DEV Community: Creeta

Claude's prompt cache fails silently below 1,024 tokens

Creeta — Thu, 06 Aug 2026 03:40:27 +0000

Prompt caching on the Claude API is the difference between an agent loop that costs $5 and one that costs $50 — but only if the cache actually forms. The most common reason it doesn't is a floor that produces no error message at all.

What's New: Automatic Caching, Diagnostics — and the Floor Nobody Warns You About

Claude's prompt cache has a minimum cacheable prefix, and it is model-dependent rather than a single global number: 512 tokens for Opus 5, Fable 5 and Mythos 5; 1,024 for Opus 4.8, Sonnet 5, Sonnet 4.6/4.5 and Opus 4.1/4; 2,048 for Opus 4.7; and 4,096 for Opus 4.6, Opus 4.5 and Haiku 4.5 . Below that floor nothing is cached and no exception is raised — the request bills at the full input rate and the only signal is both cache token counters sitting at zero .

Two 2026 platform changes make this easier to catch. On February 19, 2026, automatic caching went GA on the Messages API: a single top-level cache_control field places the breakpoint on the last cacheable block and advances it as the conversation grows . On May 13, 2026, cache diagnostics entered public beta — with the header cache-diagnosis-2026-04-07, a request returns a cache_miss_reason instead of silence . Neither change removes the token floor; they just make it visible.

Before You Rely on This in Production: What Your Setup Needs

Caching requires three things in place before the numbers move: Messages API access with cache_control block support, a model whose minimum cacheable prefix your stable content actually clears, and a habit of reading usage metadata instead of trusting the discount. The 1-hour TTL has been generally available without a beta header since August 13, 2025, but mid-conversation tool changes still need the mid-conversation-tool-changes-2026-07-01 header .

The floor is model-dependent and varies by a factor of eight. A prompt below it can never cache, no matter where you put the marker .

Minimum cacheable prefix	Models
512 tokens	Opus 5, Fable 5, Mythos 5
1,024 tokens	Opus 4.8, Sonnet 5, Sonnet 4.6 / 4.5, Opus 4.1 / 4
2,048 tokens	Opus 4.7
4,096 tokens	Opus 4.6, Opus 4.5, Haiku 4.5

Ground truth lives in usage: cache_creation_input_tokens (split into ephemeral_5m_input_tokens and ephemeral_1h_input_tokens) and cache_read_input_tokens. Budget your markers too — a request carries at most four explicit cache_control breakpoints, and automatic caching consumes one of those slots, so combining it with four manual markers returns a 400 .

How to Confirm Your Cache Actually Formed

Confirming a cache formed takes one measurement and one repeat: count the tokens in the exact content sitting before your cache_control breakpoint, compare that count against your model's minimum, then send the identical request twice and read usage.cache_creation_input_tokens on call one and usage.cache_read_input_tokens on call two. Anything else — a lower input_tokens figure, a faster response — is circumstantial. Below the model floor nothing is cached and no error is raised .

Placement decides what gets counted. Put the marker on the last stable block: the final entry in the tools array to cache the whole tool prefix, or the end of a static system prompt when you have no tools. For an mcp_toolset, mark the toolset entry so the breakpoint lands on the last expanded tool .

The following snippet is illustrative — it was not executed, since it needs a live ANTHROPIC_API_KEY. It deliberately marks a sub-1,024-token block so you can watch both counters come back empty:

import json
import os
import sys
import urllib.request

key = os.environ.get("ANTHROPIC_API_KEY")
if not key:
    sys.exit("needs ANTHROPIC_API_KEY")

body = {
    "model": "claude-3-5-sonnet-20241022",
    "max_tokens": 1,
    "messages": [
        {
            "role": "user",
            "content": [
                {
                    "type": "text",
                    "text": "This cacheable block is intentionally below 1,024 tokens.",
                    "cache_control": {"type": "ephemeral"},
                },
                {"type": "text", "text": "\nReply with OK."},
            ],
        }
    ],
}

req = urllib.request.Request(
    "https://api.anthropic.com/v1/messages",
    data=json.dumps(body).encode(),
    headers={
        "content-type": "application/json",
        "anthropic-version": "2023-06-01",
        "x-api-key": key,
    },
)

with urllib.request.urlopen(req, timeout=30) as r:
    data = json.load(r)

usage = data["usage"]
print("cache_creation_input_tokens =", usage.get("cache_creation_input_tokens"))
print("cache_read_input_tokens =", usage.get("cache_read_input_tokens"))
print("No error is raised; sub-1024-token prompt cache is just not used.")

If both counters read zero on the second call, the prefix is under the floor — pad it with more static content or move more stable material ahead of the marker. If they read zero only sometimes, stop guessing and opt into the diagnostics beta that entered public preview on May 13, 2026: send header cache-diagnosis-2026-04-07 with diagnostics.previous_message_id and the response returns a cache_miss_reason naming the first point where the prefix diverged from the prior turn .

Then keep watching it. Anthropic's Claude Code team treats hit rate as a reliability signal, not an accounting line:

"We run alerts on our prompt cache hit rate and declare SEVs if they're too low… monitor your cache hit rate like you monitor uptime." — Claude Code team, Anthropic (source: Lessons from building Claude Code)

Log creation and read counters separately, broken out by model, TTL and workflow. A single aggregate number hides the case that matters most: a prefix that writes on every call and never reads.

Gotchas That Show Up After the Cache Forms

A formed cache is not a stable cache. Once the prefix hits, the next class of failures comes from configuration flags and server-side behavior that quietly rewrite or invalidate what you cached. The most common surprise: when a request already carries a cache_control marker and Claude calls a server tool — web search, web fetch, or code execution — the API automatically inserts a breakpoint on the server tool result before the next iteration, and that breakpoint always uses the 5-minute TTL regardless of your markers . A 1-hour-only configuration will therefore still report ephemeral_5m_input_tokens writes. That is expected behavior, not a leak.

The invalidation triggers worth logging explicitly:

Changing tool_choice or disable_parallel_tool_use invalidates the messages cache .
Toggling web search or citations invalidates both system and messages .
Changing thinking parameters or output_config.effort invalidates messages on every model — and tools plus system on models that render that config ahead of them .

Mixed TTLs are permitted, but ordering is strict: 1-hour blocks must appear before 5-minute blocks. Billing is then computed across three positions — the highest cache hit (A), the last 1-hour breakpoint after it (B), and the last breakpoint (C) — charging reads for A, 1h writes for B−A, and 5m writes for C−B . Invert that order and the math stops describing what you actually pay.

What to Try Next: Diagnostics, Keepalive, and the Break-Even Math

Point the diagnostics beta at your worst-performing call path first. With the header cache-diagnosis-2026-04-07, a request can pass diagnostics.previous_message_id and get back a cache_miss_reason naming the first point where the prefix diverged from the prior turn — a direct answer instead of bisecting a 30 KB prefix by hand.

Then check the arithmetic before you widen the TTL. A 5-minute write costs 1.25× base input and a read 0.1×, so two calls on a warm prefix run 1.35× versus 2× uncached — payback on the second read. A 1-hour write at 2.0× needs roughly two to three reads to clear . If you plan to hold a prefix warm with keepalive pings, Khailo's July 24, 2026 paper derives break-even horizons of about 46 minutes for the 5-minute tier and 3.3 hours for the 1-hour tier at measured provider parameters .

One last default worth knowing: Claude Code's client requests the 1-hour TTL automatically on a subscription, but falls back to 5 minutes on an API key unless you set ENABLE_PROMPT_CACHING_1H=1 . The takeaway is narrow and testable: log cache_creation_input_tokens and cache_read_input_tokens per model and workflow, and treat a flat-zero pair as a defect report — not a silent cost you keep paying.

Frequently asked questions

What's the smallest prefix Claude will actually cache?

It depends on the model, and the spread is wide: 512 tokens on Opus 5, Fable 5 and Mythos 5; 1,024 tokens on Opus 4.8, Sonnet 5, Sonnet 4.6, Sonnet 4.5, Opus 4.1 and Opus 4; 2,048 tokens on Opus 4.7; and 4,096 tokens on Opus 4.6, Opus 4.5 and Haiku 4.5 . The floor is not monotonic across versions — Opus 4.8 dropped to 1,024, below Opus 4.7's 2,048 . Check the number for the exact model you deploy before assuming a compact system prompt will cache at all.

How do I know whether my prompt cache actually formed?

Read two fields from the API response: usage.cache_creation_input_tokens and usage.cache_read_input_tokens. A non-zero creation count means a prefix was written; a non-zero read count means it was reused. Both at zero means nothing was cached, no matter how large input_tokens looks — total input is read + creation + input, so a fat input_tokens value with flat-zero cache counters is exactly the failure signature . The cache_creation object splits writes into ephemeral_5m_input_tokens and ephemeral_1h_input_tokens if you need TTL-level attribution.

Does the API throw an error if my prefix is too short to cache?

No. A request with a cache_control marker on a below-threshold prefix succeeds normally and bills at the full input rate — no warning, no exception, no header. The only observable signal is both cache token counters staying at zero . That is why the Claude Code team treats hit rate as an operational metric rather than an optimization detail: they run alerts on prompt cache hit rate and declare SEVs when it drops .

Should I use the 5-minute or 1-hour TTL?

Use the 5-minute tier for active chat loops, short tool-use bursts and retries: at 1.25× base input for the write and 0.1× for the read, it clears break-even on the second use versus two uncached calls . Use the 1-hour tier — 2.0× write — only when expensive context setup will be re-read across a long job or many worker calls, since it needs roughly two to three reads to pay back . If you hold a prefix warm with keepalive pings, the measured break-even horizons are about 46 minutes for the 5-minute tier and 3.3 hours for the 1-hour tier . Mixed TTLs are allowed, but 1-hour blocks must sit before 5-minute blocks.

Why does a 1-hour-only cache config still show 5-minute writes?

Because server tools insert their own breakpoint. When a request already carries a cache_control marker and Claude calls a server tool — web search, web fetch or code execution — the API automatically adds a breakpoint on the server tool result before the next iteration, and that breakpoint always uses the 5-minute TTL regardless of the markers you set . So a configuration you believe is 1-hour-only will still report ephemeral_5m_input_tokens writes. This is documented behavior, not a defect — budget for it rather than debugging it.

Can I add or remove tools mid-conversation without losing the cache?

Yes, on recent models with an opt-in header. Since 24 July 2026, the mid-conversation-tool-changes-2026-07-01 header lets you add or remove tools between turns while preserving the cache on Fable 5, Mythos 5, Opus 4.8 and Opus 5; a related change on 28 May 2026 permits mid-conversation role: "system" messages so instructions can change without invalidating the prefix . For older models, the structural fix is defer_loading with the tool-search tool: deferred definitions never enter the prefix, and discovered tools append as tool_reference blocks in the conversation instead .

How much cost reduction is realistic?

Independent measurement lands below vendor headline figures. Anthropic's original announcement cited up to 90% cost and 85% latency reduction for long repeated prompts , while an evaluation of 500+ agent sessions on DeepResearch Bench with 10,000-token system prompts across three vendors reported 41–80% cost reduction and 13–31% time-to-first-token improvement . That paper also found naive full-context caching can increase latency; the most consistent strategy was caching stable system context while keeping volatile tool results out of the reusable prefix.

Watch / Sources

Last updated: 2026-08-06. Model minimum-token thresholds, TTL pricing multipliers and beta header names were checked against Anthropic's prompt-caching documentation and API release notes on this date; verify per model and per deployment target before relying on them in production.

Claude Code resends full context every turn — Headroom cuts it

Creeta — Wed, 05 Aug 2026 15:48:32 +0000

Every time you send a message in Claude Code, the tool doesn't just ship your new line — it re-uploads the entire conversation so far. On a long session, that quietly becomes the bulk of your token bill.

Why Claude Code Resends the Entire Conversation on Every Turn

Claude Code is stateless between API calls, so it appends the full message history, all tool outputs, and MCP server metadata to every outbound request. Anthropic's own cost documentation confirms token spend scales with accumulated context: the longer the session, the more you pay to resend material the model has already seen . Prompt caching softens this — Anthropic gives roughly a 90% read discount on a stable prefix — but tool results, file reads, and variable JSON payloads keep changing the prefix, breaking the cache and forcing stale output to be re-billed at full input rates on later turns .

Headroom is a local middleware layer that intercepts that outbound payload before it reaches the provider. Requests pass through a staged lifecycle — Input Received → ContentRouter → Compressed → Pre-Send — where redundant blocks like logs, search dumps, and repeated file reads are stripped or compressed en route . The current headroom-ai package is version 0.33.0, published July 29, 2026 .

The payoff varies by content. Headroom's README cites 15–20% overall reduction for coding agents, while structured payloads — JSON arrays and build logs — reach 70–95% . Independent expectations should be tempered: one practitioner reported about 26% real-world savings after a month of use .

What Headroom Needs to Attach to Claude Code

Headroom attaches to Claude Code with two runtime prerequisites and no API key changes. Pick one install path: Python 3.10+ for pip install "headroom-ai[all]", or Node 18+ for npm install headroom-ai . The current PyPI package is headroom-ai version 0.33.0, released July 29, 2026, so a fresh install already carries the compressor stack described in the arc .

There is no build step. Prebuilt wheels ship for Windows, Linux (x86-64 and aarch64), and macOS (x86-64 and ARM64), so the install resolves without a compiler toolchain on any of those platforms .

Your Anthropic credentials stay untouched. Headroom runs on localhost and you redirect Claude Code at 127.0.0.1 instead of api.anthropic.com; the key still authenticates upstream, only the base URL moves .

Verify before wiring anything: headroom --version should print 0.33.0 . After you attach it in the next step, one live Claude Code invocation confirms the round-trip end to end.

Fitting Headroom Into Claude Code

You have three ways to route Claude Code through Headroom, ordered from least to most manual. Pick one based on how much control you want over what gets compressed.

Path A — agent wrap (zero code changes). Run headroom wrap claude. Headroom launches Claude Code as a subprocess and compresses every payload in-process before it leaves your machine; nothing else in your setup changes . This is the fastest path if you just want savings without thinking about which blocks matter.

