Claude Code for Software Engineers

MCP is the interface layer between Claude and every tool in your stack. This session covers the full MCP architecture, connecting Claude to real data sources, and writing your own MCP server to expose internal APIs.

2.1 Claude Desktop for Power Users

• Desktop vs. Web UI: filesystem access, local shell execution, and persistent sessions
• Parallel development streams: multiple Git-isolated contexts running simultaneously
• Integrated preview: running and verifying apps directly in the Claude interface

2.2 MCP Architecture

• Hosts, Clients, and Servers – the three-layer model explained
• Transport options: stdio (local) vs. HTTP+SSE (remote) when to use each
• json: structure, security hardening, and secrets management
• Built-in MCP servers: filesystem, bash, fetch, and the editor integration

2.3 Connecting Claude to Your Stack

• Wiring up Google Drive, Jira, Slack, and PostgreSQL via community MCP servers
• Token efficiency: loading tool definitions on demand rather than stuffing the initial context
• Code execution via MCP: sandboxed runtimes that return only the results Claude needs

2.4 Building a Custom MCP Server

• Server skeleton: defining tools, resources, and prompts in TypeScript or Python
• Exposing an internal REST API as an MCP tool Claude can call autonomously
• Security: input validation, rate limiting, and preventing prompt injection via tool results

 Lab: Build a custom MCP server that wraps an internal API endpoint. Connect it to Claude Desktop and demonstrate Claude autonomously querying live data to answer a developer question.

Package your hard-won knowledge into reusable Skills, delegate work to sub-agents, and wire Claude into Git and CI/CD so routine engineering tasks run themselves.

3.1 Claude Skills

• What a Skill is: a markdown instruction file Claude loads on demand
• Anatomy of a production Skill: trigger pattern, tool hints, output contract, examples
• Team workflow Skills: /review-pr (style + logic), /deploy-staging, /security-audit
• Skill versioning and the skills/ directory convention

3.2 Sub-Agents

• When to spawn a sub-agent vs. keep work in the main session
• Task file pattern: writing structured task.md files Claude can pick up and execute
• Parallel sub-agents: running independent analysis tasks concurrently
• Output aggregation: merging sub-agent results back into the main context

3.3 AI-Driven Git & CI/CD

• Automating commit messages, branch naming, and PR descriptions from diff context
• PR monitoring: Claude watches CI failures and proposes targeted fixes
• Log piping: feeding build or runtime logs directly into Claude for anomaly detection
• GitHub Actions integration: triggering Claude Code as a CI step

 Lab: Write a /review-pr Skill, spawn a sub-agent to audit a module for security issues in parallel, and set up a GitHub Action that runs Claude on every failing CI build.A

AI in production requires the same rigour as any critical dependency. This session closes the loop on the failure modes that matter allucinations, prompt injection, data exposure, and cost governance.

4.1 Identifying & Mitigating Hallucinations

• Why LLMs fabricate – understanding confidence vs. correctness
• Verification patterns: always run generated code, always read generated diffs
• Grounding strategies: pinning Claude to real file contents and tool outputs

4.2 Prompt Injection & Data Security

• Prompt injection via MCP tool results: attack surface and mitigations
• Handling secrets: environment variables, secret managers, and what never goes in CLAUDE.md
• PII and sensitive data: redaction strategies before context reaches the model
• Permission principle of least privilege for MCP servers

4.3 Cost & Context Governance

• Reading /cost output and understanding token billing
• Context window budgeting: when to /compact, when to start a fresh session
• Model selection for cost: routing heavy tasks to Opus, routine tasks to Haiku