CORBAT MCP

AI Coding Standards Server

AI-generated code that passes code review on the first try.

Works with GitHub Copilot, Continue, Cline, Tabnine, Amazon Q, and 25+ more tools

⚡ Try it in 30 seconds — just add the config below and start coding.

The Problem

AI-generated code works, but rarely passes code review:

| Without Corbat | With Corbat | |----------------|-------------| | Methods with 50+ lines | Max 20 lines per method | | No dependency injection | Proper DI with interfaces | | throw new Error('failed') | Custom exceptions with context | | Missing or minimal tests | Tests included, TDD approach | | God classes, mixed concerns | SOLID principles, clean layers | | Works on my machine | Production-ready patterns |

Sound familiar? You spend more time fixing AI code than writing it yourself.

Corbat MCP solves this by injecting your team's coding standards before the AI generates code — not after.

Quick Start

1. Add to your MCP config:

{
  "mcpServers": {
    "corbat": {
      "command": "npx",
      "args": ["-y", "@corbat-tech/coding-standards-mcp"]
    }
  }
}

2. Config file location:

| Tool | Location | |------|----------| | Cursor | .cursor/mcp.json | | VS Code | .vscode/mcp.json | | Windsurf | ~/.codeium/windsurf/mcp_config.json | | JetBrains | Settings → AI Assistant → MCP | | Claude Desktop | ~/.config/Claude/claude_desktop_config.json | | Claude Code | claude mcp add corbat -- npx -y @corbat-tech/coding-standards-mcp |

Complete setup guide for all 25+ tools

3. Done! Corbat auto-detects your stack and applies the right standards.

Zero overhead. Corbat runs locally and adds ~50ms to detect your stack. After that, it's just context for the AI.

Fully customizable. Don't like a rule? Override it in .corbat.json. Jump to customization →

See It In Action

You: "Create a user registration service"

Without Corbat, you get:

class UserService {
  private users: Map<string, User> = new Map();

  register(name: string, email: string, password: string) {
    if (!name || !email || !password) throw new Error('Invalid input');
    const user = { id: crypto.randomUUID(), name, email, password };
    this.users.set(user.id, user);
    return user;
  }
}
// ✗ Hardcoded storage  ✗ Password in plain text  ✗ Generic error  ✗ No tests

With Corbat, you get:

// Domain
interface UserRepository {
  save(user: User): Promise<void>;
  findByEmail(email: string): Promise<User | null>;
}

class EmailAlreadyExistsError extends Error {
  constructor(email: string) {
    super(`Email already registered: ${email}`);
  }
}

// Application
class RegisterUserUseCase {
  constructor(
    private readonly repository: UserRepository,
    private readonly hasher: PasswordHasher
  ) {}

  async execute(input: RegisterUserInput): Promise<User> {
    const existing = await this.repository.findByEmail(input.email);
    if (existing) throw new EmailAlreadyExistsError(input.email);

    const user = User.create({
      ...input,
      password: await this.hasher.hash(input.password)
    });
    await this.repository.save(user);
    return user;
  }
}
// ✓ Repository interface  ✓ Password hashing  ✓ Custom error  ✓ Testable

// Test included
describe('RegisterUserUseCase', () => {
  const repository = { save: vi.fn(), findByEmail: vi.fn() };
  const hasher = { hash: vi.fn() };
  const useCase = new RegisterUserUseCase(repository, hasher);

  beforeEach(() => vi.clearAllMocks());

  it('should hash password before saving', async () => {
    repository.findByEmail.mockResolvedValue(null);
    hasher.hash.mockResolvedValue('hashed_password');

    await useCase.execute({ name: 'John', email: '[email protected]', password: 'secret' });

    expect(hasher.hash).toHaveBeenCalledWith('secret');
    expect(repository.save).toHaveBeenCalledWith(
      expect.objectContaining({ password: 'hashed_password' })
    );
  });

  it('should reject duplicate emails', async () => {
    repository.findByEmail.mockResolvedValue({ id: '1', email: '[email protected]' });

    await expect(
      useCase.execute({ name: 'John', email: '[email protected]', password: 'secret' })
    ).rejects.toThrow(EmailAlreadyExistsError);
  });
});

This is what "passes code review on the first try" looks like.

What Corbat Enforces

Corbat injects these guardrails before code generation:

Code Quality

| Rule | Why It Matters | |------|----------------| | Max 20 lines per method | Readable, testable, single-purpose functions | | Max 200 lines per class | Single Responsibility Principle | | Meaningful names | No data, info, temp, x | | No magic numbers | Constants with descriptive names |

Architecture

| Rule | Why It Matters | |------|----------------| | Interfaces for dependencies | Testable code, easy mocking | | Layer separation | Domain logic isolated from infrastructure | | Hexagonal/Clean patterns | Framework-agnostic business rules |

Error Handling

| Rule | Why It Matters | |------|----------------| | Custom exceptions | UserNotFoundError vs Error('not found') | | Error context | Include IDs, values, state in errors | | No empty catches | Every error handled or propagated |

Security (verified against OWASP Top 10)

| Rule | Why It Matters | |------|----------------| | Input validation | Reject bad data at boundaries | | No hardcoded secrets | Environment variables only | | Parameterized queries | Prevent SQL injection | | Output encoding | Prevent XSS |

Benchmark Results v3.0

We evaluated Corbat across 15 real-world scenarios in 6 languages.

The Key Insight

Corbat generates focused, production-ready code — not verbose boilerplate:

| Scenario | With Corbat | Without Corbat | What This Means | |----------|:-----------:|:--------------:|-----------------| | Kotlin Coroutines | 236 lines | 1,923 lines | Same functionality, 8x less to maintain | | Java Hexagonal | 623 lines | 2,740 lines | Clean architecture without the bloat | | Go Clean Arch | 459 lines | 2,012 lines | Idiomatic Go, not Java-in-Go | | TypeScript NestJS | 395 lines | 1,554 lines | Right patterns, right size |

This isn't "less code for less code's sake" — it's the right abstractions without over-engineering.

