AGENTGUARD-AI

AgentGuard AI scans GitHub repositories, detects vulnerabilities, analyzes dependency risks, and provides actionable insights to help developers build secure software.

Comment

AGENTGUARD-AI — Intelligent Repository Security Platform

Inspiration

Modern software development depends heavily on open-source libraries, third-party dependencies, APIs, and rapidly evolving codebases. While these technologies help developers build applications faster, they can also introduce security vulnerabilities, exposed credentials, and unsafe coding practices.

We were inspired to build AGENTGUARD-AI to make repository security analysis easier, more accessible, and more understandable for developers.

Traditional security tools can generate technical reports that are difficult for beginners to interpret. Developers may also need to use multiple tools to check their source code, dependencies, and potential secrets. Managing these checks manually becomes increasingly challenging as projects grow.

Our vision was to create a centralized platform that combines established security-scanning tools, AI-assisted explanations, GitHub repository integration, and workflow automation.

Instead of relying on AI alone to guess whether code is secure, AGENTGUARD-AI is designed to use real scanner findings as evidence and then use AI to help developers understand those findings.

Our mission is simple: make security analysis smarter, clearer, and more accessible to every developer.

What it does

AGENTGUARD-AI is an AI-assisted repository security platform designed to identify potential security risks and help developers understand how to address them.

  1. GitHub repository integration

Developers can connect a GitHub repository or provide an authorized repository URL for analysis.

The platform retrieves repository contents through the backend and prepares the files for security scanning. Repository access must be authorized, and untrusted source code should not be executed simply to inspect it.

  1. Automated source-code security analysis

AGENTGUARD-AI integrates specialized scanners designed to detect different categories of security issues.

  • Semgrep: Analyzes source code using security rules to identify potentially unsafe coding patterns.
  • Bandit: Checks Python source code for common security issues.
  • detect-secrets: Helps identify potential credentials and secrets accidentally included in files.
  • OSV-Scanner: Checks supported dependency manifests and lockfiles for known vulnerabilities in third-party packages.

These tools complement one another. Each scanner has its own coverage and limitations, so combining them provides broader analysis without guaranteeing that every vulnerability will be detected.

  1. Dependency vulnerability analysis

Third-party packages can introduce security risks even when an application's own code appears safe.

The platform is designed to identify dependencies associated with known security advisories using OSV-Scanner and, where configured, the OSV API.

The resulting information can help developers investigate affected packages, vulnerability identifiers, and available remediation options.

  1. AI-powered security explanations

AGENTGUARD-AI is designed to use NVIDIA Nemotron through a supported inference interface for AI-assisted analysis, with Nebius Token Factory considered as an additional model-access option.

The AI layer can help explain verified findings in simpler language, summarize potential impact, and suggest remediation approaches based on the available evidence.

The goal is to turn technical scanner output into actionable information without allowing AI-generated explanations to replace genuine scanner results.

  1. Security Command Center dashboard

The dashboard brings repository security information into one interface.

Its planned capabilities include:

  • Repository and scan status.
  • Security-risk summaries.
  • Recent and unresolved findings.
  • Finding severity and available file locations.
  • Scan history and results.
  • A central action for initiating repository scans.

The dashboard should also distinguish successful scans from failed, incomplete, or unavailable scanner runs.

  1. GitHub-triggered automation

Using n8n Cloud, the proposed workflow can connect GitHub repository events to the backend scanning pipeline.

The workflow is designed to:

  1. Receive a repository push event.
  2. Validate the event and its relevant commit information.
  3. Send an authenticated request to the backend.
  4. Verify repository authorization and prevent duplicate scan requests.
  5. Initiate or queue a scan.
  6. Store the results and make the updated status available to the dashboard.

This automation can reduce manual work and help developers identify security issues introduced by repository changes. It depends on a working backend endpoint, valid credentials, and successful workflow configuration.

How we built it

We designed AGENTGUARD-AI as a modular full-stack application that separates the user interface, backend logic, security scanners, data storage, AI services, and automation workflows.

Frontend

We use the following technologies for the web interface:

  • React: Builds reusable components and interactive dashboard pages.
  • TypeScript: Improves type safety and maintainability.
  • Vite: Provides frontend development and build tooling.
  • Tailwind CSS: Supports responsive layouts and consistent styling.
  • React Router DOM: Manages navigation between pages.
  • TanStack React Query: Manages server-state fetching, caching, and synchronization.
  • Axios: Sends HTTP requests to backend APIs.

The frontend provides the interface for repository management, scan initiation, and reviewing security findings.

Backend

The backend is built with Python and FastAPI.

It coordinates repository processing, validates requests, invokes the scanner integrations, handles errors, and returns structured results to the frontend.

Pydantic is used for request and response validation. Git is used for repository operations, while the scanner adapters provide a consistent way to integrate tools that have different command-line interfaces and output formats.

