
Security News
Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.
devlyn-cli
Advanced tools
AI development toolkit for Claude Code — ideate, auto-resolve, and ship with context engineering and agent orchestration
Structured prompts, agent orchestration, and automated pipelines — debugging, code review, UI design, product specs, and more.
If devlyn-cli saved you time, give it a star — it helps others find it too.
npx devlyn-cli
That's it. The interactive installer handles everything. Run it again anytime to update.
devlyn-cli turns Claude Code into an autonomous development pipeline. The core loop is simple:
ideate → auto-resolve → preflight → fix gaps → ship
/devlyn:ideateTurn a raw idea into structured, implementation-ready specs.
/devlyn:ideate "I want to build a habit tracking app with AI nudges"
This produces three documents through interactive brainstorming:
| Document | What It Contains |
|---|---|
docs/VISION.md | North star, principles, anti-goals |
docs/ROADMAP.md | Phased roadmap with links to each spec |
docs/roadmap/phase-N/*.md | Self-contained spec per feature — ready for auto-resolve |
Need to add features later? Run ideate again — it expands the existing roadmap.
/devlyn:auto-resolvePoint it at a spec (or just describe what you want) and walk away.
/devlyn:auto-resolve "Implement per spec at docs/roadmap/phase-1/1.1-user-auth.md"
It runs a 10-phase pipeline autonomously:
Build → Build Gate → Browser Test → Evaluate → Fix Loop → Simplify → Review → Security → Clean → Docs
Skip phases you don't need: --skip-browser, --skip-review, --skip-clean, --skip-docs, --skip-build-gate, --max-rounds 6
Customize the build gate: --build-gate strict (warnings = errors), --build-gate no-docker (skip Docker builds for speed)
Use dual-model routing: --engine auto (Codex builds, Claude evaluates — see below)
/devlyn:preflightAfter implementing all roadmap items, run a final alignment check:
/devlyn:preflight
Reads every commitment from your vision, roadmap, and item specs, then audits the codebase evidence-based. Catches what you missed:
| Category | What It Finds |
|---|---|
MISSING | In roadmap but not implemented |
INCOMPLETE | Started but unfinished |
DIVERGENT | Implemented differently than spec |
BROKEN | Has a bug preventing it from working |
STALE_DOC | Docs don't match current code |
Confirmed gaps become new roadmap items — feed them back into auto-resolve. Use --autofix to do this automatically, or --phase 2 to check only one phase.
--engineInstall the Codex MCP server during setup, then:
/devlyn:auto-resolve "fix the auth bug" --engine auto
--engine auto routes each pipeline phase and team role to the optimal model (Claude Opus 4.6 or GPT-5.4) — validated through A/B testing, not just benchmarks.
--engine auto(default, recommended) ·--engine codex(force Codex for build) ·--engine claude(Claude only)
Works across the full pipeline:
/devlyn:auto-resolve "implement feature" --engine auto
/devlyn:ideate "plan new project" --engine auto
/devlyn:preflight --engine auto
Pipeline phases — builder and critic are always different models (GAN dynamic):
| Phase | Model | Why |
|---|---|---|
| Build (implementation) | Codex GPT-5.4 | SWE-bench Pro +11.7pp for hard coding tasks |
| Evaluate | Claude | Long-context (MRCR +28pp) for full-diff grading |
| Fix Loop | Codex GPT-5.4 | Same advantage as Build |
| Challenge | Claude | Fresh skeptical review needs different model family |
| Browser Validate | Claude | Chrome MCP session-bound |
Team roles — each of 21 roles routes to the best model:
| Engine | Roles | Examples |
|---|---|---|
| Claude (11) | Analysis, design, architecture | root-cause-analyst, architecture-reviewer, ux-designer, product-analyst |
| Codex (4) | Code generation, performance | implementation-planner, test-engineer, performance-engineer |
| Dual (6) | Both models find unique issues | security-auditor, quality-reviewer, api-designer |
Key finding: Benchmark predictions were only 33% accurate. 4 of 6 A/B-tested roles needed routing changes after real testing — proving that benchmarks alone are insufficient for optimal routing.
