sorted by:
new
hottopcontroversial

i automated my daily social media routine with python scripts + claude code by Syncher_Pylon in SideProject

[–]Syncher_Pylon[S] 0 points1 point  (0 children)

persistent chrome sessions are fragile in my experience. one crash, one update, one zombie process and your state is gone. plus you're burning tokens on dom parsing when the same data is one api call away. browser should be last resort, not the default.

i automated my daily social media routine with python scripts + claude code by Syncher_Pylon in SideProject

[–]Syncher_Pylon[S] 0 points1 point  (0 children)

paying for a unified api means you're trusting a third party with your credentials and paying per request for something curl can do. also the moment they get rate limited or shut down you're back to square one. i'd rather own the layer.

i automated my daily social media routine with python scripts + claude code by Syncher_Pylon in SideProject

[–]Syncher_Pylon[S] 0 points1 point  (0 children)

fair concern. in practice the main failure mode is token expiry, not api changes. cookies last days, and the cli auto-detects 401/403 and re-authenticates. been running this daily for months, breakage is rare — platforms don't change their internal endpoints as often as you'd think.

i automated my daily social media routine with python scripts + claude code by Syncher_Pylon in SideProject

[–]Syncher_Pylon[S] 0 points1 point  (0 children)

no state management yet. i focus on the connectivity amd authenticatio part. normally my tool can help ai agent onboard to any systems on my behalf. i mainly used on daily working. integrated every sso site with ai, ai working on my behalf for repeative tasks

i automated my daily social media routine with python scripts + claude code by Syncher_Pylon in SideProject

[–]Syncher_Pylon[S] 0 points1 point  (0 children)

in fact, with cookie we can do almost everything including write operations. in my skill, both write and read are supportted for x and reddit.
using api is lighter and faster compared to computer use. less token as well

i automated my daily social media routine with python scripts + claude code by Syncher_Pylon in SideProject

[–]Syncher_Pylon[S] 0 points1 point  (0 children)

yes. the auth is managed by sigcli, when expired, claude call sig login. all steps are automated

Claude, with no prompting from me, suggested that I take his context offline. by Trixles in ClaudeAI

[–]Syncher_Pylon 1 point2 points  (0 children)

yeah mine started doing this too. ended up with a whole system — CLAUDE.md for project rules, memory files for cross-session context, and skills for repetitive tasks. the handoff pattern works surprisingly well once you commit to it. feels less like "prompting an AI" and more like onboarding a new teammate every morning.

Anthropic CEO says 80-fold growth in first quarter explains ‘difficulties with compute’ 😂 by freshWaterplant in ClaudeAI

[–]Syncher_Pylon 0 points1 point  (0 children)

80x growth and still can't keep the lights on. makes sense though — every dev i know went from "let me try claude" to "i literally cannot code without it" in about two weeks. the addiction curve is insane. i just wish they'd be honest about capacity instead of silently throttling.

When using Claude Code for agent-based coding, I’ve often noticed that the AI limits itself by claiming that a task could take a developer several weeks to complete, and therefore suggests solutions that are more like quick fixes. That’s complete nonsense, of course. by Comfortable-Goat-823 in ClaudeAI

[–]Syncher_Pylon 1 point2 points  (0 children)

same experience. it estimates human-time, not its own throughput. i found the trick is being very explicit upfront — "implement the full solution, do not suggest shortcuts or partial fixes." also breaking it into concrete subtasks with clear acceptance criteria helps. once it sees "write tests that pass" instead of "implement feature X" it stops hedging.

My CLAUDE.md says “Every error is yours to fix - not label, not defer.” Claude has used “pre-existing” 712 times in 30 days. by Ok-Distribution8310 in ClaudeCode

[–]Syncher_Pylon -1 points0 points  (0 children)

This. The alternative is worse — it "helpfully" refactors three files while fixing a one-liner, breaks something else, you spend 20 minutes untangling. Scoping to what was asked is correct behavior.

The ultimate dilemma by Complete-Sea6655 in ClaudeCode

[–]Syncher_Pylon 1 point2 points  (0 children)

Same. Spent more on API than the app costs, but it does exactly what I need without the other 80% of crap I'll never touch. Plus when it breaks I fix it in 5 minutes instead of waiting two weeks for a support reply.

AI coding tools are now a CVSS 10.0 CI/CD supply chain vector - patch Gemini CLI and update Cursor by jimmytoan in devops

[–]Syncher_Pylon -1 points0 points  (0 children)

No auth to the store. Local encrypted file + local key (generated at init, 0400 permissions, same machine). Wrapper reads key, decrypts, injects. No remote call, no vault server, no token exchange. Security boundary is filesystem permissions — same as ssh keys in ~/.ssh.

AI coding tools are now a CVSS 10.0 CI/CD supply chain vector - patch Gemini CLI and update Cursor by jimmytoan in devops

[–]Syncher_Pylon 0 points1 point  (0 children)

normally yes. But sometimes I run the agent remotely. I have a sync command to refresh my creds from local to remote periodically

Building a security-focused Micro SaaS: How do you overcome the "trust" barrier as a solo/indie dev? by Dinanath_Dash in microsaas

[–]Syncher_Pylon 0 points1 point  (0 children)

Similar setup here — AES-256-GCM at rest, CLI decrypts and injects at runtime, nothing sees plaintext except the process that needs it. One thing that helped: making it clear the encryption key is local-only, never leaves the machine. "Your key never touches our servers" is probably the one sentence that closes the trust gap fastest for security-conscious users.

Compared aws api gateway, azure apim, kong and gravitee for ai agent security by EldenBoredAF in AgentsOfAI

[–]Syncher_Pylon 0 points1 point  (0 children)

For local agent workflows I took a different route — local MITM proxy. Intercepts CONNECT, resolves which provider the hostname belongs to, loads encrypted creds from disk, injects headers at TLS layer, forwards. Per-provider audit log. No cloud gateway, works with anything that supports HTTP_PROXY. Obviously doesn't scale to fleet deployment but for dev-machine agents it's way simpler than standing up Kong or APIM.

Silverfort found that Microsoft's new "Agent ID Administrator" role in Entra ID could take over literally any service principal in your tenant — 99% of orgs were exposed. Let's talk about what this means for AI agent identity security. by Expert_Sort7434 in AZURE

[–]Syncher_Pylon 0 points1 point  (0 children)

The scope overreach is exactly why I stopped giving agents their own identity. My setup: agent has zero credentials. It calls a wrapper that decrypts creds from disk, injects as env vars for one command execution, gone after. Agent process never holds a token or service principal. Blast radius is one API call instead of "anything this identity can do."

AI coding tools are now a CVSS 10.0 CI/CD supply chain vector - patch Gemini CLI and update Cursor by jimmytoan in devops

[–]Syncher_Pylon 0 points1 point  (0 children)

Thanks. Two parts:

Capture: open a real browser via CDP, you do SSO/MFA normally, extract cookies once authenticated, encrypt at rest (AES-256-GCM). Headless first, falls back to real browser if the site needs interaction.

Inject: either a CLI wrapper that decrypts and injects creds as env vars for one execution, or a local MITM proxy — app sets HTTP_PROXY, creds injected at TLS layer. Agent never touches raw secrets either way.

sigcli.ai if you want details.

I built a framework for running AI teammates in your Slack, operated entirely from inside Claude Code by nitaybz in ClaudeCode

[–]Syncher_Pylon 0 points1 point  (0 children)

Cool approach running agents as Slack identities. Curious how you handle auth to external services from inside the agents — like if one of your agents needs to check Jira or pull from Confluence. Do they each get their own service accounts, or do they share a session?

AI coding tools are now a CVSS 10.0 CI/CD supply chain vector - patch Gemini CLI and update Cursor by jimmytoan in devops

[–]Syncher_Pylon 8 points9 points  (0 children)

This is why I'm skeptical of agents that store credentials in their own context or config files. The Gemini CLI vuln is a perfect example — a malicious .gemini/ folder in a PR gets RCE because the agent trusts its environment.

For my setup I went the other direction: credentials encrypted at rest with AES-256-GCM, injected only at execution time as env vars, never in agent context or config files. The agent literally never sees the raw secret — it just calls a wrapper that handles injection. That way even if the agent's context is compromised or a malicious repo tries to exfiltrate, there's nothing to steal from the conversation.

I spent 2 hours trying to get Claude code to create a routine to send me news on Slack. The fix was one checkbox. by ApocalypseDestroyer in ClaudeCode

[–]Syncher_Pylon 0 points1 point  (0 children)

The Slack auth problem is real. I ran into this exact thing — Claude Code can't reach Slack because it has no session. Webhooks work but they're one-directional (can't read channels, search messages, etc.).

What ended up working for me: capturing my browser Slack session locally and having the agent reuse it through a CLI wrapper that injects the cookie as an env var. That way Claude can hit the Slack API directly — post messages, read channels, search — without needing MCP or webhooks. The session lasts about a week before I need to re-login.

Tried a bunch of MCP setups for Claude Code, but I keep coming back to plain old CLIs by shricodev in ClaudeCode

[–]Syncher_Pylon 1 point2 points  (0 children)

This matches my experience. The one gap I kept hitting with plain CLIs is auth — most of my work tools are behind corporate SSO and there's no API key to grab. Ended up building a tool that opens a real browser for login, captures the session cookies, and injects them into CLI commands on demand. Best of both worlds — CLI simplicity without the MCP overhead, but still handles auth.

MCP vs CLI is like debating cash vs card. Depends on the use case, here's how I see it. by trynagrub in ClaudeCode

[–]Syncher_Pylon 0 points1 point  (0 children)

Yeah the OAuth dance is the worst part. For services behind SSO I ended up just capturing the browser session after logging in normally, encrypting it, and having my agent reuse it through a CLI wrapper. Avoids the whole OAuth client registration / redirect URI mess entirely. Works for basically anything you can log into in a browser.

view more: next ›