qode — AI-assisted developer workflow CLI

// why qode

Built for engineers who refuse to copy-paste prompts.

qode replaces ad-hoc prompting with twelve standardised steps. Every project gets the same vocabulary, the same gates, and the same hardened review pass — no matter the stack.

Slash-command native

Cursor, Claude Code and OpenCode call workflows as /qode-*. Codex picks them up as $qode-* skills. One CLI generates assets for all four.

⊕

Two-pass scoring

Worker AI produces the analysis. A separate Judge AI scores against a 25-point rubric. No self-scoring, no flattery — just a gate before code gets generated.

⌧

Hardened reviews

Review prompts demand ≥3 documented findings per file. Score caps for criticals. ≥8.0 must cite verified properties. 10.0 in security review is invalid by design.

⇄

MCP-native ticketing

No API keys in qode. Jira, Linear, GitHub, Azure DevOps, Notion — fetched through your agent's MCP server. Linked Figma, Docs, Confluence too.

▤

Named work contexts

Every feature gets a context directory with ticket, notes, refined-analysis, spec, and lessons. Switch between three concurrent features without losing state.

∎

Single binary

Static Go binary. Brew, curl, or PowerShell. Cosign-signed checksums for supply-chain verification. No runtime, no daemon, no telemetry.

// the workflow

Twelve steps. One ticket to one merged PR.

Numbered commands ensure nothing is skipped. Run qode workflow status at any point to see exactly where you are.

qode context init

Create a named work context.

/qode-ticket-fetch

Fetch ticket via MCP into context.

/qode-note-add

Optional. Append free-form notes — scope, constraints, course corrections.

/qode-plan-refine

Refine requirements: worker pass + clarification pass + judge scoring.

/qode-plan-spec

Generate the tech spec. Gated on 25/25.

/qode-start

Run the implementation prompt.

test locally

Verify the change behaves as expected.

/qode-check

Quality gates — tests + lint.

/qode-review-code

Code review with post-mortem mindset.

/qode-review-security

Security review — adversary simulation required.

/qode-pr-create

Create the pull request via MCP.

/qode-pr-resolve

Resolve PR review comments via MCP.

/qode-knowledge-add-context

Optional. Capture lessons for the knowledge base.

qode context remove

Cleanup. Onto the next ticket.

Parallel-worktree safe

Run multiple workflows in parallel. Each git worktree gets its own .qode/contexts/current — qode resolves paths from the working directory, writes atomically inside the target folder, and holds no shared on-disk state. Spin up a worktree per ticket and run qode in each without conflict.

// install

One line. Any platform.

Static binary. Pick your shell.

$brew install nqode-io/tap/qode

Then run qode init in your project root — or qode init --config-only first to review qode.yaml before anything else is generated. Cosign supply-chain verification →

// quality gates

Scoring and reviews that don't flatter you.

qode's prompts are designed to surface real problems. Self-scoring is eliminated. Findings drive the score, not the other way around.

Refinement rubric

Two-pass scoring

Worker AI produces the analysis. Judge AI scores it independently. Target 25/25 before plan-spec.

Problem Understanding5 pts

Technical Analysis5 pts

Risk & Edge Cases5 pts

Completeness5 pts

Actionability5 pts

Required to proceed25 / 25

Hardened reviews

Code & Security

Both reviews enforce structural constraints — not vibes.

›Reviewer reads the diff as if writing a post-mortem.

›Each file requires ≥3 documented items: defects, concerns, or properties verified safe.

›Critical finding → total ≤ 5.0. High finding → total ≤ 7.5.

›Scores ≥8.0 must cite specific properties verified — not the absence of bugs.

›Security: Adversary Simulation required. Three named exploit attempts, technique, target, outcome.

›Security: Score 10.0 is not valid — complete security is not provable.

Tunable per project

Every gate above is yours to shape. Adjust thresholds in qode.yaml (review.min_code_score, review.min_security_score, scoring.target_score) and rewrite rubric dimensions, weights, and criteria in .qode/scoring.yaml — both survive qode init, version-controlled with the repo. Rubric reference →

// agent support

Four agents. One vocabulary.

Cursor, Claude Code and OpenCode receive slash commands. Codex receives skills that surface the same workflow names. Toggle in qode.yaml; re-run qode init and the toggle is honoured — your config is preserved, not reset. Run qode init --config-only to write qode.yaml and stop.

	Cursor	Claude Code	Codex	OpenCode
Generated assets	`.cursor/commands/*.mdc`	`.claude/commands/*.md`	`.agents/skills/*/SKILL.md`	`.opencode/commands/*.md`
Enable	`agents.cursor.enabled: true`	`agents.claude_code.enabled: true`	`agents.codex.enabled: true`	`agents.opencode.enabled: true`
Invoke	`/qode-*`	`/qode-*`	`$qode-*`	`/qode-*`

Upgrading from 0.3.x? The key used to be ide:. Run qode init once per project and it is renamed to agents: in place, with every toggle you set kept. Run it before anything else: until you do, every command except qode init exits 1 — see the changelog.

One workflow for AI-assisted coding across every stack.

Built for engineers who refuse to copy-paste prompts.

Slash-command native

Two-pass scoring

Hardened reviews

MCP-native ticketing

Named work contexts

Single binary

Twelve steps. One ticket to one merged PR.

One line. Any platform.

Scoring and reviews that don't flatter you.

Two-pass scoring

Code & Security

Four agents. One vocabulary.

Docs and references.

Tutorial

qode.yaml reference

Ticket fetch via MCP