AI Best Practices (Technical)
Best practices for people comfortable with the command line and Linux. Each topic shows its most recent dated snapshot; open a topic to browse every archived version.
Running Coding Agents in CI/CD — Cross-Provider Best Practices (as of 10 Aug 2026)
How to run Claude Code, Codex CLI, or Gemini CLI unattended in CI/CD pipelines: headless-mode mechanics, least-privilege credentials, human approval gates, sandbox/approval-bypass dangers (including a CVSS 10.0 Gemini CLI RCE), secrets handling, and cost circuit breakers, as of 10 Aug 2026.
Tool Use & Function-Calling Design Patterns for AI Agents — Best Practices (as of 09 Aug 2026)
How to design, call, and secure tools/functions across Anthropic Claude, OpenAI, and vendor-neutral (MCP/framework) patterns: schema design, tool_choice/strict modes, parallel calls, error handling, and the injection/sandboxing risks that come with letting a model execute real actions.
Context Management for AI Coding Agents — Best Practices (as of 06 Aug 2026)
How coding agents actually fill, compact, and isolate their fixed context windows — the framework-agnostic mechanics plus Claude Code, OpenAI Codex CLI, and Google Gemini CLI specifics, including the caching and cost traps that quietly drain a budget.
Running AI Agents on Ubuntu — Best Practices (as of 03 Aug 2026)
A dated, fact-checked refresh of running Claude Code, Codex CLI, and Gemini CLI on Ubuntu — plus ecosystem-agnostic Linux foundations. Research verified 03 Aug 2026; every citation re-fetched by the grading panel 03-04 Aug 2026. 0 fabrications.
Gemini CLI Authentication & Data Handling — Best Practices (as of 01 Aug 2026)
How Gemini CLI's auth methods (OAuth login, API key, Vertex AI) map to Google's data-retention and model-training policies, plus where credentials live on disk and how to protect them — including the June 2026 retirement of personal OAuth login.
Gemini CLI Security Fundamentals — Best Practices (as of 01 Aug 2026)
How Gemini CLI's approval modes, sandboxing, checkpointing, and folder-trust settings actually work, the July 2026 'Week of Sandbox Escapes' findings, and the CVSS-disputed CVE-2026-12537 CI/CD RCE caused by headless-mode auto-trust plus a YOLO allowlist bypass.
Gemini CLI Security Practices: Extensions & MCP Integration (as of 01 Aug 2026)
How Gemini CLI's extension system and MCP (Model Context Protocol) server integration handle trust, permissions, and third-party risk — vetting gaps, the CVSS-disputed CI/CD RCE, and safe-default settings, as of August 2026.
Building Secure MCP Servers — Best Practices (as of 29 Jul 2026)
Concrete security practices for developers building MCP servers: input validation, prompt-injection defense, least-privilege tool design, secret management, the now-final 2026-07-28 OAuth/authorization requirements, rate limiting, transport hardening, and output sanitization — as of 29 Jul 2026.
MCP Security Fundamentals — Best Practices (as of 29 Jul 2026)
What the Model Context Protocol specification actually provides (and omits) for security: the now-final 2026-07-28 protocol changes (stateless core, OAuth 2.1 + RFC 9728/9207), prompt injection via tool results, permission scoping, DNS rebinding, supply-chain risks, and real CVEs — as of 29 Jul 2026.
MCP Security in Claude Code — Best Practices (as of 29 Jul 2026)
How to securely configure, discover, and use MCP servers when Claude Code is the client — covering permission modes, trust settings, sandboxing, tool restrictions, audit logging, the now-final 2026-07-28 protocol changes, and documented real-world incidents (CVE-2025-68143/144/145, CVE-2026-21852) — as of 29 Jul 2026.
AI Agent Supply Chain Verification: MCP / Claude Code — Best Practices (as of 29 Jul 2026)
How to verify the authenticity, integrity, and safety of MCP servers before connecting Claude Code to them, covering provenance, code review, version pinning, tool poisoning, sandboxing, and permission controls — updated now that the MCP 2026-07-28 specification is final.
