CodeGuard

An AI-powered agentic security tool that automates code reviews and security audits directly within your GitLab merge requests

Comment

Inspiration

Modern development teams face a brutal trade-off: speed or security. Human code reviews are slow, expensive, and prone to oversight, while traditional static analysis tools (SAST) dump hundreds of useless false positives. We built CodeGuard to eliminate this friction. Our vision was to create an autonomous, elite AI Security Engineer that embeds directly into your CI/CD pipeline, executing deep architectural audits and code safety checks in seconds, not hours.

What it does

CodeGuard intercepts code updates within your development lifecycle to perform production-grade security audits automatically. It analyzes changes, extracts context, and coordinates specialized AI agents to flag vulnerabilities, evaluate architectural compliance, and generate precise code fixes. The system compiles these insights into a definitive assessment, calculating an automated grading index based on a weighted average of localized agent vulnerabilities:

$$\text{Risk Score} = \frac{\sum_{i=1}^{n} w_i \cdot v_i}{\sum_{i=1}^{n} w_i}$$

The final review is then posted directly as a clear, actionable comment on your repository management platform.

How we built it

CodeGuard is engineered from the ground up as a resilient, high-throughput full-stack platform optimized for real-world production codebases.

  • Autonomous Multi-Agent Orchestration: The core engine orchestrates a specialized network of AI agents utilizing custom Python workflows to parallelize vulnerability scanning, logical flow analysis, and strict compliance checking.
  • The High-Availability Fallback Matrix: To guarantee 100% system uptime, we designed an automated, multi-tiered LLM routing mechanism. If one provider hits a rate limit or drops, the system instantly hot-swaps through our deterministic fallback pipeline:

$$\text{Pipeline Flow: } \mathcal{S}_1 (\text{OpenRouter}) \longrightarrow \mathcal{S}_2 (\text{Gemini Direct}) \longrightarrow \mathcal{S}_3 (\text{Groq})$$

The operational state $P(\text{success})$ for any incoming code audit payload is maximized by ensuring that each fallback stage triggers within $t < 1.5\text{s}$ upon detecting a non-200 HTTP response status code.

  • Architecture & Stack: Powered by a high-performance FastAPI backend for asynchronous request handling paired with a premium, lightning-fast React.js (Vite) dark-mode dashboard tailored for elite developer UX.

Challenges we ran into

  • The Invisible Log Deficit: One of our biggest technical hurdles was diagnosing silent payload drops and tracking down deep-nested runtime errors during heavy multi-agent execution. We overcame this by re-architecting the application logging infrastructure, implementing an explicit dictConfig layout in FastAPI to force granular, live streaming data at the DEBUG level for absolute transparency.
  • Dynamic Authentication: Shifting from rigid server-side environments to a completely decentralized, client-driven configuration setup required a clean overhaul of our state logic to ensure reliable request building.

Accomplishments that we're proud of

  • Zero-Downtime Resilience: Successfully implementing a robust API fallback chain that gracefully handles rate limits and API drops across multiple global providers without breaking user execution.
  • SaaS-Ready Architecture: Shifting configuration logic entirely to a secure, client-driven injection model. By safely passing authorization tokens via custom HTTP request headers and browser localStorage, CodeGuard operates as a highly scalable, plug-and-play tool that respects zero-trust security compliance.

What we learned

We learned the importance of structural error isolation when working with agentic workflows. Relying on simple, unchained LLM calls introduces significant variance into code review environments. Building deterministic validation layers and explicit fallback states taught us how to anchor autonomous AI systems to production-grade reliability standards.

What's next for CodeGuard

The future of CodeGuard is centered around deeper integration and proactive security patches. We plan to expand support beyond standard REST communication to native webhook listeners for enterprise-grade deployment. Additionally, we aim to introduce automated commit generation, enabling CodeGuard to not only detect vulnerabilities but automatically push safe refactored patches directly back to your staging branches.

Built With

Share this project:

Updates