DEV Community: AboJad

Last night I ran Fixor on one of my own repos. Here's what came back in 24 seconds -screenshot below-

AboJad — Tue, 28 Apr 2026 16:53:35 +0000

Fixor is a GitHub App I've been building for the last few months. It reviews every PR for SQL injection before merge. Not a linter, not Semgrep it reads the actual diff, runs a triage pass, then asks an LLM to generate a parameterized fix that compiles in the existing codebase.

The repo in the screenshot is knowflow. The PR added a single line: db.query("SELECT * FROM users WHERE id = " + req.params.id). Fixor flagged it as high severity, posted the file and line, generated a parameterized replacement, and dropped a PDF report and a SARIF 2.1.0 log as PR comments. The PDF is for compliance. The SARIF feeds into GitHub Code Scanning if you use it.
Total time: 24 seconds. No CI step. No config. Install the App on a repo and it works on the next PR.
The hard part of building this wasn't the detection that's a regex in two lines. The hard part was the layer that decides what reaches the LLM, and the layer after that decides what reaches the developer. Early versions flagged ORM queries that were already safe. Current version triages findings before the LLM call, then applies per-org filtering after. False positive rate sits under 5% on the repos I've tested.

Going public next week. If you run a repo with database queries and want to install it the day it ships, drop a comment and I'll send you the link before the public launch.

I built a GitHub App that reviews every PR for SQL injection using Claude AI – free for 3 repos

AboJad — Sun, 19 Apr 2026 04:27:33 +0000

Shipped Fixor last month. It's a GitHub App that installs in 30 seconds and
runs automatically on every PR.

What it does: sends the PR diff to Claude AI, detects SQL injection
vulnerabilities in context (not just pattern matching), and posts a review
comment directly on the PR with the exact file/line, severity level, risk
explanation, and a safe code replacement.

It also generates a downloadable PDF report per scan — useful if you need
something compliance-ready to share with your team or a client.

Real output from a scan on my own repo:

2 vulnerabilities found (1 high, 1 medium)
2 fixes generated
Scan completed in 13 seconds

Pricing: Free (3 repos) / Pro $19/mo / Enterprise $99/mo

Would genuinely appreciate installs and harsh feedback — especially if
something in the output is confusing or wrong.

https://tornidomaroc-web.github.io/fixor/

KnowFlow — I Built a Document AI for the 400M Arabic Speakers Who Were Never First

AboJad — Sat, 18 Apr 2026 05:00:16 +0000

This is a submission for Weekend Challenge: Earth Day Edition

What I Built

Every year, billions of pages are printed, scanned, and shuffled
around offices — contracts nobody reads fully, reports that answer
questions nobody asks them, catalogs searched by hand. KnowFlow is
my attempt to change that, one document at a time.

Upload any PDF, DOCX, or Excel file. Ask it a question in Arabic
or English. Get an answer pulled directly from your document — not
from the internet, not hallucinated, from your file. No printing.
No Ctrl+F. No reading 40 pages to find one clause.

The Earth Day angle is simple: the less we print, scan, and
physically shuffle documents, the better. KnowFlow makes digital
documents actually usable — which is the only way to make them
a real alternative to paper.

I built it specifically for Arabic speakers because every tool
I found treated Arabic as an afterthought. RTL from day one.
Answers in Arabic that actually make sense. The Arab market is
400 million people who deserve AI built for them, not translated
at them.

Demo

🔗 Live: tryknowflow.com

Code

tornidomaroc-web / knowflow

KnowFlow

Chat with any document — Arabic & English AI agent, no setup required.

Upload a PDF or paste a URL. Ask questions in Arabic or English.
KnowFlow streams answers in real time — sourced directly from your document.

Features

Bilingual: Arabic (RTL) + English in the same session
Streaming responses via Claude Haiku
PDF, DOCX, and URL ingestion
Authentication via Supabase
PRO tier with usage limits

Stack

Next.js 15 · FastAPI · Claude Haiku · Supabase · Railway · Vercel

Architecture

User → Next.js (Vercel)
         └→ FastAPI (Railway)
               └→ Claude Haiku (streaming)
               └→ Supabase (auth + storage)

Run locally

# Frontend
cd frontend && npm install && npm run dev

# Backend
cd backend && pip install -r requirements.txt
uvicorn main:app --reload

ANTHROPIC_API_KEY=
SUPABASE_URL=
SUPABASE_ANON_KEY=

Live

🌐 tryknowflow.com

Built by

AboJad — Full Stack AI Engineer, Marrakesh 🇲🇦

View on GitHub

How I Built It

I built KnowFlow solo in a few weeks using a stack I could
reason about completely:

Frontend: Next.js 15 + TypeScript + Tailwind CSS, deployed
on Vercel. RTL support built in from the start — not bolted on.