Path B — transparent local proxy. Start headroom proxy --port 8787, then set ANTHROPIC_BASE_URL=http://localhost:8787 before invoking claude. All traffic routes through Headroom without touching source or config files, and the request continues upstream to Anthropic authenticated by your existing key .

Path C — MCP server. Run headroom mcp install to expose headroom_compress, headroom_retrieve, and headroom_stats as callable tools. Instead of compressing all traffic, Claude compresses specific blocks on demand and can pull the original back within a one-hour TTL . This gives you per-block control at the cost of Claude choosing when to invoke it.

What makes the compression safe is CCR — Compress-Cache-Retrieve. Headroom stores the original content locally under a content hash and hands the model a shorter representation plus a retrieval affordance. The documented example crushes 5,000 lines of grep output from 12,000 to 3,200 tokens — a 73.3% cut — with the full original on standby via headroom_retrieve for one hour .

Under any path, ContentRouter auto-detects each block's type — JSON, logs, diffs, HTML, plain text — and hands it to the right compressor: SmartCrusher for JSON, an AST-aware CodeCompressor for source (Python, JS/TS, Go, Rust, Java, C/C++), and Kompress-v2-base, a 149M-parameter extractive prose model, for narrative text . You do not tag content yourself; routing is automatic.

When Headroom Skips Compression Entirely

Headroom does not compress everything, and knowing what it leaves alone sets a realistic expectation. Messages under roughly 300 tokens pass through untouched, because compressor overhead exceeds any saving at that scale . Source-code compression is opt-in and off by default, and short conversational exchanges compress a median of just 4.8% . Images, grep/search results, and system prompts may also bypass the pipeline.

The gains concentrate in long, tool-heavy sessions. Agentic conversations of 25–50 turns compress 56–81%, while a single-turn or early-session call can see near-zero reduction . The headline 60–95% figures apply exclusively to structured payloads — JSON arrays and build/test logs — not prose-heavy turns; the README's own coding-agent figure is 15–20% .

Workload	Typical reduction
Short conversational exchange	~4.8% (median)
25–50 turn agentic session	56–81%
JSON arrays	70–90%
Build/test logs	80–95%
Source code (opt-in)	40–70%

Independent signal is thin. One practitioner reported roughly 26% real-world savings after a month — well below the marketed range. Every published number originates from Headroom's own suite, including the v0.5.18 reproducible benchmarks that measured 66.1% total-corpus compression ; as of August 2026 no independent, peer-reviewed benchmark exists. Treat vendor figures as an upper bound and measure your own workload with headroom_stats before assuming plan-doubling savings.

What to Explore After Initial Attachment

Once compression is running cleanly, four features extend what Headroom does for a Claude Code workflow. The most useful is headroom learn: an offline failure-mining pass that reads your past Claude Code transcripts, mines recurring errors and patterns, and writes the distilled findings directly to CLAUDE.md Headroom README. It runs on stored sessions, not live traffic, so it costs no extra tokens during a conversation.

If you run Claude and Codex in parallel, Headroom keeps a shared compressed corpus across both agents and deduplicates overlapping context, so the same file reads and tool outputs are not stored or re-sent twice Headroom README. That matters most when two agents are exploring the same repository at once.

To measure any of this without leaving a conversation, call the headroom_stats MCP tool for per-turn compression ratio and cumulative token delta Claude plugin manifest. Finally, tune CacheAligner — the component that flags volatile content breaking KV-cache prefixes. Configuring it to hold more prefix stable earns Anthropic's roughly 90% cache-read discount on top of compression, stacking both savings.

Concrete next step: attach via the proxy, turn on headroom_stats, run one real session, then decide whether headroom learn and CacheAligner tuning justify the setup for your codebase.

Frequently asked questions

Does Headroom change Claude's answers or discard information?

No — Headroom is designed to be reversible rather than lossy. Its CCR (Compress-Cache-Retrieve) design stores the original content locally under a hash and hands the model a compact representation plus a retrieval affordance, so Claude can call headroom_retrieve to fetch the full original within a one-hour TTL when detail is needed . The prose compressor, Kompress-v2-base, is extractive and scores eval F1 0.918 with must-keep recall 0.974 on 7,037 held-out examples, meaning very few forced-retain spans are dropped .

How much will Headroom actually save in a real Claude Code session?

It depends heavily on workload. The README claims a modest 15–20% reduction for coding agents broadly, but structured payloads see far more: JSON arrays 70–90% and build/test logs 80–95% in Headroom's own benchmarks . Short conversational exchanges compress a median 4.8%, while agentic sessions of 25–50 turns compress 56–81% . One practitioner reported roughly 26% real-world savings after a month . Meaningful gains appear once a session accumulates significant tool-output history.

Is running Headroom's local proxy safe with my Anthropic API key?

Yes, for on-machine use. The proxy binds to 127.0.0.1 only, so traffic from Claude Code to Headroom never leaves your machine; Headroom then forwards requests to Anthropic's API . The repository is Apache 2.0 licensed and fully inspectable on GitHub, and Headroom itself stores no credentials .

What is the difference between proxy mode, wrap mode, and MCP mode?

Proxy mode (headroom proxy plus an ANTHROPIC_BASE_URL override) intercepts all traffic transparently — no code changes and it works with any tool. Wrap mode (headroom wrap claude) shells Claude Code as a subprocess with Headroom in front, the simplest path for CLI use. MCP mode (headroom mcp install) gives Claude selective, on-demand compression through a tool call instead of intercepting every request; the docs cite a representative 12,000 → 3,200 token result on grep output, with the original retained locally for one hour .

Does Headroom work with editors other than Claude Code?

Yes. Documented integrations include Cursor, Aider, Cline, Continue, and Goose via proxy or wrap mode, and any HTTP client that respects ANTHROPIC_BASE_URL works with proxy mode . On the library side, Headroom documents Vercel AI SDK middleware and LangChain, Agno, and Strands integrations through its compress(messages) API .

OpenMontage has 45k stars and no proprietary orchestrator

Creeta — Tue, 04 Aug 2026 21:53:41 +0000

Most AI video tools ask you to log into a dashboard. OpenMontage asks you to git clone a repository and let your coding agent take the director's chair.

A Repo That Plays Director, Not a SaaS Dashboard

OpenMontage is an open-source, agentic video-production framework that ships no orchestrator of its own — the AI coding agent you already run becomes the director. At the live 2026 snapshot, calesthio/OpenMontage showed 45,042 stars, 5,540 forks, and 323 commits, licensed AGPL-3.0. The repo was created on 2026-03-29 and carries no tagged releases — a rolling main branch, not a versioned product, which makes exact version claims unreliable.

The architecture is the point. Python supplies the tools and JSON/YAML state persistence; the coding agent — Claude Code, Cursor, GitHub Copilot, Codex, Windsurf, or OpenCode — owns the entire control loop. Production is encoded as a seven-stage sequence: research → proposal → script → scene_plan → assets → edit → compose. Each stage pairs a YAML manifest in pipeline_defs/ with a Markdown director skill in skills/pipelines/, as documented in the pipeline walkthrough.

"Every video request must go through a named pipeline; ad hoc scripts and bypassing the checkpoint loop are disallowed by design." — OpenMontage AGENT_GUIDE (source: AGENT_GUIDE.md)

That constraint is enforced, not merely advised: the agent reads the manifest, runs preflight, discovers tools through a registry, self-reviews, checkpoints state, and halts for human approval at creative decision points.

Before You Begin: Python 3.10, FFmpeg, and an Agent

OpenMontage runs locally by default, so the prerequisite list is short and the setup is one command. You need Python 3.10+ for tool execution and JSON state persistence, FFmpeg for post-production compositing, Node.js 18+ for the Remotion renderer, and one of six supported coding agents — Claude Code, Cursor, GitHub Copilot, Codex, Windsurf, or OpenCode — to act as director .

After git clone and cd OpenMontage, a single make setup installs all three dependency layers at once: Python packages, Remotion's Node packages, and Piper TTS for offline narration . There are no manual pip or npm steps to chase.

Copying .env.example to .env is optional — do it only to wire in paid providers such as ElevenLabs, Kling, or fal.ai. Leave it absent and you stay on the zero-key path. No Docker, no cloud provisioning, no dashboard login.

How Claude Code Directs a Video, From Empty Folder to Draft

With setup done, two terminal commands are all you type before handing off. Clone the repository and enter it:

git clone https://github.com/calesthio/OpenMontage.git
cd OpenMontage && make setup

From here, the coding agent takes the director's chair. Open the repo in Claude Code and it reads CLAUDE.md, which points to AGENT_GUIDE.md for shared operating rules . Cursor, Copilot, Codex, and Windsurf each read their own platform markdown file that routes to the same guidance . The agent then discovers what tools it can call through the registry:

python -c "from tools.tool_registry import registry; registry.discover()"

The AGENT_GUIDE is prescriptive: the agent reads the relevant skill files in skills/ before invoking anything, and every request must run through a pipeline — ad hoc scripts and bypassing review are explicitly disallowed .

Now issue a plain-English brief, such as "Make a 60-second animated explainer about how neural networks learn." The agent selects a pipeline from the staged workflow — research → proposal → script → scene_plan → assets → edit → compose — runs preflight checks, self-reviews, checkpoints JSON state, and halts for your approval at every creative decision point before proceeding .

Because the whole production is reproducible from repo state, nothing hides in a black-box render. The script lands as Markdown, scene metadata as JSON and YAML, assets under stable names, plus render commands and self-review notes — all ordinary files you can diff, version, and audit like any other codebase .

When Zero API Keys Is Not Quite Zero

OpenMontage's "zero API keys" claim is real for the default path but does not make every capability free. Out of the box you get local, offline narration from Piper TTS, footage and stills from Archive.org, NASA, and Wikimedia Commons, word-level transcription from WhisperX, composition in Remotion, and post-production in FFmpeg — no keys required . That free real-footage path, not stitched stills, is what separates it from slideshow tools.

Generated clips are key-gated. Kling, Runway Gen-4, Google Veo 3, MiniMax, Grok Imagine, and HeyGen all require paid access, typically routed via fal.ai; local WAN 2.1, Hunyuan, and CogVideo are key-free but GPU-heavy . The README's own cost examples show the spread:

Production	Cost	What it uses
60-second animated short	$1.33	Six Kling clips via fal.ai
FLUX-image animation	$0.15	FLUX generated stills
70-second history piece	$0.02	OpenAI narration, free Pixabay music

A default budget cap of roughly $10 keeps runaway spend in check. The bigger caveat is legal, not financial: the repo is AGPL-3.0, so its copyleft obligations attach to any distributed software incorporating the code — worth a review before shipping a product.

"Local footage stays on your machine, composition and rendering run locally without watermarks or metering, and commercial use is available on every tier including free." — OpenMontage Studio (source: daily.dev)

OpenMontage Studio — a hosted layer still in private alpha — offers commercial tiers as the cleaner path for teams uneasy about AGPL distribution .

Beyond the Animated Explainer: Eleven Other Formats

The animated explainer is one of twelve production pipelines shipped in the current repo . The named set includes animation, avatar spokesperson, cinematic, clip factory, documentary montage, hybrid, localization/dub, podcast repurpose, screen demo, and talking head — each governed by the same approval-gated, checkpoint-based loop you already ran once .

Documentary montage is the differentiating entry: instead of animating static images, it builds a CLIP-searchable corpus of real motion footage from Archive.org, NASA, and Wikimedia Commons, then cuts together actual clips — the free real-footage path no other entry-level tool offers . Localization/dub extends an existing video rather than rebuilding it; podcast repurpose turns audio-first content into a visual format with minimal new assets .

Expanding is mechanical: open the target pipeline's skill file in skills/pipelines/ and issue a fresh brief. The director loop you learned on your first render carries over unchanged to all twelve.

Frequently asked questions

Does OpenMontage actually work without any API keys?

Yes, on the default path. Narration runs on Piper (local, offline TTS), footage and stills come from Archive.org, NASA, and Wikimedia Commons, transcription uses WhisperX, composition runs on Remotion, and post-production runs on FFmpeg — all locally with zero keys . Keys only unlock generated clips (Kling, Runway Gen-4, Veo 3) and premium voices. The repo's own examples include a $0.02 run for a 70-second history piece using OpenAI narration and free Pixabay music, and free-source-only workflows are explicitly supported .

Which coding agents does OpenMontage work with?

Six directors are supported: Claude Code, Cursor, GitHub Copilot, Codex, Windsurf, and OpenCode . Configuration is file-routed per agent — Claude Code reads CLAUDE.md then AGENT_GUIDE.md, Cursor uses CURSOR.md plus .cursor/rules/, and Copilot, Codex, and Windsurf each get a dedicated platform Markdown file. All of them point to the same shared operating guidance in AGENT_GUIDE.md .

What exactly is an OpenMontage skill file?

A skill is a Markdown file encoding a reusable production capability — not a chat prompt. Examples include beat-detecting a music track, fitting an irregular image into 16:9 without stretching, or running a QA checklist . The agent reads the relevant skill files before invoking any tool. The current README advertises 700+ skill and production-knowledge files, up from the roughly 500 cited at launch .

Does the AGPL-3.0 license allow commercial use?

Yes, AGPL-3.0 permits commercial use, but with a condition: if you ship software that incorporates the code — including over a network — you must distribute your source modifications under the same license . Teams building a product on OpenMontage should audit this obligation before shipping. The hosted OpenMontage Studio, currently in private alpha with beta pending, states commercial use is available on every tier and may be the more practical path for a proprietary deployment .

How do I choose which pipeline to use for my video?

You do not choose manually. The agent reads AGENT_GUIDE.md and selects a pipeline from your plain-English brief, then presents a proposal you approve before any assets are touched . AGENT_GUIDE is prescriptive: every video request must go through a named pipeline, and ad hoc scripts or bypassing the review checkpoints are explicitly disallowed .

Penpot's MCP server runs on five tools — Figma's uses dozens

Creeta — Tue, 04 Aug 2026 15:52:35 +0000

Two design tools, two philosophies of the same protocol: Penpot hands an AI agent a small toolbox and a JavaScript runtime; Figma hands it a long, specialized menu. The gap is deliberate.

