DOKIMA

Documentation

Getting started

Dokima runs from the directory that contains the repositories you want it to review. It creates a local .dokima/ directory for configuration, state, prompts and logs.

Public trial downloads are not open yet. Approved trial customers will receive the binary and licence instructions before following this guide.

What you need

  • A Linux or macOS computer.
  • One or more Git repositories under a common workspace directory.
  • A supported command-line AI runner. Dokima currently detects Codex, Claude and Agy, and prefers Codex when it is available.
  • An account and usage allowance for that runner.

Create the workspace

Move into the directory that contains your repositories, then start Dokima:

cd /path/to/your/workspace
dokima

On first run, Dokima asks whether to set up the current directory. It then detects repositories and available runners before opening the terminal dashboard.

Add useful project context

Dokima creates DOKIMA.md at the workspace root. Use it to explain the parts of the system that source alone cannot show:

  • important architecture decisions;
  • trust boundaries and threat-model assumptions;
  • external controls or mitigations;
  • intentional non-goals;
  • business rules that affect security.

This context is added to review work. Keep it concise and update it when the system changes.

Run the first review

Use the dashboard and select Full Sweep, or run:

dokima sweep --mode full

A full review builds repository and component context, verifies assumptions, runs focused vulnerability hunting, challenges candidate findings and prepares the report. The time and runner usage depend on the number and size of repositories, the work due and the configured rate limit.

Open the report

When report work completes, Dokima writes a static site to:

./dokima-report/

You can regenerate it from accepted finding state with:

dokima report

The dashboard also provides a Findings view for reviewing the current status, evidence and annotations.

Keep reviewing

Once the initial context exists, run later sweeps as the code changes:

dokima sweep

For a long-running review loop:

dokima continuous

Dokima decides which scheduled work is due. Your runner limits still apply; if a provider reports a temporary usage window, Dokima records the cooldown and retries the queued job later.