Aegis

Inspiration

With the increasing prevalence of AI in the field of cybersecurity, notably with the release of Mythos, the ability to detect vulnerabilities in a system will become increasingly widespread and available to the average person. Acknowledging the future scope of this development, we found it necessary to create a way for those unfamiliar with Cybersecurity to adapt to this changing environment. We are personally close with several small business owners, so we immediately thought of how their businesses would respond as tools like Mythos become widespread. Currently, they can survive without prioritizing cybersecurity, but as the ability to detect vulnerabilities increases, the ability for malicious actors to exploit these vulnerabilities also increases. With that being said, the reports generated by Mythos are great for cybersecurity researchers or professionals, but impractical to the average business owner who does not have a dedicated team of cybersecurity specialists to thoroughly analyze their vulnerabilities. Aegis bridges the gap between accessibility and practicality by making dense cybersecurity jargon available from Mythos or any other AI tool into an actionable, comprehensible plan.

What it Does

Aegis is a web application that helps non-technical business owners and solo developers understand and act on security vulnerabilities without needing a dedicated/extremely advanced cybersecurity team. Users sign in, paste a public GitHub repository URL, and Aegis automatically pulls dependency lockfiles and relevant source code to begin analysis. The platform scans dependencies against the public OSV vulnerability database, so every reported CVE is real, verifiable, and reproducible. It also runs an AI-assisted (Opus 4.8) code scan over high-priority source files to surface issues like injection flaws, hardcoded secrets, and authentication weaknesses. Aegis builds an interactive exploit graph that shows how individual vulnerabilities connect into realistic attack chains. Dependency CVEs and code findings appear as nodes, linked by edges representing dependency chains, data flows, privilege escalation, CWE relationships, and lateral movement. A plain text report explains the overall risk, summarizes the most dangerous attack path, and translates dense security jargon into everyday language. The triage view ranks findings using a composite score that weighs CVSS, graph centrality, EPSS exploitation probability, CISA Known Exploited Vulnerabilities status, and network reachability to make a recommendation on which issues to focus on first. Users can explore a force-directed graph visualization, click any node for full CVE or code-finding details, and see which issues sit at the center of multiple attack paths. For each vulnerability, Aegis generates a detailed, copy-pasteable remediation plan with exact upgrade commands, file paths, line numbers, and verification steps. Plans are structured so both a human and an AI coding agent can execute the fix. Projects are saved to a personal dashboard so users can return, re-analyze, and track progress over time. Aegis supports multiple ecosystems including npm, PyPI, Go, Rust, and RubyGems through parsers for common lockfile formats. In short, it turns overwhelming scanner output, whether from Mythos or any similar tool, into a prioritized, visual, and actionable security plan.

How We Built It

Aegis is split into a Python FastAPI backend and a React + Vite frontend. The backend uses uv for dependency management, asyncpg for PostgreSQL persistence on Neon, and Clerk JWT verification for authentication. When a user submits a public GitHub URL, our GitHub integration fetches supported lockfiles (package-lock.json, requirements.txt, Cargo.lock, and others) and selectively pulls source files from security-sensitive paths like auth, API routes, and database layers. The OSV ingest pipeline parses each lockfile format, normalizes packages to exact installed versions, and batch-queries the OSV API for confirmed CVEs. Each finding is enriched with EPSS exploitation scores and CISA KEV flags so we can distinguish theoretical risk from actively exploited threats. Separately, Claude Opus analyzes fetched source files for high-confidence code vulnerabilities with structured JSON output including CWE IDs, CVSS scores, and affected code snippets. We built the system so the LLM never decides what is vulnerable; OSV handles dependency detection deterministically, and the AI only reasons over already-confirmed or high-evidence findings. Claude then generates exploit-chain edges between vulnerability nodes, identifying how dependency flaws, code weaknesses, and privilege requirements combine into realistic attack paths. Degree centrality is computed on the resulting graph to surface bridge nodes that multiple chains route through. Ideally, these operations would be handled by Mythos. Our project is not intended to compete with Mythos; instead, it is intended to function as a layer on top of Mythos. Claude also produces a narrative report with an overall risk summary, chain explanation, and highest-risk path in arrow notation. On the frontend, we built the dashboard, project creation flow, vulnerability table, triage panel, and interactive graph using React, TanStack Router, Tailwind CSS, and shadcn/ui components. The exploit graph is rendered with D3 force simulation, color-coded by severity and edge type, with a detail panel for per-node inspection. The triage view scores and ranks every node, and users can generate remediation plans rendered as Markdown with copy and download actions. Analysis runs as a background task on the backend, with the frontend polling until results are ready. All analysis results are persisted so users can revisit projects without re-running scans.

Challenges We Ran Into

One of our first challenges was supporting multiple lockfile formats across ecosystems, since npm, Python, Go, Rust, and Ruby each represent dependencies differently. We spent significant time normalizing every format into a consistent {name, version, ecosystem} structure before querying OSV. Generating meaningful exploit-chain edges was also difficult, because naive pairing of vulnerabilities produces noisy graphs that confuse rather than clarify. We iterated on prompts and confidence thresholds until Claude produced a small set of high-quality edges rather than dozens of speculative connections. Visualizing these graphs in the browser presented its own problems, as force-directed layouts can be chaotic with many nodes, so we tuned node sizing by centrality, color by severity, and edge styling by relationship type to keep the visualization readable. Balancing triage scoring was another hurdle, because raw CVSS alone often over-prioritizes unreachable critical flaws while under-prioritizing bridge nodes that enable multiple attack paths. We combined CVSS, graph centrality, EPSS, KEV status, and network attack vector into a weighted composite score, which better reflects real-world risk for our target users. Running long-running analysis pipelines in a hackathon setting required careful async design: OSV ingest, GitHub fetching, code scanning, edge generation, and report writing all needed to run concurrently without blocking the API. We also had to handle partial failures gracefully, such as when a repo has no lockfile or when the Anthropic API is unavailable. Finally, designing for small business owners rather than security professionals meant every UI decision had to favor clarity over completeness, and we constantly questioned whether a feature would help someone without a security team actually fix something today.

