DEV Community: shibayu36

I Added Minimum GitHub Security Settings to My OSS Repositories and Created a Setup Guide

shibayu36 — Tue, 07 Apr 2026 13:00:00 +0000

(This is an English translation of my original Japanese article: 日本語版はこちら)

Recently, attacks on well-known OSS projects hosted on GitHub have become more frequent (e.g., the Nx incident in August 2025 (Japanese)). I decided to learn from these cases and apply minimum security settings to my own repositories.

The following three articles were particularly helpful when considering the settings:

Based on these references, I collaborated with AI to create a minimum setup document, which I'm sharing here. If you have suggestions for additional settings I should include, I'd love to hear them.

GitHub OSS Minimum Security Setup

Checklist

[ ] Enable Dependabot Alerts
[ ] Enable Private vulnerability reporting / Security Advisories
[ ] Enable CodeQL
[ ] Enable Secret scanning & Push protection
[ ] Protect the main/master branch (require PRs + CI)
[ ] Protect version tags
[ ] Add SECURITY.md
[ ] Enable release immutability

Enable Dependabot Alerts (Vulnerability Notifications)

What to do: Get alerts in the Security tab when vulnerabilities are found in your dependencies. Reference

Steps:

Repository > Settings > Advanced Security
Enable Dependabot alerts

Enable Private Vulnerability Reporting / Security Advisories

What to do: Allow external reporters to submit vulnerability reports privately, and display a "Report a vulnerability" option. Reference

Steps:

Repository > Settings > Advanced Security
Enable Private vulnerability reporting

Enable CodeQL (Code Scanning)

What to do: Catch potential vulnerabilities with static analysis. The quickest way is to use the Default setup. Reference

Steps:

Repository > Settings > Advanced Security
Under CodeQL analysis, click Set up > Default
Enable with the suggested triggers (push / PR / schedule)

Enable Secret Scanning & Push Protection

What to do: Detect and alert when tokens, API keys, or other secrets are committed.

Steps:

Repository > Settings > Advanced Security
Enable Secret scanning (or Secret Protection)
Enable Push protection

Protect main/master Branch (Require PRs + CI)

What to do: Block direct pushes and require CI to pass before merging. GitHub offers either the traditional "Branch protection" or the more flexible "Rulesets." Rulesets can target both branches and tags. Reference

Steps:

Repository > Settings > Rules > Rulesets
New branch ruleset
Target main (or master) (e.g., Default branch / pattern matching)
Enable rules:
- Enforcement status: Active
- Add Repository admin to bypass list
  - This is because I do releases on the main branch — ideally, I'd remove this bypass too
- Target branches: Include default branch
- Restrict deletions
- Require a pull request before merging
- Require status checks to pass
  - Use "Add checks" to select your CI jobs (e.g., ci / test)
  - Note: The checks you want to require must have run at least once so GitHub recognizes the check name. Reference
- Block force pushes
- Require code scanning results

Protect Version Tags

What to do: Restrict who can create version tags.

Steps:

Repository > Settings > Rules > Rulesets
New tag ruleset
Enable rules:
- Enforcement status: Active
- Add Repository admin to bypass list
- Target tags: v*
- Restrict creations
- Restrict updates
- Restrict deletions
- Require signed commits
- Block force pushes

Add SECURITY.md

What to do: Document how to report vulnerabilities so reporters don't use public Issues. You can create and commit the template directly from GitHub's UI. Reference

Steps:

Repository > Security > Set up a security policy
Edit and commit SECURITY.md

Minimal template (copy & paste):

# Security Policy

## Supported Versions

Only the latest version is supported with security updates.
Please always use the latest release.

## Reporting a Vulnerability

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, report a vulnerability through GitHub's security advisory feature at https://github.com/<owner>/<repository_name>/security/advisories/new.

You can expect an initial response within a few days. If for some reason you do not, please follow up with a comment on the advisory to ensure we received your original report.

Enable Release Immutability

What to do: Prevent GitHub Tags, Releases, and Release assets from being modified after creation. Reference (Japanese)

Steps:

Repository > Settings > General, then enable "Enable release immutability"

Added File Search and Canvas Retrieval to slack-explorer-mcp

shibayu36 — Tue, 10 Feb 2026 17:00:00 +0000

(This is an English translation of my original Japanese article: 日本語版はこちら)

slack-explorer-mcp is an MCP server that lets AI agents search and retrieve Slack messages and threads. It's useful for investigating historical context like "why was this designed this way?" from Slack. For details, see Making Historical Context Easily Discoverable from Slack with AI - Building slack-explorer-mcp.

I added search_files and get_canvas_content tools so that AI agents can also read files and canvases shared on Slack.

search_files Tool

This tool searches for files within Slack, including canvases, PDFs, images, and more. You can filter results by file type, channel, user, and date range.

With slack-explorer-mcp installed, you can search Slack files like this:

"Search for PDFs shared in the dev-team channel"
"Search for canvases containing the word 'design document'"

get_canvas_content Tool

This tool retrieves HTML content by specifying a canvas ID. It can fetch up to 20 canvases at once.

I wanted AI to be able to read Slack canvas content, but file search alone doesn't return the actual content — you need to download it separately. Since the best approach for feeding content to AI varies by file format, I started with canvas support only.

When you retrieve canvas content, it returns HTML. The original canvas HTML contained a lot of unnecessary ID attributes and style information, which was wasteful in terms of token usage. So I made it automatically strip unnecessary attributes before returning the content. This reduces token consumption when passing the content to AI.

For example, you can:

Search for canvases and then have the AI summarize their content
Have the AI answer questions based on the content of a specific canvas

Summary

If you have slack-explorer-mcp set up with your AI agent tools, you can now search Slack files and retrieve canvas content. Try it out when you want to use AI to search files in Slack or have it read canvas content.

