Dobbe

$ /dobbe-vuln-resolve

[scan]    Found 3 Dependabot alerts (2 critical, 1 high)
[fix]     Upgraded lodash 4.17.20 -> 4.17.21, axios 0.21.1 -> 0.21.4
[verify]  Running tests... FAILED (TypeError in utils.js:42)
[retry]   Attempt 2/3 -- feedback injected, retrying with error context
[fix]     Pinned axios 0.21.4, added @types/lodash
[verify]  Running tests... PASSED (147/147)
[pr]      Created PR #142: "fix: resolve vulnerable dependencies"

Why dobbe?

• Your AI skips steps. dobbe can't. Every pipeline is a finite state machine with Zod validation at each transition. Claude submits results, the server validates them, and only then advances to the next step. If tests fail, the server loops back automatically with the exact error output injected as context. This is program control flow, not prompt engineering.

• 45 minutes to 3 minutes. A typical Dependabot triage: open GitHub, read 12 alerts, figure out which matter, checkout a branch, upgrade packages, run tests, debug failures, run tests again, push, create a PR. With dobbe: type /dobbe-vuln-resolve. The pipeline handles all steps including up to 3 retry loops if tests break.

• One command. No config files. npx dobbe install registers the MCP server and 24 slash commands. No YAML. No dashboard. No SaaS signup. Uninstall with npx dobbe uninstall.

Before vs. After

Quick Start

npx dobbe install

Restart Claude Code, then try:

/dobbe-vuln-scan
/dobbe-review-digest
/dobbe-metrics-dora

# Uninstall
npx dobbe uninstall

How It Works

The MCP server runs a finite state machine. Each step declares what needs to happen (intent, mode, context) and Claude decides how to accomplish it. Results are validated with Zod schemas before advancing.

graph LR
    A[scan] --> B[fix]
    B --> C[commit]
    C --> D{verify}
    D -->|pass| E[report]
    D -->|fail| B
    E --> F[pr]
    F --> G((done))
    D -->|max retries| H((failed))

The server controls the workflow, not the prompt. Each step has a declarative intent (what to do), mode (plan, act, gather, or report), and context (structured parameters). Claude uses its best tools and UX for the job. If results fail Zod validation, the server rejects them. If tests fail at the verify step, the server loops back to fix with the error output injected as feedback -- up to 3 iterations.

Commands

AI-Powered Pipelines

Multi-Perspective Reviews

Each review pipeline uses gather mode to understand the project interactively, then plan mode for deep analysis.

Metrics & Scanning

Utilities

Works With

Auto-detects your framework: Django, Angular, React, Next.js, Express, Flask, FastAPI, Spring Boot, Rails.

Prerequisites

• Claude Code -- installed and authenticated
• Node.js 18+ -- for the MCP server
• gh CLI -- for GitHub API access (brew install gh)
• MCP servers (optional) -- GitHub, Sentry, Slack for enhanced capabilities

Architecture

Why a state machine? LLMs are stateless -- they forget context between tool calls. A state machine ensures every step executes in order, results are validated with Zod schemas before advancing, and retry loops inject the exact error output from the previous attempt. This is control flow, not prompt engineering.

Claude Code (executor)
    |
    v
dobbe MCP Server (state machine controller)
    |
    +-- 21 Pipeline definitions
    |   +-- Each pipeline: states, transitions, Zod schemas, intent/mode/context/hints
    |   +-- 3 pipelines with retry loops (vuln-resolve, test-gen, migration-plan)
    |   +-- 7 role-based review pipelines + 1 aggregate project-review
    |
    +-- State machine engine (generic FSM)
    |   +-- Zod validation per step
    |   +-- Retry logic with feedback injection
    |   +-- Persistent sessions (crash recovery)
    |
    +-- 14 MCP Tools
    |   +-- pipeline_start, pipeline_step, pipeline_complete, pipeline_status
    |   +-- pipeline_list, pipeline_list_sessions, pipeline_abort
    |   +-- config_read, config_write
    |   +-- cache_get, cache_set
    |   +-- session_load, session_save
    |
    +-- Utilities
        +-- Atomic file writes (crash-safe)
        +-- Structured logging (JSON + pretty mode)
        +-- Framework detection (Django, React, Angular, Express, etc.)
        +-- File-based cache with TTL

Built to Ship

• 373 tests with 94% coverage -- every pipeline path is tested
• 21 pipelines with Zod validation at every state transition
• 3 retry pipelines with automatic feedback injection
• Zero global mutable state -- PipelineService is fully isolated and testable
• Atomic file writes -- crash-safe session persistence via write-to-temp + rename
• CI on Node 18, 20, 22 -- tested across all active LTS versions

[general]
default_org = "acme"
default_format = "table"
default_severity = "critical,high,medium,low"

[notifications]
slack_channel = "#security-alerts"

[timeouts]
scan = 300
resolve = 600
review = 300

Development

git clone https://github.com/nareshnavinash/dobbe-mcp.git
cd dobbe-mcp
npm install
npm test              # 373 tests
npm run test:coverage # 94%+ coverage
npm run build
npm run lint

See CONTRIBUTING.md for development guidelines.

License

MIT