Claude Code Digest — Jul 16–Jul 19

Plan mode caught bad cross-file refactors 71% of the time before a single edit landed — the fastest way to stop diff archaeology is to force Claude to think in read-only first.

11 MCP CVEs across 7,000+ instances

Trending Now

🔥 Read-Only First: /plan Is Becoming the Default Safety Rail
Shift+Tab or /plan is no longer a nice-to-have; it’s the cheapest way to surface wrong assumptions before they metastasize into multi-file churn. Use it on any refactor that touches imports, interfaces, or config fan-out. 🔥 DOM Graph + BM25: Web Research Without Token Burn
Webify MCP claims 97% lower web research token usage by routing queries through DOM-graph extraction plus BM25 retrieval. If your Claude sessions are bloated by pasted pages, move research behind a retrieval layer instead of feeding raw HTML. 📈 STDIO MCP Is a Security Footgun — Remote Servers Are the Safer Bet
The 11-CVE disclosure across 7,000+ MCP instances is a warning shot: local STDIO transports can turn config into command execution. Prefer remote, authenticated MCP services on ECS/Fargate-style infrastructure for anything beyond toy use.

Best Practices

Use `Shift+Tab` or `/plan` before cross-file edits
Before: Claude dives straight into edits and you discover the wrong architecture after 12 files changed. After: it explores read-only first and catches bad assumptions early, avoiding hours of rollback and diff review. Route research through Webify MCP instead of pasting pages
Before: raw web pages and copy-pasted snippets inflate context and waste tokens. After: DOM-graph + BM25 retrieval trims web research token usage by 97%, so the model sees only the relevant slices. Put a pre-send hotkey or CLI pipe in front of Claude
Before: MCP tools try to help after the prompt already hit the token meter. After: you strip junk before send, which is the only way to actually reduce input tokens in Claude Code.

Tools & MCP

Webify MCP — Cuts web research token usage by 97% with DOM-graph + BM25 retrieval — ideal for dense docs and long pages. cc-context-telemetry — Shows context-window and rate-limit % directly in your status line — lets you see when you’re about to cliff out. Remote MCP on AWS ECS Fargate — Runs agent tools as a hosted MCP service so Claude can query/update Smartsheet without a local client or brittle per-machine setup.

Multi-Agent Patterns

Remote Tool Boundary Pattern
Keep tool execution off the workstation and behind a remote MCP boundary; Claude gets standardized tool calls, while auth, scaling, and auditing live in AWS ECS Fargate instead of every developer laptop. Read-Only Planner + Editor Split
Use plan mode as a dedicated exploration phase, then let the edit phase act only after assumptions are validated. This reduces wrong-path refactors and makes multi-file changes more deterministic. Telemetry-Governed Agent Loop
Pair Claude with live context/rate-limit telemetry so the operator can decide when to compress context, switch models, or stop before hitting a hard limit mid-task.

Community Requests

• Native pre-send prompt sanitizer so token trimming happens before context entry, not after
• Built-in MCP security scanner for STDIO command-execution risks and config auditing
• First-party context/rate-limit HUD with alerts when Claude is near window or quota cliffs