References

I Created Claude Skills for Convenient Pull Request Review Operations from Claude Code

shibayu36 — Sun, 04 Jan 2026 17:00:00 +0000

(This is an English translation of my original Japanese article: 日本語版はこちら)

When using Claude Code or Claude Code Action to have AI autonomously review Pull Requests, I encountered several issues. To solve them, I created a Claude Skill specialized for PR review operations called github-pr-review-operation. Let me introduce it here.

The Problems

I faced these three issues:

When adding inline comments, the AI would comment on the wrong line
- Claude Code Action comes with an MCP for adding inline comments, but it often placed comments about a specific line on a different line
Even when instructed to "consider past comments on this PR," it couldn't properly retrieve the comment list
- It would fetch regular comments but proceed without getting inline comments
It couldn't properly reply to comments on the PR
- It would reply to a specific comment by creating a separate inline comment instead

All these issues could be solved by properly using gh commands, but due to the probabilistic nature of LLMs, sometimes it worked and sometimes it didn't.

Teaching Claude Code the Operations with Claude Skills

As mentioned, the solution was to teach Claude Code how to use gh commands. Claude Skills seemed perfect for this purpose, so I created a custom Claude Skill specialized for PR review operations.

When creating Skills, it's good to use the Skill Generator that's built into Claude by default. I used the following prompt in Claude Desktop to create the base, then made various adjustments while testing it:

I want to create a skill for GitHub Pull Request reviews with the necessary operations. The required operations are:

- Get PR title and description
- Get PR file changes
- Get all comments on the PR
- Comment on the PR
- Add inline comment with line specification
- Reply to a specific comment on the PR

The final result was a very simple structure with just SKILL.md. Using this alone solved the above issues almost 100% of the time. Very convenient!

SKILL.md:

---
name: github-pr-review-operation
description: "Skill for GitHub Pull Request review operations. Executes PR info retrieval, diff viewing, comment fetching/posting, inline comments, and comment replies using gh commands. Use for PR reviews, code reviews, and PR operations."
---

# GitHub PR Review Operation

PR review operations using GitHub CLI (`gh`).

## Prerequisites

- `gh` installed
- Authenticated with `gh auth login`

## Parsing PR URL

Extract the following from PR URL `https://github.com/OWNER/REPO/pull/NUMBER`:
- `OWNER`: Repository owner
- `REPO`: Repository name
- `NUMBER`: PR number

## Operations

### 1. Get PR Information

```bash
gh pr view NUMBER --repo OWNER/REPO --json title,body,author,state,baseRefName,headRefName,url
```

### 2. Get Diff (with line numbers)

```bash
gh pr diff NUMBER --repo OWNER/REPO | awk '
/^@@/ {
  match($0, /-([0-9]+)/, old)
  match($0, /\+([0-9]+)/, new)
  old_line = old[1]
  new_line = new[1]
  print $0
  next
}
/^-/ { printf "L%-4d     | %s\n", old_line++, $0; next }
/^\+/ { printf "     R%-4d| %s\n", new_line++, $0; next }
/^ / { printf "L%-4d R%-4d| %s\n", old_line++, new_line++, $0; next }
{ print }
'
```

Output example:
```
@@ -46,15 +46,25 @@ jobs:
L46   R46  |            prompt: |
L49       | -            (deleted line)
     R49  | +            (added line)
L50   R50  |              # Review guidelines
```

- `L number`: LEFT (base) side line number → Use with `side=LEFT` for inline comments
- `R number`: RIGHT (head) side line number → Use with `side=RIGHT` for inline comments

### 3. Get Comments

Issue Comments (comments on the entire PR):
```bash
gh api repos/OWNER/REPO/issues/NUMBER/comments --jq '.[] | {id, user: .user.login, created_at, body}'
```

Review Comments (comments on code lines):
```bash
gh api repos/OWNER/REPO/pulls/NUMBER/comments --jq '.[] | {id, user: .user.login, path, line, created_at, body, in_reply_to_id}'
```

### 4. Comment on PR

```bash
gh pr comment NUMBER --repo OWNER/REPO --body "Comment content"
```

### 5. Inline Comment (specifying code line)

First, get the head commit SHA:
```bash
gh api repos/OWNER/REPO/pulls/NUMBER --jq '.head.sha'
```

Single line comment:
```bash
gh api repos/OWNER/REPO/pulls/NUMBER/comments \
  --method POST \
  -f body="Comment content" \
  -f commit_id="COMMIT_SHA" \
  -f path="src/example.py" \
  -F line=15 \
  -f side=RIGHT
```

Multi-line comment (lines 10-15):
```bash
gh api repos/OWNER/REPO/pulls/NUMBER/comments \
  --method POST \
  -f body="Comment content" \
  -f commit_id="COMMIT_SHA" \
  -f path="src/example.py" \
  -F line=15 \
  -f side=RIGHT \
  -F start_line=10 \
  -f start_side=RIGHT
```

**Notes:**
- `-F` (uppercase): Use for numeric parameters (`line`, `start_line`). Using `-f` makes it a string and causes an error
- `side`: `RIGHT` (added lines) or `LEFT` (deleted lines)

### 6. Reply to Comment

```bash
gh api repos/OWNER/REPO/pulls/NUMBER/comments/COMMENT_ID/replies \
  --method POST \
  -f body="Reply content"
```

Use the `id` obtained from comment retrieval for `COMMENT_ID`.

Key Implementation Detail: Enabling Correct Line Placement for Inline Comments

Getting inline comments on the correct line was the most challenging part, requiring the most adjustments after auto-generating the Skills.

