Jonathon's AI Wiki

Five OSS Tools That Fix Claude Code's Blind Spots

5 min read

Source: raw/The_5-Tool_Fix_for_Claude_Code_s_Worst_Habits.md — YouTube operator tutorial (hqcZZuvBUSY), demoed live inside a Next.js 16 project.

An operator walkthrough framing Claude Code’s recurring weaknesses as four blind spots — it forgets everything, ignores your codebase, ships bugs, and codes blind — and pairing each with an open-source tool that closes it. The value isn’t any single tool (two are already in the wiki) but the composed workflow: navigation context, then security, then performance, then persistent memory, then a visual verification loop. A useful “harden my Claude Code setup” checklist for vibe-coders working in existing codebases.

Key Takeaways

  • Blind spot → fix, at a glance:
    • Ignores your codebase → Intent Layers (hierarchical AGENTS.md navigation).
    • Copies bad patterns / insecure code → DeepSec (Vercel security harness) + the Vercel React/Next.js best-practices skill.
    • Forgets everything → agentmemory (persistent memory server).
    • Codes blind → Claude Code + Chrome (visual verification loop).
  • Intent Layers — an OSS skill that generates a hierarchical AGENTS.md tree: a root index plus child files for any directory over ~20K tokens, each documenting that directory’s conventions, global invariants (project facts that break from the model’s training data), important patterns, and antipatterns. The worked example: a Next.js 16 project using proxy.ts (not the trained-on middleware.ts) — without the invariant documented, the agent “fixes” the missing middleware and breaks the build. Cuts context waste by giving the agent pointers instead of making it read whole directories. Same hierarchical-AGENTS.md idea the wiki tracks via the synthadoc pattern.
  • DeepSec — Vercel’s security harness (npx deepsec): scan (find candidate files by matcher) → process (batch deep-dive) → report grouped by severity. The video’s example find: an unescaped recipe string injected into a build system prompt → prompt-injection hole, with a concrete patch recommendation. ~$20-30 in tokens per run on a small project. Already covered in depth in DeepSec — Vercel Vulnerability Scanner.
  • Vercel React/Next.js best-practices skill — skills add vercel-labs agent-skills → the React/Next.js best-practices audit. Flags issues by severity with both the wrong and the correct implementation inline (e.g. three independent fetches awaited sequentially that should fire in parallel; missing caching). Encodes a decade of Vercel engineers’ performance conventions — the “borrow conventions from people who know the field” move.
  • agentmemory — persistent four-tier memory (working / episodic / semantic / procedural) with decay, hybrid search, and a dashboard; runs in the background and carries learnings across sessions. Full coverage in agentmemory.
  • Claude Code + Chrome — launch with the Chrome flag so Claude can drive a real browser, iterate on a change, and verify it visually before declaring done. The demo: “extract this modal into a real settings page,” with Claude opening Chrome, testing, and confirming the tabs render. The operator wrapped this into a reusable slash command for front-end changes. Browser-control context: Computer Use.

Why it matters

Each tool maps to a documented Claude Code failure mode rather than adding capability for its own sake. The throughline — borrow real engineers’ conventions (security, performance), give the agent a map of your codebase, persist what it learns, and make it look at its own work — is the operator-grade version of the same discipline Anthropic’s own context-management guidance preaches. Two of the five (DeepSec, agentmemory) already have standalone wiki coverage; the other three (Intent Layers, the Vercel best-practices skill, the Chrome verification loop) are the net-new pieces this workflow surfaces.

Try It

  1. Map the codebase first: run an Intent Layers pass on an existing project and inspect the generated AGENTS.md tree — especially the global invariants section for framework-version quirks the model is trained against (the proxy.ts vs middleware.ts class of bug).
  2. Layer security + performance: npx deepsec (scan → process → report) for vulnerabilities, then the Vercel react best practices skill for performance antipatterns. Feed the findings into a spec-driven change so fixes are tracked, not one-shot.
  3. Persist learnings: connect agentmemory so the conventions surfaced above survive into future sessions instead of being re-derived.
  4. Close the loop: start Claude Code with Chrome access and make it verify front-end changes visually; wrap it in a /verify-frontend slash command.

Open Questions

  • The video doesn’t name the creator/channel or link the Intent Layers repo explicitly — the exact OSS project behind “Intent Layers” should be verified (and a standalone article considered) before citing it as canonical.
  • DeepSec’s ~$20-30/run cost figure is one operator’s small-project estimate; cost scales with codebase size and isn’t benchmarked here.

Graph View

Backlinks