DEV Community

hao li profile picture

hao li

CS student building dev tools for AI coding agents. 💼 Open for freelance: Chrome extensions, Python automation, MVPs → Fiverr: fiverr.com/haoli_builds

Joined Joined on 
I built a probe for the MCP cross-tenant leak that needs no attacker (CVE-2026-111770)

I built a probe for the MCP cross-tenant leak that needs no attacker (CVE-2026-111770)

Comments
3 min read

Want to connect with hao li?

Create an account to connect with hao li. You can also sign in below to proceed if you already have an account.

Already have an account? Sign in
Who Watches the Watchers? I Built a Tamper-Evident Seal for Agent Guardrails

Who Watches the Watchers? I Built a Tamper-Evident Seal for Agent Guardrails

Comments
4 min read
I built a Claude Code skill that de-slops AI-generated web design

I built a Claude Code skill that de-slops AI-generated web design

Comments
2 min read
I built a human approval gate my coding agents can't click themselves

I built a human approval gate my coding agents can't click themselves

1
Comments 2
3 min read
Your coding agents aren't the problem. Your machine is.

Your coding agents aren't the problem. Your machine is.

Comments
3 min read
Every visa slot checker goes silent when the portal fights back. I built one that doesn't.

Every visa slot checker goes silent when the portal fights back. I built one that doesn't.

Comments
3 min read
Your LLM provider can quietly downgrade your model, and nothing will tell you

Your LLM provider can quietly downgrade your model, and nothing will tell you

Comments 2
4 min read
Your API Gateway Rate Limit Can't See the Agent Looping Your Search Tool

Your API Gateway Rate Limit Can't See the Agent Looping Your Search Tool

1
Comments 1
3 min read
ShellCheck Passed Every File. The Pipeline Was Still Broken.

ShellCheck Passed Every File. The Pipeline Was Still Broken.

Comments
3 min read
I built the tool my agent-guard README said didn't exist yet

I built the tool my agent-guard README said didn't exist yet

Comments
2 min read
contradiction-judge: the memory auditor your AI agents are missing

contradiction-judge: the memory auditor your AI agents are missing

1
Comments 1
2 min read
Your Claude Code skills are being silently demoted, and nothing tells you.

Your Claude Code skills are being silently demoted, and nothing tells you.

Comments
3 min read
Your tag says v1.2.3. But is that really what you shipped?

Your tag says v1.2.3. But is that really what you shipped?

Comments
2 min read
Your Semantic Cache Has a Health Problem. Nothing Checks It.

Your Semantic Cache Has a Health Problem. Nothing Checks It.

1
Comments
3 min read
worktree-janitor: clean up the git worktrees your dead agent sessions left behind

worktree-janitor: clean up the git worktrees your dead agent sessions left behind

Comments 1
2 min read
I pasted the same MCP server into 4 config files. Then I wrote a tool to clean up the mess.

I pasted the same MCP server into 4 config files. Then I wrote a tool to clean up the mess.

Comments
3 min read
Your Claude Code routine left 618 sessions behind. Mine deletes them while I sleep.

Your Claude Code routine left 618 sessions behind. Mine deletes them while I sleep.

Comments
3 min read
session-archive: back up Claude Code session logs before the 30-day auto-delete

session-archive: back up Claude Code session logs before the 30-day auto-delete

Comments
1 min read
canarygate: Catch the Gate That Quietly Stopped Discriminating

canarygate: Catch the Gate That Quietly Stopped Discriminating

Comments
3 min read
Your AI Shipped the App. Did It Leave the Keys in the Repo?

Your AI Shipped the App. Did It Leave the Keys in the Repo?

1
Comments
3 min read
Stop finding out you're rate-limited mid-task. Check the headroom first.

Stop finding out you're rate-limited mid-task. Check the headroom first.

1
Comments 1
3 min read
css-slop-detector v0.2: from detecting AI slop to fixing it with one command

css-slop-detector v0.2: from detecting AI slop to fixing it with one command

Comments
2 min read
Your MCP servers run real code. When was the last time you checked it for CVEs?

Your MCP servers run real code. When was the last time you checked it for CVEs?

1
Comments
3 min read
Stop Your Agent Fleet From Burning the Token Budget: subagent-budget-team

Stop Your Agent Fleet From Burning the Token Budget: subagent-budget-team

Comments 1
2 min read
I Built a Bilingual "Mini-Uber" for My Dad's Escalade Business

I Built a Bilingual "Mini-Uber" for My Dad's Escalade Business

1
Comments 1
6 min read
I Bridged My Real Logged-In Browser to Chrome's New WebMCP API

I Bridged My Real Logged-In Browser to Chrome's New WebMCP API

Comments
2 min read
SkillJacking Is Real. I Built the Pinning Layer Skills Were Missing.

SkillJacking Is Real. I Built the Pinning Layer Skills Were Missing.