Let me explain why inline comments ended up on wrong lines. When you get a diff with the gh pr diff command, you get output in git diff format. For example, an excerpt from https://github.com/shibayu36/slack-explorer-mcp/pull/20 looks like this:

diff --git a/main.go b/main.go
index 3029a7a..9383209 100644
--- a/main.go
+++ b/main.go
@@ -3,6 +3,7 @@ package main
 import (
        "context"
        "log/slog"
+       "net/http"
        "os"

        "github.com/mark3labs/mcp-go/mcp"
@@ -163,17 +164,55 @@ func main() {
                handler.SearchUsersByName,
        )

-       if err := server.ServeStdio(s, server.WithStdioContextFunc(func(ctx context.Context) context.Context {
-               ctx = WithSlackTokenFromEnv(ctx)
+       transport := os.Getenv("TRANSPORT")
+       if transport == "" {
+               transport = "stdio"
+       }
+
+       switch transport {
+       case "stdio":
+               if err := server.ServeStdio(s, server.WithStdioContextFunc(func(ctx context.Context) context.Context {
+                       ctx = WithSlackTokenFromEnv(ctx)

-               // Add session ID from ClientSession
-               if session := server.ClientSessionFromContext(ctx); session != nil {
-                       ctx = WithSessionID(ctx, SessionID(session.SessionID()))

When adding inline comments, you need to specify a line number + side (LEFT for deleted lines or RIGHT for added lines):

gh api repos/OWNER/REPO/pulls/NUMBER/comments \
  --method POST \
  -f body="Comment content" \
  -f commit_id="COMMIT_SHA" \
  -f path="src/example.py" \
  -F line=15 \
  -f side=RIGHT

Because of these two API interfaces, to add an inline comment after getting the diff, you need to extract line numbers from lines like @@ -163,17 +164,55 @@ func main() {, consider the - or + at the beginning of lines, determine whether side should be LEFT (deleted) or RIGHT (added), and use that combination for commenting. This extraction operation is difficult for LLMs (even with Opus 4.5), which caused the issue of inline comments being placed on wrong lines.

However, thinking about it more, if you look at GitHub's web "Files changed" page, the information needed for inline comments is immediately visible:

So I thought, why not create the same information from the CLI? That's how I created the command in section "2. Get Diff (with line numbers)" of SKILL.md:

gh pr diff NUMBER --repo OWNER/REPO | awk '
/^@@/ {
  match($0, /-([0-9]+)/, old)
  match($0, /\+([0-9]+)/, new)
  old_line = old[1]
  new_line = new[1]
  print $0
  next
}
/^-/ { printf "L%-4d     | %s\n", old_line++, $0; next }
/^\+/ { printf "     R%-4d| %s\n", new_line++, $0; next }
/^ / { printf "L%-4d R%-4d| %s\n", old_line++, new_line++, $0; next }
{ print }
'

Using this to get the diff from https://github.com/shibayu36/slack-explorer-mcp/pull/20, you can get similar information to the web "Files changed" page in text format:

@@ -163,17 +164,55 @@ func main() {
L163  R164 |            handler.SearchUsersByName,
L164  R165 |    )
L165  R166 |
L166      | -   if err := server.ServeStdio(s, server.WithStdioContextFunc(func(ctx context.Context) context.Context {
L167      | -           ctx = WithSlackTokenFromEnv(ctx)
     R167 | +   transport := os.Getenv("TRANSPORT")
     R168 | +   if transport == "" {
     R169 | +           transport = "stdio"
     R170 | +   }
     R171 | +
     R172 | +   switch transport {
     R173 | +   case "stdio":
     R174 | +           if err := server.ServeStdio(s, server.WithStdioContextFunc(func(ctx context.Context) context.Context {
     R175 | +                   ctx = WithSlackTokenFromEnv(ctx)
L168  R176 |
L169      | -           // Add session ID from ClientSession
L170      | -           if session := server.ClientSessionFromContext(ctx); session != nil {
L171      | -                   ctx = WithSessionID(ctx, SessionID(session.SessionID()))

Now Claude Code can easily get the information needed for inline comments from the L163 R164 | format on the left, allowing it to place comments on the correct lines.

Conclusion

In this article, I introduced a Claude Skill that's useful when having AI autonomously review Pull Requests using Claude Code or Claude Code Action. You can use it just by placing the SKILL.md described above under .claude/skills/github-pr-review-operation/. Give it a try!

How Data Formatting (Line Breaks and Indentation) Affects LLM Response Accuracy in RAG

shibayu36 — Mon, 20 Oct 2025 16:30:00 +0000

(This is an English translation of my original Japanese article: 日本語版はこちら)

In slack-explorer-mcp, instead of returning permalink URLs for each message in the response, I have the AI Agent on the client side construct them. This is because including permalinks for every message would consume a significant amount of tokens. Since permalinks can be reconstructed from other data already provided, I omit them and let the client side build them to save tokens. However, this approach has been inconsistent—sometimes it works well, sometimes it doesn't.

Currently, slack-explorer-mcp returns large responses in one-line JSON format. I wondered if changing to formatted JSON with line breaks and indentation (which is more human-readable) would also improve accuracy for LLMs.

So this time, I evaluated how data formatting methods (presence or absence of line breaks and indentation) affect LLM response accuracy. Please note that the test case volume and data size for this evaluation are limited (100 list items, about 16 test cases), so consider these results as a reference.

Experiment location: shibayu36/playground/extract-slack-url-eval

Conclusion

From this evaluation, I found three things:

Formatting with line breaks and indentation doesn't particularly improve accuracy
The stronger the LLM model, the less impact formatting has on accuracy
For RAG, it's best to choose the most token-efficient format

Incidentally, I recently came across discussions that there are differences in response accuracy based on data format, but these differences diminish as LLM models become stronger. While those discussions evaluate differences between data formats like Markdown, CSV, and JSONL (rather than the presence of line breaks and indentation), they seem to reach similar conclusions.