Security-scanning pipeline

We use a modular scanner architecture so that each tool can run independently and contribute its findings to the overall scan report.

The intended pipeline is:

  1. Validate repository access and scan configuration.
  2. Retrieve the authorized repository.
  3. Inspect its structure and identify supported files and dependency manifests.
  4. Run the relevant scanners.
  5. Parse genuine scanner output into a consistent finding format.
  6. Preserve available evidence, such as vulnerability identifiers, severity, file paths, and line numbers.
  7. Save the results and report the actual scan status.
  8. Return the findings for presentation in the dashboard.

Timeouts, unavailable executables, invalid scanner output, and API failures must be handled explicitly. If a scanner cannot run, the application should report the limitation instead of presenting an empty result as proof that the repository is secure.

Database and authentication

We use Supabase as the planned authentication and database platform, with PostgreSQL for persistent storage.

The database can store user-related records, connected repositories, scan history, and security findings. Supabase Auth supports account authentication, while server-side authorization controls access to repositories and scan operations.

Sensitive credentials must remain in secure server-side configuration rather than public frontend variables.

AI integration

The AI layer is designed around NVIDIA Nemotron and the available inference APIs, with Nebius Token Factory as a potential additional provider.

The model receives relevant scanner findings and carefully selected code context to produce explanations and remediation guidance. Its output should remain separate from the original scanner evidence so that developers can distinguish detected issues from AI-generated recommendations.

Automation and deployment

We are using or evaluating the following infrastructure components according to the current implementation stage:

  • GitHub: Source-code hosting and repository events.
  • n8n Cloud: Workflow automation.
  • Vercel: Frontend hosting.
  • Supabase: Authentication and database services.
  • FastAPI hosting: Backend APIs and scanner execution.
  • Docker: Potentially for consistent runtime packaging and controlled scanner execution.

The backend runtime must contain the required scanner binaries and dependencies. A tool installed locally is not automatically available in a deployed environment.

Challenges we ran into

Integrating multiple security tools

Each scanner has different installation requirements, supported languages, configuration options, and output formats. We needed a consistent approach to collecting findings without losing important evidence or incorrectly merging results.

Handling unavailable scanners

One challenge is that a scanner may be missing from the runtime environment or fail because of configuration, permissions, or timeouts.

For example, OSV-Scanner can report that its CLI is unavailable even if the application has a separate OSV API fallback. These execution paths must be reported independently so developers know which checks actually ran.

Preventing misleading results

A security dashboard must not invent findings or report a repository as secure simply because a scanner returned no output.

We therefore prioritize truthful scan statuses, structured scanner output, error handling, and tests that distinguish a successful clean scan from a failed or incomplete scan.

Managing scan duration

Large repositories and multiple security tools can make scanning time-consuming. Running all operations within one HTTP request can lead to timeouts and an unresponsive interface.

Potential solutions include background jobs, configurable timeouts, concurrency limits, scan progress updates, caching, and better handling of large repositories.

Connecting AI with real evidence

AI can explain complicated security reports, but it can also make unsupported claims.

The challenge is to use AI for interpretation and guidance while keeping the original scanner findings as the source of evidence. Remediation suggestions must be reviewed rather than treated as guaranteed fixes.

Securing repository processing

Repositories contain untrusted source code, dependency files, and potentially sensitive information. Safe processing requires authorization checks, resource limits, careful file handling, and isolation of scanner processes.

Deploying consistently

A scanner may work on a development machine but fail in production because its executable or dependencies are missing. We must configure and test the actual backend runtime rather than assume that local success guarantees successful deployment.

Accomplishments that we're proud of

  • A unified security vision: Bringing source-code scanning, dependency analysis, and potential secret detection into one platform.
  • A modular architecture: Separating the frontend, backend, scanners, database, AI layer, and automation workflow so each component can be maintained and tested independently.
  • A developer-focused dashboard: Designing a centralized Security Command Center to make scan status and findings easier to understand.
  • An evidence-first AI approach: Using AI to explain scanner findings rather than treating an LLM as a replacement for security tools.
  • An automation-first roadmap: Connecting GitHub events with a potential automated scanning workflow through n8n.
  • A focus on reliability: Treating missing scanners, timeouts, and partial results as important states instead of hiding them behind misleading success messages.
  • A practical learning experience: Applying full-stack development, security tooling, AI integration, API design, database management, and deployment concepts to a single project.

These accomplishments reflect the architecture and engineering goals of AGENTGUARD-AI. Individual capabilities should be considered complete only after their integrations and tests have been verified.

What we learned

Building AGENTGUARD-AI has helped us understand that effective security automation requires more than combining an AI model with a web application.

Security tools are complementary. Static code analysis, dependency scanning, and secret detection address different categories of risk. No single tool provides complete security coverage.

AI works best with evidence. Language models can help explain complicated findings, but scanner output, vulnerability advisories, and relevant code context must remain the basis for security conclusions.

