Coding Standards

The Problem

AI-generated code often works locally but misses team-specific review expectations:

Corbat helps by giving agents your team's standards before implementation and by providing validation tools before review or handoff.

Quick Start

1. Add to your MCP config:

{  "mcpServers": {    "corbat": {      "command": "npx",      "args": ["-y", "@corbat-tech/coding-standards-mcp"]    }  }}

2. Config file location:

Complete setup guide for common MCP-compatible tools

3. Done. Corbat can auto-detect your stack and return matching standards.

Zero overhead. Corbat runs locally and adds ~50ms to detect your stack. After that, it's just context for the AI.

Fully customizable. Don't like a rule? Override it in .corbat.json. Jump to customization →

See It In Action

You: "Create a user registration service"

Without Corbat, you get:

class UserService {  private users: Map<string, User> = new Map();
  register(name: string, email: string, password: string) {    if (!name || !email || !password) throw new Error('Invalid input');    const user = { id: crypto.randomUUID(), name, email, password };    this.users.set(user.id, user);    return user;  }}// ✗ Hardcoded storage  ✗ Password in plain text  ✗ Generic error  ✗ No tests

With Corbat, you get:

// Domaininterface UserRepository {  save(user: User): Promise<void>;  findByEmail(email: string): Promise<User | null>;}
class EmailAlreadyExistsError extends Error {  constructor(email: string) {    super(`Email already registered: ${email}`);  }}
// Applicationclass RegisterUserUseCase {  constructor(    private readonly repository: UserRepository,    private readonly hasher: PasswordHasher  ) {}
  async execute(input: RegisterUserInput): Promise<User> {    const existing = await this.repository.findByEmail(input.email);    if (existing) throw new EmailAlreadyExistsError(input.email);
    const user = User.create({      ...input,      password: await this.hasher.hash(input.password)    });    await this.repository.save(user);    return user;  }}// ✓ Repository interface  ✓ Password hashing  ✓ Custom error  ✓ Testable

// Test includeddescribe('RegisterUserUseCase', () => {  const repository = { save: vi.fn(), findByEmail: vi.fn() };  const hasher = { hash: vi.fn() };  const useCase = new RegisterUserUseCase(repository, hasher);
  beforeEach(() => vi.clearAllMocks());
  it('should hash password before saving', async () => {    repository.findByEmail.mockResolvedValue(null);    hasher.hash.mockResolvedValue('hashed_password');
    await useCase.execute({ name: 'John', email: '[email protected]', password: 'secret' });
    expect(hasher.hash).toHaveBeenCalledWith('secret');    expect(repository.save).toHaveBeenCalledWith(      expect.objectContaining({ password: 'hashed_password' })    );  });
  it('should reject duplicate emails', async () => {    repository.findByEmail.mockResolvedValue({ id: '1', email: '[email protected]' });
    await expect(      useCase.execute({ name: 'John', email: '[email protected]', password: 'secret' })    ).rejects.toThrow(EmailAlreadyExistsError);  });});

This is the kind of structure Corbat asks agents to consider before handoff.

What Corbat Provides

Corbat provides these guardrails before generation and validation checks during iteration:

Code Quality

Architecture

Error Handling

Security-Oriented Checks

Benchmark Results v3.0

We evaluated Corbat across 15 scenarios in 6 languages. The primary benchmark report is mixed and should be read honestly: Corbat won 1/15 scenarios by the original aggregate score, while an alternative value analysis found stronger results for code compactness and maintainability.

What The Data Supports

The strongest observed signal is that Corbat-guided outputs are often smaller and more focused:

This is not enough to claim universal quality improvement. It is evidence that standards context can reduce over-generation in some workflows.

Value Metrics

The value report reweights the same dataset toward efficiency and maintainability:

📊 Detailed value analysis

Security: No Benchmark Pattern Findings

Every scenario was analyzed using pattern checks inspired by OWASP Top 10 categories. This is not a replacement for SAST, DAST, dependency scanning, manual review, or threat modeling.

• No SQL/NoSQL injection patterns detected
• No XSS patterns detected
• No hardcoded credentials detected
• Input validation patterns present at boundaries
• Error messages did not expose stack traces in the benchmark samples

Languages & Patterns Tested

📖 Full benchmark methodology · Value analysis

Built-in Profiles

Corbat auto-detects your stack and applies the right standards:

Auto-detection: Corbat reads pom.xml, package.json, go.mod, Cargo.toml, etc.

When to Use Corbat

When Corbat Might Not Be Needed

• Quick prototypes where quality doesn't matter
• One-off scripts you'll throw away
• Learning projects where you want to make mistakes

Customize

Option 1: Interactive Setup

npx corbat-init

Detects your stack and generates a .corbat.json with sensible defaults.

Option 2: Manual Configuration

Create .corbat.json in your project root:

{  "profile": "java-spring-backend",  "architecture": {    "pattern": "hexagonal",    "layers": ["domain", "application", "infrastructure", "api"]  },  "quality": {    "maxMethodLines": 20,    "maxClassLines": 200,    "minCoverage": 80  },  "rules": {    "always": [      "Use records for DTOs",      "Prefer Optional over null"    ],    "never": [      "Use field injection",      "Catch generic Exception"    ]  }}

Option 3: Use a Template

Browse 14 ready-to-use templates for Java, Python, Node.js, React, Go, Rust, and more.

How It Works

┌─────────────┐     ┌─────────────┐     ┌─────────────┐│ Your Prompt │────▶│ Corbat MCP  │────▶│ AI + Rules  │└─────────────┘     └──────┬──────┘     └─────────────┘                          │           ┌──────────────┼──────────────┐           ▼              ▼              ▼    ┌────────────┐ ┌────────────┐ ┌────────────┐    │ 1. Detect  │ │ 2. Load    │ │ 3. Inject  │    │   Stack    │ │  Profile   │ │ Guardrails │    └────────────┘ └────────────┘ └────────────┘     pom.xml        hexagonal      max 20 lines     package.json   + DDD          + interfaces     go.mod         + SOLID        + custom errors

Corbat does not modify AI output. It supplies context, standards, profiles, and validation feedback so agents can align with your review expectations.

Important: Actual code quality depends on the model, host tool, prompt, repository context, tests, and human review. Treat Corbat as a policy and verification layer, not as a guarantee of production readiness.

Documentation

{ "mcpServers": { "corbat": { "command": "npx", "args": ["-y", "@corbat-tech/coding-standards-mcp"] }}}