Full bootstrap in one command. Real-time security auditor, automatic hooks, smart commit and slash commands for Spring Boot, Angular and React.
From initial bootstrap to daily work — AI Dev Kit covers every touchpoint between you and the AI.
Intercepts every file write via PreToolUse hook. Blocks SQL Injection, hardcoded secrets, unauthenticated endpoints before they hit disk.
Generates stack.md, architecture.md and rules.md in .claude/context/. CLAUDE.md becomes a thin index — Claude loads only what's relevant, saving tokens every session.
ai-kit tui opens a clickable, mouse-navigable interface. Manage specs, track tasks, stream live command output, and launch Claude directly — all without typing a command.
ai-kit spec new drafts a structured task spec. spec start generates a focused TASK.md — so Claude knows exactly what to build and what to ignore.
PostToolUse hook runs ./mvnw compile after each .java and tsc --noEmit after each .ts. Errors surface immediately.
Reviews the diff via AI, blocks if issues are found, generates a Conventional Commit message automatically and pushes.
Ready-to-use commands tailored to your stack: /project:endpoint, /project:refactor, /project:debug, /project:pr and more.
Define your team's rules in .aikit-rules.yml with regex patterns, severity and message. The auditor applies them automatically.
Build failures trigger a native notification on Linux (notify-send), macOS, and Windows — so you know immediately without watching the terminal.
Run ai-kit audit-report to generate a markdown summary of all auditor findings — grouped by severity with rule, file, and line.
ai-kit doctor diagnoses your installation. ai-kit update refreshes hooks and commands in-place — no need to re-run init.
ai-kit init analyzes your project and sets up each piece automatically.
Verifies claude CLI, git and python3.
Reads pom.xml, package.json, angular.json. Detects 20+ project characteristics.
Uses claude -p to generate three focused files: stack.md, architecture.md, rules.md. CLAUDE.md is a thin index that imports them.
Writes .claude/settings.json with all hooks mapped to the detected stack.
Only the commands relevant to your stack — no unnecessary clutter.
Copies hook scripts and runs a self-test to confirm everything is working.
Every file the AI writes passes through the auditor. Critical issues are blocked before they touch disk. Smart Commit adds a second layer before pushing.
audit.log. Smart Commit will highlight open warnings before committing.audit.log. Visible in ai-kit audit-report and in the session-start summary.ai-kit tui gives you a full mouse-navigable interface for the spec lifecycle. Click to approve, start, run Claude, and track tasks in real time.
Approve
Validate and approve a draft spec — checks that What, Scope and Files are filled.
Start
Activate the spec — sets status to in-progress and writes TASK.md to the project root.
✦ Claude
Suspends the TUI, opens Claude Code in the project directory with the task pre-loaded. TUI resumes automatically when you exit Claude.
Review
AI reviews the implementation against the spec. If issues are found, a ✦ Fix with Claude button appears directly in the result modal.
Close
Closes the spec — moves to done/, removes TASK.md, links commits.
A spec is a short markdown file that aligns you and the AI on scope before a single line is written. Every phase of the task has a dedicated command — from drafting to AI-reviewed close.
spec new
spec approve
spec start
spec check
spec update
spec close
<!-- AUTO-GENERATED by ai-kit spec start --> # Current Task: SPEC-001 ## Objective Add GET /users/search?email= returning paginated UserSummaryDTO. ## Files to touch - src/.../UserController.java - src/.../UserService.java - src/.../UserRepository.java - src/.../dto/UserPageDTO.java ← NEW - src/test/.../UserControllerTest.java ## Out of scope — do not touch - Authentication / security config - Database migrations
LOW finding if Claude writes a file not listed in the spec. Suppress with // ai-kit:ignore SPEC-SCOPE.done/total), and warns if TASK.md is missing.spec review sends the full diff when small (≤350 lines) or per-file summaries when large — so the AI always gets accurate input regardless of diff size.21 built-in rules for Java, Angular, React and any file. Extensible via .aikit-rules.yml and suppressible via .aikit-ignore.