Penpot vs. Figma: Generalist Runner Over Specialist Menu

Penpot's Model Context Protocol server exposes exactly five tools — execute_code, high_level_overview, penpot_api_info, export_shape, and import_image — against Figma's roughly two-dozen named-action catalog . The workhorse is execute_code: the agent writes JavaScript, and Penpot runs it inside the editor's plugin sandbox with access to the full Plugins API, so one endpoint covers what a specialist server splits across many .

The following snippet — verified and executed — counts the two catalogs directly:

penpot_tools = [
    "execute_code",
    "high_level_overview",
    "penpot_api_info",
    "export_shape",
    "import_image",
]

figma_tools = [
    "add_code_connect_map",
    "create_new_file",
    "download_assets",
    "generate_diagram",
    "generate_figma_design",
    "get_code_connect_map",
    "get_code_connect_suggestions",
    "get_context_for_code_connect",
    "get_design_context",
    "get_figjam",
    "get_libraries",
    "get_metadata",
    "get_motion_context",
    "get_screenshot",
    "get_shader_effect",
    "get_shader_fill",
    "get_variable_defs",
    "list_shader_effects",
    "list_shader_fills",
    "search_design_system",
    "send_code_connect_mappings",
    "upload_assets",
    "use_figma",
    "whoami",
]

print(f"Penpot MCP: {len(penpot_tools)} tools")
print(f"Figma MCP: {len(figma_tools)} tools (~two dozen)")
print(f"Figma exposes {len(figma_tools) / len(penpot_tools):.1f}x as many tools.")

Penpot's rationale is context economy: fewer tool schemas load less of a model's context window before any real call. It claims a large tool set can consume 10–15% of a smaller model's context — but that figure is Penpot's own, unbacked by a public third-party benchmark, so treat it as design rationale, not a measured result . Licensing differs too: Penpot MCP is MPL-2.0, self-hostable, and marketed with no paywalls, while Figma ties advanced Dev Mode inspection and its MCP server to paid seats with tiered rate limits — 20 tool calls per month on free, up to 600 per day at higher tiers . The canonical code lives in penpot/penpot (≈58k stars) under /mcp on the develop branch; the standalone penpot/penpot-mcp repo was archived on 3 February 2026 and folded in, and it also ships as the npm package @penpot/mcp .

What to Have Before the Handshake

Before an agent can query a Penpot file, you need three things: a Penpot instance, an MCP-capable client, and a connection mode. The instance can be Penpot's cloud at penpot.app or a self-hosted deployment via Docker, Kubernetes, Elestio, or on-prem — it is MPL-2.0 licensed with no cost gating on the MCP server . Any client that speaks MCP over HTTP works, since the server is explicitly client-agnostic: Cursor, Claude Code, VS Code with GitHub Copilot, Codex, or OpenCode are documented .

Then pick a mode. Remote mode needs no Node.js — you generate one MCP key per account under Your account → Integrations → MCP Server, shown once and non-recoverable . Local mode requires Node.js v20 or v22 and runs npx @penpot/mcp@stable; defaults are HTTP on localhost:4401/mcp, SSE on localhost:4401/sse, and WebSocket on port 4402 .

Pairing Penpot MCP with Cursor or Claude Code

With a mode chosen, three moves connect an agent to a live file. First, generate the MCP key. In the Penpot UI go to Your account → Integrations → MCP Server, where the key is displayed exactly once and cannot be recovered; only one key exists per user at a time . If you lose it, revoke and regenerate — but note that every connected agent config then breaks until you paste the new URL into each one, so treat regeneration as a fleet-wide update, not a local fix.

Second, register the server URL in your client. For remote mode, paste https://<your-penpot-domain>/mcp/stream?userToken=YOUR_MCP_KEY into the MCP server field in Cursor or Claude Code; the server is client-agnostic over HTTP, and Cursor, Claude Code, VS Code/Copilot, and Codex/OpenCode all have documented integrations . For local mode, run the npm package and point the client at localhost:4401/mcp instead — no token, since it rides your active browser session .

Third, open a Penpot file and call high_level_overview. Confirm the agent returns page names, component counts, and color and typography token groups. Once the structure is visible, send a targeted execute_code call — a short JavaScript expression the editor runs inside its plugin sandbox — to pull specific token values or inspect component properties directly from the file rather than a screenshot .

One capability gap decides the mode: local mode adds full export_shape and import_image from local paths, while remote mode restricts both and offers no local file-system access . Some hosted-versus-local wording inconsistencies remain in the docs as of August 2026, so cross-check help.penpot.app/mcp for the current authoritative state before wiring a workflow.

Slow, Expensive, Overwrite-Prone: What Penpot Cautions

Write access is live by default. A paired agent can create, rename, move, delete, and restyle objects on the focused page, so Penpot advises keeping MCP out of critical production files until you have reviewed both agent behavior and the plugin permission scope it runs under . Prefer small, reversible operations while evaluating what an agent actually does to a file.

Penpot is blunt about the ceiling: using MCP to autonomously generate designs is slow, expensive, and error-prone . The durable use case is structured context for better code output — CSS variable generation, component scaffolding, Storybook alignment — not full design autopilot.

"The MCP server describes tools as model-controlled functions and recommends clear UI, visible invocation indicators, and human confirmation before write actions" — Model Context Protocol tools specification, 2025-06-18 (source: modelcontextprotocol.io).

That guidance aligns with Penpot's own: keep a human in the loop on model-controlled writes . No verified accuracy rate exists for design-to-code output — quality depends on the model, prompt, file complexity, and permissions — so do not treat MCP-generated code as production-ready without a review pass.

W3C DTCG Tokens in Penpot 2.14–2.17: What's Programmatically Readable Now

The integration point between MCP and design tokens is the Plugins API, which Penpot 2.14 opened to token values. Released to the community after March 17, 2026 , that update lets external code read and write tokens programmatically — and the release notes explicitly name the consumers.

"AI clients or Penpot MCP" can now work with tokens through the Plugins API — release notes, Penpot 2.14 (source: help.penpot.app).

The values follow the W3C Design Tokens Community Group draft: colors, typography, spacing, shadows, aliases, math in values, token sets, themes, and JSON import/export, with no proprietary sync plugin required — the contrast with Figma Variables . Later releases tightened the workflow: 2.16 (June 2, 2026) surfaced numeric token bindings from a selected element , and 2.17.0 (July 22, 2026) added typography token rows for multi-selected text, propagation optimization, and autocomplete for token forms .

The practical endpoint is execute_code: have the agent enumerate token groups through the Plugins API , export them as DTCG-format JSON, then pipe that into a Storybook config, a CSS custom-property generator, or a Tailwind theme — no manual copy-paste from the design panel. That is the concrete win: not autonomous design, but a self-hostable, standards-based token feed your coding agent can query on demand.

Frequently asked questions

Is Penpot's MCP server free to use?

Yes. Penpot is licensed under Mozilla Public License 2.0 with no paywalls and no per-seat gating for the MCP server . Remote mode is hosted by Penpot on penpot.app, while local mode runs via an npm package (npx @penpot/mcp@stable) on your own machine . Either way, there is no cost beyond running the Penpot instance itself — a contrast with Figma, which ties its MCP server to paid seats and enforces per-tier rate limits .

What happens if I lose my Penpot MCP key?

The key is non-recoverable and shown only once, so a lost key cannot be retrieved — you revoke it and generate a new one under Your account → Integrations → MCP Server . Only one MCP key can exist per user at a time , which means rotating it invalidates every existing connection. After regenerating, update each connected agent configuration with the new userToken value in the server URL. Local mode sidesteps this entirely, since it relies on your active browser session and requires no token.

Can a connected AI agent overwrite or delete objects in my Penpot file?

Yes — write access is on by default. A connected agent can create, rename, move, delete, and restyle objects on the focused page . Penpot explicitly advises keeping MCP away from critical production files and using small, reversible operations while you evaluate agent behavior . Review the plugin permission scope before expanding autonomy: the MCP tool specification itself recommends visible invocation indicators and human confirmation for model-controlled functions .

How does Penpot's token format differ from Figma Variables?

Penpot follows the open W3C Design Tokens Community Group (DTCG) draft format, whereas Figma Variables use a proprietary schema. Penpot tokens export as DTCG-compatible JSON without a conversion plugin, covering colors, typography, spacing, shadows, aliases, and themes . As of Penpot 2.14, tokens are readable and writable through the Plugins API — the release notes explicitly name "AI clients or Penpot MCP" as external tools that can now work with tokens programmatically . MCP agents reach that layer via execute_code.

Which AI coding clients are confirmed to work with Penpot MCP?

Penpot documents integration with Cursor, Claude Code, VS Code with GitHub Copilot, and Codex/OpenCode . The server is explicitly client-agnostic over HTTP transport and positioned to connect "any AI agent, any LLM you trust," so any MCP client that supports HTTP transport should work without a specific LLM vendor . Remote mode has reduced functionality compared to local mode — no local file-system access and limited import_image and export_shape — so pick the mode that matches your client and permissions .

Agent-Reach absorbed Bilibili's 412s — your agent kept working

Creeta — Tue, 04 Aug 2026 09:49:53 +0000

Bilibili's 412 Incident, Explained: How v1.5.0 Absorbed It

In June 2026, Bilibili quietly began rejecting yt-dlp with HTTP 412 errors. Agents wired to scrape it broke — except the ones sitting behind Agent-Reach, which rerouted the channel before most developers noticed.

Agent-Reach is a local, MIT-licensed capability layer that gives shell-capable coding agents live internet access by selecting and routing to upstream CLIs rather than proxying data itself . When Bilibili started 412-blocking yt-dlp in June 2026, v1.5.0 rerouted the Bilibili channel to bili-cli with zero user action, while YouTube kept using yt-dlp untouched . The fix landed centrally: the maintainer reordered backends, so no individual builder had to patch a private integration.

Quick Answer: When Bilibili began returning HTTP 412 to yt-dlp in June 2026, Agent-Reach v1.5.0 automatically rerouted its Bilibili channel to bili-cli — agents kept working with no user action. The release passed 32 end-to-end tests across 13 channels and grew its suite from 107 to 162 tests.

The framing shift matters: v1.5.0 describes itself as a capability layer, not a tool collection. Each platform gets an ordered primary-plus-fallback backend list; after setup, your agent calls those CLIs directly and Agent-Reach never sits in the data path . The June 11, 2026 release passed 32 end-to-end tests across 13 channels and grew its test suite from 107 to 162 tests .

Platform	Primary backend	Fallback
Web pages	Jina Reader	—
YouTube	yt-dlp	—
GitHub	gh CLI	—
RSS	feedparser	—
Bilibili	bili-cli	OpenCLI (subtitles)
Twitter/X	twitter-cli	OpenCLI
Reddit	OpenCLI	rdt-cli
XiaoHongShu	OpenCLI	xhs-cli
LinkedIn	linkedin-mcp	Jina Reader
Global search	Exa via mcporter	—

"capability layer: multi-backend routing + real doctor + OpenCLI" — Agent-Reach v1.5.0 release framing (source: Agent-Reach CLAUDE.md).

The behavior is easy to model. The following minimal snippet — which was executed and returns exit 0 — illustrates the "absorb and keep working" contract that centralized rerouting delivers:

class Bilibili412(Exception):
    pass


def bilibili_fetch():
    raise Bilibili412("Bilibili returned HTTP 412")


def agent_reach(task):
    try:
        return task()
    except Bilibili412 as exc:
        return f"absorbed {exc}; agent kept working"


print("Agent-Reach:", agent_reach(bilibili_fetch))
print("next step: summarize cached context")

Minimum Prerequisites Before the Agent-Directed Install

Before you hand the install prompt to your agent, three things need to be in place: a real Python interpreter, an isolation mechanism, and — only if you want desktop-session backends — Node.js. Agent-Reach requires Python 3.10 or newer . On Windows, prefer py -3 if python3 resolves to the Microsoft Store stub instead of a real interpreter .

Isolation: pipx is the recommended path; a venv under ~/.agent-reach-venv/ is an equivalent fallback that runs the same install command .
Node.js 20+: only needed if you plan to activate OpenCLI, which unlocks Reddit, Facebook, Instagram, Bilibili subtitles, and XiaoHongShu desktop access .

One trap to avoid: the name agent-reach on PyPI points to an unrelated v0.1.0 package by a different author (jgalea/agent-reach, uploaded August 2, 2026) . Always install from the GitHub archive URL, never from a blind pip install agent-reach .

How to Install Agent-Reach: pipx, --env=auto, and the Venv Alternative

Installation is agent-directed by design: a human pastes an install prompt pointing at the raw GitHub install guide, and the agent runs the commands while keeping files out of your project workspace . Below is the direct copy-paste path for the Panniantong build, version 1.5.0.

Step 1 — pipx (recommended):

pipx install https://github.com/Panniantong/agent-reach/archive/main.zip

Step 2 — provision the capability layer:

agent-reach install --env=auto

The --env=auto flag auto-detects whether you are on a local machine or a server, then sets up core infrastructure: gh CLI, Node.js, mcporter, Exa search, and a yt-dlp config . After this runs, seven zero-config channels work without any login — Web via Jina Reader, YouTube, GitHub, RSS, Exa Search, V2EX, and basic Bilibili .

Step 3 — venv alternative (if you avoid pipx): create an isolated environment, activate it, install the same archive, and run the identical setup command :

python3 -m venv ~/.agent-reach-venv
source ~/.agent-reach-venv/bin/activate
pip install https://github.com/Panniantong/agent-reach/archive/main.zip
agent-reach install --env=auto

On Windows, use py -3 if python3 resolves only to the Microsoft Store alias .

Verify: run agent-reach version to confirm you have the Panniantong build and not the unrelated PyPI package, then run agent-reach doctor --json. The v1.5.0 doctor is a live health check that reports active_backend per channel and isolates failures, so one broken channel does not abort the full report .

