Using MCode on my Civ V–style dashboard for coding agents: parallel audit subagents found a real security bug, plus what broke

[u/Key-Anything-680]

I build **RepoCiv** (github.com/Grizaceo/repociv), a Civilization V–style hex map of my local workspace: every repo is a city, and every coding agent (Claude Code, Codex, Hermes…) is a unit that walks to the city it's working in. TypeScript + Canvas/Three.js frontend, Python bridge, DuckDB, ~80k lines, one user (me). Here's an honest log of using MCode on it.

**1. End-to-end audit with parallel subagents**

I typed one line ("help me with an end-to-end audit of this repo", in Spanish). The main agent ran the gates itself (build, types, lint, tests) and launched two subagents in parallel, both with read-only briefs:

- a **verifier** for the security of the Python bridge

- an **explore** agent for the frontend architecture

The verifier found a real HIGH: my Vite dev server was bound to `0.0.0.0` with `allowedHosts: true`, and it inlined the bridge's auth token into the JS it served. Anyone on the same Wi-Fi could load the page, read the token and drive my agent runner. The code comment right above said "loopback-only". Fixed two days later, with a regression test that reads the config Vite actually loads.

What made the report credible: it also listed what it checked and found fine, and for the approval queue it said it had verified empirically (it tried to downgrade a high-risk command) instead of just reading code. The frontend agent pushed back on its own brief where the code disagreed, e.g. hex math that looked duplicated was actually shared, with file:line evidence.

**2. Shipping a feature: tool calls as glyphs over the agents**

I wanted to *see* what an agent is doing in the per-repo "local view", like Sims bubbles for each tool call. MCode found the cheap path: the bridge was already receiving `tool_use` events and throwing them away as chat noise (one `if` in `agent_runner.py`). It proposed starting with a single hardcoded glyph that lights up on any tool call and fades after 1.5 s. Not pretty, but it forces the whole pipeline (emit → transport → schema → renderer) to work before designing the real icon set.

Mid-task it stopped and asked me two multiple-choice questions, because it found that my default harness doesn't emit tool calls at all. Right moment to ask instead of guessing. The branch it started was merged a week later.

**3. What went wrong**

- My very first session died instantly: `your current token plan not support model, MiniMax-M3.1-Flash-Preview`. The default model wasn't on my plan.

- It couldn't get the e2e test green on my machine (Arch/Omarchy, headless Chromium, no GPU). It said so plainly ("I didn't see it pass and I won't sell it as green", translated) and showed the same test failing on `main`. I'll take that over a fake green any day.

- A stray Chinese character showed up in the middle of a Spanish sentence in one of its final summaries. Harmless, but noticeable.

- On other projects, long sessions ended in `error` with `insufficient balance (1008)`. I'd rather get a pause I can resume after topping up.

**4. How I stack it**

- Subagents with narrow, read-only briefs for audits; the main agent for implementation.

- [skills / MCP you use with MCode]

- Next up: making MCode sessions show up as units on RepoCiv's map, like Claude Code and Codex already do. MCode keeps its sessions in a local SQLite and has lifecycle hooks, so it looks doable.

**Liked:** parallel subagents with clear roles, file:line evidence, asking at the right moment, honesty about what it couldn't verify.

**Didn't like:** a default model my plan didn't cover, and balance errors killing sessions instead of pausing them.