For freelancers and teams in Claude Code whose bottleneck is review, not writing code. Give it a brief — it works issue by issue: plan, counter-review, implementation, tests, MR. You review over morning coffee and merge.
One-time · no subscription · 14-day money-back
Launch price until Aug 31 — €249 from Sept 1
❯ /superproject-auto --cycles 8
Backlog: 12 open · 3 WIP · 2 in review
── Cycle 1/8 ───────────────────────
✓ Issue #47: Auth middleware refactor
Plan → impl → tests → MR !108 opened
4 tests · lint clean · typecheck ok
── Cycle 2/8 ───────────────────────
✓ Issue #51: Fix payment webhook edge case
⊘ GATE: payment logic · awaiting sign-off
── Cycle 3/8 ───────────────────────
⧗ Conflict on MR !104 — rebasing
✓ Resolved · MR updated
3 MRs await your review. Stopping.
webhook note #42 → /superproject-respond · answered on thread (marker note=9001)
webhook issue #58 → /superproject-auto · debounced (identical trigger 4m ago)
█
// live run output
A full setup walkthrough — from install to your first automated MR.
Maybe you've already tried AI agents on your projects. You know the pattern: excitement for the first hour, then a branch built on an unapproved MR, a "small improvement" nobody asked for, and in the worst case a half-wired payment integration — because "it was urgent."
The problem isn't that AI can't do the work. The problem is it doesn't know where to stop.
"Superproject is an autopilot built in reverse: boundaries first, throughput second."
/superprojectA brief or PRD becomes a roadmap, risks and issues with testable criteria. A vague brief doesn't pass — you get up to 5 clarifying questions, not a silent guess.
/superproject-syncThe backlog is pushed to GitLab/GitHub issues, idempotently and with labels. Adopt your existing backlog (--adopt) or pull the platform reality back (--reconcile).
/superproject-loopPlan → counter-review → implementation → check against plan → tests + acceptance criteria → an MR/PR waiting for you. With Codex CLI, a second LLM reviews the same diff.
/superproject-autoBounded cycles, a concurrency lock, a ledger, notifications. Ideal in cron — you find finished MRs in the morning.
/superproject-addA new request or bug: dedupe, triage, placement into the backlog — without replanning the whole project.
/superproject-statusWhat's happening, what's waiting on you, the single recommended next action. With --doctor it checks the whole environment.
/superproject-finishChecks the finished project against the original brief, generates a changelog from the MRs/PRs, writes the final report. A project never just fizzles out.
/superproject-housekeepingRuns on its own weekly clock, separate from feature delivery: layered security audit, dependency vulnerability scan, git and platform hygiene, stale-review nudges, allowlisted cleanup, relay health. Exactly one audit issue per run — and a fix branch only when a concrete safe fix exists. Never merges it.
/superproject-respondA client writes a comment — the session answers on the thread where they asked. Triggered by the webhook relay with only numeric ids; it fetches the content itself from the platform API, answers questions, routes work requests through triage, and can start one bounded autopilot pass. Replies are idempotent: webhook redeliveries never double-post.
/superproject-shipcheckLaunch-readiness audit of a deployed app: nine plain-language checks, each proven broken before it's touched and proven fixed after.
Incoming GitLab/GitHub webhooks can feed new issues directly into a running session via the Webhook Relay — no polling, no glue scripts.
Not a disclaimer. Not a footnote. The five hard stops are the reason you can trust the autopilot with real client work.
Not even "merge once the pipeline is green." An unattended merge is still a merge. Every issue ends as an open MR/PR labelled workflow::review — and that's where the machine's authority stops.
Any issue touching money, login, migrations or production gets gated. Only your comment on that specific issue unblocks it. "The client said to just finish it" won't work.
They report findings, never edit. After every review the git status is checked — an unexpected change is reverted and logged. Every finding is a hypothesis, verified before it's fixed.
No || true after a test, no PASS on a check the environment can't run. A small diff doesn't mean small risk — a behaviour change gets executed for real.
At most N cycles per run. When MRs waiting for review pile up, the run stops. Every run is written to a ledger — "why did this happen" always has an answer.
A cron runs bounded cycles overnight. Every MR arrives with evidence: test output, passed acceptance criteria, a ledger entry. You just review and merge.
When an MR gets stuck on a conflict, the next run fixes it before touching anything else. A real collision is laid out for your decision instead of guessed.
"Clients are complaining about confirmation emails" — /superproject-add dedupes, triages, respects the gates and queues it. No replanning the project.
With Codex CLI every diff passes a second model family. When models disagree, it verifies harder. A different model catches different failure modes.
Every detected error pattern becomes a proposed lesson. Approve them once a week — the next runs get them baked into their prompts.
A review-ready MR/PR reaches you via GitLab/GitHub natively. Optionally the autopilot sends a run summary to Telegram.
A client writes "when will this be fixed?" in an issue comment at 15:40. At 15:41 the answer is on the thread — position in the backlog, what it's waiting on. If the comment was actually a new request, it's triaged into the backlog and the autopilot picks it up. You read the exchange in the evening.
A webhook used to mean text waiting in the input for a human to press Enter. Now it can mean work. Map an event kind to a command, and an incoming issue or comment starts the autopilot or answers the client — while the event's text stays out of the prompt entirely.
GitLab authenticates with a secret token header. GitHub can't send custom headers, so the relay verifies its HMAC signature (X-Hub-Signature-256) instead — the webhook secret is your relay token, compared in constant time.
curl, n8n, CI jobs: one authenticated endpoint to send text to any allowed session. Fire-and-forget; if Claude is mid-task, the prompt waits in the input.
The same binary doubles as a CLI client. "Every Monday at 9:00, run maintenance" is one crontab line.
One command to install — builds the binary, generates scoped tokens, sets up systemd and HTTPS:
❯ sudo ./install.sh -d hooks.example.com -p myproject:cl-myproject*
You give it your live app URL and the repo. Nine plain-language checks run against the running app — each problem is proven real before anything is touched, a fix goes up on its own branch, and the fix is proven working on a throwaway preview build. One report, one verdict, and a fix branch per problem when it's safe to write one. It never merges — you always click merge.
Can a stranger with no login read private data, or is a master key exposed in the app?
Can one logged-in user read another user's private data? The leak scanners can't find, because it needs two real accounts.
Can someone hammer an expensive endpoint with no brake and run up your bill? Also public forms with no bot protection.
Can someone get the paid product for free by forging a "payment succeeded" message, or set their own price?
Share preview, robots.txt, sitemap, 404 page, HTTPS headers.
Prompt injection, leaked instructions, data the assistant shouldn't reveal. Says "no AI integration found" when the app has no AI.
User enumeration on signup and password reset, no brake on password guessing, one-time reset links that still work twice.
Validation that only runs client-side, error messages that hand over the database schema, and cross-origin access any website can use.
Reachable privacy policy, where the data lives and who else touches it, consent before tracking, and copyleft licences pulled in by an assistant. Not legal advice.
No subscription. No feature tiers. No surprise at month 2.
Launch pricing ends Aug 31. From Sept 1: Individual €249 · Studio €749.
Individual
Launch price until Aug 31 · €249 from Sept 1
Studio
Launch price until Aug 31 · €749 from Sept 1
Everything in Individual, for the whole team. One purchase, shared config, consistent workflow across all projects.
Need more seats? Email me →
Buy Studio License →// ready to ship
One license. Every future project. You show up to morning coffee and find MRs waiting — not chaos.
Secure checkout via Stripe · 14-day money-back
Launch pricing ends Aug 31 — €249 / €749 from Sept 1