Coding with Cursor or Claude Code? Keep the speed, lose the mess.

Cursor, Windsurf and Claude Code write code into your own repository, which is a big step up from app builders. They also write it faster than anyone can read it: logic duplicated across files, patterns that drift from folder to folder, and tests that pass without testing anything.

I use these tools every day, with custom subagents and MCP servers, and review what they write for a living. I audit your codebase in 48 hours and set up the rules and checks that keep agents working with your architecture, not around it.

Book a 30-min call or see packages and pricing

What these tools give you

Code: Real code in your own repository, in whatever stack you choose. No platform to outgrow.
Speed: Features in hours instead of days, from agents that can read, edit and run your whole project.
Guardrails: Only the ones you set up: rules files such as CLAUDE.md, AGENTS.md or Cursor rules, CI checks, and code review.
Left to you: Architecture, security, review, and keeping a fast-growing codebase understandable to the next person, or agent, who opens it.

Where AI-written codebases break

Security flaws at scale

In Veracode’s 2025 study of over 100 models, AI-written code introduced a security flaw in 45% of tasks, and models got better at writing working code without getting more secure. More code, faster, means more flaws.

The same thing built three ways

Agents solve the problem in front of them. Without rules, you end up with three date helpers, two API clients and a different error-handling style in every folder.

Tests that pass without testing

Ask an agent to make the tests pass and it may change the test instead of the code, or mock away the part that matters. A green build stops meaning much.

Dependencies nobody chose

Agents add packages freely, including abandoned ones and, now and then, names that don’t exist yet and get registered later by attackers.

Changes too big to review

When an agent touches forty files at once, review turns into skimming. That’s how subtle bugs and data leaks reach production.

Context that lives in one head

The prompts, decisions and workarounds behind the code aren’t written down anywhere. The next developer, or the next agent session, starts from zero.

Three ways forward

The audit tells you which one fits

Option 1
Set up guardrails
Best when the codebase is healthy and you want it to stay that way.
Rules files for your tools, CI that blocks the common mistakes, a review checklist for agent changes, and custom subagents that know your patterns.
Option 2
Clean up, then guard
Best when the codebase has drifted and changes are slowing down.
Consolidate duplicated logic, fix the risky spots from the audit, replace tests that test nothing, then add the guardrails so it doesn’t drift again.
Option 3
Ongoing technical leadership
Best when you’re growing the team or shipping fast without a senior reviewer.
Fractional CTO time: architecture decisions, review of major changes, and one AI workflow your whole team uses the same way.

Questions

Which tools do you work with?

I use Claude Code and Cursor every day, with custom subagents and MCP servers. The guardrails I set up are plain files and CI checks, so they work just as well with Windsurf and other tools.

Will this slow my team down?

The goal is the opposite. Good rules and checks mean agents get it right the first time more often, and reviews go faster because the obvious mistakes never reach them.

Do we have to stop using AI for anything?

No. I’ll suggest where a person should stay in the loop, usually auth, payments, data migrations and anything you can’t undo, and let agents run freely everywhere else.

Start with a 48-hour audit

Usually reply within a day

A fixed $1,500 review of your AI-written codebase: database rules, secrets, payments, reliability, performance and code. You get a ranked fix list within 48 hours of giving me access, and a clear call on which path fits. See everything the audit covers.

Book a 30-min call