Saturday, May 2, 2026

Daily picks

articles scored

#1 GOLDAnnouncementClaude Blog

Claude Security is now in public beta

Claude Security is Anthropic's new AI-powered security scanner, now in public beta for Enterprise customers
Unlike rule-based scanners that flood you with false positives, it reads your codebase like a security researcher — tracing data flows across files, reading Git history, understanding business logic in context
Every finding goes through an adversarial self-verification step before you see it: Claude challenges its own results, which cuts false positives significantly
Scans for high-severity issues (memory corruption, injection flaws, auth bypasses, complex logic errors), proposes a ready-to-review patch for each finding, delivers results via Slack, Jira, or webhooks
You stay in control: every patch needs your review and approval before anything merges — Team and Max plans coming later

#2 SILVERGuideReddit r/ClaudeAI

Running `/loop 30m` overnight with a long Opus 4.7 session hit a hidden cost trap: prompt cache entries expire after ~5 minutes of inactivity, so every loop iteration pays full price to re-cache the entire growing conversation
By hour 20 the conversation had grown to ~800K tokens — each loop pass paid to re-cache all of it at the expensive write rate; the actual PR check outputs were a rounding error
Four concrete lessons: (1) add a stop condition to every `/loop` (e.g., "stop after 3 hours"), (2) use Sonnet for unattended automated tasks — it's ~5x cheaper than Opus and handles polling fine, (3) don't trust the Anthropic dashboard as a real-time budget gauge — it lags by days, (4) long-lived sessions don't save money via caching when your loop interval exceeds 5 minutes

#3 BRONZEReleaseGitHub modelcontextprotocol/rust-sdk

Runtime disabling/enabling of tools without restarting the MCP server — useful when tool availability should change based on context or user state
Session store support for resumability: connections can now survive network interruptions and pick back up mid-session rather than starting from scratch
Origin header validation and Host/Origin rejection logging added for HTTP transport — helps lock down which clients can connect to your MCP server