Fine-Tuning and Adapting Language Models — Best Practices (as of 26 Jul 2026)
A decision-framework guide covering when to fine-tune vs. use RAG or prompt engineering, how to prepare data, avoid catastrophic forgetting, maintain prompt-template consistency, and run production-grade continuous fine-tuning.
Fine-Tuning and Adapting Language Models: Managed Cloud Services — Best Practices (as of 26 Jul 2026)
Practical best practices for cloud-managed fine-tuning APIs — Together.ai, Vertex AI, AWS Bedrock, and OpenPipe — covering data format, job creation, cost estimation, limitations, and evaluation. OpenAI's fine-tuning platform is winding down; readers should be aware before investing.
Fine-Tuning and Adapting Language Models: Python PEFT Ecosystem — Best Practices (as of 26 Jul 2026)
Practical, sourced best practices for supervised fine-tuning of open-weight models using Hugging Face PEFT, LoRA, QLoRA, TRL SFTTrainer, Axolotl, Unsloth, and Flash Attention 2/3 — covering configuration, memory management, and evaluation.
Structured Outputs and Tool Use with AI APIs (Python) — Best Practices (as of 24 Jul 2026)
Concrete, actionable practices for getting reliable structured output from LLM APIs in Python — covering the instructor library, Pydantic v2, LangChain, testing, caching, and async patterns.
Structured Outputs and Tool Use with AI APIs — Best Practices (as of 24 Jul 2026)
Ten actionable cross-platform best practices for getting reliable, machine-readable structured output from LLM APIs — covering schema design, validation, streaming, prompt patterns, token budgets, and safe tool execution.
Structured Outputs and Tool Use with Claude APIs — Best Practices (as of 24 Jul 2026)
Concrete, sourced best practices for getting reliable structured output from the Anthropic Claude API using tool use, caching, streaming, and related techniques.
RAG Best Practices — Anthropic Claude Ecosystem (as of 22 Jul 2026)
Nine sourced best practices for building RAG systems on Anthropic's Claude API: document blocks, citations, prompt caching, model selection, tool use, grounding, batch processing, and evaluation.
RAG Best Practices — Generic / Cross-Platform (as of 22 Jul 2026)
Practical RAG pipeline best practices covering chunking, embedding selection, hybrid retrieval, reranking, context assembly, evaluation, production patterns, and security — applicable across all frameworks and vendors.
RAG Best Practices — Python Ecosystem (LangChain, LlamaIndex, Haystack) (as of 22 Jul 2026)
Sourced best practices for building RAG systems in Python using LangChain, LlamaIndex, and Haystack — chunking, hybrid retrieval, vector stores, streaming, evaluation, and security. Accurate as of 22 Jul 2026.
AI Agent Orchestration — Anthropic/Claude — Best Practices (as of 20 Jul 2026)
Concrete, sourced best practices for orchestrating Claude agents: role design, tool scoping, context management, prompt caching, human oversight, model selection, MCP integration, and computer use.
AI Agent Orchestration — Generic/Cross-Platform — Best Practices (as of 20 Jul 2026)
Cross-framework best practices for orchestrating AI agents: sequential vs parallel execution, state machines, error handling, human-in-the-loop checkpoints, multi-agent trust, context management, idempotency, observability, and rate limiting.
AI Agent Orchestration — LangGraph — Best Practices (as of 20 Jul 2026)
Practical best practices for building orchestrated AI agent workflows with LangGraph: state schema design, checkpointing, human-in-the-loop, streaming, subgraphs, LangSmith Deployment, and LangMem integration.
AI Agent Evaluation and Testing — Anthropic / Claude Best Practices (as of 18 Jul 2026)
Source-verified best practices for evaluating AI agents built on Anthropic's Claude: Console Evaluation tool, Batches API, cross-family LLM-as-judge, adaptive thinking for evals, tool-use testing, multi-turn evaluation, and safety/refusal testing.
