lovable as draft generators to pull from
Architecture / diagramsMermaid default, Python diagrams for cloud, ADRs as in-repo Markdown (import)LLM-native, renders in PRs, version-controlled—
Code (parallel build)Claude Squad or Vibe Kanban worktree fan-out + native subagents (import)Self-hostable, no SaaS; fan-out 3 approaches, keep the bestConductor (Mac UX, paid)
Test / verifyPlaywright Test Agents over Playwright MCP + promptfoo in CI (import/layer)Self-healing E2E callable from Claude Code; eval gate on skill/prompt changes—
Review/security-review + anthropics/claude-code-security-review + self-hosted PR-Agent (import/layer)Competent AI review, zero new vendors, privacy-preservingCodeRabbit / Greptile if FP-tuning + RAG context justify it
Deploy to AWSSST/OpenNext or CDK/OpenTofu + awslabs/mcp (read-only) + OIDC CI (import/layer)Agent drafts, CI applies; preview envs per PR; no long-lived keys—
Security / depsOSV-Scanner + Grype/Syft + Renovate + Opengrep in CI (layer)Fully OSS taint-aware SAST + SCA; pin everything to digestSocket (malicious-pkg), Snyk (freshness)
Toolchain hardeningMCP allowlist + mcp-scan + Claude Code deny-rules / PreToolUse hooks (import)The 2026 load-bearing layer; cheap to set up, expensive to skip—

Suggested adoption order (don’t boil the ocean)

This suggests a sequence where each step pays for the next [Synthesis]:

  1. Lock the toolchain-security baseline first (a half-day): pin all CI actions to SHA, add an MCP-server allowlist, run mcp-scan, tighten ~/.claude/settings.json deny-rules and path-restricted Write. This is the cheapest high-consequence move given the 2026 CVEs — do it before adding any new MCP server or skill.
  2. Spec-Kit + Plan Mode as the default planning loop. Already-installed, zero cost, biggest single quality lever, and the part Dustin can review.
  3. shadcn MCP + one OSS draft tool (Onlook or bolt.diy with our Claude key) for UI prototyping that emits code we own.
  4. Worktree fan-out (Claude Squad first — lightest) once you feel the “waiting on one agent” bottleneck.
  5. Verification loop — Playwright Test Agents + a promptfoo gate in CI — before any prototype touches a real user.
  6. AWS deploy guardrails — OIDC + awslabs/mcp read-only + Checkov/Trivy(pinned) in CI — before an agent gets anywhere near the live account.
  7. Layer commercial review (CodeRabbit/Greptile) only if/when self-hosted review proves insufficient.

Confidence summary

ClaimConfidenceBasis
Spec-driven dev + worktree fan-out are the consolidated 2026 patternsHighMultiple independent OSS implementations, first-party docs
awslabs/mcp, Playwright MCP, shadcn MCP, Spec-Kit are real, maintained, Claude-Code-compatibleHighPrimary vendor repos verified
Toolchain (MCP/skill/dependency) is now a first-order attack surfaceHighNamed CVEs, Trivy compromise, OpenClaw crisis — primary sources
OSS-first stack can match commercial tools for a 2-person teamMediumSynthesis across comparisons; commercial leads on FP-tuning/RAG context
Specific benchmark rankings (Codex vs Claude Code %)LowNoisy, shifts release-to-release
Self-reported tool metrics (3–10× first-pass, skill counts, ARR)LowVendor/early-adopter self-report, flagged inline

”What would make this recommendation wrong?”

  • If TBD’s prototyping is mostly non-web (Neo4j ingestion pipelines, simulation math), the Playwright/shadcn-heavy parts of this stack are less relevant and the weight should shift toward data-pipeline testing (property-based + promptfoo) — worth checking against what ~/tbd-product actually builds.
  • If a non-technical co-founder will drive prototyping directly, a hosted builder (Lovable) may beat the import-into-CC stack for the first draft despite the repo-sync cost — the OSS-first bias assumes a technical hand on the harness.
  • If TBD ever takes on regulated/customer data, the “self-hosted everything” posture stops being a preference and becomes a requirement — re-weight away from any commercial SaaS that ingests source.

Open questions for the human

  1. Does the prototyping center of gravity sit in this ops repo, in ~/tbd-product, or both — and how web-UI-shaped is it? (Determines how much of §3–§4 applies.)
  2. Are we comfortable giving any agent OIDC-scoped AWS access at all yet, or should deploy stay fully manual through the next phase?
  3. Should we standardize the team on one worktree-fan-out tool now, or stay on native subagents until the bottleneck is real?
  4. Worth spending the half-day on the toolchain-security baseline (step 1) this week, before we import anything new?

Sources are listed per-section above. This brief synthesizes ~90 external sources (verified June 2026) against TBD’s current stack; it is an evidence map and a recommended shape, not a settled decision — per RDI, the synthesis is yours.

Graph View

Backlinks