corbat-coco
Advanced tools
Autonomous Coding Agent with Self-Review, Quality Convergence, and Production-Ready Output
The AI coding agent that doesn't just generate code—it iterates until it's actually good.
Most AI coding assistants generate code and hope for the best. Coco is different:
All autonomous. All verifiable. All open source.
Current AI assistants:
Result: You spend hours debugging AI-generated code.
Coco measures 12 dimensions of code quality:
No fake scores. No hardcoded values. Real metrics.
Current state: 58.3% real measurements (up from 0%), with 41.7% still using safe defaults.
When tests fail, Coco:
Target: 70%+ of failures fixed in first iteration.
Complex tasks are decomposed and executed by specialized agents:
Agents work in parallel where possible, coordinate when needed.
Before saving any file:
Result: Zero broken builds from AI edits.
Generate Code → Validate AST → Run Tests → Analyze Failures
↑ ↓
←────────── Generate Targeted Fixes ←───────┘
Stops when:
| Analyzer | What It Measures | Data Source |
|---|---|---|
| Coverage | Lines, branches, functions, statements | c8/v8 instrumentation |
| Security | Vulnerabilities, dangerous patterns | npm audit + static analysis |
| Complexity | Cyclomatic complexity, maintainability | AST traversal |
| Duplication | Code similarity, redundancy | Token-based comparison |
| Build | Compilation success | tsc/build execution |
| Import | Missing dependencies, circular deps | AST + package.json |
npm install -g corbat-coco
coco init
Follow prompts to configure:
coco "Build a REST API with JWT authentication"
That's it. Coco will:
coco resume
coco quality ./src
Goal: Replace fake metrics with real measurements
Results:
Before:
// All hardcoded 😱
dimensions: {
testCoverage: 80, // Fake
security: 100, // Fake
complexity: 90, // Fake
// ... all fake
}
After:
// Real measurements ✅
const coverage = await this.coverageAnalyzer.analyze(files);
const security = await this.securityScanner.scan(files);
const complexity = await this.complexityAnalyzer.analyze(files);
dimensions: {
testCoverage: coverage.lines.percentage, // REAL
security: security.score, // REAL
complexity: complexity.score, // REAL
// ... 7 more real metrics
}
Running Coco on itself (corbat-coco codebase):
⏱️ Duration: 19.8s
📊 Overall Score: 60/100
📈 Real Metrics: 7/12 (58.3%)
🛡️ Security: 0 critical issues
📝 Complexity: 100/100 (low)
🔄 Duplication: 72.5/100 (27.5% duplication)
📄 Issues Found: 311
💡 Suggestions: 3
Validation: ✅ Target met (≤42% hardcoded)
Current Score: ~7.0/10
Target Score: 8.5/10
Target Score: 9.0+/10
| Feature | Cursor | Aider | Cody | Devin | Coco |
|---|---|---|---|---|---|
| IDE Integration | ✅ | ❌ | ✅ | ❌ | 🔄 (planned Q2) |
| Real Quality Metrics | ❌ | ❌ | ❌ | ✅ | ✅ (58% real) |
| Root Cause Analysis | ❌ | ❌ | ❌ | ✅ | ✅ |
| Multi-Agent | ❌ | ❌ | ❌ | ✅ | ✅ |
| AST Validation | ❌ | ❌ | ❌ | ✅ | ✅ |
| Error Recovery | ❌ | ❌ | ❌ | ✅ | ✅ |
| Checkpoint/Resume | ❌ | ❌ | ❌ | ✅ | ✅ |
| Open Source | ❌ | ✅ | ❌ | ❌ | ✅ |
| Price | $20/mo | Free | $9/mo | $500/mo | Free |
Verdict: Coco offers Devin-level autonomy at Aider's price (free).
We believe in honesty:
corbat-coco/
├── src/
│ ├── agents/ # Multi-agent coordination
│ ├── cli/ # CLI commands
│ ├── orchestrator/ # Central coordinator
│ ├── phases/ # COCO phases (4 phases)
│ ├── quality/ # Quality analyzers
│ │ └── analyzers/ # Coverage, security, complexity, etc.
│ ├── providers/ # LLM providers (Anthropic, OpenAI, Google)
│ ├── tools/ # Tool implementations
│ └── types/ # Type definitions
├── test/
│ ├── e2e/ # End-to-end tests
│ └── benchmarks/ # Performance benchmarks
└── docs/ # Documentation
Coco is open source (MIT). We welcome:
See CONTRIBUTING.md.
# Clone repo
git clone https://github.com/corbat/corbat-coco
cd corbat-coco
# Install dependencies
pnpm install
# Run in dev mode
pnpm dev
# Run tests
pnpm test
# Run quality benchmark
pnpm benchmark
# Full check (typecheck + lint + test)
pnpm check
A: Partially. The quality scoring system (Week 1) is production-ready and thoroughly tested. Multi-agent coordination (Week 5-8) is implemented but needs more real-world validation. Use for internal projects first.
A: Similar approach (autonomous iteration, quality metrics, multi-agent), but Coco is:
A: These are safe defaults, not fake metrics:
style: 100 when no linter is configured (legitimate default)correctness, completeness, robustness, testQuality, documentation are pending Week 2-4 implementationsWe're committed to reaching 0% hardcoded by end of Phase 1 (Week 4).
A: Yes, but:
A: No. Coco is a force multiplier, not a replacement:
A: See IMPROVEMENT_ROADMAP_2026.md for the complete 12-week plan.
MIT License - see LICENSE.
Built with:
Made with 🥥 by developers who are tired of debugging AI code.
Status: 🚧 Week 1 Complete, Weeks 2-12 In Progress
Next Milestone: Phase 1 Complete (Week 4) - Target Score 7.5/10
Current Score: ~7.0/10 (honest, verifiable)
Honest motto: "We're not #1 yet, but we're getting there. One real metric at a time." 🥥
FAQs
Autonomous Coding Agent with Self-Review, Quality Convergence, and Production-Ready Output
The npm package corbat-coco receives a total of 3 weekly downloads. As such, corbat-coco popularity was classified as not popular.
We found that corbat-coco demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.
Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.