AI-SPM vs Claude Code Best Practice

AI-SPM (AI Security Posture Management) is an open-source control plane for AI agent security in production environments. Built by indie developer dshapi and posted to Hacker News, it addresses a real gap: most LLM systems now have tool access and decision-making power, but almost no runtime oversight layer to catch when things go wrong. The system works as a gateway between your application and the LLM, enforcing three main controls: prompt injection detection (including obfuscated variants that bypass naive pattern matching), structured tool call validation against defined policies using Open Policy Agent (OPA), and sensitive data leakage prevention (PII and model output filtering). An Apache Kafka and Apache Flink streaming pipeline provides real-time audit trails and anomaly detection. The creator's key insight is that tool misuse — not model jailbreaks — is the primary risk vector in production AI agents. A rogue or compromised agent that escalates tool permissions or exfiltrates data through sanctioned channels is far harder to catch than a classic prompt injection. AI-SPM is early, minimal traction, and needs real-world stress testing. But as AI agent deployments mature from demos to production, runtime security tooling like this becomes non-optional.

Claude Code Best Practice is a community-maintained GitHub repository documenting patterns, skills, commands, hooks, MCP server configurations, and multi-agent workflow strategies for Anthropic's Claude Code. With 36k+ stars and active daily updates, it has become the de facto reference guide for developers building seriously with Claude Code — filling the gap between Anthropic's official documentation and real-world production patterns. The repo is organized into modular sections covering subagent design patterns, custom slash commands, Claude.md configuration strategies, MCP server integrations, parallel agent workflows, and debugging approaches for common failure modes. Contributors include Claude Code power users, indie developers, and agentic AI practitioners who contribute battle-tested configurations from production environments. The signal-to-noise ratio is notably high for a community resource of this scale. As Claude Code has become the dominant terminal-native AI coding environment for many developers, reference material quality has become a competitive advantage. Best-practice guides that consolidate hard-won institutional knowledge prevent every team from re-discovering the same configuration pitfalls. The fact that this repo accumulated 36k stars rapidly signals the breadth of unmet need for structured Claude Code guidance beyond official docs.