Blog on Yarang's Tech Lair

Building a Blog AI Auto-Comment System (1/3) — Architecture and Implementation

Sun, 03 May 2026 01:00:00 +0900

Overview

I built a system where AI automatically responds to blog comments. When a reader leaves a comment on a blog post, the AI assistant analyzes the post context and automatically generates a technically accurate yet friendly reply.

This series consists of three parts:

Part 1 (This post): Overall architecture design and core code implementation
Part 2: File-based authentication, permission management, security hardening
Part 3: systemd deployment, nginx proxy, troubleshooting

System Architecture

Overall Data Flow

Reader writes a comment
 ↓
[giscus] → Creates a comment on GitHub Discussions
 ↓
[GitHub Webhook] → Sends HTTP POST
 ↓
[nginx reverse proxy] → Header forwarding
 ↓
[Flask Worker] → Signature verification → Comment analysis
 ↓
[Claude Code CLI] → Generates AI response
 ↓
[GitHub GraphQL API] → Posts reply to Discussion
 ↓
[giscus] → Displays reply on blog

The key point in this architecture is that giscus uses GitHub Discussions as a comment storage. Therefore, we can receive new comment events via GitHub Webhook and post responses using the same GitHub API.

Components

Component	Role	Technology
giscus	Blog comment widget	Based on GitHub Discussions
GitHub Webhook	Event delivery	`discussion_comment` event
nginx	Reverse proxy	Header forwarding, SSL termination
Flask Worker	Webhook receiving and processing	Python, Flask, Flask-Limiter
Claude Code	AI response generation	`--print` mode CLI call
GitHub GraphQL	Response posting	Mutation API

giscus Configuration

To integrate giscus into a Hugo blog, the following configuration is required in hugo.toml:

[params]
 [params.comments]
 enabled = true
 provider = "giscus"
 [params.comments.giscus]
 repo = "yarang/blogs"
 repoId = "YOUR_REPO_ID"
 category = "General"
 categoryId = "YOUR_CATEGORY_ID"
 mapping = "pathname"
 strict = "0"
 reactionsEnabled = "1"
 emitMetadata = "0"
 inputPosition = "bottom"
 lang = "ko"
 theme = "noborder_gray"

mapping = "pathname" maps Discussions based on the post URL path. This creates an independent Discussion for each blog post.

GitHub Webhook Configuration

In the GitHub repository Settings > Webhooks:

Payload URL: https://your-domain/webhook
Content type: application/json
Secret: Secret for HMAC-SHA256 signature (covered in detail in the security post)
Events: Select Discussion comments

The Webhook sends a discussion_comment event to the Flask worker whenever a comment is created.

Flask Worker Implementation

Project Structure

auto-comment-worker/
├── scripts/
│ └── auto-comment-worker.py # Main worker
├── deploy/
│ └── auto-comment-worker.service # systemd service
├── venv/ # Python virtual environment
└── logs/
 └── audit.log # Audit log

Core Dependencies

from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
from marshmallow import Schema, fields, validate, ValidationError

Flask: Provides Webhook endpoints as a lightweight web framework
Flask-Limiter: Prevents abuse with rate limiting (10 times per minute)
marshmallow: Safe data parsing via request schema validation

Webhook Endpoint

@app.route('/webhook', methods=['POST'])
@limiter.limit("10 per minute")
def github_webhook():
 """Receives GitHub Webhook"""
 # 1. Signature verification
 signature = request.headers.get('X-Hub-Signature-256')
 if not verify_webhook_signature(request.data, signature):
 log_audit('SIGNATURE_INVALID', {'ip': request.remote_addr})
 return jsonify({'status': 'unauthorized'}), 401

 # 2. Request schema validation
 schema = WebhookSchema()
 try:
 payload = schema.load(request.json)
 except ValidationError as err:
 return jsonify({'status': 'invalid'}), 400

 # 3. Extract and filter comment information
 comment = payload.get('comment', {})
 discussion = payload.get('discussion', {})
 original_author = comment.get('user', {}).get('login', 'User')

 # Ignore if it's the blog owner's comment
 if _is_blog_owner(original_author):
 return jsonify({'status': 'owner_comment_ignored'}), 200

 # Ignore if AI generated comment (prevent infinite loop)
 if _is_ai_generated_comment(comment.get('body', '')):
 return jsonify({'status': 'ai_comment_ignored'}), 200

 # 4. Generate and post AI response
 discussion_graphql_id = get_discussion_graphql_id(
 repo_owner, repo_name, discussion_number
 )
 context = f"Title: {discussion_title}\n\nContent: {discussion_body}"
 reply = analyze_comment(context, comment_body)
 post_reply_graphql(discussion_graphql_id, comment_body, original_author, reply)

The core flow consists of 4 steps:

