AegisOps

Autonomous 9-stage DevSecOps immune system on GitLab Duo that isolates pipeline crashes, purges CVEs, and slashes cloud carbon in 4.8s.

Comment

Inspiration

Software delivery breaks down after code is merged. At 2:00 AM, production pipelines crash, dependencies silently introduce high-severity CVEs, single-stage Dockerfiles waste gigabytes of bandwidth and compute carbon, and developers are inundated with passive alerting bots that create more work instead of solving the crisis.

We asked: What if the software lifecycle possessed an autonomous biological immune system?

What if GitLab Duo didn't just explain why a pipeline failed, but autonomously parsed the crash trace, engineered an AST-verified source fix, purged CVEs via real-time vulnerability databases, audited regulatory compliance, and opened a ready-to-merge Merge Request with green pre-flight verification in under 5 seconds?

That vision is AegisOps.

What It Does

AegisOps is a deterministic, autonomous post-code DevSecOps healing and GreenOps orchestrator natively powered by the GitLab Duo Agent Platform and the Model Context Protocol (MCP v2.0).

When a GitLab CI pipeline fails or an unoptimized workload is detected, AegisOps initiates an autonomous 7-agent closed-loop remediation protocol covering all 9 stages of the GitLab DevSecOps lifecycle:

  1. Verify (Root Cause Diagnosis): Intercepts GitLab CI trace logs via webhooks, isolates failing tests, and pinpoints exact exception frames (e.g., TypeError: unsupported operand type(s) for *: 'float' and 'NoneType' in tests/test_orders.py:42).
  2. Secure (Zero-Day & CVE Remediation): Scans the dependency graph via real-time Model Context Protocol (MCP) queries to the Google OSV API, identifying vulnerabilities like CVE-2023-32681 (Proxy-Authorization leak in requests 2.28.1) and auto-upgrading to patched releases (requests 2.32.3).
  3. Govern (Deterministic AST Code Transformation): Modifies Python Abstract Syntax Trees (AST) to inject defensive null-guards (tax_rate = tax_rate if tax_rate is not None else 0.0) without hallucinating invalid syntax or breaking code style.
  4. Sandbox (Pre-Flight Isolation Gate): Executes the patch in an isolated sandbox runner, executing pytest test suites to guarantee zero regressions before submitting to version control.
  5. Package & Configure (GreenOps SCI Optimization): Analyzes bloated single-stage Dockerfiles (python:3.11, 1,015 MB) and reconstructs them into multi-stage alpine distroless artifacts (142 MB, -86% weight), calculating Software Carbon Intensity (SCI) according to ISO 21031 standards ($184\text{ gCO}_2\text{e}$ saved per deployment).
  6. Govern & Comply (SOC 2 & ISO 27001 CC6.8): Generates immutable cryptographic audit trails attesting that zero untracked dependencies or unauthorized AST transformations bypassed policy controls.
  7. Release (Automated GitLab Merge Request): Generates a complete, ready-to-merge GitLab Merge Request on a dedicated remediation branch with unified diffs, OSV CVE tables, and passing CI badges.

How We Built It

  • GitLab Duo & Agent Platform Integration: Built custom MCP v2.0 server tools (cve_lookup, calculate_sci_carbon, parse_ci_trace, optimize_dockerfile, evaluate_soc2_compliance) that GitLab Duo Chat and autonomous agents invoke over standard JSON-RPC.
  • GitLab API & Webhooks: Full bidirectional integration with GitLab's REST API v4 to ingest pipeline webhooks, inspect job traces, register self-hosted runners, and programmatically open enriched Merge Requests.
  • Backend Architecture: High-throughput Python 3.11 asynchronous FastAPI micro-orchestrator coordinating the agent swarm with deterministic safety guards.
  • Frontend Command Center: Apple/Linear-grade deep obsidian (#08090C) dashboard built with Tailwind CSS, Lucide icons, glassmorphism, dynamic diff comparisons, real-time SRE terminal telemetry, and tactile kinetic triggers.
  • Production Infrastructure: Fully containerized and deployed to public HTTPS on Render PaaS (https://aegisops-vh0s.onrender.com).

Challenges We Overcame

  1. Closing the Loop Without Hallucinations: Traditional LLMs often invent syntax or modify unrelated code when fixing bugs. We paired language models with deterministic Python Abstract Syntax Tree (AST) validation and mandatory isolated pre-flight testing (pytest), rejecting any proposed patch with non-zero exit codes.
  2. Empirical Sustainability Math: Rather than relying on vague "green" claims, we implemented the official Green Software Foundation Software Carbon Intensity equation ($SCI = ((E \times I) + M) / R$), benchmarking real Docker image weights and build energy curves.
  3. 9/9 GitLab DevSecOps Pipeline Execution: Free-tier accounts face SaaS runner verification gates; we engineered an API-driven self-hosted runner integration to run and pass all 9 pipeline stages (plan, create, verify, package, secure, release, configure, monitor, govern) directly on GitLab.com.

Accomplishments We're Proud Of

  • Live, Verifiable Production Assets: Real public HTTPS deployment, real GitLab repository, real Merge Request (!1), and 9/9 passing GitLab CI pipelines. Zero mock facades.
  • 4.8-Second Autonomous Remediation: Slashing Mean Time to Resolution (MTTR) from hours of manual developer triage to single-digit seconds.
  • -86% Docker Footprint: Proven reduction from 1,015 MB to 142 MB, directly reducing cloud egress costs and carbon emissions.

What We Learned

Autonomy in mission-critical developer tooling requires ruthless determinism. Agents are vastly more effective when anchored by tight protocol contracts like the Model Context Protocol (MCP) and verified by deterministic execution sandboxes rather than open-ended prompt chains.

What's Next for AegisOps

  • Native GitLab Duo Workflow integration as an enterprise GitLab CI/CD Component catalog plugin.
  • Autonomous canary rollback gating triggered by OpenTelemetry anomaly detection in production Kubernetes clusters.
  • Dynamic cross-repository vulnerability propagation for enterprise monorepos.

Built With

  • cd/cid
  • docker
  • fastapi
  • gitlab
  • pytest
  • python
  • render
  • restapi
  • tailwind
  • unicorn
Share this project:

Updates

Submission history