Metadata-Version: 2.4
Name: dobbe
Version: 0.8.0
Summary: AI-powered CLI that orchestrates Claude Code agents to scan vulnerabilities, fix dependencies, review PRs, generate tests, triage incidents, and track DORA metrics
Project-URL: Homepage, https://nareshnavinash.github.io/dobbe
Project-URL: Documentation, https://github.com/nareshnavinash/dobbe/tree/main/docs
Project-URL: Repository, https://github.com/nareshnavinash/dobbe
Project-URL: Issues, https://github.com/nareshnavinash/dobbe/issues
Project-URL: Changelog, https://github.com/nareshnavinash/dobbe/blob/main/CHANGELOG.md
Author-email: Naresh Sekar <nareshnavinash@gmail.com>
License-Expression: MIT
License-File: LICENSE
Keywords: agents,ai,automation,claude,cli,code-review,dependabot,dependency-management,devops,dora-metrics,incident-triage,security,testing,vulnerability
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Testing
Classifier: Topic :: System :: Monitoring
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: pydantic>=2.0.0
Requires-Dist: rich>=13.0.0
Requires-Dist: tomli-w>=1.0.0
Requires-Dist: tomli>=2.0.0; python_version < '3.12'
Requires-Dist: typer[all]>=0.9.0
Provides-Extra: dev
Requires-Dist: pytest; extra == 'dev'
Requires-Dist: pytest-asyncio; extra == 'dev'
Requires-Dist: pytest-cov; extra == 'dev'
Description-Content-Type: text/markdown

> **dobbe is moving to a new architecture.** The next version runs as an MCP server
> inside Claude Code — faster, more reliable, and no subprocess overhead.
> See the [Migration Guide](docs/migration-to-mcp.md) for details.
> Current CLI (v0.8.x) continues to work but will not receive new features.

[![CI](https://github.com/nareshnavinash/dobbe/actions/workflows/ci.yml/badge.svg)](https://github.com/nareshnavinash/dobbe/actions/workflows/ci.yml)
[![PyPI version](https://img.shields.io/pypi/v/dobbe)](https://pypi.org/project/dobbe/)
[![Downloads](https://img.shields.io/pypi/dm/dobbe)](https://pypi.org/project/dobbe/)
[![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
[![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
[![Tests](https://img.shields.io/badge/tests-2539_passed-brightgreen)]()
[![GitHub stars](https://img.shields.io/github/stars/nareshnavinash/dobbe)](https://github.com/nareshnavinash/dobbe)

---

# dobbe

**Scan. Fix. Test. Retry. Ship. — All from your terminal.**

AI agents that autonomously resolve vulnerabilities, review PRs, generate tests,
and track engineering metrics across your GitHub repos.

---

## Demo

```
$ dobbe vuln resolve --repo acme/web-app

  dobbe v0.6.0 - AI Engineering Platform

  ● Discovering MCP servers... GitHub ✓  Slack ✓
  ● Resolving repository... acme/web-app (main)
  ● Creating fix branch... fix/dobbe-security-2026-03-21

  ┌─────────────────────────────────────────────────────┐
  │  SCAN - Fetching Dependabot alerts                  │
  └─────────────────────────────────────────────────────┘
  Found 12 alerts. Triaging with AI...

  ┌──────┬──────────────────┬──────────┬────────────────┐
  │  #   │ Package          │ Severity │ AI Triage      │
  ├──────┼──────────────────┼──────────┼────────────────┤
  │  1   │ lodash 4.17.20   │ Critical │ Fix - in path  │
  │  2   │ express 4.17.1   │ High     │ Fix - in path  │
  │  3   │ semver 7.3.5     │ Medium   │ Skip - unused  │
  └──────┴──────────────────┴──────────┴────────────────┘

  ┌─────────────────────────────────────────────────────┐
  │  FIX - Upgrading 2 dependencies                     │
  └─────────────────────────────────────────────────────┘
  ✓ lodash 4.17.20 → 4.17.21
  ✓ express 4.17.1 → 4.21.0

  ┌─────────────────────────────────────────────────────┐
  │  VERIFY - Running tests (attempt 1/3)               │
  └─────────────────────────────────────────────────────┘
  ✓ 847 tests passed

  ┌─────────────────────────────────────────────────────┐
  │  REPORT - Creating pull request                     │
  └─────────────────────────────────────────────────────┘
  ✓ PR #142 opened: fix/dobbe-security-2026-03-21
    https://github.com/acme/web-app/pull/142
```

## Why dobbe?

Other tools bump versions and hope for the best. dobbe works like an engineer:

- **Fixes that actually work** — Upgrades dependencies, runs your test suite, reads the errors, reverts, and retries with a different approach. Opens a PR only when tests pass.
- **AI triage, not alert fatigue** — Analyzes each CVE against your actual code paths. Tells you which alerts matter and which are noise.
- **Reviews that don't bottleneck** — Posts inline PR comments across security, performance, and correctness — so humans focus on architecture.
- **No SaaS, no vendor lock-in** — Open source, MIT licensed, runs locally. Your code never leaves your machine.