Backend: Next.js API routes (serverless) handling ingestion,
agent queries, and billing webhooks.

AI: Anthropic's Claude API (claude-haiku) for streaming
responses. The model reads the document content directly — no
vector search, no embeddings in v1. Clean and fast.

Ingestion: A Python FastAPI service on Railway using
Microsoft's MarkItDown to convert any file format to Markdown
before storing it.

Database + Auth: Supabase (PostgreSQL + RLS + Storage).
Row-level security means users only ever see their own documents.

Billing: Paddle as Merchant of Record — handles VAT and
compliance so I don't have to.

The hardest decision was keeping v1 simple: no RAG, no
embeddings, no vector search. The full document goes into
context. This trades scale for accuracy — for the document
sizes most users have (contracts, reports, catalogs), it works
better than chunked retrieval.

The most interesting technical moment was the conversation
history implementation. The backend was already saving
everything to Supabase, but the frontend was using useState
only. Fixing it required decoupling the remount key from the
conversation ID — a subtle React batching issue that would
have killed the UX silently.

I'm one developer, building from Morocco, shipping tools for
a market that's been waiting for someone to build for it first.

Just launched a new service on Fiverr

AboJad — Sat, 18 Apr 2026 04:50:36 +0000

Validated Q/A datasets for RAG evaluation and LLM fine-tuning — generated from your own documents (PDF, DOCX, URLs).

Built on Anthropic Claude with a hallucination filter, so you don't ship garbage training data.

Starting at $150.

If you're building RAG systems or fine-tuning LLMs and need clean eval data without spending weeks hand-writing it, give it a look:

https://www.fiverr.com/s/ak62v7W

Open to feedback.

I built an MCP server that shows your AI agent which files matter — before it breaks something

AboJad — Sat, 11 Apr 2026 06:16:03 +0000

My AI agent broke a billing function last month.

It wasn't wrong about the code. It just didn't know that file touched payments. It had no way to know.

That's the problem I built context-ops-mcp to fix.

What the agent was doing wrong

When I'd ask Claude or Cursor to make a change, the agent would either:

Read every file (wasting my entire context window), or
Guess which files were relevant and sometimes guess wrong

There was no middle ground. No structured view of the repo that said: these files are risky, these are entry points, these are probably what you need for this task.

What context-ops-mcp does

It's a local Model Context Protocol (MCP) server. You point it at your project, and your agent gets 6 tools instantly:

get_project_structure — Full repo map, skipping noise (node_modules, .git, dist)

get_risky_files — Flags auth, DB, env, and payment logic before the agent touches it

get_relevant_files_for_task — You describe a task, it ranks which files actually matter

get_entry_points — Finds wiring files, HTTP handlers, bootstrap points

get_semantic_summary — Surface-level exports and functions from every .ts file

get_likely_config_files — All config, CI, env, and build files by naming convention

No cloud sync. No account. No indexer. Just npx and stdio.

Install in 30 seconds

npx context-ops-mcp

Or add to your Claude MCP config:

{
  "mcpServers": {
    "context-ops": {
      "command": "npx",
      "args": ["-y", "context-ops-mcp"],
      "cwd": "/path/to/your/project"
    }
  }
}

What it's not

I want to be honest about this:

It's heuristic-based — pattern matching, not a full AST
It only reads the first 50 lines per file for semantic checks
It's TypeScript-first — other languages get minimal treatment
It does not replace tests, code review, or IDE intelligence

It's a navigation layer. The agent still does the work — it just knows where to look first.

Why I built it as an MCP server

MCP is the right abstraction for this. It plugs into Claude Code, Cursor, Windsurf, and Cline without any custom integration. You configure it once and every agent that supports MCP gets the tools automatically.

The alternative was building a one-off plugin per tool. That's a maintenance nightmare.

Try it

npm: context-ops-mcp
GitHub: tornidomaroc-web/context-ops-mcp

If you use it and hit something broken or missing, open an issue. This is an MVP and I'm actively building on it.