Evaluation Method

I used a tool called promptfoo for the evaluation.

First, I prepared dummy data mimicking the message search responses returned by slack-explorer-mcp as RAG test data. I created three format variations for this data:

oneline JSON: JSON format without line breaks or indentation
pretty JSON: JSON format with line breaks and indentation
CSV: Comma-separated CSV format. Included to check performance with a token-efficient format that includes line breaks

Here's an example of the actual dummy data. For details, see messages-pretty.json.

{
    "workspace_url": "https://example.slack.com",
    "messages": {
        "matches": [
            {
                "user": "U012ABC3DEF",
                "text": "Sharing detailed investigation results on BigQuery materialized view deduplication\\n\\nFrom the investigation, we found the following:",
                "ts": "1756096495.765749",
                "channel": {
                    "id": "C01ABC2DE",
                    "name": "general"
                }
            },
            {
                "user": "U023DEF4GHI",
                "text": "Got it!",
                "ts": "1756096501.234567",
                "channel": {
                    "id": "C01ABC2DE",
                    "name": "general"
                },
                "thread_ts": "1756096495.765749"
            },
            ...

I designed the prompt to include information for generating Slack permalinks and output only the permalink URL:

Your role is to construct the permalink URL for a single Slack message specified by the user from Slack message data. Use the information below to construct the permalink URL.

# How to construct the permalink
Response includes workspace_url, channel.id, and ts (timestamp) which can be used to construct Slack permalinks:
- Regular message (no thread_ts field): {workspace_url}/archives/{channel.id}/p{ts without dot}
- Thread reply (has thread_ts field): Same URL with ?thread_ts={thread_ts}&cid={channel.id}

# Output format
Output only the permalink URL.

# Slack message information
{{RAG data}}

# Let's begin
Please construct the Slack permalink URL according to the instructions below.

{{input}}

I prepared 16 test cases. For example, here are some test case inputs. See here for all test cases.

I want the URL for the 3rd message
URL of the message discussing BigQuery

Additionally, for the evaluation models, I selected both the latest models and slightly older models to observe differences due to model performance:

gpt-5-2025-08-07 (latest)
gpt-4.1-mini-2025-04-14 (slightly older small model)
claude-sonnet-4-5-20250929 (latest)
claude-3-7-sonnet-20250219 (slightly older)

Results

The accuracy rates across the 16 test cases were as follows:

Model	oneline JSON	pretty JSON	CSV
gpt-5	100% (16/16)	100% (16/16)	100% (16/16)
gpt-4.1-mini	62.50% (10/16)	43.75% (7/16)	68.75% (11/16)
claude-sonnet-4-5	62.50% (10/16)	68.75% (11/16)	75% (12/16)
claude-3-7-sonnet	56.25% (9/16)	56.25% (9/16)	43.75% (7/16)

gpt-5 achieved an impressive 100% accuracy rate across all formats, showing no difference based on format. For other models, the format with the highest accuracy varied.

From these results, I confirmed that adding line breaks and indentation doesn't improve accuracy, and furthermore, as models become stronger, the differences due to formatting disappear.

Summary

From this evaluation, I found that when passing list data to LLMs in RAG, formatting for readability with line breaks and indentation doesn't particularly improve accuracy. Additionally, as LLM models become stronger, differences due to formatting disappear. Since gpt-5 already achieved 100% accuracy, this trend will likely continue.

Paradoxically, these results suggest that for RAG, it's best to choose the most token-efficient format. In the RAG data used this time:

oneline JSON: 6,479 tokens
pretty JSON: 9,144 tokens
CSV: 4,784 tokens

Since CSV format is the most token-efficient, it would be reasonable to adopt CSV format for slack-explorer-mcp as well.

A Detailed Workflow for Creating an MCP Server that Returns MySQL Schema Information Using Vibe Coding

shibayu36 — Wed, 08 Oct 2025 17:10:00 +0000

(This is an English translation of my original Japanese article: 日本語版はこちら)

The MCP server that provides compressed MySQL schema information I introduced previously was largely built using Vibe Coding. While researching Vibe Coding techniques, I found many tips but couldn't find detailed examples of actual AI conversations and workflows, which was frustrating.

So in this article, I'll share the specific Vibe Coding process I used when implementing this tool. I hope this helps others who are struggling to understand the concrete approaches like I was.

When building this MCP server, my overall Vibe Coding approach was:

Built the core functionality almost entirely through Vibe Coding with minimal code review, just runtime verification
Since Vibe Coding didn't work well for initial test structure setup, I manually created this part
From there until this point, I made changes like test creation, refactoring, and text/template implementation. I used Vibe Coding as the main approach while manually adjusting parts that didn't work well.

I'd like to share some implementation examples from this process. In this repository, up to this commit tree, I actively committed files in .cursor/ and docs/ directories, so looking at those alongside will be helpful.

Basic Workflow

Before starting implementation, chat with AI to brainstorm requirements and create a requirements.md file
When implementing something: first ask AI to design it in chat => write out the design including TODO lists in docs => reload those docs and have AI code based on them
- However, if it's not complex design and won't exceed context length limits, you can implement directly without writing to docs
When making spec or design changes during development, document them in docs

I primarily used Cursor's Agent with Gemini 2.5 Pro model. Occasionally used o4-mini or Claude 3.5 Sonnet. I didn't use memory bank or MCP servers.