Signature verification: Verifies if the request came from GitHub using HMAC-SHA256
Schema validation: Validates payload structure with marshmallow
Filtering: Ignores comments from the blog owner and the AI itself (prevents infinite loops)
Response: Generates AI response with Claude Code and posts via GraphQL API

Preventing Infinite Loops

If AI responds to a comment created by AI, it will fall into an infinite loop. To prevent this, we use marker-based detection:

def _is_ai_generated_comment(body: str) -> bool:
 """Identifies if the comment was generated by AI"""
 ai_markers = [
 '🤖 AI Assistant',
 'AI Assistant',
 'AgentForge',
 'Automatically generated by Claude Code',
 'was automatically generated'
 ]
 body_lower = body.lower()
 return any(marker.lower() in body_lower for marker in ai_markers)

When posting the AI response, you must include one of these markers in the body:

body = f"""---
**🤖 AI Assistant**

{safe_reply}

*This comment was automatically generated by AgentForge + Claude Code.*
---
"""

Calling Claude Code CLI

Use Claude Code’s --print mode to generate an AI response non-interactively:

def analyze_comment(context: str, comment: str) -> str:
 """Run Claude Code with AgentForge settings"""
 prompt = f"""## Blog Post Context
{context[:2000]}

## Reader Comment
{comment}

Please write a response to this comment.
- As a technical blog assistant, be professional yet friendly
- Concise within 200 characters
- Provide additional info or links if needed
"""

 cmd = [
 CLAUDE_CODE_PATH,
 '--settings', AGENTFORGE_CONFIG,
 '--print', prompt
 ]

 result = run(cmd, capture_output=True, text=True, timeout=60)

 if result.returncode == 0 and result.stdout.strip():
 return result.stdout.strip()

 return "Thanks for your opinion! I think it would be great to discuss the technical aspects further. 🙏"

Specify the AgentForge dedicated configuration file with the --settings flag. You can manage the model, token limits, etc. in this configuration file.

The --print flag runs Claude Code in non-interactive mode and outputs the result to stdout. Unlike interactive mode, it terminates after a single prompt-response.

GitHub GraphQL API Integration

Since giscus uses GitHub Discussions, the response must also be posted via the GitHub GraphQL API.

Retrieve Discussion GraphQL ID:

def get_discussion_graphql_id(repo_owner, repo_name, discussion_number):
 query = """
 query($owner: String!, $name: String!, $number: Int!) {
 repository(owner: $owner, name: $name) {
 discussion(number: $number) {
 id
 }
 }
 }
 """
 variables = {
 "owner": repo_owner,
 "name": repo_name,
 "number": discussion_number
 }

 response = requests.post(
 GITHUB_API_URL,
 json={"query": query, "variables": variables},
 headers={
 "Authorization": f"Bearer {GITHUB_TOKEN}",
 "Content-Type": "application/json"
 },
 timeout=10
 )

 if response.status_code == 200:
 data = response.json()
 return data["data"]["repository"]["discussion"]["id"]
 return None

The Webhook payload only includes the Discussion’s REST API ID. However, to post a comment, the GraphQL Node ID is required. Therefore, we first retrieve the Discussion’s Node ID via a GraphQL query, then use it to post the comment.

Post Response (Mutation):

def post_reply_graphql(discussion_graphql_id, original_comment, original_author, reply):
 query = """
 mutation($discussionId: ID!, $body: String!) {
 addDiscussionComment(input: {
 discussionId: $discussionId, body: $body
 }) {
 comment { id, databaseId }
 }
 }
 """
 # ... (Send request)

The addDiscussionComment mutation adds a new comment to the entire Discussion. It is a Discussion-level comment, not a reply to a specific comment.

Input Sanitization

Since user comments are external input, they must be sanitized:

def sanitize_comment(body: str) -> str:
 """User input sanitization"""
 if not body:
 return body
 body = re.sub(r'<[^>]+>', '', body) # Remove HTML tags
 body = html.escape(body) # Escape HTML entities
 body = body[:1000] # Length limit
 return body

To prevent XSS attacks, HTML tags are removed, remaining special characters are escaped, and the length is limited to 1000 characters.

Audit Logging

We keep audit logs to track security events:

def log_audit(event_type: str, details: dict):
 """Record security event audit log"""
 with open(AUDIT_LOG, 'a') as f:
 f.write(json.dumps({
 'timestamp': datetime.utcnow().isoformat(),
 'event': event_type,
 'details': details
 }) + '\n')

Event types recorded:

SIGNATURE_INVALID: Webhook signature verification failed
INVALID_PAYLOAD: Invalid request payload
WEBHOOK_RECEIVED: Webhook received successfully
AI_RESPONSE_SENT: AI response posted successfully

Conclusion

In this Part 1, we covered the overall architecture and core implementation code connecting giscus, GitHub Webhook, Flask worker, Claude Code CLI, and GitHub GraphQL API.

