dev-buddy

中文文档

One AI writing and reviewing its own code is like grading your own homework. VCP orchestrates multiple AI models through structured pipelines — then enforces 41 security and quality standards with real-time blocking.

❌ VCP Security Gate — BLOCKED:
   CWE-798: Hardcoded secret detected. Use environment variables or a secret manager.

---

Table of Contents

• Quick Start
• Three Plugins, One Protocol
• Why This Matters
• The Echo Chamber Problem
• Dev Buddy — Multi-AI Pipeline
• VCP — Three-Layer Enforcement
• Standards Coverage
• Organization-Wide Standards
• Configuration
• Core Philosophy
• Documentation
• How to Contribute
• Repo Structure
• References
• License

---

Quick Start

Prerequisites: Claude Code and Bun. See the Getting Started guide for full setup.

# Add the VCP marketplace
/plugin marketplace add Z-M-Huang/vcp

# Install the plugin
/plugin install vcp@vcp

# Initialize your project
/vcp-init

That's it. Standards are injected at session start, dangerous patterns are blocked on every write, and 10 scanning skills are available on demand.

Docker

Prefer a containerized environment? VCP provides a ready-to-use Docker image with Claude Code, Codex CLI, Gemini CLI, and all dependencies pre-installed:

cd docker/
cp .env.example .env
# Edit .env with your API keys and host paths
docker compose up -d
docker exec -it vcp-docker bash

See docker/README.md for full setup instructions, volume mounts, and platform-specific configuration.

---

Three Plugins, One Protocol

VCP ships three complementary plugins:

Plugin	What It Does	Install
VCP	Standards enforcement — 41 standards, real-time blocking, 10 skills	/plugin install vcp@vcp
Dev Buddy	Multi-AI pipeline — configurable stages with role-based prompts, cross-model review gates, specialist analysis team	/plugin install vcp@dev-buddy
mcp-doc	Documentation manifest generator — indexes project docs as MCP resources with search, path-lookup, and tree-view tools	/install vcp@mcp-doc

Use VCP alone for standards enforcement. Add Dev Buddy when you want structured multi-AI workflows with cross-model review.

---

Why This Matters

AI coding assistants produce code fast. They also produce code that's 2.74x more likely to contain security vulnerabilities, 40% more complex, and architecturally unsound at scale: