
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@corbat-tech/coding-standards-mcp
Advanced tools
AI coding standards that apply themselves - MCP server that enforces production-grade code
AI-generated code that passes code review on the first try.
Works with GitHub Copilot, Continue, Cline, Tabnine, Amazon Q, and 25+ more tools
AI-generated code works, but rarely passes code review:
| Without Corbat | With Corbat |
|---|---|
| No dependency injection | Proper DI with interfaces |
| Missing error handling | Custom error types with context |
| Basic tests (if any) | 80%+ coverage with TDD |
| God classes, long methods | SOLID, max 20 lines/method |
| Fails SonarQube | Passes quality gates |
Result: Production-ready code that passes code review.
1. Add to your MCP config:
{
"mcpServers": {
"corbat": {
"command": "npx",
"args": ["-y", "@corbat-tech/coding-standards-mcp"]
}
}
}
2. Config file location:
| Tool | Location |
|---|---|
| Cursor | .cursor/mcp.json |
| VS Code | .vscode/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |
| JetBrains | Settings → AI Assistant → MCP |
| Claude Desktop | ~/.config/Claude/claude_desktop_config.json |
| Claude Code | claude mcp add corbat -- npx -y @corbat-tech/coding-standards-mcp |
Complete setup guide for all 25+ tools
3. Done! Corbat auto-detects your stack.
You: "Create a payment service"
Corbat: ✓ Detected: Java 21, Spring Boot 3, Maven
✓ Profile: java-spring-backend
✓ Architecture: Hexagonal + DDD
✓ Testing: TDD, 80%+ coverage
| Metric | Without Corbat | With Corbat | Improvement |
|---|---|---|---|
| Quality Score | 4.6/10 | 7.7/10 | +67% |
| Custom Errors | 3 | 18 | +500% |
| Interfaces/Ports | 19 | 41 | +116% |
| Files (modularity) | 55 | 95 | +73% |
| Category | Scenarios | Without | With | Improvement |
|---|---|---|---|---|
| Basic | UserService, REST API, React Form | 4.0 | 7.6 | +90% |
| Intermediate | Kafka Consumer, FastAPI, Go HTTP | 4.3 | 7.2 | +67% |
| Advanced | Saga, Circuit Breaker, Event Sourcing | 5.6 | 8.2 | +46% |
| Pattern | Without Corbat | With Corbat |
|---|---|---|
| Hexagonal Architecture | 0/10 scenarios | 10/10 |
| Repository Pattern | 2/10 | 7/10 |
| Custom Error Types | 1/10 | 8/10 |
| Dependency Injection | 2/10 | 10/10 |
| Saga Pattern | 0/10 | 1/1 (when needed) |
| Without Corbat | With Corbat |
|---|---|
|
|
| 9 files, 292 LOC, manual rollback | 17 files, 707 LOC, orchestrated compensation |
View full benchmark analysis with 10 scenarios
class UserService {
private users: Map<string, User> = new Map();
getById(id: string): User | undefined {
return this.users.get(id);
}
createUser(input: CreateUserInput): User {
if (!input.name) throw new Error('Name is required');
const user = { id: uuidv4(), ...input };
this.users.set(user.id, user);
return user;
}
}
// ✗ Returns undefined ✗ Generic errors ✗ No DI ✗ Hardcoded storage
// Port (interface)
interface UserRepository {
findById(id: string): User | null;
save(user: User): void;
existsByEmail(email: string): boolean;
}
// Custom errors
class UserNotFoundError extends Error { /*...*/ }
class UserAlreadyExistsError extends Error { /*...*/ }
class InvalidUserInputError extends Error { /*...*/ }
// Service with DI
class UserService {
constructor(
private readonly repository: UserRepository,
private readonly idGenerator: IdGenerator
) {}
getUserById(id: string): User {
const user = this.repository.findById(id);
if (!user) throw new UserNotFoundError(id);
return user;
}
createUser(input: CreateUserInput): User {
this.validateInput(input);
this.ensureEmailNotTaken(input.email);
const user = createUser(this.idGenerator.generate(), input);
this.repository.save(user);
return user;
}
}
// ✓ Repository interface ✓ 3 custom errors ✓ DI ✓ 11 tests ✓ Testable
Result: 3 files → 7 files | 129 LOC → 308 LOC | 0 interfaces → 4 interfaces | 0 custom errors → 3
| Profile | Stack | Architecture | Testing |
|---|---|---|---|
java-spring-backend | Java 21 + Spring Boot 3 | Hexagonal + DDD + CQRS | TDD, 80%+ coverage |
kotlin-spring | Kotlin + Spring Boot 3 | Hexagonal + Coroutines | Kotest, MockK |
nodejs | Node.js + TypeScript | Clean Architecture | Vitest |
nextjs | Next.js 14+ | Feature-based + RSC | Vitest, Playwright |
react | React 18+ | Feature-based | Testing Library |
vue | Vue 3.5+ | Feature-based | Vitest |
angular | Angular 19+ | Feature modules | Jest |
python | Python + FastAPI | Hexagonal + async | pytest |
go | Go 1.22+ | Clean + idiomatic | Table-driven tests |
rust | Rust + Axum | Clean + ownership | Built-in + proptest |
csharp-dotnet | C# 12 + ASP.NET Core 8 | Clean + CQRS | xUnit, FluentAssertions |
flutter | Dart 3 + Flutter | Clean + BLoC/Riverpod | flutter_test |
minimal | Any | Basic quality rules | Optional |
Auto-detection: Corbat reads pom.xml, package.json, go.mod, Cargo.toml, pubspec.yaml, *.csproj to select the right profile.
Copy a production-ready configuration for your stack:
Browse 14 templates — Java, Python, Node.js, React, Vue, Angular, Go, Kotlin, Rust, Flutter, and more.
npx corbat-init
Interactive wizard that auto-detects your stack and lets you configure architecture, DDD patterns, and quality metrics.
Create .corbat.json in your project root:
{
"profile": "java-spring-backend",
"architecture": {
"pattern": "hexagonal",
"layers": ["domain", "application", "infrastructure", "api"]
},
"ddd": {
"aggregates": true,
"valueObjects": true,
"domainEvents": true
},
"quality": {
"maxMethodLines": 20,
"maxClassLines": 200,
"minCoverage": 80
},
"rules": {
"always": ["Use records for DTOs", "Prefer Optional over null"],
"never": ["Use field injection", "Catch generic Exception"]
}
}
Your Prompt ──▶ Corbat MCP ──▶ AI + Standards
│
├─ 1. Detect stack (pom.xml, package.json...)
├─ 2. Classify task (feature, bugfix, refactor)
├─ 3. Load profile with architecture rules
└─ 4. Inject guardrails before code generation
| Resource | Description |
|---|---|
| Setup Guide | Installation for all 25+ tools |
| Templates | Ready-to-use .corbat.json configurations |
| Compatibility | Full list of supported tools |
| Benchmark v2 Analysis | 10 scenarios with detailed comparison |
| API Reference | Tools, prompts, and configuration |
Stop fixing AI code. Start shipping it.
| Without Corbat | With Corbat |
|---|---|
| 4.6/10 quality | 7.7/10 quality |
| 3 custom errors | 18 custom errors |
| 0% hexagonal | 100% hexagonal |
Recommended by corbat-tech — We use Claude Code internally, but Corbat MCP works with any MCP-compatible tool.
FAQs
AI coding standards that apply themselves - MCP server that enforces production-grade code
We found that @corbat-tech/coding-standards-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.