AI Agent Evaluation and Testing — Python Ecosystem Best Practices (as of 18 Jul 2026)
Source-verified best practices for evaluating AI agents in Python: Inspect AI, DeepEval, RAGAS, LangSmith, Weave, Phoenix, Promptfoo, pytest mocking, conftest.py fixtures, and PromptLayer A/B rollouts.
AI Agent Evaluation and Testing — Best Practices (as of 18 Jul 2026)
Cross-framework best practices for evaluating and testing AI agents: golden datasets, LLM-as-judge calibration, regression CI, unit mocking, red-teaming, evaluation metrics, trajectory evaluation, and the eval-driven iteration loop.
LLM Observability and Monitoring — Generic / Architectural Patterns — Best Practices (as of 16 Jul 2026)
Platform-agnostic observability architecture for LLM applications: OTel semantic conventions, span trees, structured logging, prompt versioning, golden datasets, LLM-as-judge, drift detection, and SLO design.
LLM Observability and Monitoring — Open-Source Tooling — Best Practices (as of 16 Jul 2026)
How to use Langfuse, Arize Phoenix, W&B Weave, OpenLLMetry/Traceloop, and Helicone for LLM tracing, evaluation, and debugging — including acquisition notes and self-hosting trade-offs as of mid-2026.
LLM Observability and Monitoring — Managed Cloud Platforms — Best Practices (as of 16 Jul 2026)
How to instrument and monitor LLM workloads on Datadog Agent Observability, New Relic AI Monitoring, AWS Bedrock + CloudWatch, GCP Vertex AI, and Azure AI Foundry — with trade-offs versus open-source alternatives.
AI Agent Supply Chain Verification — Cross-Platform (as of 13 Jul 2026)
Platform-agnostic practices for verifying the integrity of AI agent supply chains: model weights, containers, CI/CD pipelines, OS packages, and SBOM tooling.
AI Agent Supply Chain Verification — Node.js/npm (as of 13 Jul 2026)
How to verify the integrity and provenance of Node.js/npm packages used in AI agent pipelines and MCP servers, covering lockfiles, provenance attestations, behavioral scanning, and private registries.
AI Agent Supply Chain Verification — Python (as of 13 Jul 2026)
Practices for verifying the integrity and provenance of Python packages used in AI agent pipelines: hash pinning, lock files, vulnerability scanning, SBOM generation, typosquatting defenses, private indexes, and CVE monitoring for AI libraries.
AI Agent Supply Chain Verification — Best Practices (as of 12 Jul 2026)
Cross-platform practices for verifying the integrity and provenance of AI agents, models, and their dependencies — covering model weight checksums, serialization format risks, artifact signing, provenance tracking, and multi-agent trust.
AI Agent Supply Chain Verification — Python Ecosystem (as of 12 Jul 2026)
How Python developers building or running AI agents verify the safety and integrity of their Python dependency supply chain — covering PyPI vetting, hash-pinning, vulnerability scanning, SBOM generation, model file integrity, and CI supply chain hardening.
Vector Store Security — RAG Pipeline (as of 09 Jul 2026)
Cross-cutting security best practices for RAG pipelines using vector stores: embedding privacy, retrieval-layer access control, data poisoning, prompt injection via retrieved documents, multi-tenant isolation, audit trails, and secure ingestion.
Vector Store Security — Cloud-Managed Services (as of 09 Jul 2026)
Security and access-control best practices for cloud-managed vector store services (Pinecone, Azure AI Search, AWS OpenSearch Serverless, Google Vertex AI Vector Search) used in AI/RAG pipelines — covering auth, network isolation, encryption, audit logging, multi-tenancy, and known misconfigurations.
