CODEGUARDIAN

What inspired us

Anyone who has ever done a late-night hackathon sprint knows the feeling: you need to push code fast, but moving fast usually means breaking things. Manual code reviews just take too long when you're racing against the clock. We built "CodeGuardian" because we were tired of the tradeoff between speed and security. We wanted a safety net—an AI-driven tool that could look at our code, tell us exactly what our changes were going to break, and catch vulnerabilities before they ever reached production so we could ship fearlessly.

How we built it

We designed CodeGuardian to sit quietly in the background of your Git workflow and jump in when needed: The Brains: We used Python and wired up a multi-agent LLM system. Instead of just searching for basic keywords, it actually understands the context and semantics of the code diffs. The Memory: We hooked up PostgreSQL and Supabase to keep track of commit histories and log vulnerability trends over time. The Impact Mapper: We built a way to read the Abstract Syntax Tree (AST) so the tool can trace exactly how a change in one file affects dependencies in another.

The challenges we faced

Token Overload: You can't just dump an entire codebase into an AI prompt—you'll hit token limits instantly and it gets slow. We had to build a smart chunking system to isolate only the changed code and its direct dependencies. 2.Calculating the "Blast Radius": Figuring out how one function change ripples through a giant repo is mathematically heavy. If you look at files as nodes ($V$) and their dependencies as edges ($E$), a simple check runs at $O(V + E)$. But doing AI evaluations on all of that scales terribly, pushing closer to $O(V^2)$ in the worst cases. We solved this by caching the parts of the code that hadn't changed, only sending the actually modified sub-graphs to the AI.
Dodging "Alert Fatigue":Developers hate tools that cry wolf over every little formatting change. We spent a lot of time tweaking our AI prompts so CodeGuardian only flags actual threats and breaking changes, not harmless style edits.

What we learned

Webhooks & CI/CD: We got our hands dirty figuring out how to intercept webhook payloads and inject our tool seamlessly into the continuous integration pipeline. AI Agents in Practice:There's a big difference between a standard chatbot and a deterministic AI agent. We learned how to force LLMs to do specific, structured coding tasks without hallucinating. Graph Optimization: We figured out how to map dependencies quickly so that CodeGuardian actually saves time instead of acting like a roadblock in the build process.

What's next

We want to turn CodeGuardian from a tool that just finds problems into one that fixes them. The next step is adding auto-remediation to generate instant patches for the bugs it finds. We're also planning a lightweight IDE extension so you can see the blast radius of your code before you even hit commit.