In the upcoming Part 2, we will cover security hardening for this system — file-based authentication management, file permission verification, HMAC-SHA256 signature verification, and more in detail.

This post is Part 1 of the AgentForge blog automatic comment system series.

[MCP] Blog Server Improvement Kickoff

Wed, 25 Feb 2026 00:00:00 +0900

Blog MCP Server Improvement Project Kickoff Meeting Minutes

Date: 2026-02-25 Project: Blog MCP Server Improvement Attendees: team-lead, backend-dev, search-specialist, qa-tester, meeting-writer Document Author: meeting-writer

1. Meeting Overview

1.1 Purpose

Project kickoff to improve the stability and performance of the blog MCP server according to the improvement roadmap defined in ARCHITECTURE.md

1.2 Project Scope

Blog Repository: /Users/yarang/workspaces/agent_dev/blogs
API Server: /Users/yarang/workspaces/agent_dev/blog-api-server

2. Project Background

2.1 Current System Status

The current blog system operates with the following structure:

Claude Code (MCP Client)
 ↓ HTTP POST /posts
API Server (blog-api-server)
 ↓ Git clone/pull, Git commit/push
GitHub (yarang/blogs)
 ↓ GitHub Actions trigger
Hugo Build + Deploy
 ↓
Blog (blog.fcoinfup.com)

2.2 Identified Issues

🔴 P0 - Critical Issues

Insufficient Concurrency Control: Only using global threading.Lock(), potential race conditions in multi-process environments
Search Bug: search_posts() only searches Korean directory, missing English posts

🟡 P1 - Scalability Issues

Git Pull on Every Request: Unnecessary network calls, increased latency
File-based Search (O(n)): Performance degradation with 100+ posts
Global Instance Dependency: Difficult testing, no dependency injection

🟢 P2 - Maintainability Issues

Duplicate Git code (GitManager and GitHandler coexist)
Unstable language detection logic
Broad exception handling

3. Team Composition

Role	Member	Responsibilities
team-lead	Project Leader	Overall project management, coordination
backend-dev	Backend Developer	Concurrency control, Git optimization
search-specialist	Search Specialist	Search functionality improvement
qa-tester	QA Tester	Testing and quality assurance
meeting-writer	Meeting Scribe	Meeting notes and documentation

4. Work Items and Progress

4.1 Search Bug Fix ✅ Complete

Owner: search-specialist
Priority: P0
Results:
- Confirmed P0 bug in ARCHITECTURE.md was already fixed
- Verified with 12 test cases in test_search.py
- All language directories (ko, en) now searchable

4.2 Git Pull Optimization ✅ Complete

Owner: backend-dev
Priority: P1
Results:
- Introduced CacheManager in MCP client (5-minute TTL)
- Implemented cache invalidation after write operations
- Location: .claude/mcp_server.py:25-71

4.3 Enhanced Concurrency Control ✅ Complete

Owner: backend-dev
Priority: P1
Results:
- Introduced asyncio.Lock in MCP client
- Prevented write operation conflicts

4.4 Existing Test Code Validation 🔄 In Progress

Owner: qa-tester
Priority: QA
Status: In progress

4.5 ARCHITECTURE.md Update ✅ Complete

Owner: team-lead
Results:
- Reflected completed work
- Progress indicators (✅ Complete, 🔄 In Progress, ⚡ Partial)

5. Key Achievements

Before Improvements

Git Pull on every request (up to 60-second timeout)
Only Korean posts searchable
Insufficient concurrency control

After Improvements

Caching Introduced: 5-minute TTL minimizes unnecessary API calls
Multi-language Search: Both Korean and English posts searchable
Concurrency Control: asyncio.Lock prevents write operation conflicts

6. Test Coverage

Test Item	Status
Multi-language search (ko, en)	✅
Relevance sorting	✅
Case-insensitive search	✅
Result structure validation	✅
Caching behavior	✅
Connection pooling	✅
Error handling	✅

7. Next Steps (Medium-term Plan)

P2 - Structural Improvements

Git Class Consolidation: Merge GitManager and GitHandler
Dependency Injection: Utilize FastAPI Depends
Index-based Search: Consider Whoosh or Meilisearch

8. Meeting Summary

This meeting minutes includes:

Project kickoff discussion items
Team composition and role assignments
Work item progress
Summary of completed work
Future plans

This meeting minutes was prepared by meeting-writer and will be updated as the project progresses.

Korean Version: 한국어 버전

[MCP] Blog Automation System

Sat, 21 Feb 2026 21:30:00 +0900

Introduction

We built a system where Claude can directly manage blog posts using the Model Context Protocol (MCP). This article explains the implementation and usage.

What is MCP?