## Features

### AI-Powered

| Command | Description |
|---|---|
| `dobbe vuln scan` | Scan repos for vulnerabilities, triage with AI |
| `dobbe vuln resolve` | Agentic fix loop: scan, upgrade, test, iterate |
| `dobbe review digest` | AI-powered PR review digest (supports single PR with `--pr`) |
| `dobbe review post` | Post AI reviews to GitHub |
| `dobbe audit report` | Security posture audit with compliance templates |
| `dobbe deps analyze` | Dependency health, licensing, and usage analysis |
| `dobbe test gen` | Generate tests for coverage gaps |
| `dobbe changelog gen` | AI-generated release notes |
| `dobbe migration plan` | Dependency migration planning and execution |
| `dobbe incident triage` | Sentry incident triage with AI |

### Tools

| Command | Description |
|---|---|
| `dobbe metrics velocity` | PR velocity and cycle time metrics |
| `dobbe metrics dora` | DORA metrics |
| `dobbe scan secrets` | Secrets and credentials scanner |
| `dobbe workflow` | Multi-step workflow automation |
| `dobbe schedule` | Recurring task automation |
| `dobbe setup` | Interactive configuration wizard |
| `dobbe doctor` | Environment health diagnostics |
| `dobbe config` | View and manage configuration |

## Quick Start

```bash
pip install dobbe          # or: pipx install dobbe
dobbe setup                # interactive config wizard
dobbe vuln scan            # auto-detects repo from CWD
dobbe vuln resolve         # scan → fix → test → PR (fully autonomous)
dobbe review digest --pr 42  # AI review of a single PR
```

> **First time?** See the [Getting Started guide](docs/getting-started.md) for prerequisites and walkthrough.

## dobbe vs. the Alternatives

Dependabot opens a PR and walks away. Renovate auto-merges and hopes CI catches breakage. dobbe runs tests, reads failures, and iterates — the way you would.

|                          | dobbe | Dependabot | Renovate | Snyk  |
|--------------------------|-------|------------|----------|-------|
| Auto-bump versions       |  Yes  |    Yes     |   Yes    |  Yes  |
| AI code path analysis    |  Yes  |     -      |    -     |   -   |
| Run tests before PR      |  Yes  |     -      |    -     |   -   |
| Retry on test failure    |  Yes  |     -      |    -     |   -   |
| AI PR code reviews       |  Yes  |     -      |    -     |   -   |
| AI test generation       |  Yes  |     -      |    -     |   -   |
| DORA/velocity metrics    |  Yes  |     -      |    -     |   -   |
| Incident triage          |  Yes  |     -      |    -     |   -   |
| Workflow automation      |  Yes  |     -      |    -     |   -   |
| Dependency migration     |  Yes  |     -      |    -     |   -   |
| Org-wide batch scanning  |  Yes  |     -      |   Yes    |  Yes  |
| Terminal-native CLI      |  Yes  |     -      |    -     |  Yes  |
| Open source              |  Yes  |    Yes*    |   Yes    |   -   |
| No SaaS required         |  Yes  |     -      |  Self-host|  -   |

_*Dependabot is open source but tightly coupled to GitHub's hosted infrastructure._