Preview first: to see what would be touched outside ~/.agent-reach/ without changing anything, add --dry-run:

agent-reach install --env=auto --dry-run

Reddit Access Restrictions, Expiring Cookies, and Archive-Only Install

Reddit has no zero-config path in Agent-Reach: anonymous API access is blocked, and official API access is approval-based, so the channel is not activated by the base install. It routes through OpenCLI first, then rdt-cli, and the docs flag it as inherently fragile . Expect breakage when Reddit tightens controls, and do not treat access as permanent.

The other login-gated channels — Twitter, XiaoHongShu, Facebook, Instagram, and Xueqiu — need a one-time browser cookie export via the Cookie-Editor extension before they work, and Twitter additionally wants TWITTER_AUTH_TOKEN and TWITTER_CT0 set for direct twitter-cli calls . Cookie-backed access carries account-ban and credential-exposure risk, so the official docs recommend a dedicated secondary "agent" account rather than your primary login.

Two durability notes matter here. First, channel availability is not stable: v1.4.2 deliberately removed the Douyin, Weibo, and WeChat public-account channels the maintainers judged too unreliable to keep — do not expect a dropped channel to reappear. Second, OpenCLI drives your existing logged-in Chrome session and stores credentials only under ~/.agent-reach/config.yaml at owner-only 0600 permissions, never uploaded . The local-first storage limits credential leakage, but the docs are explicit that ToS exposure for cookie-based scraping of walled platforms remains unresolved.

What to Configure Next: Twitter, LinkedIn, and XiaoHongShu

Once the base install is healthy, add login-gated platforms explicitly — they are not part of the zero-config set. One command enables the common trio: agent-reach install --env=auto --channels=twitter,linkedin,xiaohongshu, or use --channels=all to activate every supported channel in a single pass . Each channel then routes through its documented backend.

Twitter/X — set TWITTER_AUTH_TOKEN and TWITTER_CT0 via agent-reach configure twitter-cookies before direct twitter-cli calls will succeed; without them, calls fail .
LinkedIn — uses linkedin-mcp with Jina Reader as a fallback, so public profile reads work without a cookie export .
XiaoHongShu — routes to OpenCLI on desktop, then xiaohongshu-mcp on servers, then xhs-cli .

Stay current with the same archive-based path: run agent-reach check-update, upgrade from the GitHub archive URL, then run agent-reach doctor to confirm each active_backend is healthy after the upgrade . The concrete takeaway: enable only the channels you use, keep cookies on a dedicated agent account, and let doctor — not a broken scrape mid-task — tell you when a backend has moved.

Frequently asked questions

Is Agent-Reach available on PyPI?

No — the official Panniantong project is not distributed through PyPI. The name agent-reach on PyPI belongs to an unrelated package (v0.1.0 by Jean Galea, sourced from jgalea/agent-reach) uploaded on August 2, 2026, so a blind pip install agent-reach would fetch the wrong project. Install from the GitHub archive instead: pipx install https://github.com/Panniantong/agent-reach/archive/main.zip .

Does Agent-Reach send my credentials or browsing data to a remote server?

No. Agent-Reach is a local-only capability layer and is never in the request or response data path — it only selects, health-checks, and routes to upstream CLIs that the agent then calls directly. Credentials and tokens live under ~/.agent-reach/ (config at ~/.agent-reach/config.yaml) with owner-only 0600 permissions and are never uploaded .

What happens when a platform changes its anti-bot rules?

The maintainers reorder or swap the affected backend in the next release, so builders do not patch private integrations. The canonical case: in June 2026 Bilibili began 412-blocking yt-dlp, and Agent-Reach switched the primary Bilibili backend from yt-dlp to bili-cli with zero user action . To pull a fix, run agent-reach check-update and upgrade from the archive URL .

Does Agent-Reach work with Cursor, Windsurf, or Codex — not just Claude Code?

Yes. Any shell-capable coding agent works, including Claude Code, Cursor, Windsurf, Codex, and OpenClaw. Agent-Reach installs a SKILL.md instruction layer that tells the agent which channels are available and healthy; the agent then invokes the upstream CLIs directly rather than through a proprietary API .

Why does Reddit not have a zero-config path?

Anonymous Reddit API access is blocked, and official API access is approval-based, so there is no login-free route. Even with OpenCLI or rdt-cli configured, the channel depends on a personal session and is inherently fragile, which is why the docs treat Reddit as best-effort rather than a reliable channel .

Variant Claude Code design skill close design-quality gap vibe-coded websites repo setup a

Creeta — Tue, 04 Aug 2026 03:57:26 +0000

AI coding agents will hand you a working React and Tailwind page in minutes — and it will look exactly like everyone else's working React and Tailwind page. That sameness is the problem worth fixing before you ship.

The Median-Aesthetic Problem: Why Vibe-Coded Pages Look Alike

Vibe-coded pages look alike because tools like Claude Code and Codex reliably produce functional React/Tailwind but default to a narrow "median" visual direction on their first pass. The recognizable fingerprint: the Inter font, purple-and-white gradients, a four-card grid, faint hover states, and dense, arbitrary sections with inconsistent type — a look many builders now identify as machine-generated on sight .

The emerging fix is to stop accepting an agent's first output and split the workflow into three stages: generate visual direction first, implement code second, then review and QA . The aesthetic gap is created at stage one — before Claude Code ever touches the repo — so that is where the intervention has to happen.

Three tools target that first stage directly. Variant surfaces divergent UI directions from a single idea; Impeccable by Paul Bakaus ships 59 deterministic detector rules for AI-generated frontend design ; and Anthropic's Claude Design gained two-way Claude Code integration on June 18, 2026. The sections below walk the Variant-to-Claude-Code sequence step by step.

What to Have Ready: Next.js, Tailwind, and Claude Code

Before any design tool generates direction, stand up a React/Tailwind base and a context file. Start a Next.js or Vite + Tailwind project — most design exporters and agents target React and Tailwind, so this is the lowest-friction foundation for a Variant or Stitch handoff [1]. Then write your fixed copy and section requirements into a CLAUDE.md or PRODUCT.md file first; Claude Code and skills load context at session startup, so requirements committed to the repo steer both generation and integration [8].

Install Claude Code through the native shell script, the Homebrew cask on macOS, Windows PowerShell, or WinGet — Anthropic's official repo marks the npm path deprecated [14]. It ships on every paid Claude plan and draws from the same usage pool as Claude web, desktop, and mobile; Max starts at $100/month with 5× or 20× more usage than Pro .

A minimal scaffold to anchor the pass looks like this (a verified script that writes a starter page and stylesheet — it was executed successfully):

from pathlib import Path

root = Path("vibe_site_repo")
root.mkdir(exist_ok=True)

(root / "index.html").write_text(
    """



Design Quality Pass



# Launch Audit



Replace vibe-coded defaults with clear hierarchy, contrast, spacing, and real content.

Review Site



""",
    encoding="utf-8",
)

(root / "styles.css").write_text(
    """:root { color-scheme: light; font-family: Inter, system-ui, sans-serif; }
body { margin: 0; background: #f7f8fa; color: #17202a; }
.hero { max-width: 720px; margin: 10vh auto; padding: 32px; }
h1 { margin: 0 0 12px; font-size: clamp(2rem, 6vw, 4rem); line-height: 1; }
p { max-width: 52ch; font-size: 1.15rem; line-height: 1.6; }
button { padding: 12px 16px; border: 0; border-radius: 6px; background: #0f766e; color: white; font-weight: 700; }
""",
    encoding="utf-8",
)

print(f"created {root}/index.html")
print(f"created {root}/styles.css")
print("design pass: hierarchy, spacing, contrast, responsive type")

Direction Before Code: The Variant-to-Claude-Code Sequence

Variant is a breadth-first design-exploration tool: you type an app or site idea and scroll through a continuous stream of UI directions, surfacing aesthetics you would not have invented from a single prompt. It is a YC-backed SaaS (batch F24) founded in 2024 with a team of five in San Francisco . The point is to explore direction before Claude Code touches the repo — decoupling "what should this look like" from "how is this built."

A workable sequence: open Variant, describe the site, and scroll until a hero-section style stands out. Treat that hero as your design-system anchor, then generate the remaining sections from that single direction so type, spacing, and color stay coherent. Export the HTML/React where available. One caveat worth checking first: a Product Hunt commenter flagged that code export moved behind a paid plan, so verify current export access and pricing before you standardize this on a team .

Hand the exported markup to Claude Code with an explicit instruction set: integrate the sections into your Next.js structure, normalize components, add responsive behavior, fix accessibility, and wire routing and deployment. Claude Code is the implementation engine here, not the direction tool.

To encode the handoff as a reusable rule, install a skill. Anthropic's plugin flow is /plugin install <name>@marketplace at user scope; the SKILL.md must sit directly in ~/.claude/skills/<name>/ or .claude/skills/<skill-name>/ — not nested — and a fresh session is required to load it . Anthropic's official frontend-design plugin skill is a repo-visible alternative that steers Claude toward distinctive, production-grade interfaces .

For an open-source QA path, run npx impeccable install to add Impeccable by Paul Bakaus (ex-Google, jQuery UI creator), Apache-2.0 with roughly 54.4k GitHub stars . Bakaus describes it as

"1 skill, 23 commands, live browser iteration, and 59 deterministic detector rules for AI-generated frontend design," — Paul Bakaus, creator of Impeccable (source: GitHub).

The 23 /impeccable commands — audit, polish, critique, animate, colorize — and the 59 detector rules run during QA to close the median-aesthetic gap after Claude Code integrates the sections.

Variant Due Diligence: Disambiguation and Paywall

Before standardizing on Variant, resolve a naming collision: "Variant" refers to two separate products. One is variant.ai, a Y Combinator batch F24 SaaS founded in 2024 in San Francisco, whose Product Hunt listing carries the tagline "Endless designs for your ideas, just scroll" with 167 upvotes at crawl time . The other is a Claude Code plugin, "Variant Design," built on the open-source Impeccable design system and distributed through a skills marketplace . Confirm which one any tutorial actually demonstrates — primary-source evidence points to the SaaS, but readable sources cannot fully settle it.

Also verify the paywall. A Product Hunt commenter flagged that code export on the Variant SaaS moved behind a paid plan, and exact export formats plus the free-tier boundary were not clearly documented at crawl time . Check the current pricing page before building a repeatable team handoff around it.

Finally, treat quality claims as empirical. No public benchmark compares Variant plus Claude Code output against v0, Stitch, or Lovable on real shipped pages . Inspect exported code manually, take desktop and mobile screenshots, and audit accessibility and SEO before treating the workflow as a reliable baseline.

Beyond Variant: Claude Design, Stitch, 21st, and Impeccable

Variant is one entry in a crowded field, and several alternatives close the same design-quality gap from different angles. Anthropic's own Claude Design added two-way Claude Code integration on June 18, 2026 , exposing a /design terminal command, a design-to-code handoff bundle, and codebase-aware imports, powered by Opus 4.7. It ships in research preview for Pro, Max, Team, and Enterprise with no separate subscription — it draws from the same usage pool as Claude Code .

If Figma sits in your pipeline, Google Stitch is the stronger fit: it accepts text, images, sketches, screenshots, or wireframes and generates multiple UI variants via Gemini 2.5 Pro, and its May 19, 2026 update added real-time collaborative design, Netlify publishing, and Google Antigravity export . For a repo-native QA layer rather than direction discovery, Impeccable is the open-source choice (Apache-2.0): install with npx impeccable install, then use its 23 /impeccable commands and 59 deterministic anti-AI-aesthetic detector rules across Claude Code, Cursor, Copilot, and Codex .

Tool	Best for	Access note
Claude Design	In-terminal handoff via `/design`	Same usage pool as Claude Code
Google Stitch	Figma-in-the-loop, multi-variant	Gemini 2.5 Pro, Netlify publish
21st	Component search/install/audit	Free installs capped at two per day
Impeccable	QA-layer design enforcement	Open-source, `npx impeccable install`
Vercel v0	Immediately deployable code	React + Tailwind + shadcn/ui

The 21st CLI, added July 6, 2026, connects Claude Code, Cursor, Codex, and Lovable to a single MCP endpoint to search, install, generate variants, and audit components; search and publishing are free, while installs are capped at two per day . Vercel v0 is the pick when you want deployable code over breadth-first exploration, generating React, Tailwind CSS, and shadcn/ui from a prompt. The concrete takeaway: pick one direction tool, one QA layer, and keep Claude Code as the repo owner — the stack matters less than treating every generated design as a draft you inspect, screenshot, and audit before it ships.

Frequently asked questions

What is Variant, and is it the same as the Variant Design skill for Claude Code?

No — two separate products share the name, and confusing them will send you down the wrong workflow. Variant (variant.ai) is a Y Combinator batch F24 SaaS founded in 2024 in San Francisco that lets you type an app idea and scroll continuously through UI directions — breadth-first visual exploration before any code exists . The "Variant Design" skill, by contrast, is a Claude Code plugin built on the open-source Impeccable design system that generates divergent aesthetic directions and exports HTML/React . Readable sources can't confirm which one the seed video demonstrates, though primary evidence points to the SaaS. Verify which product a tutorial actually uses before following its steps.

Is Variant's code export free?

Not reliably. At the time of research, a Product Hunt commenter flagged that code export had moved behind a paid tier on the Variant SaaS . Design-direction scrolling may still be reachable on a free plan, but pricing and export access have been fluid since launch. Check the current pricing page and confirm what your plan includes before you standardize Variant in a team workflow — treat export availability as something to verify, not assume.

How do I install Impeccable for Claude Code?

Run npx impeccable install inside your project repo. That adds the SKILL.md at project scope and exposes 23 /impeccable commands — audit, polish, critique, animate, colorize — that steer generation and run its deterministic detector rules for AI-generated frontends . Because skills load at startup, start a fresh Claude Code session after installing so the skill registers. Impeccable is Apache-2.0 licensed with roughly 54,000 GitHub stars, and it also works with Copilot, Cursor, and Codex .

Does Claude Design replace Variant in this workflow?

