AegisOps Autonomous Code Remediation Engine

AegisOps is a solo-built, autonomous multi-agent security engine powered by Qwen-Max. It orchestrates AI agents to scan code, generate patches, and auto-commit fixes via isolated Docker sandboxes.

Comment

Inspiration

Security vulnerabilities and zero-day exploits cost enterprises billions annually, yet the traditional patch lifecycle is heavily bottlenecked by manual review and slow staging validations. We wanted to build a "firewall for the codebase" — an autonomous system that doesn't just block exploits, but active-remediates them in real-time. Crucially, we realized that security teams need to trust these systems. Thus, we built an interactive workspace that supports both fully autonomous execution and human-guided verification.

What it does

AegisOps orchestrates a multi-agent society to secure codebases on autopilot:

  1. Lead Auditor: Runs read-only AST scans to detect vulnerabilities and define a threat footprint.
  2. Patch Developer: Uses Qwen-Max to surgically generate code diff blocks matching the files.
  3. Sandbox Engineer: Dynamically spins up isolated Docker testing environments mimicking production, injects the patch, and executes compile/syntax validations.
  4. Git Manager: Commits the verified changes to the git repository.

Security teams interact with the system via a real-time Command Cockpit featuring:

  • Live Telemetry HUD: Monitors execution time, token usage, and real-time USD costs.
  • Synchronized Resizable Diff Viewer: A custom split code-viewer that locks height scaling between deleted (Coral Rose) and added (Emerald Mint) code blocks.
  • Dual Modes:
    • Autopilot Mode: Runs the entire cycle autonomously from detection to commit.
    • Co-pilot Mode: Pauses after sandbox tests pass, introducing a thread-safe human-in-the-loop gate to approve or reject the commit.

How we built it

AegisOps is engineered with a modular, highly scalable Python backend and a lightweight real-time dashboard:

  1. Qwen Cloud Integration: We utilized Qwen-Max via the Alibaba Cloud Model Studio and dashscope SDK. Qwen-Max acts as the core reasoning engine, generating surgical search-and-replace patches.
  2. Multi-Agent Society: We mapped distinct responsibilities to three agents:
    • Lead Auditor: Read-only AST-parsing scanner.
    • Patch Developer (Qwen-Max): Surgeon generating code diff blocks.
    • Sandbox Engineer: Provisions Docker-isolated environments to run tests.
  3. Consensus Handshake: The Developer and Sandbox Engineer execute a feedback loop where tests must return VERIFIED before committing.
  4. Interactive Co-Pilot Gate: Added a thread-safe human-in-the-loop approval gate. In Co-pilot mode, the pipeline suspends after sandbox verification, prompting the user via the frontend to Approve & Commit or Reject & Rollback.
  5. Command Cockpit: A premium, light-themed engineering interface displaying real-time system events streamed via Server-Sent Events (SSE) and offering a resizable, synchronized split diff-viewer.

Challenges we ran into

Windows Subprocess & Zombie Ports: Orphaned background python servers on Windows would periodically block port 8000. We solved this programmatically by building an auto-clear function into the server start handler that sweeps port bindings via netstat and frees the port. Thread Suspend and Resume: Suspending a background async loop to wait for synchronous HTTP-driven human approvals in a separate thread. We solved this by implementing a thread-safe synchronization callback leveraging threading.Event. Diff-viewer Layout Jitter: Standard HTML textareas would scroll out of sync during resizes. We built a custom ResizeObserver listener in JavaScript to dynamically lock and synchronize the height of the deletion and addition code blocks.

Accomplishments that we're proud of

Developing a 100% automated threat modeling -> patch generation -> sandbox validation pipeline that executes in under 45 seconds. Creating a robust human-in-the-loop decision gate that lets security teams toggle between fully autonomous and review-gated workflows, addressing the core enterprise trust barrier for AI agents. Creating a highly responsive, light-themed dashboard that breaks away from typical "cyberpunk" hacker skins in favor of a clean, trustworthy, enterprise-grade engineering workspace.

What we learned

How to handle state synchronization between asynchronous background agent threads and real-time frontend SSE clients. The power of Qwen-Max in retaining strict markdown formatting constraints and parsing complex source code contexts.

What's next for AegisOps Autonomous Code Remediation Engine

Adding support for multi-file patches and dependency-aware imports. Integrating with GitHub Actions and GitLab CI/CD webhooks to trigger patch loops on every code commit.

Built With

Share this project:

Updates