Claude Now Writes 80% of Code: How Google and Anthropic Scaled Delivery and CI in 6 Months

I’m Denis Shokhirev, Agentic AI Systems Architect based in Freiburg, Germany. My production stack: Claude, Supabase, n8n, Doppler, and self-hosted Postgres. In shipping real AI systems for DACH B2B clients, I hit a wall: code velocity was fine, but human review bottlenecked delivery. Now, with Claude generating 80% of code, my CI/CD throughput tripled in six months — but only because every step is locked down for real production, not demos.

Claude in Production: From Prototype to Stable Delivery

When Claude Code first launched, skeptics pointed to LLM hallucinations and security gaps. But in my deployments — including a live, observable agent stack at live.gerdennisai.com — Claude now delivers the majority of CRUD endpoints, data integrations, and even test scaffolding. The human role is focused on architecture, integration edge cases, and reviewing flagged diffs, not hand-writing boilerplate.

My current pipeline:

Issue or spec is converted into a precise Claude Code prompt (via Anthropic SDK, not manual copy-paste).
Claude generates code with inline docstrings and type hints.
Automated static analysis (semgrep, bandit, gitleaks) runs on every pull request.
CI/CD via GitHub Actions, with merge blocked unless all checks pass.
Manual review is limited to security findings or test coverage below 92%.

Scaling CI/CD Without Losing Control

Static Analysis: The Non-Negotiable Layer

The biggest risk with LLM codegen is not “AI mistakes” — it’s silent vulnerabilities. The 2024 Stanford CodeML paper (source) found 38% of LLM-generated Python snippets contained CWE-89 (SQL injection) patterns. In my last three agent deployments, I caught similar SQL injection flaws in Claude-generated ORM layers — always flagged by semgrep or bandit.


# Static analysis pipeline for Python/TypeScript
semgrep --config=python --error ./
bandit -r ./src
gitleaks detect --source=./src

Direct CI integration means:

semgrep: blocks unsafe SQL, OS calls, or insecure patterns.
bandit: detects Python-specific vulnerabilities before merge.
gitleaks: scans for hardcoded secrets pre-deploy.

Only if every check passes does code auto-merge and deploy via n8n + Supabase. Anything flagged triggers manual review — no exceptions.

Integrating Claude, Supabase, n8n, and Postgres: The Real-World Stack

Claude Code isn’t natively aware of your schema or workflow. I prompt with explicit table definitions, event flows, and Postgres constraints (like ENUMs or foreign keys), providing real or anonymized data examples. This cuts integration bugs at the source. Example: CRUD endpoint prompt for FastAPI and Supabase:


prompt = f"""
Write Python code for a FastAPI service. Table 'users':
- id: UUID, PK
- email: TEXT, unique
- status: ENUM('active', 'blocked')
Generate CRUD endpoints with validation and logging.
"""
response = anthropic_client.completions.create(
    model="claude-3-opus-20240229", prompt=prompt, max_tokens=1000
)

Same pattern for n8n flows: describe the event structure, expected inputs/outputs, and error handling. Claude outputs code that is CI-ready, not demo-ware.

Production Guardrails: Preventing Regression at Scale

Dynamic Testing and Coverage Enforcement

I never trust static analysis alone — runtime sandbox testing is mandatory. I generate tests with Claude (based on spec and edge-case scenarios), then execute them in an isolated Docker Compose environment. Coverage below 92% blocks any merge. This standard is enforced on all regulated B2B projects (fintech, logistics, industrial automation).


docker-compose -f docker-compose.test.yaml up --abort-on-container-exit
pytest --cov=src tests/

Key tools and when they run:

Tool	Purpose	Trigger
semgrep	Static pattern scan	Every commit
bandit	Python security check	Pre-merge
gitleaks	Secret detection	Pre-deploy
pytest + coverage	Test coverage	Pre-merge

FAQ

Does Claude really write production code?

Yes, if you prompt precisely and require all code to pass static + dynamic checks. Human review is only needed for architecture or complex integration, not routine CRUD.

How does Claude handle edge cases?

If you specify edge cases in the prompt and generate tests, Claude matches a solid mid-level developer. Underspecified? Expect subtle bugs.

Isn’t CI/CD now the bottleneck?

With automation and static analysis, CI/CD is faster than ever. Manual review is only a bottleneck for flagged or high-complexity changes.

What bugs does Claude most often miss?

Validation edge cases, incorrect nullable handling, and subtle business logic — anything not spelled out explicitly in the prompt.

What tools are mandatory in this stack?

semgrep, bandit, gitleaks, pytest, docker-compose, Anthropic SDK. Everything else is project-specific.

Which stage in your LLM pipeline catches the most issues in prod — static analysis, runtime sandbox, or human review? I’d genuinely like to know. I run a free 30-min stack audit for DACH founders building AI in regulated markets. DM me on LinkedIn or write to @ger_dennis_ai.