| ID | Severity | Description |
|---|---|---|
J-001 | CRITICAL | SQL Injection via string concatenation in queries |
J-002 | HIGH | @RestController with no @PreAuthorize on any endpoint |
J-003 | MEDIUM | System.out.println in production code |
J-004 | HIGH | @Transactional on a private method (no effect in Spring AOP) |
J-005 | MEDIUM | JPA @Entity missing proper equals/hashCode |
J-006 | CRITICAL | Hardcoded JWT secret in source code |
J-007 | MEDIUM | Generic catch(Exception) that swallows all errors silently |
J-008 | MEDIUM | @Scheduled without @Async — blocks the scheduler thread pool |
J-009 | MEDIUM | @Value injecting a secret field directly — prefer @ConfigurationProperties |
| ID | Severity | Description |
|---|---|---|
F-001 | LOW | console.log in production code |
F-002 | MEDIUM | Explicit TypeScript any |
F-003 | HIGH | .subscribe() without takeUntilDestroyed or unsubscribe — Angular memory leak |
F-004 | CRITICAL | Secret in environment.ts, .env or frontend config file |
F-005 | MEDIUM | useEffect without dependency array — runs on every render |
F-006 | HIGH | Direct DOM manipulation in Angular component (document.getElementById) |
F-007 | LOW | router.navigate with hardcoded string literal in Angular component |
| ID | Severity | Description |
|---|---|---|
U-001 | CRITICAL | Hardcoded password, token, API key or private key |
U-002 | LOW | TODO / FIXME in new code |
U-003 | MEDIUM | Emoji in source code (.java, .ts, .tsx, .js) |
Define your team's rules in .aikit-rules.yml at the project root:
rules: - id: C-001 severity: HIGH files: "*.java" pattern: 'System\.exit\(' message: "System.exit() must not be used. Throw a proper exception instead." - id: C-002 severity: MEDIUM files: "*.tsx,*.ts" pattern: '^\s*fetch\s*\(' message: "Use the useApi() hook instead of calling fetch() directly."
Fields: id, severity (CRITICAL/HIGH/MEDIUM/LOW), files (glob), pattern (regex grep -P), message, fix (optional — appended to the auditor message)
To suppress built-in rules project-wide, add them to .aikit-ignore:
# one rule ID per line — # starts a comment F-001 # uses custom logger wrapper, no console.log needed U-002 # TODOs tracked in Linear
Requirements: Claude Code CLI, bash (Git Bash on Windows), python3, git.
git clone https://github.com/jeffev/ai-dev-kit.git
cd my-project bash /path/to/ai-dev-kit/ai-kit.sh init
claude # SessionStart shows git + Docker status # Auditor active on every file write
git add . bash smart-commit.sh --push
# ~/.bashrc or ~/.zshrc alias ai-kit="bash /path/to/ai-dev-kit/ai-kit.sh" # Bootstrap & maintenance ai-kit init ai-kit update # update hooks in-place ai-kit doctor # diagnose installation ai-kit tui # open the visual TUI # Spec-driven workflow ai-kit spec new "add payment endpoint" ai-kit spec approve SPEC-001 ai-kit spec start SPEC-001 ai-kit spec close # archives spec with commit links ai-kit spec list # show active & done specs # Daily workflow ai-kit commit --push ai-kit audit-report # generate findings report ai-kit audit-test src/main/java/MyClass.java
You can close it manually even if not all tasks are done:
ai-kit spec close SPEC-001 --force
The --force flag skips the interactive confirmation prompt. The spec will be archived in .aikit-specs/done/ with its current state.
In the TUI, click the Close button — it will show a review modal. Click Close in the modal to confirm.
The ✦ Claude button is only enabled when the spec status is active (i.e. after running Start). This ensures TASK.md exists before opening Claude.
The flow is: Approve → Start → ✦ Claude.
When the Review modal opens, click ✦ Fix with Claude. The TUI will suspend and Claude will open with the full review output pre-loaded as context — Claude knows exactly what to fix without you having to paste anything.
After Claude finishes, exit it (/exit or Ctrl+C) to return to the TUI. Run Review again to confirm everything is resolved before closing.
Use spec check — it's fast, requires no AI, and works directly in the terminal:
ai-kit spec check # uses the currently active spec ai-kit spec check SPEC-001 # check a specific spec
It shows the checklist (done/pending), which expected files have been touched, and any out-of-scope changes detected in git diff.
Run ai-kit upgrade from your project directory:
ai-kit upgrade
This pulls the latest changes from the AI Dev Kit repository and automatically reapplies hooks and commands to your current project. No need to run init again.
The TUI requires the textual Python library. Running ai-kit tui will attempt to install it automatically, but if that fails:
pip install textual # or pip3 install textual
If you're on Windows and python3 points to the Microsoft Store stub, use python instead, or install Python 3 from python.org.
Run spec start again on the active spec — it regenerates TASK.md without resetting the status or start commit:
ai-kit spec start SPEC-001
If the spec is already in-progress, it will warn you but still regenerate the file.