Accomplishments That We're Proud Of

Quite simply, we are proud that we shipped a complete, working full-stack product in a single weekend. Our grounding architecture ensures dependency vulnerabilities are never hallucinated, because every CVE is confirmed through OSV before it ever reaches the user or the LLM. We successfully combined dependency scanning and AI code analysis into a single unified exploit graph, which is something traditional tools like Dependabot and npm audit do not attempt. The graph does not just show what is vulnerable; instead, it shows how vulnerabilities connect, which is the insight small business owners actually need to understand why a "medium" flaw might matter more than a "critical" one. We built a triage system that goes beyond CVSS sorting and incorporates real-world exploitation signals like EPSS and the CISA KEV catalog. Our per-vulnerability remediation plans are detailed enough to hand directly to a developer or an AI coding agent, with exact commands, file paths, and verification steps rather than generic security advice. We support five major package ecosystems out of the box, making Aegis useful beyond just JavaScript projects. The easily understandable narrative report successfully translates technical CVE data into a story about overall risk and the single most dangerous attack path. We integrated Clerk authentication, PostgreSQL persistence, and a polished React UI that feels like a real product rather than a hackathon prototype. The interactive D3 graph with node detail panels gives users a spatial understanding of their security posture that a flat list never could. We designed the tool specifically for people we can relate to (small business owners and solo developers) and kept that user front and center in every feature decision. Perhaps most importantly, we built something that directly addresses the problem we identified in our inspiration: as vulnerability detection becomes more accessible, the bottleneck shifts from finding flaws to understanding and fixing them, and Aegis attacks that bottleneck head-on.

What We Learned

Tools like Mythos and OSV scanners are getting better at finding vulnerabilities, but their output is still designed for security professionals, not the restaurant owner running a booking app or the student maintaining a Discord bot. We learned that CVSS severity scores alone are a poor guide for non-experts, because a critical vulnerability in an unreachable dependency matters far less than a medium-severity flaw sitting on the only path to sensitive data. Graph centrality turned out to be a surprisingly intuitive way to communicate priority. When users can see that one package sits at the center of multiple attack chains, the fix order becomes obvious without reading a single CVE description. We learned that LLMs are powerful narrators and chain-reasoners but dangerous detectors, which reinforced our decision to keep AI on the interpretation layer and public databases on the detection layer. Building parsers for real-world lockfiles taught us how messy dependency management actually is across ecosystems, and how much hidden complexity lives in files developers rarely look at. We learned that small, conservative AI outputs beat large, speculative ones: three to ten high-confidence exploit edges are far more useful than thirty guessed connections. Working with public GitHub repos taught us about the practical constraints of rate limits, file selection, and the impossibility of scanning an entire monorepo in a single API call. We learned that remediation plans need to be extremely specific to be actionable. Generic advice like "update your dependencies" is what users are already ignoring. Designing for our actual target users (people we know personally) kept us honest about scope and forced us to cut features that would impress judges but confuse users. We also learned how much value there is in persistence, letting users save projects and return to them transforms a one-time scan into an ongoing security workflow. Finally, we learned that the cybersecurity landscape is shifting quickly, and tools that bridge the gap between powerful detection and practical action will only become more necessary as AI makes vulnerability discovery more widespread.

What's Next for Aegis

Our immediate next step is deeper integration with AI security scanners like Mythos, so users can import scan results directly into Aegis rather than only analyzing GitHub repositories. We want to add continuous monitoring that re-scans projects on a schedule and alerts owners when new CVEs affect their dependencies or when CISA adds a flaw to the KEV catalog. Private repository support through GitHub App installation is a high priority, since many small businesses do not host their code publicly. We plan to build automated pull request generation that applies the top-priority fixes from our remediation plans, reducing the gap between "knowing what to fix" and "fixing it." Team dashboards would let small business owners share a read-only security overview with contractors or IT consultants without exposing their full codebase. We want to improve our code scanning with true reachability analysis, determining whether a vulnerable dependency is actually invoked in the application's code paths rather than just present in the lockfile. CI/CD integration (GitHub Actions, GitLab CI) would let developers run Aegis checks on every push and block merges when critical attack paths are introduced. We plan to expand ecosystem support to Maven, NuGet, and Composer, and add SBOM import for teams already generating software bills of materials. A simplified "business owner view" with executive summaries, risk scores, and plain-language weekly digests would serve users who never want to see a CVE ID. Longer term, we envision Aegis as the security layer that sits between raw scanner output and real-world action, ingesting findings from any tool, prioritizing them by actual exploitability, and producing fixes that a human or AI agent can execute. We also want to explore compliance mapping so small businesses can see how fixing specific vulnerabilities moves them toward frameworks like SOC 2 or PCI-DSS. As AI-powered vulnerability discovery tools proliferate, Aegis aims to be the platform that makes those discoveries actionable for the people who need them most.

Built With

• claude
• clerk
• fastapi
• postgresql
• react
• shadcn
• tailwind
• tanstack
• typescript
• vite