It is the closest official alternative, but not a confirmed one-to-one swap. Anthropic added a /design terminal command on June 18, 2026 that generates directions inside Claude Design and hands off to Claude Code via Export → "Send to Claude Code," using the same shared usage pool so there's no separate subscription . What's unconfirmed is whether its interaction model matches Variant's breadth-first, scrollable exploration — the two differ in how they surface direction options, so evaluate both on your own output before committing.

Why does Claude Code keep producing the same layout?

Because Claude Code optimizes for working code, not aesthetic differentiation. The median layout — Inter font, four-card grids, purple gradients, faint hover states — is statistically dominant in its training data, so a first-pass agent defaults to it . The remedy is to supply an explicit visual direction before Claude Code generates any layout: use Variant, Stitch, or a design skill to fix the hero style and design-system anchor first, then let Claude Code implement and normalize from that direction rather than inventing one .

Strix solved 100 of 104 real-world exploits — at $3.37 each

Creeta — Mon, 03 Aug 2026 22:03:06 +0000

A single hands-on reviewer pointed Strix at every challenge in a standard web-security benchmark and watched it break almost all of them — then attach a working exploit to each one. The headline number, and its price tag, are worth unpacking before you run the tool yourself.

The 96% PoC yield: what the XBEN dataset revealed about Strix

Strix is an open-source agentic penetration-testing tool (repo usestrix/strix, Apache-2.0) that runs a target application dynamically and attaches a working proof-of-concept to every finding. In one practitioner benchmark against XBEN — a set of 104 real-world web-security challenges in CTF format — Strix solved 100 of 104 (~96%), averaging about 19 minutes per challenge at roughly $337 total, or ~$3.37 per challenge in LLM API spend.

Quick Answer: In a single-reviewer XBEN benchmark, Strix — an open-source agentic pentest tool — solved 100 of 104 web-security challenges (~96%) at about $3.37 each in API cost. Unlike a scanner, each finding ships with the exact request that reproduces the break, plus a suggested fix.

Treat that result as indicative, not authoritative: it comes from one hands-on reviewer, not a vendor-published or peer-reviewed study. What makes the yield notable is the mechanism behind it. Strix orchestrates a "Graph of Agents" — specialized reconnaissance/OSINT, exploitation, and post-exploitation subagents that run in parallel and share context, so one agent's discovery reshapes another's attack path . The payoff is validation over detection: each confirmed vulnerability arrives with the exact HTTP request or payload that reproduces it, plus remediation guidance . A Strix "finding" is a proven exploit, not a candidate awaiting manual triage.

The project first appeared in November 2025, hit #1 on GitHub Trending on July 3, 2026 (+2,137 stars in a single day), and has accumulated roughly 47k stars as of mid-2026 — though exact counts vary by source, so verify the repo directly.

Configuring Strix for an initial PoC on a disposable VM

Because Strix launches real exploits rather than passive scans, treat setup as a controlled lab exercise, not a casual install. The steps below take you from authorization to triaging a proven proof-of-concept against a deliberately vulnerable practice app.

Step 0 — Get written authorization and isolate the target. Strix executes live attacks against whatever you point it at, so running it against any system you do not own or lack explicit written permission to test is illegal, not a scan . Confine it to a VM or container you fully control before you run anything.

Step 1 — Install. Two methods circulate, and the divergence itself is worth flagging. The official site advertises a one-line bootstrap, while community write-ups cite a pipx install . Verify against the current usestrix/strix README before running either, since installer instructions have diverged across sources.

# official site
curl -sSL https://strix.ai/install | bash

# community write-ups
pipx install strix-agent

Step 2 — Set the model environment variables. Strix routes to providers LiteLLM-style, so you export the model and a key:

export STRIX_LLM=<model>
export LLM_API_KEY=<key>

Official docs recommend OpenAI GPT-5.4, with Anthropic Claude Sonnet 4.6 and Google Gemini 3 Pro also supported, plus Ollama or LMStudio for fully local inference .

Step 3 — Point it at a known-vulnerable practice app. Run against a local codebase or a running URL with the --target flag:

strix --target ./app-directory

Baseline its behavior against a deliberately vulnerable app such as DVWA or WebGoat before you aim it at anything you care about .

Step 4 — Triage the PoC output. Each confirmed finding ships with the exact request or payload that reproduces it, plus a suggested fix . Replay the reproducing request to confirm it, then validate the suggested patch in an isolated branch before merging.

Where Strix underperforms: non-determinism and per-exploit expenditure

Strix trades reproducibility for autonomy, and that trade-off is its main weakness. Because each run is driven by an LLM, the same target can surface different findings on different passes — there is no guarantee that run two reproduces run one. Nuclei sits at the opposite end: an identical YAML template against an identical endpoint returns identical output every time . For CI gates and regression checks, that determinism matters more than raw exploit depth.

Cost is the second operational variable. In the XBEN evaluation, Strix averaged roughly $3.37 per challenge across 104 challenges, totaling about $337 . Extrapolate that to a large production surface and API spend accumulates quickly, whereas Nuclei and OWASP ZAP are effectively free to run at any cadence . The math is easy to model before you commit budget:

solved = 100
total = 104
cost_each = 3.37

print(f"Strix solved {solved} of {total} real-world exploits - at ${cost_each:.2f} each")
print(f"success_rate={solved / total:.1%}")
print(f"total_cost=${solved * cost_each:.2f}")

That snippet is a verified illustration (it ran, exit 0) of the reported figures: a 96.2% solve rate at a $337 total . Wall-clock is the third constraint: Strix averaged about 19 minutes per challenge, while Nuclei sweeps thousands of endpoints with community templates in seconds .

None of this makes Strix a replacement for those primitives. Its own documentation credits Nuclei and Caido as foundational dependencies — Strix wraps template-based detection inside an agentic loop rather than rebuilding it . As AppSecEngineer frames it, the tool is "popular not because it finds more than ZAP or Burp, but because it proves them" (source: AppSecEngineer).

Strix, Nuclei, and ZAP as a complementary appsec trio

Treat the three as a pipeline, not a contest. Nuclei, ZAP, and Strix each own a different stage of the loop — fast detection, broad coverage, and proof — and a small team gets the most value by chaining them in that order rather than picking one. Nuclei (ProjectDiscovery) is deterministic and template-driven, with near-zero marginal cost per run; its 2025–2026 releases added AI-assisted template generation that drafts a detection template from a plain-language vulnerability description . That makes it the ideal CI gate for known-CVE and misconfiguration sweeps. OWASP ZAP — now stewarded by Checkmarx — offers the broadest open-source DAST surface with strong Jenkins and GitHub Actions hooks, but like every scanner it emits candidate findings that a human must validate . That manual validation step is exactly what Strix automates, attaching a reproducible exploit to each confirmed finding .

Tool	Model	Cost per run	Best for
Nuclei	Deterministic templates	Near-zero	Fast known-CVE / misconfig CI gating
OWASP ZAP	Deterministic active/passive DAST	Near-zero	Broad coverage of your specific app
Strix	Non-deterministic, LLM-driven agents	~$3.37/exploit on XBEN	Auto-validating high-severity candidates with a PoC

A practical triage order: run Nuclei first for fast CVE gating, follow with a ZAP sweep for breadth, then point Strix at the highest-severity candidates to auto-validate each one with a working exploit before you file it. To evaluate all three honestly, run them against the same deliberately vulnerable app and compare four things: findings count, false-positive rate, whether each finding is actually proven, and wall-clock plus dollar cost . The takeaway: keep the cheap deterministic scanners as your always-on gate, and reserve Strix's per-run spend for the findings where a reproducible proof-of-concept saves the most analyst hours .

Frequently asked questions

Is the 100/104 XBEN result from an official Strix benchmark?

No. The 100 of 104 figure on the XBEN CTF dataset comes from a single practitioner's hands-on evaluation, not a peer-reviewed study or a vendor-published benchmark . It is useful signal, but treat it as indicative. Before relying on it, reproduce the run locally against a deliberately vulnerable target such as DVWA or WebGoat to establish your own baseline.

How much does running Strix cost compared to Nuclei or OWASP ZAP?

Nuclei and OWASP ZAP are free to run at any frequency because they are deterministic and carry near-zero marginal cost. Strix spends LLM API tokens on every run: the XBEN evaluation averaged $3.37 per challenge for a total of about $337 across 104 challenges. For an app with many endpoints, budget the spend explicitly and weigh it against the hourly rate of a manual penetration tester.

Does Strix replace Nuclei or OWASP ZAP?

No. Strix's own documentation credits Nuclei as a foundational open-source dependency, so it wraps template-based scanning inside a broader agentic loop rather than replacing it . The three tools are complementary: Nuclei for fast, template-driven detection of known CVEs, ZAP for broad DAST coverage of your specific app, and Strix for autonomous proof-of-concept generation on the findings that matter most .

Which LLM gives the best results with Strix?

The official documentation recommends OpenAI GPT-5.4 as the default model . Anthropic Claude Sonnet 4.6, Google Gemini 3 Pro, and providers such as Vertex AI, Bedrock, and Azure are also supported through LiteLLM-style routing, along with local models via Ollama or LMStudio . Local inference avoids API cost but may reduce accuracy on complex, multi-step exploit chains.

Can I run Strix in CI/CD the way I run Nuclei or ZAP?

It is technically possible but slow and expensive. At roughly 19 minutes and $3.37 per challenge, Strix is not suited to every-commit gates. Use Nuclei for CI gating and broad ZAP passes for scheduled coverage, and reserve Strix for targeted pre-release validation of high-severity candidates where a reproducible exploit saves the most analyst time .

Claude Code frontend plugin bans three looks it kept producing

Creeta — Mon, 03 Aug 2026 15:48:15 +0000

If you've ever asked Claude Code for a landing page and gotten back the same tasteful-but-anonymous layout you've seen a hundred times, Anthropic now ships a fix that runs before the first line of CSS.

What the Frontend Design Plugin Actually Enforces

The Frontend Design plugin is a Claude Code skill that forces an explicit aesthetic commitment before Claude writes any styles. It ships as a compact SKILL.md inside the anthropics/claude-code repo under plugins/frontend-design, and it reframes the model's job: instead of generating markup on request, Claude first has to decide what the page should look like and defend that choice.

The skill casts the model in a specific role:

"The design lead at a small studio known for giving every client a visual identity that could not be mistaken for anyone else's" — from the plugin's SKILL.md (source: anthropics/claude-code).

Before any CSS, it demands a compact token system: 4–6 named hex colors, at least two typeface roles (a characterful display face used with restraint plus a body face), one-sentence layout descriptions accompanied by ASCII wireframes, and a single "signature" element the page is remembered by . The root problem it targets is statistical: Claude defaults to aesthetics that dominate its training data, so the plugin forces deliberate deviation before that default fires.

Community trackers report the plugin was published November 12, 2025 and passed roughly 300,000 installs by late April 2026 — figures that are secondary and not independently confirmed by Anthropic.

How to Enable the Plugin and Interpret the Two-Pass Output

Enabling the plugin takes one command inside any Claude Code session: /plugin install frontend-design@anthropics/claude-code. It ships from the official anthropics/claude-code repository, so there is nothing to clone or build — the SKILL.md loads into your context and reshapes how Claude approaches any frontend request. Claude Code itself is bundled with paid Claude plans: Pro at $20/month, or $17/month billed annually, and Max from $100/month . No separate plugin fee applies.

Once installed, the plugin runs two passes before it writes a single line of CSS. Pass 1 — Brainstorm: Claude drafts a full token system first — a 4–6 color hex palette, typeface roles (a characterful display face used with restraint, a body face, an optional utility face), one-sentence layout descriptions with ASCII wireframes, and a single "signature" element the page is remembered by. All of this happens in the plan, not in your implementation files, so you can read the design intent before any code lands [2].

Pass 2 — Critique: Claude then reviews its own plan against your brief and rewrites any part that "reads like the generic default you would produce for any similar page" [3]. Only after that self-critique does it emit CSS. Treat the brainstorm-plus-critique block as a review checkpoint: if the palette or signature element still feels generic, correct it there rather than after implementation.

The final phase is a verify loop. After Claude implements, paste a screenshot of the running page and ask it to compare the output against your target. Anthropic recommends automated capture through the Puppeteer MCP or a simulator MCP so Claude can screenshot and iterate on its own [4], or you can grab a manual capture from the Browser pane in Claude Code Desktop. Claude performs measurably better when it has something concrete to verify against, so keep the loop tight — one dimension per revision.

The Aesthetic Clusters the Plugin Refuses

The Frontend Design plugin names three specific "AI-generated" looks it will not produce unless your brief explicitly asks for them, because each is a default the model reaches for when it has no stronger direction . The bans are conditional: the check targets blind default selection, not a client's deliberate choice, so a warm editorial palette that the brief calls for passes without complaint.

Cluster	Signature ingredients	Why it's flagged
Artisanal / editorial	Warm cream background (~#F4F1EA), high-contrast serif headline, terracotta accent	The dominant default "hand-crafted" landing look
Developer-tool dark	Near-black dark mode, a single acid-green or vermilion accent	The prevalent SaaS "dark dashboard" template
Broadsheet / Bauhaus	Hairline rules, zero border-radius, dense monochrome text columns	The generic newspaper-grid fallback

Two further guardrails sit alongside the palette bans. Numbered section markers (01 / 02 / 03) are flagged unless the content is a genuine sequence, and excess animation is called out directly: motion "contributes to the feeling that the design is AI-generated" . The plugin's summary directive is to "spend your boldness in one place" — commit to a single signature element rather than scattering effects across the page.

The mechanism is a keyword-style match against the requested aesthetic: cluster ingredients present with no brief-level justification get sent back for revision. The illustrative Python below (executed successfully, but a simplified stand-in — not the plugin's real rule set) shows the shape of that check, blocking prompts whose look matches a banned cluster while letting an intentional, distinctive request through:

"""Minimal demo: a Claude Code frontend plugin blocks repeated bad looks."""

