• Simon Willison's post says his tools site now offers tag clouds for browsing 244 vibe-coded tools.
• By his account, the tags cover JavaScript APIs, libraries and web API hosts, extracted with tree-sitter.
• The post describes a convenience feature; it does not report a security finding or a benchmark.
• The Weights has not run or validated the tagging, so its accuracy is unknown to us.
• The one reusable idea is to have a model write a parser-based analyzer once, then verify its output before trusting it.

Simon Willison has added tag-based browsing to his collection of vibe-coded tools, which he counts at 244. By his own account, he used Fable 5.2 and tree-sitter to extract the JavaScript APIs, libraries and web API hosts each tool uses. The Weights rates this Noise for enterprise AI teams: it is a small, self-reported convenience feature with no security finding attached.

What the source does and does not establish

The post establishes what the author says he built and how: a model-assisted analysis of tool source code using a syntax parser, feeding three tag categories on a homepage. It does not, in the material we relied on, establish how accurate the tags are, and we have not run the analysis ourselves. Any claim beyond the author's description, including benefits for security review, is inference rather than something demonstrated.

The one idea worth keeping

Parser-based extraction is deterministic, which is different from asking a model to read code and guess. Tree-sitter's documentation describes it as a parser generator and incremental parsing library that produces concrete syntax trees, so the same input yields the same tree. A team could use that pattern to inventory what generated code calls, provided it samples the output against the code before relying on it. That is a suggestion, not a result.

Verdict: Noise, with a caveat

Treat this as Noise for anyone deciding how to secure or govern AI-written code: nothing here was tested adversarially, benchmarked or reported as an exploit. A static scan also reads syntax, not runtime behavior, so hosts built dynamically could be missed. Watch for a published method, code or accuracy check from the author. Until then, the post is a useful pointer to a technique, not evidence.