Roadmap · Foundations
Coding with AI tools (Cursor)
FreeFor students and developers who use Claude Code, Cursor or GitHub Copilot and want to get real work done without losing the skills that make them engineers. By the end you can set up your tool with good project context, prompt for small checkable changes, review and test everything it writes, run agents safely and ship a real project with an honest write-up.
Curated by Tauseef Fayyaz10 stages, 59 topics~5 months at a few hours a weekBy the end, you will be able to
- Explain what AI coding tools are good and bad at, and decide task by task whether to use one, which mode to use, or to write the code yourself
- Set up your tool in a real repository with a short, accurate instructions file, scoped rules and secrets kept out of its reach
- Turn a task into a small, specified prompt with a definition of done, and review every diff with a checklist before it is committed
- Use tests, debugging evidence, permission rules, checkpoints and Git so agent changes are verified, reversible and safe
- Keep your fundamentals sharp with regular AI-off practice, and ship a small real project with an agent plus a write-up of what you decided and what you caught
The path
10 stages, in the order to learn them. Open one to start.
1What AI coding tools are good and bad atLearn how the models behind these tools work, the difference between completions, chat and agents, and where they help or hurt, so you use them with judgment from day one.6 topics · ~1 week
- 1How a language model writes codeEvery AI coding tool sits on a large language model (LLM): a program trained on huge amounts of text and public code that predicts the next small chunk of…
- 2Hallucinations and the context windowA hallucination is a confident answer that is simply wrong: a function, command-line flag, file path or package that does not exist, or an outdated detail…
- 3Completions, chat and agentsYou use these tools in three ways.
- 4Where AI helps and where it hurtsAI tools shine on well-trodden work with a clear check: boilerplate, syntax you half remember, explaining unfamiliar code, first drafts of tests, mechanical…
- 5Automation bias and staying in chargeAutomation bias is the human habit of trusting a confident machine more than we should: approving its output with less care than we would give a classmate's…
- 6What Cursor isCursor is an AI code editor from Anysphere, built on VS Code, so your extensions, settings and keyboard habits mostly carry over.
6 in this stageOpen this stage2Setup and project contextInstall your tool in a real repository, write a short instructions file it loads every session, add scoped rules, keep secrets out of its reach and learn to point it at exactly the right files.6 topics · ~1 week
- 1Installing Cursor and opening a projectDownload Cursor from cursor.com and sign in.
- 2Writing project rules in .cursor/rulesCursor's project rules live in
.cursor/rulesas.mdcfiles, Markdown with a small frontmatter block (settings between two lines of three dashes) at the top. - 3AGENTS.md for mixed teamsAGENTS.md is a plain Markdown instructions file at the root of a repository that many coding agents read, so one file can guide everyone whichever tool they…
- 4Rules that apply to some filesSome guidance only matters for part of the codebase, such as "API handlers validate input with zod" or "tests use the factory helpers".
- 5Keeping secrets out of reachAnything your tool reads may be sent to a model provider, so keep secrets out of what it can see.
- 6Pointing the tool at the right filesYou get faster, more accurate answers when you name exactly what the tool should read rather than describing where code lives.
6 in this stageOpen this stage3Prompting for code: small tasks, clear specsTurn work into small, checkable tasks with a written spec and a definition of done, plan before multi-file changes, reuse prompts that work and start each task with a clean context.7 topics · ~2 weeks
- 1Small, checkable tasksThe single biggest improvement to your results is asking for less at a time.
- 2Writing a task spec with a definition of doneA task spec is a short, structured prompt: the goal, the files involved, the constraints, what is out of scope, and how to prove the work is done.
- 3Pointing at a pattern to followModels write generic code by default.
- 4Plan before codeFor any change that touches several files, or where you are unsure of the approach, ask the tool to read the code and propose a plan before it edits anything:…
- 5Prompt templates for everyday tasksMost of your prompts will be one of a few kinds: explain this code, fix this bug, add this feature, refactor without changing behaviour.
- 6Saving prompts that workWhen a prompt works well several times, save it in the repository so you and your team can run it by name.
- 7Fresh context for each taskEvery message, file and command output stays in the conversation and competes for the model's attention.
7 in this stageOpen this stage4Reading and reviewing AI codeReview every AI change like a colleague's pull request: read the whole diff, run a fixed checklist, explain it back, catch invented APIs and unrequested changes, and use AI review only as a second pass.7 topics · ~2 weeks
- 1Reading every diffA diff shows exactly which lines were added, removed or changed.
- 2A review checklist for AI codeAI mistakes repeat, so a short, fixed checklist catches most of them: does it do what I asked and nothing else; does every function, flag and package exist;…
- 3Explaining it back in your own wordsBefore you commit an AI change, explain what it does and why it works in your own words, without reading the tool's summary.
- 4Catching invented and outdated APIsThe most common AI error is a call that does not exist in the version you use: an invented method, a renamed option, a removed flag or a configuration key…
- 5Spotting unrequested changesTools often do more than you asked: rename variables, reformat whole files, add abstractions, sneak in an extra feature, delete comments or tests, or leave…
- 6Committing in small, reviewed stepsCommit your own work before each AI task, so the tool starts from a clean state.
