AI agents that fix your vulnerabilities
while you sleep.

The CLI that orchestrates Claude Code to scan, fix, verify, and ship security patches — autonomously.

          pip install dobbe
          
        

View on GitHub →

The problem

Alerts pile up

200+ open Dependabot alerts. Nobody knows which ones actually matter.

Fixes break things

Bumping versions without testing creates outages. Manual verification doesn't scale.

Reviews bottleneck

PRs wait days for swamped reviewers. Security debt compounds.

What dobbe does

Intelligent Vulnerability Scanning

$ dobbe vuln scan

AI analyzes each CVE against your actual code paths. Know which alerts matter and which are noise.

Agentic Fix Loop

$ dobbe vuln resolve

Upgrade, test, read errors, revert, retry — like a real engineer. Opens a PR only when tests pass.

Automated Code Reviews

$ dobbe review post

AI-generated inline comments across 5 quality categories. Posted directly to your PRs.

Scheduled Automation

$ dobbe schedule add

Run scans daily, reviews weekly. Set it and forget it with cron-like scheduling.

How it works

Four stages, fully autonomous

SCAN

Fetch alerts, triage with AI

FIX

Upgrade deps, run agent loop

VERIFY

Run tests, check for breakage

REPORT

Open PR with executive summary

  GitHub Alerts API        Claude Code (AI Agent)         GitHub PRs
  ┌─────────────┐         ┌────────────────────┐        ┌──────────┐
  │ Dependabot  │────────>│  dobbe vuln scan   │        │          │
  │   Alerts    │         │                    │        │  Auto PR │
  └─────────────┘         │  1. Fetch alerts   │        │  + Body  │
                          │  2. AI triage      │        │  + Tests │
                          │  3. Upgrade deps   │───────>│  + Diff  │
                          │  4. Run tests      │        │          │
                          │  5. Retry on fail  │        └──────────┘
                          └────────────────────┘

dobbe vs. the alternatives

The only tool that autonomously fixes dependencies AND verifies the fix works before opening a PR.

	dobbe	Dependabot	Renovate	Snyk
Auto-bump versions	✓	✓	✓	✓
AI code path analysis	✓	—	—	—
Run tests before PR	✓	—	—	—
Retry on test failure	✓	—	—	—
AI PR code reviews	✓	—	—	—
Org-wide batch scanning	✓	—	✓	✓
Terminal-native CLI	✓	—	—	✓
Open source	✓	✓*	✓	—
No SaaS required	✓	—	Self-host	—

Get started in 30 seconds

pip install dobbe

dobbe setup

dobbe vuln resolve --repo your-org/your-repo

Integrations

Auto-discovers MCP servers from your Claude Code config

Claude Code GitHub Slack Jira Sentry

AI agents that fix your vulnerabilitieswhile you sleep.