--with-codex (superseded by --engine)/devlyn:auto-resolve "fix the auth bug" --with-codex
--with-codex evaluate(default) ·--with-codex review·--with-codex both
--engine auto subsumes --with-codex both with broader coverage — Codex is used for build, fix, and 4 team roles, not just evaluate/review.
When you want step-by-step control instead of the full pipeline.
| Command | Use When |
|---|---|
/devlyn:resolve | Simple bugs (1-2 files) |
/devlyn:team-resolve | Complex issues — spawns root-cause analyst, test engineer, security auditor |
/devlyn:browser-validate | Test a web feature in a real browser (Chrome MCP → Playwright → curl fallback) |
| Command | Use When |
|---|---|
/devlyn:review | Solo review — security, quality, best practices checklist |
/devlyn:team-review | Multi-reviewer team — security, testing, performance, product perspectives |
/devlyn:evaluate | Grade work against done-criteria with calibrated skepticism |
/devlyn:clean | Remove dead code, unused deps, complexity hotspots |
| Step | Command | What It Does |
|---|---|---|
| 1 | /devlyn:design-ui | Generate 5 distinct style explorations |
| 2 | /devlyn:design-system | Extract design tokens from chosen style |
| 3 | /devlyn:implement-ui | Team builds it — component architect, UX, accessibility, responsive, visual QA |
Use
/devlyn:team-design-uifor step 1 with a full creative team.
| Command | What It Does |
|---|---|
/devlyn:preflight | Verify codebase matches vision/roadmap — gap analysis with evidence |
/devlyn:product-spec | Generate or update product specs |
/devlyn:feature-spec | Turn product spec → implementable feature spec |
/devlyn:discover-product | Scan codebase → auto-generate product docs |
/devlyn:recommend-features | Prioritize top 5 features to build next |
/devlyn:update-docs | Sync all docs with current codebase |
These activate automatically — no commands needed. They shape how Claude thinks during relevant tasks.
| Skill | Activates During |
|---|---|
root-cause-analysis | Debugging — enforces 5 Whys, evidence standards |
code-review-standards | Reviews — severity framework, approval criteria |
ui-implementation-standards | UI work — design fidelity, accessibility, responsiveness |
code-health-standards | Maintenance — dead code prevention, complexity thresholds |
workflow-routing | Any task — guides you to the right command |
Selected during install. Run npx devlyn-cli again to add more.
.claude/skills/| Skill | Description |
|---|---|
asset-creator | AI pixel art game asset pipeline — generate, chroma-key, catalog |
cloudflare-nextjs-setup | Cloudflare Workers + Next.js with OpenNext |
generate-skill | Create Claude Code skills following Anthropic best practices |
prompt-engineering | Claude 4 prompt optimization |
better-auth-setup | Better Auth + Hono + Drizzle + PostgreSQL |
pyx-scan | Check if an AI agent skill is safe before installing |
dokkit | Document template filling for DOCX/HWPX |
devlyn:pencil-pull | Pull Pencil designs into code |
devlyn:pencil-push | Push codebase UI to Pencil canvas |
| Pack | Description |
|---|---|
vercel-labs/agent-skills | React, Next.js, React Native best practices |
supabase/agent-skills | Supabase integration patterns |
coreyhaines31/marketingskills | Marketing automation and content skills |
anthropics/skills | Official Anthropic skill-creator with eval framework |
Leonxlnx/taste-skill | Premium frontend design skills |
claude mcp add| Server | Description |
|---|---|
codex-cli | Codex MCP server — enables --engine auto/codex intelligent model routing and legacy --with-codex mode |
playwright | Playwright MCP — powers browser-validate Tier 2 |
Want to add a pack? Open a PR adding it to the
OPTIONAL_ADDONSarray inbin/devlyn.js.
.md file in config/commands/config/skills/ with SKILL.mdoptional-skills/ and OPTIONAL_ADDONSMIT — Nocodecat @ Donut Studio
FAQs
AI development toolkit for Claude Code — ideate, auto-resolve, and ship with context engineering and agent orchestration
The npm package devlyn-cli receives a total of 1,329 weekly downloads. As such, devlyn-cli popularity was classified as popular.
We found that devlyn-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.

Research
/Security News
Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.