- 7AI review as a second passAfter your own review, a separate AI review in a fresh context can catch edge cases, because it is not attached to the code it just wrote.
7 in this stageOpen this stage5Tests first, so AI output is checkedUse tests as the specification and the judge: write the first test yourself, recognise tests that cannot fail, list edge cases, and give the agent a check it must pass and show you.6 topics · ~2 weeks
- 1Tests as the specificationA test written before the code is a specification you can run.
- 2Red, green, refactor with an AI toolTest-driven development (TDD) is a short loop.
- 3Writing the first test yourselfWrite at least the first, most important test for any feature by hand.
- 4Recognising tests that cannot failAI-generated tests often look thorough and check nothing.
- 5Listing edge cases up frontModels write the happy path well and the edges badly.
- 6Making the agent prove itAn agent stops when the work looks done.
6 in this stageOpen this stage6Debugging with AIUse AI to find causes rather than hide symptoms: reproduce first, shrink the problem, give full evidence, test hypotheses, fix the root cause with a regression test and keep using the real debugger.6 topics · ~2 weeks
- 1Reproduce, then shrink the problemBefore asking anyone, human or AI, to fix a bug, find the exact steps, input and environment that make it happen every time.
- 2Giving the tool full evidenceGive the tool the full error message, the stack trace (the list of function calls running when the error happened), relevant logs, the input, what you…
- 3Hypotheses before fixesInstead of asking for a fix straight away, ask for a ranked list of possible causes and how to test each one, with no code changes yet.
- 4Symptom patches versus root causesA symptom patch makes the error go away without fixing the bug: an empty catch block that swallows the exception, a null check that quietly skips the work, a…
- 5Using the real debuggerThe model predicts what your code probably does; the debugger shows what it actually does.
- 6Learning from every bugDebugging is where you learn how systems really work, so do not outsource the learning with the fix.
6 in this stageOpen this stage7Agents: multi-file changes, permissions and safetyUnderstand the agent loop, choose permission modes and rules deliberately, undo with checkpoints and Git, sandbox what you can, and guard against prompt injection, risky MCP servers and unreviewed background work.5 topics · ~2 weeks
- 1How an agent works through a taskAn agent runs a loop: read the task, choose a tool (read a file, search, edit, run a command), look at the result, decide the next step, and repeat until it…
- 2Run Modes and approvals in CursorCursor's Run Modes, in Settings, Agents, Approvals & Execution, decide which shell commands, MCP tools and fetches run without asking.
- 3Checkpoints and Git as your safety netTools snapshot the files they edit so you can roll back.
- 4Sandboxing and prompt injectionPrompt injection is text hidden in content the agent reads, a web page, an issue, a README or a package's docs, that tries to make it do something you did not…
- 5MCP servers and background agentsThe Model Context Protocol (MCP) is an open standard for connecting agents to outside tools and data, such as databases, issue trackers and browsers.
5 in this stageOpen this stage8Security and licencesKeep secrets and sensitive data out of prompts, check every dependency an AI suggests, recognise the insecure patterns it repeats, scan automatically, and respect licences, data settings and AI policies.6 topics · ~2 weeks
- 1What never goes into a promptPrompts and files the tool reads leave your machine, so some things never go in, whatever the tool's privacy settings say: API keys, tokens and passwords;…
- 2Hallucinated packages and new dependenciesModels sometimes suggest packages that do not exist.
- 3Insecure patterns AI repeatsModels learned from public code, including insecure code, so the same flaws appear again and again: SQL built by joining strings, which allows SQL injection;…
- 4Scanning code and secrets automaticallyYou will not catch everything by eye, so let tools check every line.
- 5Licences, data settings and AI policiesGenerated code occasionally matches public code closely, and that code may carry a licence with conditions such as attribution or sharing your changes.
- 6Security rules in your instructions fileYour instructions file is a cheap place to prevent whole classes of mistakes.
6 in this stageOpen this stage9Keeping your skillsProtect the skills AI tools can quietly erode: regular practice with AI switched off, attempting before comparing, using the tool as a tutor, reading docs first and keeping your fundamentals strong.5 topics · ~2 weeks
- 1Why skills fade with AI helpSkills form through effort: recalling syntax, getting stuck, reasoning through an error.
- 2Regular practice with AI switched offSet aside regular sessions, a few hours a week, with suggestions and agents switched off: solve problems, build small features, write tests and debug by…
- 3Attempt first, then compareWhen you are learning, write your own solution, or at least your own plan, before you ask the tool.
- 4Using AI as a tutor, not an answer machineThe same tool that can make you dependent can be a patient tutor if you set the rules.
- 5Docs first and the fundamentals that lastTwo habits keep you independent.