Examples

Requirements.md Brainstorming

Let me start with an example of brainstorming requirements. I began with questions like this and had AI help define requirements:

I continued chatting quite casually:

What I want to do is configure which database to connect to via environment variables, then have two tool calls:
- Output table list
- Output table details

What would be good tool names?

After continuing the conversation, when I felt we had something reasonable, I said "Please reflect our conversation so far into requirements.md" and had it written out.

What was created then is here. As you can see, at this point the AI didn't understand the MCP server concept.

So I continued to help AI understand MCP server concepts while updating requirements.md. Since I thought the reference material https://modelcontextprotocol.io/quickstart/server would be useful for implementing MCP servers, I first asked ChatGPT to create summary material:

I want to prepare reference material for AI when implementing MCP Server.
Please read the material at https://modelcontextprotocol.io/quickstart/server and create markdown information for AI to read

After placing the created material in docs/, I loaded it and created requirements.md again. The commit is here. This produced a requirements.md that seemed to understand MCP server tool concepts.

Please also refer to the diff up to this point.

Implementing list_tables

Next, let me introduce an example of implementing list_tables, a tool function that outputs summary information for table lists in a specific database. The overall picture is here.

Since I had a TODO list for list_tables implementation in my head, I implemented it step by step with Vibe Coding.

First, I created the part that outputs only table names and table comments. When creating this, I used Cursor's @ reference to load docs/ and asked to start with design rather than writing code. The chat flow was roughly:

@main.go I want to create list_tables. First, please think about what kind of design to use without writing code @docs

How about we start by listing table names and table comments?

Please read @https://github.com/mark3labs/mcp-go/blob/main/README.md and examine the content that listTablesHandler should return more carefully

After repeating chat like this and feeling the design was reasonable, I generated code all at once:

Looks good. Please reflect this implementation in main.go

Similarly, I also created the PK, UK, FK output parts using this flow.

Refactoring to Use text/template

After creating all functional requirements with the approach explained above, let me also introduce an example of refactoring to use text/template.

The code initially created with Vibe Coding used string concatenation for text assembly. To improve readability, I considered using text/template and implemented it through Vibe Coding. The overall picture is this.

The approach was the same as previously introduced: first have AI design in chat => write out the design including TODO lists in docs => reload those docs and have AI code. I started with questions like this:

I continued chatting, asking questions like:

Should template-related processing go in view.go? Are there other good file names?

When I felt the design was roughly complete, I had it written to docs. What was created then is this (though this doc wasn't committed and includes describe_tables text/template work too).

Let's go in that direction. Could you write out the design so far to docs/onetime/20250427-use-template.md?

Then I moved to the implementation phase. After loading the document and having AI create a TODO list:

Let's go step by step. What should we do first?

After that, I repeated the flow of generating code one step at a time, staging it in git, then implementing the next step. I committed when list_tables text/template conversion was complete.

I then created the describe_tables side using the same flow to complete the refactoring.

Thoughts After Trying Vibe Coding

Among various models I tried, Gemini 2.5 Pro was quite good. Not sure if it's because of the long context length or other reasons
- However, Gemini has a tendency to write excessive code comments, which was very annoying
Setting up .cursor/rules/ is essential
- For example, without rules like 000-global.mdc, code generation became quite chaotic and difficult. Reference: https://qiita.com/masachaco/items/c56bd601576ed9612f6c
- I also prepared 100-go-test.mdc to inform about Go test execution methods
For newer technology specs or library usage, prepare separate docs and load them when needed
- I prepared a summary of MCP server implementation documentation and a summary of mcp-go usage
- Having many such references on hand seems important
While I used agent delegation as a constraint to understand Vibe Coding this time, for anything other than throwaway code or tools maintained only by myself, it seems better to use Vibe Coding for PoC then adjust or rewrite code yourself

Summary

In this article, I introduced the specific workflow for creating an MCP server that returns MySQL schema information using Vibe Coding. Since there are many articles about Vibe Coding but few concrete examples, I hope this helps people with similar concerns.

Improving Code Generation Accuracy by Automatically Searching for Similar Examples After Referencing Documentation

shibayu36 — Mon, 06 Oct 2025 16:00:00 +0000

Recently, when using AI for code generation with tools like Claude Code's slash commands, I've found that automatically searching for similar examples after referencing documentation improves generation accuracy compared to just referencing documentation alone. In this article, I'll introduce this method.

Documentation-only generation often leaves room for improvement in subtle nuances

When generating code, it's well-known that referencing team-established rules such as coding conventions and database design guidelines before generation produces better accuracy than generating code from scratch. Given LLM characteristics, explicitly stating team rules rather than having no rules obviously generates something closer to those standards.

However, using documentation alone often left me feeling "it's mostly correct, but something feels off about the details." For example, the writing style might be slightly different from other parts of the project.

Automatically search for similar examples after referencing documentation

I believe the reason for getting "mostly correct but different" results is that documentation typically contains a summary of project rules and doesn't capture all the subtle nuances. Indeed, when we implement something ourselves, we often reference rule documentation first, then read through similar code in surrounding areas before making flexible decisions like "let's align with this writing style."

So I thought: what if we follow a similar flow by automatically searching for code similar to what we're about to generate after referencing documentation, and then generate code? I tried this approach, and while it's based on subjective experience, the accuracy improved.

For example, here's a slash command for generating database ALTER TABLE statements. The key point is not manually providing similar files yourself, but automatically searching for files similar to what you're about to create (step 3 in the procedure):

---
allowed-tools: Read, WebFetch, TodoWrite, Grep, WebSearch, Search
description: "Create database migration files"
---

You are a MySQL expert creating database migrations.

## Procedure
1. Understand the requirements written in $ARGUMENTS
2. Read the database design guideline @docs/db-guideline.md
3. Load 5 similar migration files from existing migration files
    - Search for about 5 files in the `migrations/` directory that make similar changes and check the writing rules
    - Pay special attention to the following:
        - Indentation
        - Which ALTER TABLE format is preferred
        - Naming conventions
        - Type handling
        - NULL permission handling
        - DEFAULT writing style
        - COMMENT writing style
4. Create migration files based on guidelines and similar implementations
    - Write accurate SQL following MySQL 8 syntax

## Important Notes
- **Follow conventions**: Always follow the conventions written in the documentation
- **Consistency**: Maintain consistency with existing code
- **Verification**: Confirm that the generated code matches the project's style

Now let's start generating migration files according to $ARGUMENTS.

The same concept can be applied to various cases

I think this concept of "automatically searching for similar examples after referencing documentation" can be applied to various cases. For example, when applied to blog writing where you want to generate text similar to your own style, it would look like this:

When writing articles, always refer to @WRITING.md.
Also, from the content of the article you're about to write, randomly pick several recent similar articles and:

- Use their structure as reference
- Mimic the writing style as much as possible

Articles are stored under the shibayu36.hatenablog.com/ directory.

Summary

In this article, I introduced a method to improve the accuracy of code generation and text generation by automatically searching for similar examples after referencing documentation. While this is based on subjective experience, the subtle details became much less concerning, so I encourage you to give it a try.

Creating Project-Specific Commit Messages with Claude Code Subagents

shibayu36 — Tue, 23 Sep 2025 10:15:13 +0000

When developing with Claude Code, I often face the problem of overly verbose commit messages being generated. I recently discovered that the newly released subagents feature can solve this problem, so I'd like to share how to set it up.

The Problem with Claude Code's Commit Messages

When you ask Claude Code to execute git commit after implementing features, it generates extremely verbose commit messages like this:

Add describe_tables e2e test and refactor MCP initialization

- Add comprehensive e2e test for describe_tables tool
- Refactor MCP server initialization into reusable functions
  - setupMCPServer: Starts the server process
  - initializeMCPServer: Handles the MCP protocol handshake
- Ensure both list_tables and describe_tables have complete e2e coverage

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Claude Code's generated commit messages have several issues:

They include excessive implementation details in bullet points
They reflect the conversation context from the session
They don't consider the project's preferred simple message style

In worse cases, they even include trial-and-error processes like "Initially tried this approach, but got errors, so abandoned it and ended up doing this instead." This happens because the session's conversation context influences the message generation.

Solving It with Subagents

Claude Code's subagents feature allows you to delegate specific tasks to independent agents with separated context. I thought this could isolate commit message generation from conversation context and create messages tailored to project conventions.

First, I used the /agents command to generate a subagent configuration file, then made some adjustments to create the following setup. Here's what this subagent does:

Check README.md and CLAUDE.md for project commit message rules and conventions
Analyze detailed changes in git added files
Study the project's commit history to learn message patterns
Generate commit messages following project conventions
Propose the generated message to the parent session

Full content of .claude/agents/git-commit-message-generator.md

---
name: git-commit-message-generator
description: "Use this agent when you need to generate appropriate commit messages for staged files in a git repository. Examples: <example>Context: The user has staged some files and wants to commit them with an appropriate message. user: 'I've staged some changes to the authentication system. Can you help me create a commit message?' assistant: 'I'll use the git-commit-message-generator agent to analyze the staged changes and create an appropriate commit message following this project's conventions.' <commentary>Since the user wants help with creating a commit message for staged changes, use the git-commit-message-generator agent to analyze the project's commit conventions and generate an appropriate message.</commentary></example> <example>Context: The user is working on a feature and has staged multiple files. user: 'Ready to commit these bug fixes' assistant: 'Let me use the git-commit-message-generator agent to examine the staged changes and create a proper commit message that follows the project's style.' <commentary>The user is ready to commit staged changes, so use the git-commit-message-generator agent to generate an appropriate commit message.</commentary></example>"
model: sonnet
---

You are a specialized agent for generating git commit messages! ✨ You are responsible for creating appropriate commit messages that follow project conventions for staged files.

## Your Work Process

### 1. Check Project Commit Rules
- Check CLAUDE.md and README.md files for any rules or conventions about commit messages
- If found, follow those rules as top priority

### 2. Analyze Staged Files
- Run `git diff --cached` to check detailed changes in staged files
- Identify the nature of changes (new features, bug fixes, refactoring, documentation updates, etc.)
- Evaluate the scope and importance of changes

### 3. Analyze Project Commit History
- Run `git log --oneline -10` to check recent commit message formats
- Pay special attention to these aspects:
  - Language (Japanese, English, or other)
  - Message structure (single-line vs multi-line format)
  - Prefix usage (feat:, fix:, docs:, etc.)
  - Writing style and tone patterns
  - Character count tendencies
  - Other distinctive patterns

### 4. Generate and Propose Commit Message
- Based on the analysis above, generate a commit message that perfectly matches project conventions
- The message should accurately and concisely describe changes and be easily understood by future developers
- End with "Please run git commit -m 'generated message' yourself"

## Important Notes

- **Do NOT execute git commit** - Only propose messages and leave the actual commit to the parent session
- Respect existing project patterns and maintain consistency
- For complex changes, summarize appropriately while not missing important information
- Ask for clarification if anything is unclear

## Error Handling

- If no files are staged, report this
- If not in a git repository or git-related errors occur, report appropriately
- If project conventions can't be determined, follow general best practices and explain this

Your goal is to provide project-optimized messages that developers can confidently commit! Good luck! 💪

An important design choice was not letting the subagent execute the commit itself. The reason is that if the subagent commits directly, you can't adjust the message if you want to. Instead, I have it end with "Please run git commit -m 'generated message' yourself", so the parent session executes git commit. This allows message adjustments if you're not satisfied with it.

