← Accueil
  • Further Exercises — AI Agents & Code Auditing

    • Further Exercises — AI Agents & Code Auditing

    Author: Olivier Vitrac, PhD, HDR — olivier.vitrac@adservio.fr
    Affiliation: Adservio Innovation Lab · Applied AI & Engineering Sciences
    License: CC BY-NC-SA 4.0

    This companion proposes hands-on tasks per lecture. Each exercise lists goals, inputs, expected deliverables, and a rubric.

    Lecture 0 — Installation, Setup & Shell/VS Code Integration

    E0.1 — Reproducible Env Bootstrap (30–45 min, ★☆☆)

    Goal: Produce a deterministic Claude Code setup usable from VS Code and shell.
    Steps:

    1. Document OS, VS Code, Claude Code plugin version, and MCP configuration.

    2. Create .claudeignore tuned for your repo.

    3. Validate shell access: list repo files and run a harmless command (e.g., python --version) through Claude Code. Deliverables:

    E0.2 — Minimal Reveal Build (20–30 min, ★☆☆)

    Goal: Build a slide deck using your template.
    Steps: Run tools/scripts/build_reveal.sh lectures/lecture0_install --title "L0 Install".
    Deliverables: lectures/lecture0_install/dist/index.html, reports/L0_build_log.md.
    Rubric (5 pts): 2 build, 2 organization, 1 screenshot.

    E0.3 — MCP “Read-Only” Tool (40–60 min, ★★☆)

    Goal: Register one read-only MCP tool (e.g., file lister).
    Deliverables: tools/mcp/config.json diff + reports/L0_mcp_readonly.md.
    Rubric (10 pts): 4 working config · 3 safety · 3 docs.

    Lecture 1 — Practical Agents (Claude Code Max, MCP, CLI)

    E1.1 — Planning Protocol in Claude.md (20 min, ★☆☆)

    Goal: Turn your working protocol into a checklist.
    Deliverables: Claude.md with sections 0–9 + “Plan v1.x”.
    Rubric (5 pts): structure, brevity, reviewability.

    E1.2 — Single-Agent Workflow (60–90 min, ★★☆)

    Goal: Use Claude Code to refactor a module and update tests.
    Steps:

    1. Ask Claude to propose plan → approve → execute.

    2. Enforce minimal diffs and commit messages.
      Deliverables: PR or patch (patches/E1_refactor.patch), reports/E1_refactor.md (before/after, tests).
      Rubric (10 pts): 4 correctness · 3 diffs · 3 tests.

    E1.3 — MCP Chained Tools (90–120 min, ★★★)

    Goal: Chain: ruff → pytest → summarization.
    Deliverables: reports/E1_chain.md (commands, outputs), CI snippet (optional).
    Rubric (15 pts): 6 chaining · 5 automation · 4 reporting.

    Lecture 2 — Code Auditing (Debt, Standards, Issues)

    E2.1 — Hybrid Audit (SAST + LLM) (60–90 min, ★★☆)

    Goal: Run Semgrep/Bandit/Ruff locally and compare with Claude audit.
    Deliverables: reports/E2_hybrid_audit.md with table mapping findings ↔ CWE/OWASP.
    Rubric (15 pts): 5 tooling · 5 mapping · 5 clarity.

    E2.2 — Technical Debt Notebook (60–90 min, ★★☆)

    Goal: Classify debt (code/design/test/docs/security) and propose remediation.
    Deliverables: reports/E2_debt.md with ranked backlog (impact × effort).
    Rubric (10 pts): 4 diagnosis · 4 remediation · 2 prioritization.

    E2.3 — CI Gate (90–120 min, ★★★)

    Goal: Add a pre-merge gate using Claude Code CLI + linter exit codes.
    Deliverables: CI config snippet + reports/E2_ci_gate.md.
    Rubric (15 pts): 6 correctness · 5 resiliency · 4 developer experience.

    Bonus Tracks

    Self-Assessment Template

    Create self_assessment.md after each exercise with: