antibody

Every fix becomes a rule your AI coding agent can't break.

Quick start · Supported tools · How it works · Docs · Examples

AI coding agents repeat mistakes, and a line in AGENTS.md is only a suggestion. antibody turns each fix into a small rule, proves it against the real fix, and checks every edit your agent makes, with no LLM in the loop.

antibody: this edit repeats a mistake that was fixed before
  app/invoices.py:5  [naive-datetime]  This makes a timestamp with no timezone, which breaks
  comparisons and shifts times across servers. Use datetime.now(timezone.utc).
    learned from 95ffe5603abe "Use timezone-aware timestamps in billing"
Fix the code. Ask the user before suppressing a match with `# nosemgrep`.

_{What the agent sees right after it writes datetime.utcnow() again.}

Why antibody

• Lessons that stick. Agents forget between sessions, and rules in prompt files are only suggestions. An antibody is a deterministic check that runs on every edit.
• Proven, not guessed. Your agent drafts a Semgrep-format rule from the fix. antibody verify only accepts it if it fires on the old code and stays silent on the fix.
• No noise. Only new matches count, so old code never blocks an edit or breaks a build.
• Any tool. It works with Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot, any agent that reads AGENTS.md, git hooks and CI.

Install

uv tool install "antibody[semgrep]"     # or: pipx install "antibody[semgrep]"

The [semgrep] extra brings the rule engine. If you already use Opengrep, plain antibody is enough.

Quick start

cd your-repo
antibody init          # .antibodies/, AGENTS.md, the agent skill, and hooks for the agents it finds

Fix a bug as usual, then ask your agent to "make an antibody from that fix." It runs:

antibody learn         # brief + skeleton from the fix (uncommitted changes, or HEAD)
antibody verify <id>   # the proof: fires on the mistake, silent on the fix
antibody sweep <id>    # every repeat in the code today
antibody baseline <id> # accept what's left, so only new matches fail

Supported tools

antibody init sets up the tools it detects. Choose them yourself with --agent claude,cursor or --agent all. ✓ means tested in a live session; the others are tested against each tool's documented hook format. See docs/agents.md.

How it works

  fix ─► antibody learn ─► agent writes the rule ─► antibody verify ─► checked on every edit,
                                                    fires on the bug,   commit and pull request
                                                    silent on the fix

1. Learn from a commit, from uncommitted changes, or, for a mistake that never reached git, from a fixture.
2. Prove. The rule must fire near the change in the old code and never on lines the fix wrote.
3. Enforce. Hooks, pre-commit and CI run the rules with Semgrep or Opengrep. That's about 0.5 s per edit, with no network and no tokens.

Antibodies are plain Semgrep rules in .antibodies/, so they work without antibody too.

Documentation

Contributing

Issues and pull requests are welcome.

git clone https://github.com/cipheraxat/antibody && cd antibody
uv sync && uv run pytest     # runs against real git repos and the real engine

License

MIT