Results from Actual Usage

Usage is simple - just say "create a commit message" after doing git add. Claude Code will automatically launch the subagent. If it doesn't launch automatically, you can explicitly say "create a commit message with the subagent".

Let's look at an actual session log. While developing slack-explorer-mcp, I was implementing a feature to add workspace URL to responses. When I asked for a commit message afterward, it generated a simple message:

Add workspace URL to search_messages response

I'm including the session log below. You can see how the subagent properly analyzes and generates a message following project conventions, and the parent session executes git commit.

Full session log

> git add completed, subagent commit

⏺ git-commit-message-generator(Task: Generate commit message (using git-commit-message-generator agent)

                              Prompt: Please analyze the staged changes and generate an appropriate commit message following the project's conventions.)
  ⎿  Agent Response:
     No special commit message rules in CLAUDE.md. Let me analyze recent commit history patterns!

     Project Commit Message Pattern Analysis 📊

     1. Language: English
     2. Structure: Simple single-line format
     3. Prefix: None used (no feat:, fix:, etc.)
     4. Style: Imperative mood starting with verbs (Add, Update, Implement, Refactor, etc.)
     5. Character count: Around 50-70 characters

     Change Analysis 🔍

     Looking at staged changes:

     handler.go:
     - Added WorkspaceURL field to SearchMessagesResponse struct
     - Added workspace URL extraction from first message permalink when messages exist

     handler_test.go:
     - Updated existing tests to assert workspace_url is included in response
     - Added test case for when no messages found (workspace_url should be empty string)

     This is adding workspace URL return functionality to search_messages response!

     Proposed Commit Message ✨

     Following existing project patterns, I propose this commit message:

     Add workspace URL to search_messages response

     Reasons for this message:
     - Starts with imperative verb "Add" matching the pattern
     - Accurately and concisely describes the change
     - 51 characters, appropriate length
     - No prefix, matching project style

     Please run git commit -m "Add workspace URL to search_messages response" yourself!
  ⎿  Done (4 tool uses · 20.2k tokens · 27.2s)

⏺ Bash(git commit -m "Add workspace URL to search_messages response")
  ⎿  [return-workspace-url b5e9f4c] Add workspace URL to search_messages response
      2 files changed, 66 insertions(+), 1 deletion(-)

⏺ Commit completed! 🎉

Conclusion

Using Claude Code's subagents feature successfully solved the verbose commit message problem. Since introducing this setup, I rarely need to manually edit commit messages. If you're experiencing similar issues with Claude Code development, I recommend giving this approach a try.

Added Streamable HTTP Support to Slack Explorer MCP

shibayu36 — Mon, 22 Sep 2025 12:01:00 +0000

I've added Streamable HTTP support to Slack Explorer MCP, which I introduced in this article. Now you can easily connect from ChatGPT and other AI tools via Remote MCP by hosting it somewhere. Let me share how to use it.

Here's how to launch it:

# Launch in Streamable HTTP mode (default port: 8080)
docker run -i --rm --pull always \
  -e TRANSPORT=http \
  -p 8080:8080 \
  ghcr.io/shibayu36/slack-explorer-mcp:latest

# Launch with custom port
docker run -i --rm --pull always \
  -e TRANSPORT=http \
  -e HTTP_PORT=9090 \
  -p 9090:9090 \
  ghcr.io/shibayu36/slack-explorer-mcp:latest

When running with default settings (http://localhost:8080), you can add the MCP server to Claude Code like this. The Slack token is passed through the X-Slack-User-Token header.

claude mcp add \
  --transport http \
  --header "X-Slack-User-Token: xoxp-..." \
  -- slack-explorer-mcp http://localhost:8080/mcp

Why I Wanted Streamable HTTP Support

I wanted to add Streamable HTTP support to make it easier for non-engineers to use.

With the previous stdio communication, people needed to set up Docker locally and run containers... While this is simple for developers, it creates a barrier for others.

With Streamable HTTP support, you can host it somewhere and connect from ChatGPT and other tools. No more local environment setup required.

Technical Background: Cache and Stateful Implementation

I'd like to share a technical challenge I faced - I had to implement this as a stateful service.

When adding Streamable HTTP support, it's easier to implement it stateless. That way you can easily deploy to serverless platforms like Lambda. However, Slack Explorer MCP caches Slack's user list, so I couldn't make it stateless.

Therefore, I implemented it as a stateful service with in-memory cache management per session. The cache has an expiry mechanism, and I use goroutines to periodically clean up expired entries to prevent memory leaks.

You can see how this is implemented in user_repository.go which handles cache management.

Summary

I added Streamable HTTP support to Slack Explorer MCP to make it more accessible for non-engineers. While the cache implementation was challenging, I'm happy with the result.

Making Historical Context Easily Discoverable from Slack with AI - Building slack-explorer-mcp

shibayu36 — Tue, 02 Sep 2025 22:44:04 +0000

When working on engineering projects, we often need to understand "why things are the way they are now." Even after reading the code, it's often unclear why certain design decisions were made or why specific specifications exist.

Historical context is often preserved in commit logs, GitHub Pull Requests, and Slack discussions. By combining these sources, we can discover the background behind design decisions, the reasoning for specification choices, and troubleshooting processes that aren't visible in the code itself.