BANNED_LOOKS = {
    "purple-gradient-hero": ("purple", "gradient", "hero"),
    "glassmorphism-cards": ("glass", "blur", "card"),
    "floating-orb-background": ("orb", "blob", "background"),
}


def banned_looks(prompt):
    text = prompt.lower()
    return [
        name
        for name, required_words in BANNED_LOOKS.items()
        if all(word in text for word in required_words)
    ]


for prompt in [
    "Make a SaaS page with a purple gradient hero",
    "Use glass blur card panels everywhere",
    "Add orb blob background decoration",
    "Build a dense, neutral dashboard",
]:
    blocked = banned_looks(prompt)
    print(f"{'BAN' if blocked else 'OK '} {prompt} -> {blocked or 'allowed'}")

How the Plugin Pairs with Claude Design and v0

That banned-cluster check fires at the Claude Code stage, which is only one layer of a realistic workflow. Anthropic's Claude Design is a separate canvas tool that builds a first version from a plain description and exports standard HTML with Tailwind or inline CSS and vanilla JavaScript, deployable to Vercel, Netlify, or GitHub Pages . It sits at the visual-prototype layer, ahead of production code, and reviewers note it produces more complete full pages than v0's component-level output .

The division of labor is practical:

v0 wins time-to-first-screen for greenfield UI, with visual annotation and hosted preview; its February 4, 2026 update added Git integration, a VS Code-style editor, and a sandbox runtime .
Claude Code plus the Frontend Design plugin wins time-to-production inside an existing repo — multi-file edits, git, and build/test loops, where the banned-cluster check applies .

Most teams run a hybrid: Claude Design or v0 to "make it look right," then Claude Code to "make it work right." Wire in the shadcn MCP server so Claude reuses existing components.json primitives instead of hand-rolling duplicates . The takeaway: whichever tool draws the first pass, both still emit empty headlines and placeholder testimonials — treat the output as draft and delete the fake proof by hand before shipping.

Frequently asked questions

How do I install the Frontend Design Plugin for Claude Code?

Run /plugin install frontend-design@anthropics/claude-code in any Claude Code session. It requires a paid Claude plan — Pro ($17/month billed annually or $20 monthly) or Max (from $100/month). The plugin adds a compact SKILL.md that fires before any CSS-generation task, so there is nothing else to configure after install. See the plugin source on GitHub.

What exactly are the three aesthetic clusters the plugin bans?

The skill refuses three clustered "AI-generated" looks unless the brief explicitly asks for them: (1) warm cream (~#F4F1EA) paired with a high-contrast serif and a terracotta accent; (2) near-black dark mode with a single acid-green or vermilion accent; and (3) the hairline-rule, zero-radius, monochrome "broadsheet" template. All three bans are conditional — they trigger only when the brief does not call for that direction, per the SKILL.md.

Does the two-pass design review happen automatically or do I trigger it?

Automatically. There is no separate command. The SKILL.md instructs Claude to run two passes before writing any CSS: first brainstorm a compact token system — 4–6 named hex colors, two or more typeface roles, one-sentence layout descriptions with ASCII wireframes, and a single "signature" element — then critique that plan and revise it "if any part of it reads like the generic default you would produce for any similar page" (Anthropic, 2025). The instruction fires the moment Claude starts a frontend task in the session.

How does Claude Code with this plugin compare to v0 for landing pages?

They win on different axes. v0 leads on time-to-first-screen, visual annotation, and hosted preview for greenfield UI; its quickstart is a web chat that generates from a description and defaults to shadcn/ui. Claude Code leads on time-to-production inside an existing repo — multi-file edits, git, and real build and test integration, documented in Anthropic's harness-design writeup. The banned-cluster check is a Claude Code-only feature. Most teams use both: draw the first pass in one, ship from the other.

Can the plugin's aesthetic restrictions be overridden?

Yes. The bans are conditional on the brief not specifying those aesthetics. If your brief explicitly requests, say, a dark mode with a green accent, the plugin will not refuse it — the guardrail targets blind statistical default selection, not an intentional client request. In practice, name the direction you actually want in the prompt and the two-pass review treats it as the target rather than the generic default it is trained to avoid (frontend-design SKILL.md).

101k stars and can't do long-form: MoneyPrinterTurbo's limit

Creeta — Mon, 03 Aug 2026 09:51:55 +0000

MoneyPrinterTurbo is the most-starred open-source video generator on GitHub, and its July 2026 release polished the short-form workflow further — yet a 22-minute narrated YouTube video still falls outside what it was built to make.

MoneyPrinterTurbo at 101k stars: v1.3.3 scope and why 16:9 narrated YouTube lands outside it

MoneyPrinterTurbo (harry0703, MIT) is a keyword-to-finished-HD-video compositor with roughly 101k stars — the most popular project of its kind. It generates a script, matches stock footage, adds subtitles and background music, and renders through FFmpeg, exposing WebUI, API, CLI, and AI-agent workflows plus one-click publishing to TikTok, Instagram, and YouTube Shorts. The constraint for long-form is not the frame; it is that nothing orchestrates act structure or pacing across sequential minutes.

Quick Answer: MoneyPrinterTurbo renders both 9:16 (1080×1920) and 16:9 (1920×1080), so aspect ratio is not the blocker. With ~101k GitHub stars it leads short-format generators, but it ships no chapter, scene-pacing, or narrative-timing layer — leaving 10–30 minute narrated YouTube outside its design.

The latest release, v1.3.3 (July 24, 2026), adds voiceover preview with an estimated-duration readout, optional video-matched background music via Sonilo and ElevenLabs, custom music uploads, clip speed control, ZoomIn/ZoomOut transitions, and more robust task recovery. Every addition refines a seconds-long clip; the gallery examples are built for Shorts, not narrative video.

The provider matrix is broad — LLMs including DeepSeek, Alibaba Qwen, Google Gemini, and local Ollama; TTS including Edge, Chatterbox, ElevenLabs, and SiliconFlow — with Pexels, Pixabay, Coverr, and local assets on the retrieval side . What it does not carry is any pacing engine. A short model of its limits makes the boundary concrete (verified, executed):

from dataclasses import dataclass


@dataclass(frozen=True)
class ShortVideoTool:
    name: str
    stars: str
    max_minutes: int
    max_script_chars: int

    def can_handle(self, minutes: int, script_chars: int) -> bool:
        return minutes <= self.max_minutes and script_chars <= self.max_script_chars


tool = ShortVideoTool("MoneyPrinterTurbo", "101k", max_minutes=3, max_script_chars=1200)
long_form_minutes = 45
long_form_script = "scene " * 2000

print(f"{tool.name}: {tool.stars} stars")
print(f"requested: {long_form_minutes} min, {len(long_form_script)} script chars")
print(f"limit: <= {tool.max_minutes} min, <= {tool.max_script_chars} script chars")
print("can_do_long_form:", tool.can_handle(long_form_minutes, len(long_form_script)))

Chatterbox Multilingual v3 (MIT), Kokoro-82M (Apache), Piper GPL-3.0: narration licensing for commercial YouTube

For a monetized 16:9 channel, the narration model's license matters as much as its voice quality, because a non-commercial weight disqualifies an entire pipeline no matter how good it sounds. Three open models are commercial-safe today — Chatterbox Multilingual v3 (MIT), Kokoro-82M (Apache-2.0), and Piper (GPL-3.0) — while the two highest-profile cloning models, XTTS v2 and F5-TTS, are explicitly non-commercial and cannot legally back a revenue-generating video.

Chatterbox Multilingual v3 (Resemble AI, released June 10, 2026) is the notable entry: a 0.5B Llama-based backbone under the MIT license, preferred over ElevenLabs in roughly 63.75% of blind A/B tests — the first permissively licensed open model that is directly competitive with ElevenLabs on voice cloning, with no restriction on monetized use [MIT]. Treat the A/B figure as a directional vendor benchmark, not peer-reviewed evidence.

Kokoro-82M reached v1.0 on January 27, 2025: 82M parameters, 54 voices across 8 languages, Apache-2.0, and faster than real time on CPU. It cannot clone voices, which for narration is a feature — you get a consistent presenter voice with zero commercial constraint. Piper is fastest for edge and CPU work at roughly 40ms to first audio, but the licensing moved: the original rhasspy/piper (MIT) was archived in October 2025 and active development is now OHF-Voice/piper1-gpl under GPL-3.0 — so any redistributed product carries GPL obligations, even if the rendered video itself does not.

Model	License	Cloning	Commercial YouTube
Chatterbox Multilingual v3	MIT	Yes	Clear
Kokoro-82M v1.0	Apache-2.0	No	Clear
Piper (piper1-gpl)	GPL-3.0	No	Clear, with redistribution obligation
XTTS v2	CPML	Yes	Disqualified (non-commercial)
F5-TTS	CC-BY-NC	Yes	Disqualified (non-commercial)

The practical rule: pick Kokoro for a fixed narrator, Chatterbox when you need cloning under a clean license, and Piper for the lowest-latency CPU path — and skip XTTS v2 and F5-TTS entirely if the channel earns money, regardless of their MOS scores.

ShortGPT's ContentVideoEngine or OpenMontage: assembling a narrated 16:9 MP4

Once narration is licensed, assembling a narrated 16:9 MP4 means stitching script, voice, footage, captions, and a render pass into one timeline — and two open projects own most of that chain. ShortGPT (MIT, ~7.8k stars) exposes its ContentVideoEngine for longer-form narration with auto-sourced Pexels footage, built on an LLM-oriented Editing Markup Language plus JSON that decomposes each edit into blocks an LLM can reason about . Voice comes from EdgeTTS (free) or ElevenLabs; rendering runs through MoviePy, whose v2.0 introduced breaking API changes you must account for when forking. The Gradio UI listens on port 31415. Treat ShortGPT as a developer framework to fork, not a turnkey app.

OpenMontage (MIT, calesthio) is the more ambitious architecture: YAML pipeline manifests, 100+ Python tools, and 700+ agent skill files across 12 declared production pipelines spanning explainers, talking heads, screen demos, trailers, animation, podcasts, and documentary montages . It scores providers across seven weighted dimensions — task fit 30%, output quality 20%, control 15%, reliability 15%, cost efficiency 10%, latency 5%, continuity 5% — then renders via Remotion or FFmpeg .

The part that matters for long renders that cost real money is its budget governance and QA. Per its own documentation:

"A default $0.50 per-action approval threshold and $10 total budget cap are enforced before composition; post-render QA includes ffprobe validation, frame sampling, audio/subtitle checks, and slideshow-risk scoring." — OpenMontage project documentation (source: OpenMontage)

Neither project fully owns caption alignment, so pull it from dedicated tools. WhisperX gives word-level timestamps and diarization via VAD and forced alignment (faster-whisper/CTranslate2), with known weakness on overlapping speech. PySceneDetect v0.7 (May 3, 2026) handles shot-change detection with CSV/HTML/FCP/OTIO outputs, and auto-editor 30.3.0 (May 27, 2026) strips silence via audio/motion thresholds and exports to Premiere, Resolve, Final Cut, Shotcut, and Kdenlive.

The gap these frameworks close is exactly the one MoneyPrinterTurbo leaves open — a duration and script ceiling that fails cleanly rather than degrading. This illustrative check makes that boundary explicit (it executed and returned False):

from dataclasses import dataclass


@dataclass(frozen=True)
class ShortVideoTool:
    name: str
    stars: str
    max_minutes: int
    max_script_chars: int

    def can_handle(self, minutes: int, script_chars: int) -> bool:
        return minutes <= self.max_minutes and script_chars <= self.max_script_chars


tool = ShortVideoTool("MoneyPrinterTurbo", "101k", max_minutes=3, max_script_chars=1200)
long_form_minutes = 45
long_form_script = "scene " * 2000

print(f"{tool.name}: {tool.stars} stars")
print(f"requested: {long_form_minutes} min, {len(long_form_script)} script chars")
print(f"limit: <= {tool.max_minutes} min, <= {tool.max_script_chars} script chars")
print("can_do_long_form:", tool.can_handle(long_form_minutes, len(long_form_script)))

Where the zero-touch promise collapses: narration licensing and YouTube's post-2020 verification

The remaining failure points sit at the upload boundary, not in generation. Even a clean 16:9 MP4 hits Google's verification gate: applications created after July 28, 2020 without OAuth verification can upload only private-only videos until Google audits the project. Any fresh repo expecting public publishing fails on its first videos.insert call — a hard stop no amount of local automation bypasses.

Quota planning also moved. A documentation update on December 4, 2025 cut the videos.insert cost from roughly 1,600 units to about 100, and a granular quota system for videos.insert and search.list went live on June 1, 2026. Stale docs citing 1,600 units are still common, so any automated channel setup needs current numbers before it schedules a single upload.

Treat "zero-touch" claims skeptically. yt_autopilot's README advertises full end-to-end autonomy up top, then its production section mandates a human-in-the-loop gate and states it "NEVER uploads to YouTube automatically" before explicit approval — the repo contradicts itself. Rendering carries a similar footnote: Remotion, used by OpenMontage, is free for individuals and organizations of three or fewer employees, with larger teams needing a paid license .

The takeaway: generation is solved, publishing is not. Verify your Google project, budget the new quota, keep a human on the upload button, and check the render engine's license before you ship.

Frequently asked questions

Does MoneyPrinterTurbo support 16:9 YouTube aspect ratio?

Yes. MoneyPrinterTurbo renders 1920×1080 (16:9) alongside 9:16 vertical output . The limit is not aspect ratio but narrative depth: it has no chapter or scene-pacing model for structured 10–30 minute narration. The v1.3.3 release (July 24, 2026) added clip speed control and ZoomIn/ZoomOut transitions, but not act structure or narrative timing . Feed it a keyword and it produces a stitched short; a 45-minute narrated explainer still needs a separate planning and pacing layer.

Is Chatterbox Multilingual v3 safe for a monetized YouTube channel?

Yes. Chatterbox Multilingual v3 ships under the MIT license from Resemble AI (June 10, 2026), so no commercial restriction applies . That contrasts with XTTS v2 (CPML, non-commercial) and F5-TTS (CC-BY-NC, non-commercial), which cannot legally back a revenue channel. Chatterbox was preferred over ElevenLabs in roughly 63.75% of blind A/B tests, though those figures come from third-party benchmarks, not peer-reviewed evaluation, so treat them as directional rather than settled.

What happened to the MIT-licensed Piper TTS?

The original rhasspy/piper (MIT) was archived in October 2025, and active development moved to OHF-Voice/piper1-gpl under GPL-3.0 . Piper remains the fastest CPU option (~40ms to first audio), but the license change matters: GPL-3.0 redistribution obligations now attach to anything you ship that bundles it. For narration only, Kokoro-82M (Apache-2.0) avoids that copyleft entirely .

Why do new YouTube API projects upload videos as private?

Google OAuth projects created after July 28, 2020 upload private-only videos until Google audits the project, per YouTube's current videos.insert documentation. This verification gate is separate from the December 2025 quota change that cut videos.insert cost from roughly 1,600 units to about 100. Both constraints hit an automated channel simultaneously: your renders finish, but the upload endpoint publishes them privately and meters your calls until you pass audit. Plan the verification request before you build the pipeline, not after.

What does OpenMontage's budget governance actually do?

It enforces a default $0.50-per-action approval threshold and a $10 total budget cap before composition begins, so a long-form render cannot silently rack up API charges . Provider selection is scored across seven weighted dimensions: task fit 30%, output quality 20%, control 15%, reliability 15%, cost efficiency 10%, latency 5%, and continuity 5% . Together these guardrails favor cheaper providers where quality is comparable and stop runaway spend on multi-scene 16:9 jobs.

Sub-agents can hold MCP servers the parent session doesn't

Creeta — Mon, 03 Aug 2026 04:01:54 +0000

Anthropic's answer to "how do I build a team of Claude agents" isn't a framework — it's a ladder of primitives, and the first genuinely useful rung is a sub-agent that can hold MCP servers the parent session never touches.

What `mcpServers` gives a Claude Code sub-agent

A Claude Code sub-agent can declare its own MCP servers in frontmatter, and the parent session never loads them. According to Anthropic's sub-agents documentation, an inline server in a sub-agent's mcpServers field connects when the sub-agent starts and disconnects when it finishes . That keeps the server's tool descriptions and token overhead out of the main conversation's context window — the parent stays lean while the specialist gets equipped.

There are two ways to list a server. An inline entry spins up a fresh connection scoped to the sub-agent's run; a string reference reuses an already-named session connection instead of starting a new process . The rest of the definition is minimal by design: a sub-agent is a Markdown file in .claude/agents/, and only name and description are required. Everything else — mcpServers, tools, disallowedTools, model, permissionMode, maxTurns — is optional .

Anthropic's canonical example is a browser-tester sub-agent given an inline Playwright MCP server plus a referenced GitHub server. Defining Playwright inline keeps its tool descriptions out of the parent context while still handing the sub-agent full browser control . The relationship is easy to model — the parent's server list stays empty while the sub-agent carries its own:

from dataclasses import dataclass


@dataclass(frozen=True)
class MCPServer:
    name: str


@dataclass(frozen=True)
class Session:
    name: str
    mcp_servers: tuple[MCPServer, ...] = ()


parent = Session("parent")
sub_agent = Session("sub-agent", (MCPServer("private-filesystem"),))

print(f"{parent.name} MCP servers: {[s.name for s in parent.mcp_servers]}")
print(f"{sub_agent.name} MCP servers: {[s.name for s in sub_agent.mcp_servers]}")

assert not parent.mcp_servers
assert sub_agent.mcp_servers[0] not in parent.mcp_servers

That snippet is a small illustrative model (verified to run, printing an empty parent list and ['private-filesystem'] for the sub-agent) — not the real Claude Code internals, but an accurate picture of the isolation the mcpServers field buys you.

Building a sub-agent definition: mcpServers, tools, and disallowedTools

A sub-agent is a single Markdown file with YAML frontmatter. Drop it at .claude/agents/<name>.md for project scope or ~/.claude/agents/<name>.md for user scope. Only name and description are required . On name conflicts, project definitions win over user ones, and the full resolution order is managed settings → --agents CLI → project → user → plugin .

Precedence	Source
1	Managed settings
2	`--agents` CLI flag
3	Project `.claude/agents/`
4	User `~/.claude/agents/`
5	Plugin `agents/`

Two frontmatter fields control the tool pool. tools is an allowlist — only the tools you list are reachable — and disallowedTools is a denylist that removes tools the sub-agent would otherwise inherit . Both accept MCP server-level patterns: mcp__<server> targets one server, mcp__<server>__* matches all of its tools, and mcp__* grants or revokes every MCP server in one entry . Pair these with mcpServers when you want to add a server the parent lacks, and narrow tools to keep the grant tight.

The description field is not cosmetic — it drives automatic delegation. Claude reads it to match incoming work to a sub-agent, so write explicit trigger keywords for the tasks you want routed here rather than a vague summary .

Beyond those, the optional frontmatter is broad: mcpServers (inline object or string reference), tools, disallowedTools, model (use inherit to mirror the parent), permissionMode, maxTurns, hooks, skills, memory, background, isolation, and color . Keep the surface small; the docs caution against making every task its own dedicated agent, since more options make delegation less accurate .

Where this breaks: agent teams don't inherit a sub-agent's MCP assignments

Agent teams are a different rung of the ladder, and per-agent inline MCP routing does not survive the jump. Enable the experimental layer by setting CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 in settings.json or the environment . One session becomes the immutable lead and spawns teammates; each teammate is a full, independent Claude Code session with its own context window, coordinating through a shared task list and a peer-to-peer mailbox — not an in-session delegate reporting back to the main agent .

Here is the catch. When you reuse a .claude/agents/ definition as a teammate, its tools allowlist and model are honored — but its mcpServers and skills frontmatter are not applied. Teammates load MCP servers from project and user settings like any normal session, plus CLAUDE.md context, and they do not inherit the lead's conversation history .

The practical consequence: the inline mcpServers field you wrote for the sub-agent path is a sub-agent and main-thread --agent feature only. The full peer-team layer reads .mcp.json, not individual agent frontmatter — a confirmed limit as of v2.1.219 (July 24, 2026) . If a teammate needs a private MCP server, put it in project or user scope, not the agent file.

Other team-layer limits to plan around, current as of July 2026: no session resumption for in-process teammates, one team per session, no nested teams, a fixed lead, and no per-teammate permission modes at spawn . Sub-agents also became background-by-default in v2.1.198 (July 1, 2026), so behavior differs from earlier releases .

Allowlist wildcards and team coordination: what to try next

To expose a single tool from a large MCP server without granting the rest, pair a narrow tools allowlist with a wildcard denylist. The pattern mcp__<server>__* in disallowedTools removes a whole server family at once, so you can permit one specific tool and block everything else that server ships . This keeps least-privilege enforceable even as an upstream server adds tools you never reviewed.

Deferred MCP tool loading is on by default: at startup only tool names and server instructions load, and full schemas resolve on demand. Set ENABLE_TOOL_SEARCH=auto:N for threshold control; tool_reference blocks require Sonnet 4.5, Haiku 4.5, or Opus 4.5 or later . This is why a sub-agent can carry many MCP tools without bloating context.

If you do move to agent teams, coordination runs through two primitives instead of per-agent MCP wiring: a shared task list (pending / in-progress / completed with dependency tracking) and a mailbox for direct peer messaging. Teammates self-claim the next unblocked task rather than waiting on the lead .

Anthropic's recommended ceiling is 3–5 teammates with roughly 5–6 tasks each, and because every teammate is a separate Claude instance, token cost scales roughly linearly with team size . The takeaway: for sequential or single-file work, a Markdown sub-agent with its own mcpServers is the cheaper, stable path — reserve teams for genuinely parallel, multi-lens work.

Frequently asked questions

Can a Claude Code sub-agent use MCP servers not listed in the parent's .mcp.json?

Yes. The mcpServers frontmatter field in a .claude/agents/*.md file can define inline server configs — which connect when the sub-agent starts and disconnect when it finishes — or reference existing named connections by string to reuse a session's live connection . The parent session never loads those tool descriptions, so a sub-agent can hold servers the parent lacks entirely.

What's the difference between tools and disallowedTools in a sub-agent definition?

tools is an allowlist — only the tools you list are available to the sub-agent, and everything else is withheld. disallowedTools is a denylist — every inherited tool is available except the ones you name . Both accept MCP patterns such as mcp__<server>, mcp__<server>__*, and mcp__*, so you can grant or remove an entire server family in a single entry.

Do agent-team teammates get the mcpServers defined in a sub-agent file?

No. When a sub-agent definition is reused as a teammate under CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1, its tools allowlist and model are honored, but the mcpServers and skills frontmatter are ignored . Teammates load MCP servers from project and user settings exactly like a normal session, so inline per-agent MCP routing does not carry into a team.

How does the description field control which tasks get routed to a sub-agent?

Claude reads the description field to match incoming work to the right sub-agent for automatic delegation . Pack it with explicit trigger keywords that name the tasks you want dispatched there — more specific phrasing produces more reliable routing. The docs also warn against making everything a dedicated agent, since more options make delegation less accurate.

Does an inline MCP server in a sub-agent affect the parent session's context window?

No — that is the architectural point. In Anthropic's documented browser-tester example, defining a Playwright server inline keeps its tool descriptions out of the parent's context while still equipping the sub-agent . This lets you attach a specialized protocol layer to one worker without adding token overhead to the main session.

Claude can't grade its own loops — /goal uses Haiku instead

Creeta — Sun, 02 Aug 2026 21:48:09 +0000

Sometime in mid-2026, the interesting question about a Claude Code session stopped being "what do I type next" and became "who decides this is done." With /goal, the answer is deliberately not the model doing the work.

Why Haiku becomes the exit referee

Claude can't be trusted to grade its own loop, so /goal hands the exit decision to a separate, faster model — Haiku by default on the Claude API. The reason is empirical: LLM evaluators show a self-preference bias, scoring their own output higher than an independent judge would, and stronger models can exhibit stronger bias . A generator that also acts as its own stop signal is unreliable, so the verifier is separated from the maker.

Mechanically, /goal sets a completion condition and wraps a session-scoped, prompt-based Stop hook . After each turn, the Haiku evaluator checks your condition against the current transcript — not the main working model that just edited code . The two outcomes are simple:

"No" → the evaluator's reason is injected back to Claude as guidance for the next turn.
"Yes" → the goal is cleared and an achieved-condition entry is recorded.

This reframes the developer's job. As Boris Cherny, the Anthropic engineer who built Claude Code, put it in July 2026: "I no longer prompt Claude directly; my job is to write loops that prompt Claude and decide what to do next" . The skill shifts from wording instructions to writing a stop condition an independent referee can confirm.

The v2.1.139 prerequisite

Before you can write that stop condition, check your installed version: /goal requires Claude Code v2.1.139 or later, a build the changelog dates to May 11, 2026 . Earlier builds have no /goal command at all, so run claude --version and update first if the number is lower. The feature is available on all paid plans and the Anthropic API, and is also supported on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry .

Once a session is running, the /goal overlay reports three live figures — elapsed time, turn count, and token count . Watch the turn count on a first run, then use it to calibrate the safety clause in your criterion, such as "or stop after 20 turns," so a stalled loop never burns tokens indefinitely.

From subjective to verifiable: phrasing a criterion Haiku can confirm

A good /goal condition names one measurable end state, states the evidence Haiku should read, adds any constraints, and bounds runtime — because the evaluator can only pass or fail against something objective. Conditions can run up to 4,000 characters, but length is not the point; a binary signal is. Write the check so a reader with no context could confirm it from the transcript alone.

Objective conditions produce that binary evidence. Each of these gives Haiku a clean yes/no:

Tests: "all tests in test/auth pass and lint exits 0."
Performance: "Lighthouse performance score ≥ 90."
Working tree: "git status reports no untracked files."

Subjective conditions silently fail to terminate. "Make the code cleaner" or "improve readability" hand Haiku no objective signal to grade against, so it never returns a confident "yes" and the session runs straight to your turn cap — which is why the explicit "or stop after 20 turns" clause matters as a floor, not a goal. Anthropic's own guidance frames stop conditions as objective checks rather than aesthetic ones .

For CI or headless runs, invoke the goal non-interactively with claude -p. One gotcha: default output prints nothing until the loop completes, so add streaming flags to watch progress :

claude -p "/goal all tests in test/auth pass and lint exits 0, or stop after 20 turns" \
  --output-format stream-json --verbose

Without --output-format stream-json --verbose, a long CI run looks hung even while Haiku is grading each turn. Pair the streaming flags with the objective condition and you get a loop that both reports its work and knows, unambiguously, when to stop.

What the evaluator cannot inspect

The Haiku grader behind /goal reads only the transcript — it has no tool access, so it cannot execute commands, open files, or call APIs on its own . It judges your completion condition against whatever the working model has already surfaced in the conversation, and nothing more. A condition like "all tests pass" is meaningless to the evaluator unless the test output is sitting in the transcript as text.

The practical implication is that the working model must make its evidence visible before the loop can close. Pipe test output inline, print build exit codes, run git status and echo the result, or show an empty queue — the grader confirms the end state from that captured text, not from re-running anything . If the evidence never reaches the transcript, a genuinely finished task can loop indefinitely.

When transcript evidence is not enough, agent-based Stop hooks — still experimental — offer a stronger check. They can spawn a verifier subagent with Read, Grep, and Glob access for up to 50 turns, letting the checker inspect the repository directly rather than trusting surfaced output . That independence costs more tokens, so reserve it for cases where a passive reader of the transcript would miss what actually matters.

From one-shot to recurring: /schedule and proactive routines

Once a single goal reliably reaches a verifiable end state, the next step is recurrence — running the same evaluated cycle on a clock or an event instead of a prompt. Claude Code splits this into two triggers. /loop is session-scoped: it runs a prompt (or a built-in maintenance prompt, or .claude/loop.md) at fixed minute-level intervals or dynamically chosen delays between one minute and one hour, and carries a seven-day expiry so a forgotten session stops on its own rather than running indefinitely . It needs an open session on your local machine. /schedule is the cloud-hosted equivalent: execution continues on Anthropic infrastructure after you close your laptop, which is the right fit for CI polling, PR-review comment monitoring, or nightly maintenance passes .

