DEV Community: Dev Learning Tools

AI Coding Agents Explained (With a Real Example)

Dev Learning Tools — Wed, 09 Sep 2026 17:48:16 +0000

AI coding agents have moved past autocomplete: they can read an entire codebase, plan a multi-file change, write it, verify it, and ship it, mostly without step-by-step approval.

I wrote up how that actually looks day to day, since this exact site (devlearningtools.com) is built entirely through a terminal agent (Claude Code): request comes in as plain language, agent reads the existing code first, plans the change, writes it, verifies with a real build, then commits and confirms it's live.

Also compares Claude Code, Codex CLI, Gemini CLI, Cursor, Copilot, and Windsurf, plus a Common Mistakes section from real experience.

Full writeup: https://www.devlearningtools.com/blog/ai-coding-agents-explained

Curious what everyone else's actual workflow looks like.

ColdFusion's September 2026 Security Update: What 2025 Update 13 and 2023 Update 24 Actually Fix

Dev Learning Tools — Wed, 09 Sep 2026 12:55:36 +0000

Adobe recently released ColdFusion (2025 release) Update 13 (build 2025.0.13.331960) and ColdFusion (2023 release) Update 24 (build 2023.0.24.330957) as a coordinated security update across both currently supported versions.

According to the release notes, this update resolves critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, privilege escalation, security feature bypass, and memory exposure, tracked under security bulletin APSB26-119.

Key changes include:

SQL injection prevention — and now validate that table and procedure names are plain SQL identifiers before use.
XSLT security hardening — XmlTransform() now blocks the collection() and uri-collection() functions, in addition to the existing restrictions on doc() and document().
Stricter AJAX widget sanitization — dynamic content now requires GetSafeHTML() before rendering.
Configurable deserialization limits — cfserialfilter.txt now supports settings for maximum array length, nesting depth, and total element count.
If cfgridupdate or cfstoredproc build any part of a query from user-controllable input, or an app runs XmlTransform() against untrusted XSLT, those are the two areas worth checking first.

Full writeup with version numbers and sources: https://www.devlearningtools.com/blog/coldfusion-security-update-september-2026

MCP vs RAG Explained (Complete Beginner Guide with Architecture)

Dev Learning Tools — Wed, 02 Sep 2026 18:56:33 +0000

Two terms you'll keep hearing around modern AI assistants — RAG and MCP. Beginners often assume they're two versions of the same thing. They're not.

The short version: RAG helps AI find information. MCP helps AI use tools.

Think of AI as a new hire at your company. They're smart, but hit two walls immediately:

They don't know your documents (HR policy, product manuals, customer records) — that's the gap RAG fills, by searching your actual current data before answering instead of guessing from stale training data.
Even once they know the answer, they can't send an email or query a database on their own — that's the gap MCP fills, giving AI a standard way to call real tools (Gmail, a database, GitHub, a calendar) instead of a custom integration per app.
RAG's pipeline: your question → an embedding model turns it into a vector → a vector database (Pinecone, Weaviate, pgvector) finds the closest-matching documents → the language model reads them and answers.

MCP's pipeline: the AI client → an MCP client → an MCP server exposing a tool (filesystem, database, calendar) → the real software doing the work, with the result routed back.

The best AI systems use both — RAG to know things, MCP to do things.

I wrote up the full version with architecture diagrams for each: MCP vs RAG Explained

A Free ColdFusion Course With Something Most Tutorials Skip: Interview Questions

Dev Learning Tools — Wed, 02 Sep 2026 18:15:59 +0000

I've been building a free, structured ColdFusion course: Learn ColdFusion — no signup, no paywall.

It covers the basics (variables, loops, conditionals), collections (arrays, structs, queries, JSON), a full OOP module (CFCs, inheritance, polymorphism, interfaces), Application.cfc and scopes, and reusable code (custom tags, cfmodule, cfinclude).

What makes it different from other CFML tutorials: every single lesson ends with interview questions on that topic — real questions, phrased the way they actually come up in interviews, not generic recap quizzes. There's even a dedicated Scopes Interview Questions page. I haven't found this depth of interview prep anywhere else in ColdFusion learning content online.

If you've worked with ColdFusion, I'd love to know what topics you got asked about in interviews — happy to add them to the course.

Is ColdFusion Ready for AI in 2026? (Honest Take)

Dev Learning Tools — Mon, 31 Aug 2026 18:00:06 +0000

AI is changing how developers build software, but what does that mean for developers still maintaining ColdFusion/CFML applications? Is the language excluded from AI development, or just harder to search for?

Short version: ColdFusion doesn't need its own AI model. It just needs to talk to one over an API, the same way it already talks to any other third-party service. That architecture works the same whether you're calling OpenAI, Gemini, or Anthropic.

I wrote up the full breakdown covering document processing use cases, why the API call is actually the easy part (retrieval quality and evaluation matter way more), how the developer skillset is shifting, and where Lucee fits in.

Full post here: https://www.devlearningtools.com/blog/coldfusion-2025-ai-integration

Curious what others think, especially anyone who's actually tried wiring an LLM into a legacy CFML app.