However, finding past discussions in Slack can be quite challenging because:

Finding the right search queries for the problem is difficult
Extracting the information you need from search results is time-consuming
Unlike commit logs or GitHub Pull Requests, there are limited ways for AI agents to directly access Slack information

To make it easier to discover historical context using AI agents, I created an MCP server called slack-explorer-mcp that can retrieve Slack discussions. This has made tracking down historical context incredibly efficient. Let me introduce this tool today.

https://github.com/shibayu36/slack-explorer-mcp

What is slack-explorer-mcp?

slack-explorer-mcp is an MCP server specifically designed to retrieve Slack messages and thread information using a Slack User Token. It can be used with MCP-compatible AI agents like Claude Code, Claude Desktop, and Cursor.

Key features include:

Message search (with advanced filtering by channel, user, date range, reactions, file presence, and more)
- Most features available in Search in Slack are supported
Retrieving thread replies
Fetching user information (by User ID or Display name)

Installation and Setup

For detailed installation instructions, please refer to the README.md. Basically, you just need to create a Slack App to obtain a User Token, then add the MCP server to your MCP-compatible AI agent like Claude Code or Cursor.

If you have Docker installed and want to add it to Claude Code, you can use the following command with your User Token:

claude mcp add slack-explorer-mcp -- docker run -i --rm --pull always -e SLACK_USER_TOKEN=xoxp-your-token-here ghcr.io/shibayu36/slack-explorer-mcp:latest

Example 1: Investigating Historical Context

Let me share some specific examples of when this tool is useful.

Finding Why a BigQuery Table Became a Materialized View

Recently, I was wondering "Why is this BigQuery table a materialized view?" I could ask Claude Code to investigate with a prompt like:

Find out from Slack discussions why the foo_summary table in BigQuery is a materialized view.

The AI then investigated the historical context through the following process:

Thinking of search queries and performing an initial search
Based on the results, creating more specific search queries for several additional searches
Reading all content when threads are found

Through this investigation process, it created a summary like "The table was changed to a materialized view at [specific time] for [specific reason]." If you request permalinks, it will also return links to the actual logs so you can verify the details.

Investigating Current SaaS Contract Terms

Questions like "Why is this SaaS on an annual contract?" or "Why is the quota limit set to this number?" can also be investigated from past Slack content. For example:

Research from past Slack discussions why the oo SaaS service is on an annual contract and why the quota limit is set to this specific number

Example 2: Other Useful Applications

Since this tool leverages the Search in Slack functionality, it can be used for various purposes beyond investigating historical context.

Summarizing weekly topics in a specific channel
- Summarize all topics discussed this week in the #random channel
- Analyzes the week's conversations in the specified channel and lists main topics. Useful for weekly reviews and understanding team trends
Summarizing who you talked to and what you discussed today
- Summarize who shibayu36 talked to today and what they discussed
- Can summarize a specific user's daily activities. Useful for writing daily reports or summarizing someone's activities

Conclusion

With slack-explorer-mcp, you can easily search and analyze past Slack discussions from Claude Code or Cursor. Try it out when you need to understand historical context that isn't visible in code, or when you want to summarize team activities. I think you'll find it quite useful!

References

Appendix: Differences from Other MCP Tools

While there are other MCP tools for Slack, I created this new one because existing tools had some limitations for my use case.

ubie-oss/slack-mcp-server
- Provides various bot-perspective operations with many features
- To focus only on information retrieval, you need to add the bot to many channels, which was inconvenient for casual information gathering
- Should be useful when you want AI agents to operate Slack bots
korotovsky/slack-mcp-server
- Similar to this tool, offers many features for information retrieval
- However, it requires browser authentication tokens, which I felt was quite poor security practice, so I didn't want to use it

DEV Community: shibayu36

I Added Minimum GitHub Security Settings to My OSS Repositories and Created a Setup Guide

GitHub OSS Minimum Security Setup

Checklist

Enable Dependabot Alerts (Vulnerability Notifications)

Enable Private Vulnerability Reporting / Security Advisories

Enable CodeQL (Code Scanning)

Enable Secret Scanning & Push Protection

Protect main/master Branch (Require PRs + CI)

Protect Version Tags

Add SECURITY.md

Enable Release Immutability

Added File Search and Canvas Retrieval to slack-explorer-mcp

search_files Tool

get_canvas_content Tool

Summary

References

I Created Claude Skills for Convenient Pull Request Review Operations from Claude Code

The Problems

Teaching Claude Code the Operations with Claude Skills

Key Implementation Detail: Enabling Correct Line Placement for Inline Comments

Conclusion

How Data Formatting (Line Breaks and Indentation) Affects LLM Response Accuracy in RAG

Conclusion

Evaluation Method

Results

Summary

Related Links

A Detailed Workflow for Creating an MCP Server that Returns MySQL Schema Information Using Vibe Coding

Basic Workflow

Examples

Requirements.md Brainstorming

Implementing list_tables

Refactoring to Use text/template

Thoughts After Trying Vibe Coding

Summary

Improving Code Generation Accuracy by Automatically Searching for Similar Examples After Referencing Documentation

Documentation-only generation often leaves room for improvement in subtle nuances

Automatically search for similar examples after referencing documentation

The same concept can be applied to various cases

Summary

Creating Project-Specific Commit Messages with Claude Code Subagents

The Problem with Claude Code's Commit Messages

Solving It with Subagents

Results from Actual Usage

Conclusion

Added Streamable HTTP Support to Slack Explorer MCP

Why I Wanted Streamable HTTP Support

Technical Background: Cache and Stateful Implementation

Summary

Making Historical Context Easily Discoverable from Slack with AI - Building slack-explorer-mcp

What is slack-explorer-mcp?

Installation and Setup

Example 1: Investigating Historical Context

Finding Why a BigQuery Table Became a Materialized View

Investigating Current SaaS Contract Terms

Example 2: Other Useful Applications

Conclusion

References

Appendix: Differences from Other MCP Tools