Scan. Fix. Test. Retry. Ship.
All from your terminal.
AI agents that autonomously resolve vulnerabilities, review PRs, generate tests, and track engineering metrics — powered by Claude Code.
The problem
Alerts pile up
200+ open Dependabot alerts. Nobody knows which ones actually matter.
Fixes break things
Bumping versions without testing creates outages. Manual verification doesn't scale.
Reviews bottleneck
PRs wait days for swamped reviewers. Security debt compounds.
What dobbe does
Agentic Fix Loop
$ dobbe vuln resolve
Upgrade, test, read errors, revert, retry — like a real engineer. Opens a PR only when tests pass.
Intelligent Vulnerability Scanning
$ dobbe vuln scan
AI analyzes each CVE against your actual code paths. Know which alerts matter and which are noise.
Automated Code Reviews
$ dobbe review post
AI-generated inline comments across security, performance, and correctness. Posted directly to your PRs.
Engineering Intelligence
$ dobbe metrics dora
DORA metrics, PR velocity, cycle time, and incident triage — engineering health at a glance.
How it works
Four stages, fully autonomous
Fetch alerts, triage with AI
Upgrade deps, run agent loop
Run tests, check for breakage
Open PR with executive summary
GitHub Alerts API Claude Code (AI Agent) GitHub PRs
┌─────────────┐ ┌────────────────────┐ ┌──────────┐
│ Dependabot │────────>│ dobbe vuln scan │ │ │
│ Alerts │ │ │ │ Auto PR │
└─────────────┘ │ 1. Fetch alerts │ │ + Body │
│ 2. AI triage │ │ + Tests │
│ 3. Upgrade deps │───────>│ + Diff │
│ 4. Run tests │ │ │
│ 5. Retry on fail │ └──────────┘
└────────────────────┘
dobbe vs. the alternatives
Dependabot opens a PR and walks away. Renovate auto-merges and hopes CI catches breakage. dobbe runs tests, reads failures, and iterates — the way you would.
| dobbe | Dependabot | Renovate | Snyk | |
|---|---|---|---|---|
| Auto-bump versions | ✓ | ✓ | ✓ | ✓ |
| AI code path analysis | ✓ | — | — | — |
| Run tests before PR | ✓ | — | — | — |
| Retry on test failure | ✓ | — | — | — |
| AI PR code reviews | ✓ | — | — | — |
| Org-wide batch scanning | ✓ | — | ✓ | ✓ |
| Terminal-native CLI | ✓ | — | — | ✓ |
| Open source | ✓ | ✓* | ✓ | — |
| No SaaS required | ✓ | — | Self-host | — |
Get started in 30 seconds
pip install dobbe
dobbe setup
dobbe vuln resolve --repo your-org/your-repo
Integrations
Auto-discovers MCP servers from your Claude Code config
Built for engineers who care about reliability
FAQ
Is dobbe free?
Yes. dobbe is open source under the MIT license. You need a Claude Code subscription (or API key) to power the AI agents.
What languages and frameworks does it support?
Any project with a package manager and test suite. dobbe includes specialized skills for Django, React, Angular, Node.js, Go, and Rust — but the core commands work with any stack.
Does my code leave my machine?
dobbe runs locally and orchestrates Claude Code on your machine. Code context is sent to Claude's API for analysis (same as using Claude Code directly). No third-party SaaS involved.
Can I use it in CI/CD?
Yes. Use dobbe schedule for recurring automation, or invoke any command directly in your pipeline. Works with GitHub Actions, GitLab CI, and any runner with Python 3.11+.