186 Commands, 54 Agents: How Claude Night Market Automates TDD, Code Review, and Project Maintenance Without Manual Scripts

I’m Denis Shokhirev, Agentic AI Systems Architect based in Freiburg im Breisgau, Germany. At DennisCraft AI Studio, I ship fully autonomous multi-agent AI systems for DACH B2B clients—using Claude, Supabase, n8n, Doppler, and self-hosted Postgres. In production, there’s no room for manual scripting or “we’ll fix it later”—every step from TDD to code review to maintenance must be automated and observable.

The Pain: Why Manual Scripts Don’t Survive Production

In regulated European markets, manual scripts and ad hoc pipelines break down fast. I’ve seen LLM-generated code that skips tests, exposes credentials, or opens up SQL injection holes—right in the middle of production cycles. The Claude Night Market stack now runs 186 distinct command types and 54 focused agent patterns, each handling a concrete task (TDD, code review, maintenance), all orchestrated without hand-written bash or one-off glue code.

Agent Pattern: No Silver Bullets, Only Composable Units

Forget “agent platforms”—what works in prod is a pattern: a single agent is a Claude Code instance, running in a container, orchestrated by n8n, with Supabase as the command-and-log backbone. Here’s a real pattern for automated TDD:

import supabase
import subprocess

def run_tests():
    result = subprocess.run(["pytest", "--maxfail=2", "--tb=short"], capture_output=True, text=True)
    return result.stdout

def log_to_supabase(client, log):
    client.table("test_logs").insert({"log": log}).execute()

if __name__ == "__main__":
    sb = supabase.create_client("SUPABASE_URL", "SUPABASE_KEY")
    result = run_tests()
    log_to_supabase(sb, result)

The agent fetches a command from Supabase, executes it, logs outcome, and triggers n8n for notifications or escalations. No manual triggers, no SSH into servers.

186 Commands: Declarative, Not Scripted

Every task is a declarative JSON command, not a script. Example: security scan of Python code using semgrep:

{
  "type": "security_scan",
  "tool": "semgrep",
  "target": "repo/src/",
  "ruleset": "p/ci"
}

The agent interprets the command, runs semgrep, and stores the summary in Supabase. If critical CWE-89 or similar patterns are found, it notifies the responsible engineer via n8n and blocks the PR.

Production Findings: What the Agents Actually Catch

Across three recent deployments, my agents flagged the same issue: LLM-generated backend code introducing unsafe user input—classic SQL injection in Postgres. semgrep and bandit caught it before it merged, and n8n notified the team in Slack. Without integrated static analysis, this would have reached production. Similarly, gitleaks prevented hardcoded API key leaks in 2 real projects.

Code Review and Maintenance: Automated, Not Optional

Code review is handled by a dedicated agent using Claude Code and the OpenAI Cookbook (link). The workflow:

1. Parse PR diff using Claude Code.
2. Run semgrep, bandit, and gitleaks over the diff.
3. Cross-check with a database of known patterns.
4. Generate a summary and actionable recommendations in Supabase.
5. Push to n8n for real-time reviewer notification.

Maintenance agents listen to error logs in Supabase via triggers. If a specific error repeats 3+ times in 24 hours, they automatically launch remediation scripts and log the action for audit.

Secrets Management: Doppler and Supabase Only

No agent or script stores secrets in code. Doppler provides all key and token management: each agent requests time-limited tokens via API, and all run in isolated containers. If a secret is leaked or outdated, Doppler rotates it instantly via webhook. This is essential for DACH compliance.

Public Observability: Night Market Live

A portion of Night Market is publicly visible at live.gerdennisai.com—showing real-time agent execution, report generation, and incident response. The architecture is transparent: all tools are open, no black boxes.

FAQ

Which stack components integrate best with Claude Code?

Supabase for command/log storage, n8n for orchestration, Doppler for secrets, and open-source security tools like semgrep, bandit, and gitleaks.

How many agents are practical for a SME team?

Typically 7–15 cover tests, code review, and monitoring. Scaling to 50+ is straightforward for enterprise needs.

Can Night Market patterns handle non-Python projects?

Yes—swap in eslint for JS, shellcheck for bash, or any analyzers for your stack. The pattern is language-agnostic.

Which pipeline stage catches most vulnerabilities?

In my experience, pre-commit and code review stages are the most effective. Runtime monitoring is critical for complex integrations.

How does Night Market pass compliance audits?

All logs are persistent, secrets are managed only via Doppler, and no LLM tokens are stored unencrypted. Full audit reports are available for external review.

Which stage in your LLM pipeline catches the most issues in prod—static analysis, runtime sandbox, or human review? I’d genuinely like to know. I run a free 30-min stack audit for DACH founders building AI in regulated markets. DM me on LinkedIn or write to @ger_dennis_ai.