Value Metrics

When we measure what actually matters for production code:

| Metric | Result | What It Means | |--------|:------:|---------------| | Code Reduction | 67% | Less to maintain, review, and debug | | Security | 100% | Zero vulnerabilities across all scenarios | | Maintainability | 93% win | Easier to understand and modify | | Architecture Efficiency | 87% win | Better patterns per line of code | | Cognitive Load | -59% | Faster onboarding for new developers |

📊 Detailed value analysis

Security: Zero Vulnerabilities Detected

Every scenario was analyzed using pattern detection for OWASP Top 10 vulnerabilities:

• ✓ No SQL/NoSQL injection patterns
• ✓ No XSS vulnerabilities
• ✓ No hardcoded credentials
• ✓ Input validation at all boundaries
• ✓ Proper error messages (no stack traces to users)

Languages & Patterns Tested

| Language | Scenarios | Patterns | |:--------:|:---------:|:---------| | ☕ Java | 5 | Spring Boot, DDD Aggregates, Hexagonal, Kafka Events, Saga | | 📘 TypeScript | 4 | Express REST, NestJS Clean, React Components, Next.js Full-Stack | | 🐍 Python | 2 | FastAPI CRUD, Repository Pattern | | 🐹 Go | 2 | HTTP Handlers, Clean Architecture | | 🦀 Rust | 1 | Axum with Repository Trait | | 🟣 Kotlin | 1 | Coroutines + Strategy Pattern |

📖 Full benchmark methodology · Value analysis

Built-in Profiles

Corbat auto-detects your stack and applies the right standards:

| Profile | Stack | What You Get | |---------|-------|--------------| | java-spring-backend | Java 21 + Spring Boot 3 | Hexagonal + DDD, TDD with 80%+ coverage | | kotlin-spring | Kotlin + Spring Boot 3 | Coroutines, Kotest + MockK | | nodejs | Node.js + TypeScript | Clean Architecture, Vitest | | nextjs | Next.js 14+ | App Router patterns, Server Components | | react | React 18+ | Hooks, Testing Library, accessible components | | vue | Vue 3.5+ | Composition API, Vitest | | angular | Angular 19+ | Standalone components, Jest | | python | Python + FastAPI | Async patterns, pytest | | go | Go 1.22+ | Idiomatic Go, table-driven tests | | rust | Rust + Axum | Ownership patterns, proptest | | csharp-dotnet | C# 12 + ASP.NET Core 8 | Clean + CQRS, xUnit | | flutter | Dart 3 + Flutter | BLoC/Riverpod, widget tests |

Auto-detection: Corbat reads pom.xml, package.json, go.mod, Cargo.toml, etc.

When to Use Corbat

| Use Case | Why Corbat Helps | |----------|------------------| | Starting a new project | Correct architecture from day one | | Teams with juniors | Everyone produces senior-level patterns | | Strict code review standards | AI code meets your bar automatically | | Regulated industries | Consistent security and documentation | | Legacy modernization | New code follows modern patterns |

When Corbat Might Not Be Needed

• Quick prototypes where quality doesn't matter
• One-off scripts you'll throw away
• Learning projects where you want to make mistakes

Customize

Option 1: Interactive Setup

npx corbat-init

Detects your stack and generates a .corbat.json with sensible defaults.

Option 2: Manual Configuration

Create .corbat.json in your project root:

{
  "profile": "java-spring-backend",
  "architecture": {
    "pattern": "hexagonal",
    "layers": ["domain", "application", "infrastructure", "api"]
  },
  "quality": {
    "maxMethodLines": 20,
    "maxClassLines": 200,
    "minCoverage": 80
  },
  "rules": {
    "always": [
      "Use records for DTOs",
      "Prefer Optional over null"
    ],
    "never": [
      "Use field injection",
      "Catch generic Exception"
    ]
  }
}

Option 3: Use a Template

Browse 14 ready-to-use templates for Java, Python, Node.js, React, Go, Rust, and more.

How It Works

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│ Your Prompt │────▶│ Corbat MCP  │────▶│ AI + Rules  │
└─────────────┘     └──────┬──────┘     └─────────────┘
                          │
           ┌──────────────┼──────────────┐
           ▼              ▼              ▼
    ┌────────────┐ ┌────────────┐ ┌────────────┐
    │ 1. Detect  │ │ 2. Load    │ │ 3. Inject  │
    │   Stack    │ │  Profile   │ │ Guardrails │
    └────────────┘ └────────────┘ └────────────┘
     pom.xml        hexagonal      max 20 lines
     package.json   + DDD          + interfaces
     go.mod         + SOLID        + custom errors

Corbat doesn't modify AI output — it ensures the AI knows your standards before generating.

Important: Corbat provides context and guidelines to the AI. The actual code quality depends on how well the AI model follows these guidelines. In our testing, models like Claude and GPT-4 consistently respect these guardrails.

Documentation

| Resource | Description | |----------|-------------| | Setup Guide | Installation for Cursor, VS Code, JetBrains, and 25+ more | | Templates | Ready-to-use .corbat.json configurations | | Compatibility | Full list of supported AI tools | | Benchmark Analysis | Detailed results from 15 scenarios | | API Reference | Tools, prompts, and configuration options |

Stop fixing AI code. Start shipping it.

Add to your MCP config and you're done:

{ "mcpServers": { "corbat": { "command": "npx", "args": ["-y", "@corbat-tech/coding-standards-mcp"] }}}

Your code reviews will thank you.

Developed by corbat-tech