Built on Succeed In Software by Sean Cannon. 30 years of industry experience, automated.
Inspired by GSD 🙏
| git clone https://github.com/seancannon/agent-cannon.git && cd agent-cannon && bash core/install.sh |
Every time the AI writes code, Agent Cannon runs checks. Strategy pattern violations get flagged. Missing tests get flagged. Mutation, side effects, hardcoded secrets, commented-out code. All reported. Verification agents run against the actual code and surface findings. The developer decides what to do with them.
CRITICAL violations are surfaced with recommendations. The developer can override or fix.
| Other Tools | Agent Cannon |
|---|---|
| Generic suggestions | Book-backed rules from Succeed In Software |
| Passive rules in prompt | Active agents that read the actual code |
| Hope AI remembers | Verification agents that check and report |
| No build verification | Runs build and tests before claiming done |
Agent Cannon assesses project requirements and researches stack options based on industry adoption, ecosystem maturity, and what fits the problem. It offers options with tradeoffs and lets the developer decide.
Paradigms shift across languages. Currying for DI is idiomatic in JavaScript but weird in Rust, where trait bounds do the job. Mutation is a bug in JavaScript but idiomatic in Rust when you own the data. The checks adapt to the language, not the other way around.
Supported languages include JavaScript/TypeScript, Rust, Python, Go, and others.
Examples. Agent Cannon adapts to the language.
| Paradigm | JS/TS | Rust | Python | Go |
|---|---|---|---|---|
| Mutation | Clone first | Fine if you own it | Clone first | Fine if you own it |
| DI pattern | Inject via params | Trait bounds | Inject via params | Inject via params |
| Strategy | Strategy maps | Match expressions | Strategy maps/classes | Match expressions |
| Composition | Function chains | Iterator chains | Function chains | Function chains |
| Error handling | Throw or Result | Result/Option | Exceptions or Result | Error returns |
From Succeed In Software by Sean Cannon. Agent Cannon runs automated checks for all of them.
Logic that branches on a type doesn't belong in if/else chains. Create a strategy map. Each key is a behavior, each value is the function. The dispatcher looks up the key and runs it. Two lines replace fifty.
Checks: Flags 3+ else-if branches or 4+ switch/case blocks. Two branches are fine. Three means consider a strategy map.
Same input, same output, every time. No file reads, no API calls, no global state, no modifying what was passed in. If your function takes an array and pushes to it, the caller's data just changed. Clone it first.
Checks: Reports mutation of input parameters (e.g., .push/.pop in JS/TS, list.append in Python, vector.push in Rust).
Currying lets you partially apply dependencies. Write a function that takes the database as a parameter and returns the actual function. Real database in production, mock in tests. No monkey-patching.
Composition chains small functions together. Output of one becomes input of the next.
Every exported function gets tested. Every branch, every error path, every edge case. Untested code is unverified code.
Inject dependencies. Pass the database as a parameter. Every function becomes testable by passing mocks. Tests become proof, not hope.
Data transformation is separate from I/O. Utility functions separate from application logic. A function that validates, queries, formats, and sends email has four jobs. Split them.
Comments explain why, not what. If you need a comment to explain what a function does, rename it. processPayment() doesn't need a comment. doStuff() does. That means doStuff() is the wrong name.
Tabs vs spaces. Not a decision for humans during code review. Set up a linter, commit the config, let machines enforce it. Code reviews focus on logic and architecture. Not style.
- Assume users are smarter than you.
- Never leave a back door.
- Assume breach means lose everything.
Least privilege. RBAC. One-way hash passwords. MFA.
Well-maintained dependencies with LTS versions. No bleeding-edge libraries in production without a damn good reason. Tested code is certain code.
Debt is inevitable. Pretending it doesn't exist is the mistake. Track it. Pay it off in sprints. Tell stakeholders what deferring costs.
Stateless architecture so you add servers without coordination. Horizontal over vertical. Behavior driven by data, not code changes.
Required:
- OpenCode installed
- Node.js 18+ (runs the ac-tools CLI)
For language-specific checks (install based on your project):
| Language | Tools |
|---|---|
| TypeScript/JavaScript | ESLint, TypeScript, Jest/Vitest |
| Python | Ruff, Mypy, Pytest |
| Rust | Clippy, Cargo |
| Go | golangci-lint, Go toolchain |
Agent Cannon configures linting per-project during /ac-new-project. Tool installation is deferred until then.
git clone https://github.com/seancannon/agent-cannon.git
cd agent-cannon
bash core/install.shThe install script copies rules, agents, commands, and workflows to ~/.config/opencode/ and updates opencode.json to load Agent Cannon rules at session start.
node ~/.config/opencode/agent-cannon/bin/ac-tools.cjs help| Command | What It Does |
|---|---|
/ac-new-project |
Initialize a new project with Agent Cannon checks configured |
/ac-plan-phase <N> |
Create a phase plan. Research, plan, verify. |
/ac-execute-phase <N> |
Execute plans with the verification gate |
/ac-verify [file] |
Run standalone verification against existing code |
/ac-new-issue <text or URL> |
Tackle an issue. Accepts raw text or a Jira/GitHub URL. Breaks work into utility logic (additive, safe) and application logic (integration). Utility first so you can pause without unwinding. |
| CLI Command | What It Does |
|---|---|
ac-tools verify <file> |
Run all verification agents against a file |
ac-tools verify-pattern |
Pattern checks only (strategy, SoC, pure functions) |
ac-tools verify-test |
Test coverage only (existence, passing, DI, mocks) |
ac-tools verify-anti-pattern |
Anti-patterns only (mutation, side effects, secrets) |
AI writes code
> Verification agents run against the actual code
> Surface findings: what passed, what flagged
> CRITICAL issues? Report them with recommendations
> Developer decides: fix or override with documentation
30-second timeout per agent. A hung agent reports as warning, not failure.
| Agent | Checks | Severity |
|---|---|---|
| Pattern Checker | Strategy pattern, separation of concerns, pure functions, FP patterns, naming | CRITICAL / WARNING |
| Test Verifier | Tests exist, tests pass, dependency injection, mocks | CRITICAL / WARNING |
| Anti-Pattern Detector | Mutation, side effects, condition-heavy branching, commented code, hardcoded secrets | CRITICAL / WARNING |
| Code Quality | Linter errors, formatter violations, codebase consistency | CRITICAL / WARNING |
| Orchestrator | Spawns all agents in parallel, aggregates findings, surfaces to developer | Decision layer |
~/.config/opencode/
├── rules/
│ ├── agent-cannon-rules.md Primary rules (loaded at session start)
│ └── references/
│ ├── strategy-pattern.md
│ ├── pure-functions.md
│ ├── testing-standards.md
│ ├── anti-patterns.md
│ ├── code-quality.md
│ └── linter-configs.md Stack-specific lint configs
├── agents/
│ ├── ac-pattern-checker.md
│ ├── ac-test-verifier.md
│ ├── ac-anti-pattern-detector.md
│ ├── ac-orchestrator.md
│ └── ac-code-quality.md
├── command/
│ ├── ac-new-project.md
│ ├── ac-plan-phase.md
│ ├── ac-execute-phase.md
│ ├── ac-verify.md
│ └── ac-new-issue.md
└── agent-cannon/
├── bin/ac-tools.cjs CLI tool
├── config.json
└── workflows/
├── execute-phase.md Verification gate workflow
├── new-project.md
├── new-issue.md Issue breakdown workflow
└── plan-phase.md
Based on Succeed In Software by Sean Cannon. Published 2025. Available on Amazon.
MIT License