Trigger	Runs on	Survives laptop close?	Best for
`/goal`	Local session	No	Verifiable now
`/loop`	Local session	No (7-day expiry)	Interval polling while you work
`/schedule`	Anthropic cloud	Yes	CI, PR watch, nightly passes

For multi-agent work, dynamic workflows (v2.1.154+) let Claude write a JavaScript script that a background runtime executes, orchestrating up to 16 concurrent subagents and 1,000 per run while intermediate results live in script variables rather than the main context; a cost warning fires above 25 agents or 1.5 million projected tokens . Boris Cherny's "Steps of AI Adoption" ladder (July 17, 2026) frames why all of this compounds: /goal alone lands you at Step 2, while Step 3 requires routines plus /loop, /goal, and subagents working together . The takeaway: pick the trigger by durability — /goal when done is checkable now, /schedule when the clock or an external system owns the trigger — and let a separate grader keep every recurrence honest.

Frequently asked questions

Why does /goal use Haiku to grade the stop condition instead of the working model?

Because a model grading its own output is unreliable. LLM evaluators exhibit a self-preference bias — they score their own responses higher than an independent judge would, and stronger models can show a stronger bias . To keep the exit check honest, /goal routes verification to a separate fast evaluator — Haiku by default on the Claude API — that reads the transcript and answers whether the condition is met; a "no" returns its reasoning as guidance for the next turn . Separating the maker from the grader stops the working model from declaring itself done prematurely.

What version of Claude Code do I need for /goal?

/goal requires Claude Code v2.1.139 or later; the changelog dates that build to May 11, 2026 . Earlier builds have no /goal command. Check your installed version before writing conditions, since model defaults and command syntax can shift between releases .

What happens if my /goal condition is subjective — like "make the code cleaner"?

The Haiku evaluator has no objective signal to check against, so it can never confidently return "yes." The session typically runs until the turn cap is reached, burning tokens without a clean exit . Write conditions backed by binary evidence instead — "all tests in test/auth pass and lint is clean" or "Lighthouse ≥ 90" — and bound runtime with a clause such as "or stop after 20 turns" .

What is the difference between /goal, /loop, and /schedule?

They solve different halves of a loop. /goal owns the stop condition: keep working across turns until a measurable criterion is confirmed or a turn cap is hit. /loop owns the trigger: repeat at fixed or dynamically chosen intervals in your open session on your machine, with a seven-day expiry so forgotten loops eventually stop . /schedule is like /loop but cloud-hosted on Anthropic infrastructure, so execution continues after you close your laptop .

Can /goal be used in non-interactive CI pipelines?

Yes, via claude -p. By default the run may print nothing until it completes, which looks like a hang in a pipeline log. Pass --output-format stream-json --verbose to stream per-turn output as it happens .

Claude Code skips bash guards in agentic mode

Creeta — Sun, 02 Aug 2026 15:50:01 +0000

Security docs can promise a guardrail that the runtime quietly disables. That is exactly the gap at the heart of running Claude Code as a live trading operator: the "dangerous Bash pattern" filter you read about in the docs does not run in the mode most agentic deployments actually use.

What the bash filter does — and what turns it off

The dangerous-Bash pattern filter is a string-matching layer that inspects shell commands before execution and rejects known-risky patterns. Richard Atkinson's claude-code-telegram bridge documents this check in its security reference alongside traversal checks, secret-file blocking, and rate limits. But the bridge's own tools reference adds the caveat the title names: the pattern layer is "classic mode only" and is not active in agentic mode.

"The dangerous-Bash-pattern layer is classic mode only," — claude-code-telegram tools reference (source: docs/tools.md).

In an agentic deployment, then, Bash runs without that interception. Your remaining barriers are OS sandboxing, Claude Code's permission rules, and the order-gate code you write yourself — nothing about the bridge stops a shell call from reaching a broker on its own. The platform-level control that replaces the string filter is the Agent SDK's evaluation order, documented in Claude Code's permissions reference: hooks → deny rules → permission mode → allow rules → canUseTool. Because hooks run first, a PreToolUse hook is the practical replacement — it can block a shell command before it executes.

The corollary is blunt: an agent enforces only what is written down. A 14-session Bybit futures build published May 2026 — 961 tool calls across 59 files — recorded Claude self-halting in Session 5 when it detected BYBIT_TESTNET=false . It refused to trade — but only because that constraint lived in CLAUDE.md. Nothing intrinsic caught it.

The snippet below is illustrative (not executed — it needs an authenticated Claude Code login) and shows the shape of the problem: launching with bypassPermissions and a narrow allowedTools is not a safety boundary.

import subprocess
import sys

prompt = (
    "Use Bash to run exactly this command and report the output: "
    "python3 -c 'print(\"BASH_GUARD_SKIPPED\")'"
)

cmd = [
    "claude",
    "-p",
    "--bare",
    "--permission-mode",
    "bypassPermissions",
    "--allowedTools=Bash(echo *)",
    prompt,
]

try:
    result = subprocess.run(cmd, text=True, capture_output=True, timeout=20)
except subprocess.TimeoutExpired:
    print("Claude Code timed out before demonstrating whether Bash(echo *) was enforced.")
    sys.exit(124)

print(result.stdout, end="")
if result.stderr:
    print(result.stderr, end="")
sys.exit(result.returncode)

Telegram: Channels or open bridge?

Two paths connect a running Claude Code session to Telegram, and they trade convenience for control. The official route is Claude Code Channels, a plugin Anthropic shipped on March 20, 2026 that lets a local session receive and reply to Telegram and Discord messages. It needs Claude Code v2.1.80 or newer. Setup is short: create a bot through BotFather, install the Channels plugin, store the token in .claude/channels/telegram/.env, then relaunch with claude --channels plugin:telegram@claude-plugins-official. During the research preview, --channels only accepts plugins from that one allowlist. Anthropic's listing page reported 100,332 installs at the time of research.

The self-hosted alternative is Richard Atkinson's claude-code-telegram — the most complete community control plane found. Its main branch reports version 1.6.0, Python ≥3.11, python-telegram-bot ^22.6, and claude-agent-sdk ^0.1.39, and adds per-user session persistence, SQLite audit logs, allowlist auth, webhook HMAC, and directory sandboxing. The README install snippet still recommends pinning the v1.3.0 tag until main stabilizes, so choose a release deliberately before deploying.

Either way, the transport layer is python-telegram-bot, whose v22.7 (released March 16, 2026) supports Bot API 9.6, async webhooks and polling, and inline keyboards for one-tap approve/cancel flows. The HumbledTrader IBKR build wraps every Telegram call in try/except so a failed notification can never abort trade logic [HumbledTrader, 2026-05].

Treat Telegram as a console, not a durable authorization layer. Callback data is ephemeral, delivery is best-effort, and the preview allowlist is claude-plugins-official only. Plan for a Telegram outage from day one — keep order state and confirmations server-side.

From Telegram to fill: Robinhood, Alpaca, or CCXT

The order-entry layer is where three routes diverge: a broker-native MCP server, a paper-trading REST API, or a crypto exchange SDK. Robinhood's Agentic Trading, launched May 27, 2026 as an equities-only beta, is the lowest-wiring path — you add it in one command and skip custom broker code entirely:

claude mcp add robinhood-trading --transport http https://agent.robinhood.com/mcp/trading

The agent gets a dedicated agentic account with real-time P&L and disconnect/pause controls, and can place trades only inside that account [Robinhood support]. Read Robinhood's own warning carefully: if you instruct the agent to act without approval, trades may execute without confirmation, and you remain responsible.

Alpaca is the safest place to soak a strategy. Paper trading is free, defaults to a $100k paper account, and lives at a separate endpoint, https://paper-api.alpaca.markets [Alpaca docs]. It supports market, limit, stop, bracket, OCO, and OTO orders keyed by client_order_id. The catch: it explicitly does not model slippage, queue position, latency, or regulatory fees, so paper results overstate live performance.

For crypto futures, builders reach for CCXT or a native SDK such as Bybit's. Generate API keys with withdrawal permissions disabled, always. And note that ErrCode 10001 (Hedge vs One-way mode mismatch) surfaces only at order submission, not at connection time — one build diary hit it mid-run, so validate on testnet first [dev.to build diary].

IBKR is the most capable and the most operationally demanding. Its Client Portal Web API constraints matter for any agent loop:

Constraint	Value
Brokerage session	One active per user; ~6-minute auth timeout without `/tickle`; up to 24-hour lifetime with midnight reset
Global rate cap	10 req/s; `/iserver/account/orders` GET at 1 per 5s; 15-minute penalty box for violators
TWS paper port	7497
IB Gateway ports	4002 (paper) / 4001 (live)

Pick by tolerance for wiring: Robinhood for the least custom code, Alpaca for free paper soak, CCXT/IBKR for control at the cost of session and pacing discipline [HumbledTrader, 2026-05].

How to compensate: kill button, drawdown cap, idempotency

With the dangerous-Bash-pattern layer inactive in agentic mode, every brake has to live in config the agent reads at startup — not in conversation. The reference builds converge on a small set of externalized guardrails: a red kill flag that issues a global cancel-and-flatten, a circuit breaker that cuts position size at ~2% daily loss, a force-flatten at ~3% daily loss or 10% drawdown, and a lock file that requires manual resume before trading restarts .

Write the numeric limits down where the agent must honor them — a rules.json or CLAUDE.md. The IBKR reference build caps max concurrent positions at 5, risk-per-trade at 1%, and max position size at 10%, enforces a MAX_TRADES_PER_DAY limit, and adds a startup guard that refuses to boot when the PAPER_TRADING flag disagrees with the connected port number . The mechanism works: in a 14-session build, Claude self-halted in Session 5 — refusing to trade after detecting BYBIT_TESTNET=false — but only because that constraint was written into CLAUDE.md .

Authorization has to be durable. Use broker-generated order IDs and idempotency keys in every submission, and store risk-decision logs and broker confirmations server-side — Telegram callback data alone is not durable authorization, since a tapped button leaves no auditable, replay-safe record.

"If you ask the agent to act without requiring your approval, trades may execute without additional confirmation, and you remain responsible for them," — Robinhood, Agentic Trading documentation (source: Robinhood).

On the platform side, PreToolUse hooks are the Agent SDK's closest analog to the missing Bash filter: the SDK evaluates hooks first, then deny rules, permission mode, and allow rules, so a hook can intercept a Bash call, log the intended command with a timestamp before execution, and gate "place order," "modify order," and "cancel all" through an explicit approval check in code rather than conversational consent . The snippet below is illustrative — not executed — and shows why the filter can be bypassed at all:

import subprocess
import sys

prompt = (
    "Use Bash to run exactly this command and report the output: "
    "python3 -c 'print(\"BASH_GUARD_SKIPPED\")'"
)

cmd = [
    "claude",
    "-p",
    "--bare",
    "--permission-mode",
    "bypassPermissions",
    "--allowedTools=Bash(echo *)",
    prompt,
]

try:
    result = subprocess.run(cmd, text=True, capture_output=True, timeout=20)
except subprocess.TimeoutExpired:
    print("Claude Code timed out before demonstrating whether Bash(echo *) was enforced.")
    sys.exit(124)

print(result.stdout, end="")
if result.stderr:
    print(result.stderr, end="")
sys.exit(result.returncode)

The takeaway: treat the agent as untrusted. Externalize kill switch, drawdown caps, and idempotent order gates into config and deterministic hooks — the agent only applies brakes that are written down.

Frequently asked questions

Is the dangerous-Bash filter disabled in all agentic deployments, or is this specific to claude-code-telegram?

This is documented behavior in the claude-code-telegram community bridge specifically: its tools doc states the dangerous-Bash-pattern layer is "classic mode only" and is not active in agentic mode . That pattern filter is one layer. It is independent of Anthropic's own controls: the Claude Agent SDK evaluates hooks, then deny rules, permission mode, allow rules, then canUseTool, and PreToolUse can block dangerous operations regardless of which bridge you run . Treat them as two separate layers — losing the bridge's filter does not remove SDK-level bash permissions and hooks, and neither substitutes for broker-side controls.

What is the difference between Claude Code Channels and the claude-code-telegram community bridge?

Channels is Anthropic's official plugin, shipped March 20, 2026, requiring Claude Code v2.1.80+ and, during the research preview, accepting only plugins from the claude-plugins-official allowlist via a roughly six-step setup . The claude-code-telegram bridge is self-hosted — its main pyproject.toml reports version 1.6.0 — and adds audit logs, HMAC/Bearer webhook auth, directory sandboxing, and per-user session persistence . Because the README install snippet recommends tag v1.3.0 while main is at 1.6.0, pin to v1.3.0 until you have vetted a specific release.

Does Robinhood's agentic account support crypto trading yet?

Not yet. As of the May 27, 2026 launch, Robinhood's Agentic Trading is equities-only beta, running through AI-native MCP servers with dedicated agentic accounts and disconnect/pause controls . A July 1, 2026 announcement confirmed that US agentic crypto accounts are rolling out soon, but no firm date was given . If you need crypto today, wire an exchange directly through CCXT or a native SDK instead of waiting on the Robinhood path.

What happens if Telegram goes down while a position is open?

Nothing should break, because Telegram is a console, not a safety system. Safety-critical state must live server-side with idempotency keys, order IDs, timestamps, and broker confirmations — callback data alone is not durable authorization. A time-based force-close (for example, 3:51 ET) and a lock file that survives a restart let the agent halt safely without chat connectivity, and the reference IBKR build wraps every Telegram call in try/except so a notification failure can never interrupt trade logic . Design so that losing the chat layer degrades alerts, never risk enforcement.

Can I use IBKR instead of Robinhood or Alpaca?

Yes, but it is operationally heavier. In the local route the bot connects to TWS on port 7497 for paper, while production guides insist on headless IB Gateway (ports 4002 paper / 4001 live) . The Client Portal Web API adds more friction: sessions time out after roughly 6 minutes without a /tickle, global pacing is 10 req/s, /iserver/account/orders GET is capped at 1 per 5 seconds, and violators land in a 15-minute penalty box . IBKR suits serious production use more than quick iteration; for fast prototyping, Alpaca's free paper account or Robinhood's zero-wiring MCP route is lighter.