AstraSec AI

Less noise, More Security- AstraSec AI prioritises and solves.

Comment

Inspiration

While building projects, we noticed a recurring problem: developers are overwhelmed by too many security alerts, most of which are either low priority or hard to understand.

Instead of helping, security tools often slow developers down. We asked a simple question:

What if security tools could think like a developer and tell us what actually matters? That idea led to AstraSec AI.

What it does

AstraSec AI is an AI-powered security co-pilot designed to integrate seamlessly into the developer workflow.

Astrasec AI integrates directly into GitHub and CI/CD workflows to automate security processes during development.

  • Automatically scans repositories on push and pull requests
  • Detects and classifies vulnerabilities
  • Uses AI to summarize findings
  • Analyzes CI failures to generate root cause insights
  • Automatically creates actionable security tickets
  • Prevents duplicate ticket creation Tracks vulnerability status (OPEN, FIXED, IGNORED)

The system runs asynchronously and does not block developer workflows.

How we built it

System Architecture

Core Components

  • LLM Provider: Databricks (Meta Llama 3.1 8B)

    • Primary AI model powering all agents

  • Local LLM Fallback: Ollama (Llama 3)

    • Ensures offline capability when cloud APIs are unavailable

  • AI Copilot: OpenAI-compatible API + MCP Tools

    • Chat-based security assistant

  • Multi-Agent Architecture: 4 Specialized AI Agents

    • Repo Scan Agent
    • Pipeline CI/CD Agent
    • RCA Agent
    • Auto-Ticket Agent
    • Each agent operates with its own role and API key

  • Protocol: MCP (Model Context Protocol)

    • Standardized interface between LLM and backend services
    • Enables seamless tool-calling and integration

Security Tools Integrated

  • Semgrep

    • Performs SAST (Static Application Security Testing)
    • Scans repositories for OWASP Top 10 vulnerabilities

  • Trivy

    • Misconfiguration scanner
    • Audits CI/CD pipeline YAML files for security issues

  • Custom Heuristic Rules

    • Detects hardcoded secrets
    • Identifies insecure patterns like curl | bash
    • Flags missing SAST stages in pipelines

Challenges we ran into

  • LLM Fine-Tuning Limitations
    We initially planned to fine-tune Phi-3 models for improved vulnerability understanding and domain-specific reasoning.

  • Accurate Root Cause Analysis (RCA)
    Interpreting logs and identifying meaningful root causes demanded contextual understanding beyond simple parsing.

  • High Volume of Security Alerts
    Managing and filtering large volumes of vulnerabilities from multiple tools was challenging.

  • Model Constraints & Performance
    Running AI models efficiently within limited resources was a key challenge.

  • Multi-Tool Integration
    Integrating tools like Semgrep and Trivy into a unified pipeline was complex due to differing output formats and workflows.

Accomplishments that we're proud of

  • Robust Root Cause Analysis (RCA)
    Successfully implemented AI-driven RCA that analyzes logs and identifies the underlying cause of failures, providing clear and actionable explanations to developers.

  • Dependency & Misconfiguration Scanning (Trivy)
    Integrated Trivy to effectively detect vulnerabilities in dependencies and identify misconfigurations within CI/CD pipelines, improving overall security coverage.

  • AI-Powered Vulnerability Prioritization
    Reduced alert fatigue by intelligently ranking vulnerabilities based on severity, impact, and exploitability.

  • Seamless CI/CD Integration
    Integrated the system directly into the development pipeline, enabling real-time security feedback during code pushes and pull requests.

What we learned

  • Multi-Agent Systems Improve Modularity
    Breaking down responsibilities across specialized AI agents made the system more scalable, maintainable, and easier to extend.

  • Bridging the Gap Between Security and Developers
    Translating complex security findings into simple, actionable insights is key to making security tools actually usable.

What's next for AstraSec AI

  • Version Control System (VCS) Integrations
    Extend support beyond GitHub to platforms like GitLab and other VCS providers for broader adoption and seamless workflow integration.

  • Expanded Ticketing Integrations
    Currently integrated with Jira, with plans to support additional platforms like Asana for more flexible issue tracking and team collaboration.

Built With

Share this project:

Updates

Submission history