## How It Works

The `dobbe vuln resolve` pipeline orchestrates multiple AI agents in a feedback loop:

```
┌─────────────────────────────────────┐
│     dobbe vuln resolve --repo       │
└──────────────┬──────────────────────┘
               │
               v
┌─────────────────────────────────────┐
│  MCP Discovery + Repo Resolution    │
└──────────────┬──────────────────────┘
               │
               v
┌─────────────────────────────────────┐
│  Create fix branch from base        │
└──────────────┬──────────────────────┘
               │
               v
┌─────────────────────────────────────┐
│  SCAN AGENT                         │
│  Fetch Dependabot alerts,           │
│  triage risk with code analysis     │
└──────────────┬──────────────────────┘
               │
         ┌─────┴─────┐
         │ Dry run?  │
         └─────┬─────┘
       yes |       | no
           v       v
     ┌────────┐  ┌─────────────────────┐
     │ Report │  │  FIX AGENT          │<───┐
     │  and   │  │  Upgrade deps,      │    │
     │  exit  │  │  update lockfiles   │    │
     └────────┘  └──────────┬──────────┘    │
                            │               │
                            v               │
                 ┌──────────────────┐       │
                 │  Git commit      │       │
                 └────────┬─────────┘       │
                          │                 │
                          v                 │
                 ┌──────────────────┐       │
                 │  VERIFY AGENT    │       │
                 │  Run tests,      │       │
                 │  check breaking  │       │
                 │  changes         │       │
                 └────────┬─────────┘       │
                          │                 │
                    ┌─────┴─────┐           │
                    │  Pass?    │           │
                    └─────┬─────┘           │
                  yes |       | no          │
                      │       v             │
                      │  ┌────────────┐     │
                      │  │ Iterations │     │
                      │  │ left?      │     │
                      │  └─────┬──────┘     │
                      │  yes |    | no      │
                      │      │    │         │
                      │      v    │         │
                      │  Revert,  │         │
                      │  feed back├─────────┘
                      │  errors   │
                      │           │
                      v           v
                 ┌──────────────────┐
                 │  REPORT AGENT    │
                 │  Executive       │
                 │  summary         │
                 └────────┬─────────┘
                          │
                          v
                 ┌──────────────────┐
                 │  Create PR       │
                 │  (if converged)  │
                 └──────────────────┘
```

Each agent has scoped tool access - the fix agent can edit files, the verify agent can only read and run tests, and the report agent can only read. See the [resolve pipeline deep dive](docs/architecture/resolve-pipeline.md) for full details.

## Prerequisites

- **Python 3.11+**
- **[Claude Code CLI](https://docs.anthropic.com/en/docs/claude-code)** - installed and authenticated
- **[gh CLI](https://cli.github.com/)** - for GitHub API access
- **MCP servers** (optional) - GitHub, Slack, Atlassian, Sentry for enhanced capabilities

## Installation

```bash
# Install from PyPI
pip install dobbe

# Or with pipx for isolated install
pipx install dobbe

# Development install
git clone https://github.com/nareshnavinash/dobbe.git
cd dobbe
pip install -e ".[dev]"
```

## Configuration

dobbe stores configuration in `~/.dobbe/config.toml`. Run `dobbe setup` to generate it interactively, or edit it directly:

```toml
[general]
default_org = "nareshnavinash"
default_format = "table"          # table, json, markdown
default_severity = "critical,high,medium,low"

[notifications]
slack_channel = "#security-alerts"

[tools]
gh_path = "gh"                    # path to GitHub CLI
claude_path = "claude"            # path to Claude Code CLI

[timeouts]
scan = 300                        # seconds per scan operation
resolve = 600                     # seconds per resolve cycle
review = 300                      # seconds per review operation
```

See the [full configuration reference](docs/reference/configuration.md) for all options.

## Documentation

- [Why dobbe?](docs/why-dobbe.md) - positioning, personas, and design principles
- [dobbe vs. Alternatives](docs/comparison.md) - detailed comparison with Dependabot, Renovate, Snyk
- [Getting Started](docs/getting-started.md) - install, setup, first scan
- [Command Reference](docs/commands/) - per-command docs with flowcharts and examples
  - [vuln](docs/commands/vuln.md) | [review](docs/commands/review.md) | [audit](docs/commands/audit.md) | [deps](docs/commands/deps.md)
  - [test](docs/commands/test.md) | [changelog](docs/commands/changelog.md) | [migration](docs/commands/migration.md) | [incident](docs/commands/incident.md)
  - [metrics](docs/commands/metrics.md) | [scan](docs/commands/scan.md) | [workflow](docs/commands/workflow.md) | [schedule](docs/commands/schedule.md)
- [Architecture](docs/architecture/) - system design, pipeline deep dives
- [Configuration Reference](docs/reference/configuration.md) - full TOML reference
- [CLI Reference](docs/reference/cli-reference.md) - every command and option
- [MCP Integrations](docs/reference/mcp-integrations.md) - GitHub, Slack, Jira, Sentry setup
- [Contributing](docs/contributing.md) - dev setup and PR guidelines

## Contributing

```bash
git clone https://github.com/nareshnavinash/dobbe.git
cd dobbe
pip install -e ".[dev]"
pytest
```

2539 tests with 98%+ coverage. See the [contributing guide](docs/contributing.md) for full details.

## License

MIT
