Second pack shipped: senior-engineer workflows as Claude Code slash commands

Léa Moreau — Mon, 13 Jul 2026 16:14:35 +0000

I shipped a second small pack this week: 10 Claude Code slash commands, 4 subagents, 3 hook recipes and 2 templates, built from the same discipline as the MCP kit: no fix without a reproduction, no refactor without a test harness, no "optimization" without a measurement.

Commands like /ship, /fix-issue, /refactor-safe, /test-first and /security-pass turn those rules into two-keystroke invocations instead of paragraphs you retype every session. Plain Markdown, no build step, everything editable.

10 commands: ship, fix-issue, review, refactor-safe, test-first, security-pass, perf-pass, doc-sync, release-notes, onboard.

4 subagents: test-writer, bug-hunter (read-only, zero-false-positive discipline), docs-writer (no-fluff contract), dep-auditor.

3 hook recipes: auto-format on edit, block edits to protected paths (lockfiles, migrations, .env), tests-must-pass-before-stopping.

$9, one developer / unlimited projects: https://leamoreau1988.gumroad.com/l/claude-code-power-pack

Happy to answer questions about any of the commands in the comments.

Notes on running an MCP server in production

Léa Moreau — Fri, 10 Jul 2026 10:52:57 +0000

Most MCP tutorials stop at a single stdio tool. These notes cover what I had to change once a server of mine had actual users, in the order the problems appeared.

Logging corrupts the protocol if you let it

The stdio transport uses stdout for JSON-RPC frames. A single console.log, including one buried in a dependency, breaks the stream. The symptom is a client that disconnects for no visible reason, and nothing in the error output points back to the cause.

The fix is unglamorous. Every log line goes to stderr through a small structured wrapper, and that entire class of bug disappears.

Plan for the second transport early

Editor clients (Claude Desktop, Claude Code, Cursor) talk stdio to a local process. Hosting the same server for a team requires Streamable HTTP, and the refactor is painful if the code assumes one global server instance.

I build everything behind a factory now:

export function createServer(config: Config): McpServer {
  const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
  registerTools(server, config, log);
  registerResources(server);
  registerPrompts(server);
  return server;
}

The stdio entrypoint calls it once at startup. The HTTP handler calls it per request and keeps no session state. Request isolation comes from the structure rather than from discipline, and horizontal scaling requires no coordination between replicas.

Validate configuration at boot

A malformed environment variable should stop the process immediately with a readable message, instead of surfacing hours later as strange behavior. I parse all config with Zod at startup.

Tool inputs get the same treatment. Declare them as Zod schemas and the SDK validates every call before your handler runs, so handlers only ever receive typed, checked arguments.

Treat a fetch tool as a proxy

A tool that fetches URLs is an HTTP proxy driven by a language model, and the model reads untrusted text all day. Mine enforces four limits: http and https only, an optional hostname allowlist, a byte cap on responses, and a timeout. Without the allowlist, a prompted model can probe your internal network from inside your infrastructure. This is a standard SSRF vector.

Test against the real server, in memory

The SDK provides InMemoryTransport.createLinkedPair(). A real client connects to the real server inside the test process, with no sockets and no subprocess management. My suite exercises tools, resources and prompts this way and completes in a few seconds on Node 20, 22 and 24.

Update (July 11): @skillselion points out in the comments that the in-memory pair structurally cannot catch stdout corruption, the exact bug this post opens with, because it bypasses the real stdio framing. He is right. The template now ships a subprocess smoke test next to the in-memory suite: it spawns the actual entrypoint with the SDK's StdioClientTransport and completes an initialize plus tools/list exchange over a real pipe, so anything that pollutes stdout fails CI instead of disconnecting a user.

His other two points are covered too. The suite now asserts the serialized tools/list payload stays under a size budget, since every rich .describe() string and nested Zod object ends up in what each client downloads at session start. And a raw JSON-RPC test confirms the server correctly echoes back an older supported protocol version when a client requests one, instead of forcing the latest, which matters for long-lived editor clients that pin older revisions.

The template

I assembled these pieces into a template I now start every server from: both transports, the guarded fetch tool, the test setup, Docker and CI. It costs $19 and lives on my Gumroad page. The notes above contain most of the design, so building your own from them is a perfectly reasonable choice too.

If production has bitten you somewhere I did not list, leave a comment. I am collecting these.

DEV Community: Léa Moreau