Inspiration Engineering teams get review signal from five different places — linters, scanners, CI, PR comments — and none of them agree on what matters most. We wanted one workflow that reads all of that evidence and tells you what to fix first, and why.
What it does CodeBuster is an AI-powered code review and engineering health dashboard for GitHub repos. It runs a multi-dimensional scan — security, dependencies, code quality, performance, IaC, accessibility, dead code, duplicate code — backed by CodeQL, SonarQube, Semgrep, and TruffleHog. An OpenAI-powered reasoning pass then reads the combined findings and produces a repository health score, a prioritized issue list, plain-language explanations of impact, and concrete suggested fixes. From there, a Fix Sprint flow can turn a finding directly into a GitHub branch and pull request.
How we built it Flask + SQLAlchemy + Celery/Redis on the backend, with each analyzer running as an independent stage so a scan degrades gracefully if one tool is unavailable. The AI layer calls the OpenAI API to prioritize findings, generate an executive summary, and draft fix suggestions — findings are cached by a SHA-256 content hash so re-scanning unchanged code doesn't re-spend API calls. The provider layer is abstracted so other models can be swapped in, and the app still works with an honest rule-based fallback if no API key is set. The frontend is React 18 + Vite, with Recharts for health trends and dedicated views for review history, fix checklists, and job monitoring.
Challenges we ran into Normalizing output from a dozen different tools — some external, some homegrown — into one schema the AI layer could reason over consistently was the hardest part; a bad or inconsistent input made the AI summary useless no matter how good the prompt was. We also had to build real failure handling around the OpenAI calls (rate limits, auth errors, timeouts) so a flaky API response degrades to a clear status instead of a silent failure. Generating auto-fixes safely across ten-plus languages, without ever hardcoding a secret into a suggested diff, took more care than expected.
Accomplishments that we're proud of A full pipeline — GitHub auth, multi-tool analysis, OpenAI-backed reasoning, one-click fix PRs — working end to end, not just as a demo script. And the product is still genuinely usable with zero API key configured, thanks to the fallback path.
What we learned The bottleneck in "AI code review" isn't the model call — it's building an evidence pipeline clean enough that the model has something worth reasoning over. Garbage findings in means a garbage summary out, regardless of model quality.
What's next for CodeBuster Multi-turn "explain and fix" conversations in the issue drawer instead of one-shot suggestions, a fuller autonomous Fix Sprint that batches related fixes into a single PR, and AI-explained health-score trends across an org's full repo list.
Log in or sign up for Devpost to join the conversation.