Skip to content
DevSquad Copilot
This project is under active development and subject to breaking changes. See the changelog for release notes.

Support Agents

Five agents handle the non-linear parts of delivery: code review, security assessment, sprint planning, backlog health, and framework customization.

devsquad.review Quality

Section titled “devsquad.review ”

Validate implementation against spec, ADRs, and plan with independent context.

ProducesReview log with findings by severity
Handoffto implement, specify, or plan
Skillsdocumentation-style, reasoning, quality-gate

Key design principle: The review agent operates with clean context. It did not participate in implementation, reducing confirmation bias.

Coordinator execution model:

  • Parallel checkers: Spec, ADR, code, security, and tests validation run in isolated worker contexts
  • Merged verdict: The coordinator consolidates findings, classifies severity, and decides whether self-correction can proceed

Three trigger scopes:

  • Pull Request: Code-level review of changes
  • Work item: Task-level validation against acceptance criteria
  • Feature completion: Full feature validation against spec, ADRs, and plan

Self-correction loop: maximum 2 attempts before escalating findings.

devsquad.security Security

Section titled “devsquad.security ”

Security assessment in two modes: architectural (design-time) and code (implementation-time).

ProducesSecurity report with findings
Handoffto implement or review
Skillsdocumentation-style, reasoning

Architectural Mode

STRIDE threat analysis, ADR security evaluation, trust boundary mapping, Azure compliance checks (Policy, RBAC, Well-Architected Framework).

Code Mode

OWASP vulnerability checks, dependency scanning, GitHub security alerts (code scanning, secret scanning, Dependabot).

Six security principles applied:

  1. CIA Triad: Confidentiality, Integrity, Availability
  2. Defense in Depth: Multiple layers of security controls
  3. Least Privilege: Minimum permissions required
  4. Secure by Default: Secure configuration out of the box
  5. Zero Trust: Verify explicitly, assume breach
  6. Shift Left: Security early in the lifecycle

Triggers: authentication/authorization, sensitive data, external integrations, exposed endpoints, data persistence.

devsquad.sprint Planning

Section titled “devsquad.sprint ”

Sprint planning with previous sprint closure, velocity analysis, and adaptive capacity.

Producesdocs/sprints/sprint-N.md + scope options
Handoffto plan, decompose, or specify
Skillsdocumentation-style, reasoning

Five-step execution:

  1. Previous sprint closure: Planned vs actual, velocity, goal achievement
  2. Historical velocity: Calculated from 2+ sprints of data
  3. Capacity calculation: Team size, availability, adjustment factors
  4. Backlog readiness: Flag incomplete items, missing dependencies
  5. Scope options: Committed vs stretch scenarios with data

Operating principles: Options not recommendations. Dependencies visible. Gaps visible. Evidence-based.

devsquad.refine Health

Section titled “devsquad.refine ”

Analyze backlog health and detect inconsistencies between specs, ADRs, and work items.

ProducesAnalysis report with fixes
Handoffto specify, plan, decompose, or kickoff
Skillsdocumentation-style, reasoning, work-item-creation

Six analysis categories:

  1. Spec-Board Mismatch: Specs updated after tasks were created
  2. ADR-Implementation Gap: Decisions made but not reflected in code
  3. Missing Tasks: User story without task coverage
  4. Orphan Tasks: Tasks without parent user story
  5. Stale PRs: Open, unreviewed, or failing CI
  6. Unfinished Dependencies: Blocking tasks still open

Principles: Read-first with surgical edits. Facts, not opinions. No false positives. Configurable scope.

Execution model: devsquad.refine can fan out artifact analysis and backlog health checks into parallel workers, then merge the results into a single report.

devsquad.extend Extension

Section titled “devsquad.extend ”

Guide creation of extensions for the SDD framework.

ProducesCustom instructions, skills, agents, or hooks
Handoffvaries
Skillsdocumentation-style, reasoning

Decision tree for choosing the right mechanism:

CriterionMechanism
Less than 50 lines, applies to file typeInstruction
50-200 lines, reusable by agentsSkill
Over 200 lines or needs own toolsAgent
Deterministic post-action validationHook
Inject MCP tools into agentsTool Extension
Access external APIMCP Server

Process: Understand need, Recommend mechanism, Check name collision, Scaffold with reference example.

Section titled “What to Read Next”