Vector Store Security — Open-Source Self-Hosted (as of 09 Jul 2026)
Security and access-control best practices for self-hosted open-source vector databases (Chroma, Qdrant, Weaviate, Milvus) used in AI/RAG pipelines. Covers dangerous defaults, authentication, network isolation, encryption, multi-tenancy, and recent CVEs including ChromaToast (CVSS 10.0) and Milvus auth bypass (CVSS 9.3).
AI Agent Memory and State Management — Anthropic/Claude (as of 07 Jul 2026)
How to build persistent memory and state into Claude-based agents: in-context curation, Files API, the memory tool, Managed Agents memory stores, server-side compaction, context editing, and when adaptive thinking helps vs. hurts — accurate as of July 2026.
AI Agent Memory and State Management — Best Practices (as of 07 Jul 2026)
Framework-agnostic patterns for managing memory and state in AI agents: taxonomy, storage tradeoffs, compression, isolation, security, and evaluation — accurate as of July 2026.
AI Agent Memory and State Management — LangChain / LangGraph (as of 07 Jul 2026)
How to manage memory and persistent state in LangChain agents and LangGraph graphs — covering checkpointers, cross-thread stores, deprecated memory APIs, LangMem, retrieval-augmented memory, state schema design, and production pitfalls — accurate as of July 2026.
LLM Cost Management — Anthropic/Claude (as of 06 Jul 2026)
Practical, sourced guidance on tracking and reducing Claude API spend: model tier selection including Fable 5, prompt caching, batch processing, spend limits, rate limits, and built-in monitoring tools.
LLM Cost Management — Best Practices (as of 06 Jul 2026)
Eight platform-agnostic practices for controlling and monitoring LLM API spending: key metrics, cost attribution, prompt discipline, caching, budget guardrails, alerting, model routing, and cost/quality evaluation.
LLM Cost Management — Open-Source Tooling (as of 06 Jul 2026)
Best practices for tracking LLM token usage and costs with Langfuse, LiteLLM proxy, OpenInference/OpenTelemetry, and W&B Weave. Covers integration, budget enforcement, security, self-hosting trade-offs, and alerting.
Prompt Injection Defense for Web-Browsing and RAG Agents — Best Practices (as of 04 Jul 2026)
How to defend AI agents that browse the web or use Retrieval-Augmented Generation (RAG) from indirect prompt injection — structural controls, ACL enforcement, vector database hardening, and detection patterns — sourced and dated as of July 2026.
Prompt Injection Defense — Claude & Anthropic Platform (as of 04 Jul 2026)
How Anthropic documents and implements defenses against prompt injection in Claude-based agentic systems: threat model, six permission modes, built-in controls, deployment patterns, and known CVEs — sourced from official Anthropic engineering publications as of July 2026.
Prompt Injection Defense in AI Agents — Best Practices (as of 04 Jul 2026)
Cross-framework, implementation-agnostic best practices for defending AI agents against prompt injection: threat modelling, structural controls, architectural patterns, and detection techniques — sourced and dated as of July 2026.
Cursor Prompt Engineering — Best Practices (as of 01 Jul 2026)
Concrete, source-verified best practices for getting better results from Cursor AI — covering .cursor/rules/ files, activation types, Chat vs Agent mode, context tools (@codebase, @docs, @file, @web), and what to avoid.
Prompt Engineering for Claude Code — Best Practices (as of 01 Jul 2026)
Concrete, source-verified practices for getting better results from Claude Code: writing effective CLAUDE.md files, managing context, using subagents, hooks, and staying safe.
Prompt Engineering for GitHub Copilot — Best Practices (as of 01 Jul 2026)
Concrete, source-verified practices for getting better results from GitHub Copilot — covering .github/copilot-instructions.md, Copilot Chat, inline completions, agent mode, and the June 2026 billing transition.
Prompt Engineering for Coding Agents — Best Practices (as of 30 Jun 2026)
Concrete, source-verified practices for getting better results from AI coding agents — covering universal prompt hygiene plus tool-specific guidance for Claude Code, GitHub Copilot, and Cursor.