17 posts carrying this tag.
The number that gets quoted from that case study is the token bill, somewhere between €10M and €15M for one week of autonomous agent work. The number that should get quoted is the second half of the sentence, which is that the resulting code was described as nearly unmaintainable. The bill was paid once. The code has to be lived with.
Veracode has now evaluated more than 150 models and the average security pass rate sits at about 56%, against 55% in their first report. Across that same period coding benchmarks improved steadily, larger models did not outperform smaller ones, and vendor claims about security aware training did not correspond to measured outcomes. A capability that stays flat while adjacent capabilities improve is telling you the bottleneck is somewhere other than the model.
Skills are the best thing to happen to agent workflows in the last year, and we write them ourselves. This is not an argument against using them. It is an argument about what category of thing a skill is, because a large number of teams are now treating a code review skill as the answer to whether AI generated code is safe to merge, and a skill structurally cannot be that.
claude-context is Zilliz's open source code search MCP server, around 11,800 stars, chunking along AST boundaries and serving hybrid BM25 and vector retrieval with Merkle tree incremental reindexing. The engineering is competent. We cannot credibly write a takedown of it, because we shipped the same architecture in October 2025, watched it fail on accuracy, and threw it away. This is what that cost us to learn.
When Augment exposed its context engine over MCP in February 2026, Claude Code on Opus 4.5 gained around 80% on quality and Cursor gained around 71%, with code completeness up 60% and correctness improved fivefold. Somebody else measured that, on somebody else's product, and it is the strongest evidence anyone has produced that context architecture matters more than model selection. Here is where our architecture diverges from theirs.
A $125M Series B into formal verification for defence is the strongest market proof anyone has produced that enterprises will pay real money to know whether code is correct. It also published its own ceiling, in public, and that ceiling is the reason we took a different route: equivalence is a relation between two artifacts, and it is silent about purpose.
CodeGraph went from launch on 18 January 2026 to roughly 47,000 stars in five months by mapping symbols and call edges locally, with no server and no cloud embedding call. It deserved every one of those stars. It also answers one class of question completely and another class not at all, and the second class is where production breaks.
A pull request changes 11 lines, the tests pass, every automated reviewer approves, and three weeks later a reporting service is quietly returning wrong revenue. Nothing about the diff was incorrect. What was wrong lived in another repository nobody in the pipeline had read. This is where diff scoped review has nothing to say, and it is now the majority of what breaks in a large organisation.
Spec Kit spent a year and gathered well over 100,000 stars teaching several million developers that the specification, not the code, should be the source of truth. That is category creation at a scale no startup could have afforded, and it lands directly on our thesis. It also assumes a blank page, which is true exactly once in the life of a system.
The deepest MCP integration anybody has shipped, with 16 tools, 7 resources, skills and Claude Code hooks, running with zero server on a local graph. The developer experience is the best in the category and that is why it grew. Two things are worth thinking through before you build anything organisational on top, and only one of them is technical.
Local deterministic parsing over 36 tree sitter grammars, typed nodes, provenance tagged edges, Apache 2.0, no vector store and no telemetry. That is a clean design and the privacy position is better than most of the category. The problem starts the moment your organisation has more than one repository, and it is not a problem more parsing solves.
Of every commercial tool in automated code review, Greptile made the closest architectural call to ours: index the whole repository first, then review the change against it. That decision is why it catches 82% of bugs against CodeRabbit's 44%. It also arrives with about 11 false positives per run, and the shape of those false positives tells you exactly what an index of symbols can and cannot know about intent.
Repomix is the leader in context packing, with 26,000 stars and 255,000 npm downloads a month, and its tree sitter compression genuinely cuts token count by about 70%. Apply that to 10 million files and you go from three orders of magnitude short of the context window to slightly less than three orders of magnitude short. Every tool in this category publishes a token reduction number. None of them publishes a correctness number.
Serena is the best open source symbol level tool for agents, with 25,200 stars, 170 contributors and over 40 languages behind a clean LSP to MCP design. A language server gives you exact call edges and zero intent. In the MSR 2026 dataset of rejected agentic pull requests, only 36% failed on the code itself and 31% failed on a decision the project had already taken, which is the third no symbol table can reach.
Sourcegraph built the most complete cross repository code search anyone has shipped, and it did so on an assumption that held for fifteen years: a human is asking. Humans supply the meaning the index leaves out. An agent cannot, and at 10 million files a 1 million token window holds 0.01% of the estate, so the gap is not one model generation away.
This argument was being compared to the Vim and Emacs wars in 2024, and then it returned everywhere inside six months. Something dragged it out of retirement, and it is not really about where files live. The variable that decides whether agents work is whether the question of what depends on this is answerable at all, and neither layout answers it.
Agent runtimes got very good very fast. The thing that decides whether a change is correct across your other repositories did not get built at all. On cross repository blast radius, why AI code review misses it, and what a check actually needs.
