--- title: "Thomas Tartrau (@thomastartrau) | Hashnode" description: "Thomas Tartrau (@thomastartrau) writes on Hashnode. Read their latest articles and follow their work." url: "https://hashnode.com/@thomastartrau" --- @thomastartrau # Thomas Tartrau @thomastartrau · Paris, France · Joined September 2026 ### [AI Coding Agent Security Flaws: Claude Code, Gemini, Codex](https://thomastartrau.hashnode.dev/ai-coding-agent-security-flaws-claude-code-gemini-codex?utm_source=hashnode&utm_medium=feed) An AI coding agent reads files written by other people, runs commands with your privileges, and sees your secrets. AI coding agent security is therefore not a theoretical topic: between June 2025 and 15 min read · [thomastartrau.hashnode.dev](https://thomastartrau.hashnode.dev/ai-coding-agent-security-flaws-claude-code-gemini-codex?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/ai-coding-agent-security-flaws-claude-code-gemini-codex/6aba84b220e0c0bf999ad89f) [Sep 28](https://hashnode.com/posts/ai-coding-agent-security-flaws-claude-code-gemini-codex/6aba84b220e0c0bf999ad89f) ### [Jev Ultrafast MCP: an autonomous browser for Claude Code](https://thomastartrau.hashnode.dev/jev-ultrafast-mcp-an-autonomous-browser-for-claude-code?utm_source=hashnode&utm_medium=feed) I use Claude Code with two browser MCP servers: Claude in Chrome and Jev Ultrafast MCP. Both let Claude control a browser, but the approach is radically different. Claude in Chrome sends each click an 8 min read · [thomastartrau.hashnode.dev](https://thomastartrau.hashnode.dev/jev-ultrafast-mcp-an-autonomous-browser-for-claude-code?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/jev-ultrafast-mcp-an-autonomous-browser-for-claude-code/6ab11425821f3934cde67d1b) [Sep 21](https://hashnode.com/posts/jev-ultrafast-mcp-an-autonomous-browser-for-claude-code/6ab11425821f3934cde67d1b) ### [The 5 Walls Between a 3M req/s HTTP Benchmark and Production](https://thomastartrau.hashnode.dev/the-5-walls-between-a-3m-req-s-http-benchmark-and-production?utm_source=hashnode&utm_medium=feed) An HTTP framework advertised at 3 million requests per second never serves 3 million requests per second in production. The number is real, the measurement is honest, but it describes a scenario that 7 min read · [thomastartrau.hashnode.dev](https://thomastartrau.hashnode.dev/the-5-walls-between-a-3m-req-s-http-benchmark-and-production?utm_source=hashnode&utm_medium=feed) [Sep 21](https://hashnode.com/posts/the-5-walls-between-a-3m-req-s-http-benchmark-and-production/6ab1137429e5f6b2f1d6b101) ### [Why More Than 30 Skills Kill Your AI Agent](https://thomastartrau.hashnode.dev/why-more-than-30-skills-kill-your-ai-agent?utm_source=hashnode&utm_medium=feed) The more skills an agent has, the better it should work. That is the intuition. It is wrong. Past thirty or so skills or tools, adding one more capability often degrades the agent instead of improving 7 min read · [thomastartrau.hashnode.dev](https://thomastartrau.hashnode.dev/why-more-than-30-skills-kill-your-ai-agent?utm_source=hashnode&utm_medium=feed) [Sep 17](https://hashnode.com/posts/why-more-than-30-skills-kill-your-ai-agent/6aabbe3a8fda52367089578c) ### [JSON vs Programmatic Tool Calling with Claude](https://thomastartrau.hashnode.dev/json-vs-programmatic-tool-calling-with-claude?utm_source=hashnode&utm_medium=feed) When building an application with the Claude API, connecting tools is the first step toward a functional agent. The model can call functions, query databases, send messages. But how you wire those too 8 min read · [thomastartrau.hashnode.dev](https://thomastartrau.hashnode.dev/json-vs-programmatic-tool-calling-with-claude?utm_source=hashnode&utm_medium=feed) [Sep 11](https://hashnode.com/posts/json-vs-programmatic-tool-calling-with-claude/6aa439fc73a97501cdf58702)