
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
devlyn-cli
Advanced tools
AI development toolkit for Claude Code — ideate, auto-resolve, and ship with context engineering and agent orchestration
Structured prompts, agent orchestration, and automated pipelines — debugging, code review, UI design, product specs, and more.
If devlyn-cli saved you time, give it a star — it helps others find it too.
npx devlyn-cli
That's it. The interactive installer handles everything. Run it again anytime to update.
devlyn-cli turns Claude Code into an autonomous development pipeline. The core loop is simple:
ideate → auto-resolve → ship → repeat
/devlyn:ideateTurn a raw idea into structured, implementation-ready specs.
/devlyn:ideate "I want to build a habit tracking app with AI nudges"
This produces three documents through interactive brainstorming:
| Document | What It Contains |
|---|---|
docs/VISION.md | North star, principles, anti-goals |
docs/ROADMAP.md | Phased roadmap with links to each spec |
docs/roadmap/phase-N/*.md | Self-contained spec per feature — ready for auto-resolve |
Need to add features later? Run ideate again — it expands the existing roadmap.
/devlyn:auto-resolvePoint it at a spec (or just describe what you want) and walk away.
/devlyn:auto-resolve "Implement per spec at docs/roadmap/phase-1/1.1-user-auth.md"
It runs a 9-phase pipeline autonomously:
Build → Browser Test → Evaluate → Fix Loop → Simplify → Review → Security → Clean → Docs
Skip phases you don't need: --skip-browser, --skip-review, --skip-clean, --skip-docs, --max-rounds 6
Install the Codex MCP server during setup, then:
/devlyn:auto-resolve "fix the auth bug" --with-codex
Claude builds, OpenAI Codex evaluates independently — two models collaborating, catching what a single model misses.
--with-codex evaluate(default) ·--with-codex review·--with-codex both
When you want step-by-step control instead of the full pipeline.
| Command | Use When |
|---|---|
/devlyn:resolve | Simple bugs (1-2 files) |
/devlyn:team-resolve | Complex issues — spawns root-cause analyst, test engineer, security auditor |
/devlyn:browser-validate | Test a web feature in a real browser (Chrome MCP → Playwright → curl fallback) |
| Command | Use When |
|---|---|
/devlyn:review | Solo review — security, quality, best practices checklist |
/devlyn:team-review | Multi-reviewer team — security, testing, performance, product perspectives |
/devlyn:evaluate | Grade work against done-criteria with calibrated skepticism |
/devlyn:clean | Remove dead code, unused deps, complexity hotspots |
| Step | Command | What It Does |
|---|---|---|
| 1 | /devlyn:design-ui | Generate 5 distinct style explorations |
| 2 | /devlyn:design-system | Extract design tokens from chosen style |
| 3 | /devlyn:implement-ui | Team builds it — component architect, UX, accessibility, responsive, visual QA |
Use
/devlyn:team-design-uifor step 1 with a full creative team.
| Command | What It Does |
|---|---|
/devlyn:product-spec | Generate or update product specs |
/devlyn:feature-spec | Turn product spec → implementable feature spec |
/devlyn:discover-product | Scan codebase → auto-generate product docs |
/devlyn:recommend-features | Prioritize top 5 features to build next |
/devlyn:update-docs | Sync all docs with current codebase |
These activate automatically — no commands needed. They shape how Claude thinks during relevant tasks.
| Skill | Activates During |
|---|---|
root-cause-analysis | Debugging — enforces 5 Whys, evidence standards |
code-review-standards | Reviews — severity framework, approval criteria |
ui-implementation-standards | UI work — design fidelity, accessibility, responsiveness |
code-health-standards | Maintenance — dead code prevention, complexity thresholds |
workflow-routing | Any task — guides you to the right command |
Selected during install. Run npx devlyn-cli again to add more.
.claude/skills/| Skill | Description |
|---|---|
cloudflare-nextjs-setup | Cloudflare Workers + Next.js with OpenNext |
generate-skill | Create Claude Code skills following Anthropic best practices |
prompt-engineering | Claude 4 prompt optimization |
better-auth-setup | Better Auth + Hono + Drizzle + PostgreSQL |
pyx-scan | Check if an AI agent skill is safe before installing |
dokkit | Document template filling for DOCX/HWPX |
devlyn:pencil-pull | Pull Pencil designs into code |
devlyn:pencil-push | Push codebase UI to Pencil canvas |
| Pack | Description |
|---|---|
vercel-labs/agent-skills | React, Next.js, React Native best practices |
supabase/agent-skills | Supabase integration patterns |
coreyhaines31/marketingskills | Marketing automation and content skills |
anthropics/skills | Official Anthropic skill-creator with eval framework |
Leonxlnx/taste-skill | Premium frontend design skills |
claude mcp add| Server | Description |
|---|---|
codex-cli | Codex MCP server — enables --with-codex dual-model mode |
playwright | Playwright MCP — powers browser-validate Tier 2 |
Want to add a pack? Open a PR adding it to the
OPTIONAL_ADDONSarray inbin/devlyn.js.
.md file in config/commands/config/skills/ with SKILL.mdoptional-skills/ and OPTIONAL_ADDONSMIT — Nocodecat @ Donut Studio
FAQs
AI development toolkit for Claude Code — ideate, auto-resolve, and ship with context engineering and agent orchestration
We found that devlyn-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.