5 in this stageOpen this stage10A real project shipped with an agentPut it all together: scope a small real project, write a spec, build it in vertical slices with your tool, gate every pull request on CI, disclose AI use honestly and publish a write-up of your decisions.5 topics · ~4 weeks
- 1Scoping a project you can finishPick a project small enough to finish in a few weeks, for a real user you can talk to, with a handful of features each of which you can test.
- 2A written spec and vertical slicesWrite a short spec in the repository, for example SPEC.md: the users, the features each with a "done when" check, the data, what is out of scope, and the…
- 3CI and one pull request per sliceSet up continuous integration (CI) early: automated checks that run on every pull request, such as tests, type checking, linting and your security scanners,…
- 4Deploying and learning from real useA project is not shipped until someone real uses it.
- 5Disclosing AI use and writing it upBe honest about how you used AI: in the README, pull request descriptions or commit trailers, following any required format from your course or employer.
5 in this stageOpen this stage
Build a project
A finished project proves more than a certificate.
- Start with this oneintermediate1 semester · 2 studentsInstruction File Linter for AI Coding Agents: AGENTS.md, CLAUDE.md, Cursor Rules and Copilot Instructions
Builds directly on the setup stage: check CLAUDE.md, AGENTS.md, Cursor rules and Copilot instructions against the real repository
- TypeScript or Python
- remark or markdown-it-py
- YAML frontmatter parsing
- GitHub Actions
- An LLM API (optional)
- intermediate1 semester · 2 studentsMutation Testing Bot That Grades AI-Written Tests on Pull Requests
Turns the tests-first stage into a tool: measure whether AI-written tests actually catch bugs on each pull request
- Python or TypeScript
- Stryker, mutmut or PIT
- GitHub Actions and the GitHub REST API
- Docker
- A small web dashboard (optional)
- intermediate1 semester · 2 to 3 studentsSocratic AI Programming Tutor for University Labs That Never Gives the Answer
Puts the keeping-your-skills stage to work: an AI tutor that asks questions and never hands over the answer
- Next.js or Django
- An LLM API with a guardrail layer
- PostgreSQL
- Sandboxed runner (Judge0 or Docker)
- Python or TypeScript
Related on Sefism
Picked from the other libraries by shared topics.
Best practices
See all- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
- Best Practices for Building LLM AppsHow to build LLM apps and agents that hold up in production: prompts, evals, prompt injection, tool permissions, cost, logging and privacy.
- Prompt Engineering Best PracticesHow to write prompts that work the same way on the hundredth input as on the first: clear instructions, structure, examples, reasoning, output control and testing.
Checklists
See all- RAG Production ChecklistA RAG production checklist: chunking, embeddings, hybrid search, reranking, per-user permissions, citations, evals, re-indexing and cost, with how to verify each check.
- LLM Evaluation ChecklistAn LLM evaluation checklist: success criteria, eval datasets, code and model graders, judge calibration, agent evals, safety tests and production monitoring, with how to verify each check.
- AI Feature Launch ChecklistAn AI feature launch checklist: use case fit, evals, UX for errors, disclosure, human override, abuse filters, rate limits, cost caps, prompt privacy, monitoring and rollback.
Project structures
See all- GenAI RAG app (FastAPI) project structureFor developers turning a "chat with your documents" demo into an app people can rely on. A FastAPI backend where every layer has a home: ingestion workers, retrieval, prompts as versioned files, model clients with fallbacks and cost caps, guards, evals that gate CI, and tracing, so a wrong answer can be traced to the step that caused it.
- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Machine learning project project structureFor students and analysts whose model works in a notebook and now needs to be reproducible, reviewable, served and watched. It starts from the Cookiecutter Data Science v2 layout (immutable raw data, numbered notebooks, a real Python package) and grows into versioned data with DVC, typed parameters, data validation with pandera, experiment tracking and a model registry with MLflow, a FastAPI prediction service, drift monitoring and, for a team, scheduled retraining, model cards, fairness checks and shadow deployment.
Career questions
See all- Is it bad that I rely on ChatGPT or Cursor and cannot write code from scratch?Using AI tools is fine and increasingly expected. Being unable to write, debug or explain code without them is a real risk, because interviews, reviews and production incidents test exactly that. Keep the tools, but rebuild the ability to think and code independently first.
- Which AI tools do employers expect junior developers to know in 2026?Employers rarely require a specific brand. They expect you to use an AI coding assistant well (in the editor and in the terminal), to review and test what it produces, to call an LLM API in a small feature, and to explain when you would not use AI. Pick one assistant, learn it properly, and show judgement in your projects.
- What is vibe coding, and can it get me a job?Vibe coding means building software by describing what you want to an AI and accepting the code without really reading it. It is great for prototypes and personal tools. On its own it will not get you a developer job, because employers pay for people who can understand, debug and take responsibility for code. Use it, but learn what is underneath.
Cheat sheets
See all- Choosing an LLM and AI stack cheat sheetModels, hosting and tools for your use case.
- Prompt Engineering cheat sheetPrompt anatomy, few-shot examples, chain of thought, structured output, long context, prompts for code and study, and testing prompts.
- AI engineering cheat sheetBuild products on LLMs and generative AI.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com