Reliable status reporting matters. A successful scan with no findings is different from a scan that failed, timed out, or could not start. Accurate reporting is essential for user trust.

Full-stack integration requires clear boundaries. The frontend, API, database, scanner processes, and AI services need well-defined responsibilities and predictable interfaces.

Automation requires security controls. GitHub events and external workflow services must be authenticated, validated, and protected against duplicate requests and unauthorized repository access.

Deployment is part of engineering. Dependencies and scanner binaries must be available in the environment where the backend runs, with appropriate timeouts, permissions, and resource limits.

Most importantly, we learned that a useful security platform must make results both actionable and trustworthy.

What's next for AGENTGUARD-AI

Our next goal is to evolve AGENTGUARD-AI into a more reliable and intelligent repository security platform.

1. Reliable background scanning

Introduce a background-job system so large scans can continue independently of HTTP requests, with accurate progress tracking, cancellation, timeout handling, and partial-result reporting.

2. More intelligent finding prioritization

Combine scanner severity, vulnerability metadata, dependency information, and available repository context to help developers prioritize findings. Any additional AI-based prioritization should be clearly distinguished from scanner-provided severity.

3. GitHub pull-request integration

Run security checks when relevant pull requests or commits are created, and report newly introduced findings so developers can address problems earlier in the development lifecycle.

4. Verified AI-assisted remediation

Generate suggested fixes grounded in the relevant code and finding evidence. Add validation through the appropriate scanners and tests before recommending a patch as successful.

5. Better scan performance

Explore incremental scanning, caching, duplicate-finding reduction, resource limits, and configurable concurrency to improve performance on larger repositories.

6. Expanded security coverage

Evaluate additional scanners and supported languages to extend coverage across modern web applications, backend services, and dependency ecosystems.

7. Improved reporting and visibility

Add scan comparisons, historical trends, finding lifecycle tracking, exportable reports, and clearer indicators for failed, incomplete, or unavailable security checks.

8. Stronger isolation and deployment

Improve the security of repository processing through isolated scanner execution, restricted permissions, controlled network access, and reproducible deployment configurations.

9. Responsible AI evaluation

Evaluate the accuracy and usefulness of AI-generated explanations and remediation suggestions, reduce unsupported claims, and ensure that security evidence remains traceable to its original source.

Our long-term vision is to make AGENTGUARD-AI a trusted security companion for developers and teams, combining established security tools, AI-assisted understanding, and automation to make secure software development more accessible.

AGENTGUARD-AI — Scan smarter. Understand risks. Build more secure software.

Technology Stack and Components

1. Frontend

  • React 19 — Interactive security dashboard and repository management.
  • TypeScript — Type safety and maintainable frontend code.
  • Vite — Frontend development and build tooling.
  • Tailwind CSS — Responsive dashboard styling.
  • React Router DOM — Application navigation.
  • TanStack React Query — API data fetching and caching.
  • Axios — Communication with backend APIs.

2. Backend

  • Python — Core application and scanning logic.
  • FastAPI — REST APIs and scanner orchestration.
  • Pydantic — Request and response validation.
  • Git — Repository retrieval and source management.

3. NVIDIA AI Integration

  • NVIDIA Nemotron — AI-assisted vulnerability explanations, security analysis, and remediation suggestions.
  • NVIDIA API / NVIDIA NIM — Model inference access, depending on the selected model and supported endpoint.
  • Nebius Token Factory — Optional alternative inference provider if configured.

The AI layer interprets actual scanner findings and explains them in developer-friendly language. Security findings must remain grounded in scanner output rather than AI-generated guesses.

4. Security Scanning Tools

  • Semgrep — Static application security testing and potentially unsafe code-pattern detection.
  • Bandit — Security analysis for Python code.
  • OSV-Scanner — Detection of known vulnerabilities in supported software dependencies.
  • Google OSV API — Dependency vulnerability advisory lookup and a possible fallback.
  • detect-secrets — Detection of potential credentials and secrets in source files.

Each scanner covers different risk categories. Their findings are collected into a consistent report.

5. Database and Authentication

  • Supabase Auth — User registration, login, and session management.
  • Supabase PostgreSQL — Storage for repository information, scan history, and security findings.
  • Row Level Security (RLS) — Database access controls where configured and tested.

6. Deployment and Infrastructure

  • Vercel — Frontend hosting.
  • FastAPI-compatible hosting — Backend APIs and scanner execution.
  • Docker — Optional containerization for consistent dependencies and isolated scanner execution.
  • GitHub — Repository integration and source-code management.

7. System Architecture

GitHub Repository → React Frontend → FastAPI Backend → Semgrep + Bandit + OSV-Scanner + detect-secrets → Structured Security Findings → Supabase PostgreSQL → NVIDIA Nemotron AI Explanations → Security Command Center Dashboard

Key Differentiator

Built With

Share this project:

Updates

Submission history