Comments
2 min read
Your .gitignore Won't Save Your Docker Image

Your .gitignore Won't Save Your Docker Image

Comments
2 min read
1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

1 in 5 AI-Suggested Packages Doesn't Exist — I Built a Scanner for That

Comments
2 min read
Your Claude Code skills are being silently demoted. I built a CLI to catch it

Your Claude Code skills are being silently demoted. I built a CLI to catch it

Comments 1
3 min read
dlog v0.2: two gates for the decision log — one I can enforce, one I can't

dlog v0.2: two gates for the decision log — one I can enforce, one I can't

Comments 1
2 min read
pin-deep: you pinned your Actions, but your Actions didn't pin theirs

pin-deep: you pinned your Actions, but your Actions didn't pin theirs

Comments
2 min read
rules-doctor 0.3: your CLAUDE.md might be lying to your agent

rules-doctor 0.3: your CLAUDE.md might be lying to your agent

1
Comments 1
2 min read
subagent-tax 0.3: the preamble re-enters every turn — and every subagent spawn re-pays it

subagent-tax 0.3: the preamble re-enters every turn — and every subagent spawn re-pays it

Comments
2 min read
readmeta v0.2: --fix rewrites your broken PyPI README links at build time

readmeta v0.2: --fix rewrites your broken PyPI README links at build time

Comments
2 min read
agent-guard 0.7: the legit-test-change escape hatch

agent-guard 0.7: the legit-test-change escape hatch

Comments
2 min read
task-progress-mod v0.2: your agent's progress bar now summarizes tool output

task-progress-mod v0.2: your agent's progress bar now summarizes tool output

Comments
2 min read
Your Claude Code Plugin Passed Validation. That Proves Nothing.

Your Claude Code Plugin Passed Validation. That Proves Nothing.

Comments
3 min read
deny-probe v0.4.0: Your Deny Rules Can't See the Payload — So I Test What It Does When It Wakes Up

deny-probe v0.4.0: Your Deny Rules Can't See the Payload — So I Test What It Does When It Wakes Up

Comments
3 min read
session-handover v0.5: what survives compaction in 8 agent harnesses

session-handover v0.5: what survives compaction in 8 agent harnesses

Comments
2 min read
memgovern 0.5.0: a `memgovern audit` CLI that shows who your agent's memory trusts

memgovern 0.5.0: a `memgovern audit` CLI that shows who your agent's memory trusts

Comments
2 min read
mod-audit v0.2: the update is the attack — delta risk reports for Claude Code Mods

mod-audit v0.2: the update is the attack — delta risk reports for Claude Code Mods

1
Comments 1
2 min read
mcp-tax 0.3: your MCP schemas are billed every turn, not once per session

mcp-tax 0.3: your MCP schemas are billed every turn, not once per session

Comments
2 min read
mcp-lint v0.2: catching the near-duplicate tool names that make your agent confidently wrong

mcp-lint v0.2: catching the near-duplicate tool names that make your agent confidently wrong

Comments 1
2 min read
My Subagents Were Eating 48% of My Tokens. So I Gave Them Hard Budget Caps — Enforced by Hooks, Not Dashboards

My Subagents Were Eating 48% of My Tokens. So I Gave Them Hard Budget Caps — Enforced by Hooks, Not Dashboards

Comments 1
3 min read
Your Skill's Frontmatter Has a Typo. Nothing Will Ever Tell You

Your Skill's Frontmatter Has a Typo. Nothing Will Ever Tell You

Comments
3 min read
Your MCP Config Is the Actual Security Boundary. Nobody Audits It

Your MCP Config Is the Actual Security Boundary. Nobody Audits It

Comments 1
3 min read
I Built an Offline Supply-Chain Auditor for Claude Code Mods (stdlib-only Python)

I Built an Offline Supply-Chain Auditor for Claude Code Mods (stdlib-only Python)

Comments
3 min read
My Parents Ran a Noodle Restaurant for 15 Years. They Never Read a Single Google Review.

Hacktoberfest Weekend Challenge: Build for a Friend Submission 🤝

My Parents Ran a Noodle Restaurant for 15 Years. They Never Read a Single Google Review.

Comments
4 min read
Your wheel can be a valid zip and still break installers. I built a checker for that.

Your wheel can be a valid zip and still break installers. I built a checker for that.

1
Comments
2 min read
Your Package Has a License. Your Wheel Doesn't Say So.

Your Package Has a License. Your Wheel Doesn't Say So.

Comments
3 min read
Your Python Package Installed. Its CLI Crashed on --help.

Your Python Package Installed. Its CLI Crashed on --help.

Comments
4 min read
Apple's Python Package Says 3.11. Its Wheel Requires 3.14.

Apple's Python Package Says 3.11. Its Wheel Requires 3.14.

Comments
3 min read
Google Published a PyPI Release Without Its Git Tag

Google Published a PyPI Release Without Its Git Tag

1
Comments 1
3 min read
Git Can Track Two Files Your Mac Cannot Check Out

Git Can Track Two Files Your Mac Cannot Check Out

Comments
3 min read
Your Python Tests Passed. Your Published Wheel Is Missing Files.

Your Python Tests Passed. Your Published Wheel Is Missing Files.

Comments
3 min read
I stopped letting my agents guess ports

I stopped letting my agents guess ports

Comments
2 min read
Your Subagents Are Re-Sending 51K Tokens Every Call. I Built a Tool to Prove It.

Your Subagents Are Re-Sending 51K Tokens Every Call. I Built a Tool to Prove It.

Comments
2 min read
Your Claude Code Read Deny Rule Is a Screen Door — I Built a Tool That Proves It

Your Claude Code Read Deny Rule Is a Screen Door — I Built a Tool That Proves It

Comments
4 min read
Your CLAUDE.md Might Not Be Loading — I Built a Check-Up for That

Your CLAUDE.md Might Not Be Loading — I Built a Check-Up for That

Comments
3 min read
loading...