MCP (Model Context Protocol) is a protocol developed by Anthropic that enables standardized communication between Claude and external tools/data sources.

flowchart LR
 Claude <-->|MCP| MCPServer[MCP Server]
 MCPServer --> BlogFiles[Blog Files]

Architecture

System Structure

blogs/
├── .claude/
│ ├── mcp_server.py # MCP Server Implementation
│ ├── requirements.txt # Python Dependencies
│ ├── README.md # Documentation
│ └── claude_desktop_config.json
├── content/
│ └── posts/ # Blog Posts
└── static/
 └── images/ # Image Files

MCP Server Structure

class BlogManager:
 """Blog Management Class"""

 def create_post(self, title, content, tags, categories):
 """Create new post"""

 def list_posts(self, limit, offset):
 """List posts"""

 def get_post(self, filename):
 """Get specific post"""

 def update_post(self, filename, **kwargs):
 """Update post"""

 def delete_post(self, filename):
 """Delete post"""

 def search_posts(self, query):
 """Search posts"""

Available Tools

flowchart TB
 subgraph Tools[MCP Tools]
 C1[blog_create_post]
 R1[blog_list_posts]
 R2[blog_get_post]
 R3[blog_search_posts]
 U1[blog_update_post]
 D1[blog_delete_post]
 end

 subgraph CRUD[CRUD Operations]
 Create[Create]
 Read[Read]
 Update[Update]
 Delete[Delete]
 end

 C1 --> Create
 R1 --> Read
 R2 --> Read
 R3 --> Read
 U1 --> Update
 D1 --> Delete

1. blog_create_post

Create a new blog post.

{
 "title": "Post Title",
 "content": "Markdown content...",
 "tags": ["tag1", "tag2"],
 "categories": ["Development"],
 "draft": false
}

2. blog_list_posts

Retrieve post list.

{
 "limit": 20,
 "offset": 0
}

3. blog_get_post

Get details of a specific post.

{
 "filename": "2026-02-21-004-example.md"
}

4. blog_update_post

Update existing post.

{
 "filename": "2026-02-21-004-example.md",
 "content": "Updated content...",
 "draft": false
}

5. blog_search_posts

Search posts by content.

{
 "query": "Docker"
}

Automated File Naming

Post filenames are automatically generated using the following rule:

YYYY-MM-DD-NNN-slug.md

YYYY-MM-DD: Creation date
NNN: Serial number (001, 002, …)
slug: URL-friendly string generated from title

Example: 2026-02-21-004-mcp-blog-automation.md

Usage Scenarios

flowchart LR
 User -->|Natural Language| Claude
 Claude -->|blog_create_post| MCP[MCP Server]
 MCP -->|Create File| Blog[YYYY-MM-DD-NNN-slug.md]

1. Quick Post Writing

User: "Write a short tip post about Python list comprehensions"

Claude: Use blog_create_post tool to create post
→ File created: 2026-02-21-005-python-list-comprehension.md

2. Search and Update Existing Posts

User: "Find Docker-related posts and update with latest version info"

Claude: blog_search_posts("Docker") → Check results → blog_update_post

3. Manage Series Posts

User: "Show me all agent-related posts written so far"

Claude: blog_search_posts("agent") → List related posts

Implementation Considerations

Front Matter Parsing

Parses Hugo’s TOML format front matter:

def _parse_front_matter(self, content: str) -> Dict[str, Any]:
 """Parse TOML front matter"""
 if not content.startswith("+++"):
 return {}

 parts = content.split("+++", 2)
 # ... parsing logic

Concurrency Handling

Prevents filename conflicts by checking existing file count:

existing_count = len(list(self.content_dir.glob("*.md")))
filename = self._generate_filename(title, existing_count + 1)

Extensibility

flowchart TB
 subgraph Current[Current Implementation]
 C1[blog_create_post]
 C2[blog_list_posts]
 C3[blog_get_post]
 C4[blog_update_post]
 C5[blog_delete_post]
 C6[blog_search_posts]
 end

 subgraph Future[Future Extensions]
 F1[blog_upload_image]
 F2[blog_suggest_tags]
 F3[blog_optimize_seo]
 F4[blog_publish]
 end

 Current --> Future

1. Image Processing

blog_upload_image: Image upload and optimization

2. Auto Tag Suggestion

blog_suggest_tags: Content analysis-based tag suggestions

3. SEO Optimization

blog_optimize_seo: Meta description, keyword optimization

4. Deployment Automation

blog_publish: git commit, push, deployment trigger

Conclusion

With the MCP-based blog automation system:

Improved Productivity: Write posts in natural language
Consistency: Automatic file naming rules
Better Accessibility: Intuitive blog management via Claude

This system is continuously extensible, with potential additions like image processing, SEO optimization, and automated deployment.

References

Korean Version: 한국어 버전