Vibe coding packs, templates and launch reviews, page 4
For people who build software by describing it to an AI coding tool: security prompts before launch, instruction files your agent follows, MCP setup, debugging without spiraling, and a review before real users arrive.

Move your Claude Code, Codex, Cursor or OpenClaw setup into Hermes with a dry run first
Nous Research's agent-importers plugin gives Hermes one command that reads an existing agent setup (instructions, memories, MCP servers, skills and command allow and deny lists) and shows a per-item plan before writing anything. Credentials stay behind unless you opt in for OpenClaw.

Sandbox your MCP servers too, because the agent's sandbox may not cover them
A write-up on r/mcp points out that Claude Code's and Codex's own docs say local MCP servers run as ordinary processes outside the agent's sandbox. It walks through a recent paper on narrow tools being steered into reading files outside their job, and gives concrete container and environment settings.

Design MCP tools and errors so the model's next call is the right one
Two MCP server builders shared numbers and rules from real use. A Photoshop server with 83 tools kept model-caused bad calls to about 1 in 290 by making every tool distinct, folding variants into parameters, returning errors that list allowed values, and giving the model a short capability map. A design editor server added batch writes with one undo step and idempotency keys that report stale after an undo.

Extension Lockfile: pin your editor extensions and check for persistence after a bad update
Write down the editor extensions you trust at the versions you reviewed, turn off silent updates, and check every machine against that list with a read-only script. Take a baseline of SSH keys, startup entries, crontab and shell files on a quiet day, so when the next bad extension update is announced you can see what changed in one command. Includes an indicator file and runbook for the 2026-10-29 Claude Code extension incident.

Extension Lockfile: an allow-list check for your editor extensions (free sample)
From Extension Lockfile: the quick checks for the 2026-10-29 Claude Code extension incident, pointing to the vendor's notice, five habits for editor extensions, and a read-only script that flags extensions not on your allow list, at an unapproved version, or installed in the last few days.
Bug Report Your Agent Can Fix
A no-install way to turn "it is broken" into a report a coding agent can act on: a capture checklist, one report template, a redaction step for logs, a read-only checker, and four prompts that make the agent reproduce, fix, test and write back what changed.
Bug Report Your Agent Can Fix (free sample)
From the $14 pack: the capture checklist, the report template, five rules and the reproduce-first prompt.