Every FAANG-adjacent shop is scoping the same question: "How do we let 500 engineers run Claude Code, Codex, and Cursor without leaking IP or trashing prod?" Coder (Series B) posted on HN in July 2026 looking for engineers to build "secure, standardized, and governed workspaces to deploy autonomous coding agents alongside human developers." Anthropic and Cursor have marketing pages. Nobody has written the operational playbook.
This hub curates skills for the platform / DevEx engineer standing up a coding-agent program at scale. Sandbox architectures that let agents run tests without touching prod, credential scoping so agents never see production secrets, PR-gating policies for agent-generated code, monorepo-scale context management via AGENTS.md and .cursorrules, cost attribution per developer, and the guardrails that keep an unsupervised agent from burning $10K in API credits over a weekend. If you own the "coding agents at scale" mandate, this is the reading list.
Who this hub is for
Platform engineers, DevEx leads, and engineering managers at 500+ engineer organizations deploying coding agents.
Six months of shipping the same context to Claude Code, Cursor, and Copilot the hard way — here's the head-to-head on schema, activation, token budget, and a portable pattern that works across all three.
Seven Claude Code skills that actually move the needle when you're a one-person engineering team. Real skills, install links, and the workflow recipes that combine them.
Convert your existing Cursor rules to SKILL.md skills and keep your customisations working across Claude Code, Codex CLI, and any other agent that supports the SKILL.md standard — with a step-by-step migration guide.
Curated list of open source SKILL.md skills on GitHub for Claude Code. Free to use, fork, and customize. With security tips for vetting repos.
SKILL.md skills that make Claude Code generate React components, hooks, and tests matching your project's exact patterns. TypeScript, Next.js, and more.
The best Claude Code skills for documentation in 2026 — SKILL.md files that auto-generate README files, API docs, changelogs, and inline code comments.
The best Claude Code skills for solo developers in 2026 — act as your full AI team with SKILL.md files for frontend, backend, testing, and deployment.
Best Claude Code skills for JavaScript and TypeScript developers — SKILL.md files for React, Next.js, Node.js, testing, API design, and code documentation.
A skill is a reusable instruction bundle — usually a SKILL.md file — that a coding agent loads when it needs to do a specific task. Instead of the agent re-deriving how to review a pull request every time, you give it a "requesting-code-review" skill that codifies your team's conventions. Skills work in Claude Code, Codex CLI, Cursor, Windsurf, and any agent that supports procedural memory.
Three layers. Layer one: run the agent inside a sandbox — a fresh container, a scratch git worktree, or an ephemeral VM. Layer two: scope credentials — the agent has read-only access to your codebase, no production database credentials, no cloud console tokens. Layer three: gate every write — every PR the agent opens goes through a human review gate before merge. All three, not one.
AGENTS.md is repo-scoped context that every agent working in this repo should read. .cursorrules is Cursor-specific (older format, still widely used). SKILL.md is a portable skill file that any agent can load on-demand, not just when opening the repo. Use all three: AGENTS.md for the repo baseline, SKILL.md for reusable procedural knowledge, .cursorrules if your team uses Cursor.
Give each developer a scoped API key (Anthropic, OpenAI, or your gateway). Tag every request with the developer email, project ID, and agent name. Aggregate into a dashboard weekly. Set soft budgets ($200/week per developer typical) with Slack alerts at 80%. This turns "agents burned $50K last month" into a per-team line item you can defend.
None are wrong. Claude Code and Codex CLI are terminal-first, agentic, ideal for autonomous workflows. Cursor and Windsurf are IDE-native, ideal for pair-programming style use. Most large orgs end up supporting all four because different teams have different workflows. Pick your default (Claude Code is a strong 2026 pick), publish standards for the others, do not try to force one on everyone.
No. If an agent needs to reason about a production schema, give it a sanitized snapshot with the same shape but scrambled values. If it needs to reason about production errors, feed it error signatures and stack traces with PII redacted. Any agent that has read access to prod is an audit finding waiting to happen. The one exception: read-only observability agents that consume already-redacted logs.