# How Tom MacWright actually uses coding agents

Val Town, Placemark, ex-Mapbox

**If you take one thing:** `Pi on GLM 5.2`, as the security bug hunter. a cheap model that does not refuse security work, in a separate harness with Cloudflare's audit skill and a local OWASP cheatsheet checkout.

- **Agent:** Claude Code (cli) ([source, 2026-03-18](https://macwright.com/2026/03/18/effect-devlog))
- **Agent:** Pi ([source, 2026-07-31](https://blog.val.town/security))
- **Model:** Claude Sonnet 5 ([source, 2026-09-29](https://github.com/val-town/codemirror-json-schema/commit/e3a1518c621d092502a0d86676f5c26ae0d75b1b))
- **Model:** GLM 5.2 ([source, 2026-07-31](https://blog.val.town/security))
- **Review:** Careful human review of LLM fixes ([source, 2026-07-31](https://blog.val.town/security))
- **Harness:** Neovim (LazyVim) with coder/claudecode.nvim ([source, 2026-07-13](https://github.com/tmcw/nvim/blob/5c1ef283babf541b31ded623c77225fc614dc928/lua/plugins/claude.lua#L1-L2))
- **Skills:** Cloudflare security audit skill ([source, 2026-07-31](https://blog.val.town/security))

## In their words

> Obligatory LLM discourse: my usual AI tool, Claude Code with Opus 4.6, is decent at using Effect but stumbles in the same places that the documentation is lacking

> Swapped out Claude Code with Pi for these tasks. Added lazy-pi so it has subagents and todo lists and all kinds of gizmos.

> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

> First, I use GLM 5.2 for security research.

> I've been using LLMs much more for remediation, with lots of careful human review involved.


Archetype (our label): Skeptic. Newest source: 2026-09-29.
Card: https://www.prehistoriq.com/stacks/tmcw/ · Data: https://github.com/prehistoriq/stacks/blob/main/data/stacks/tmcw.json