Inspiration
Every team has the same problem: someone joins a project, or picks up an unfamiliar repo, and the fastest way to get an answer isn't grep or the README, it's asking a senior engineer to explain it out loud. That costs days of someone's time. On top of that, most "ask your codebase" tools either hallucinate answers or quietly leak secrets into an LLM prompt because redaction is treated as an access-control afterthought instead of a structural guarantee.
I wanted a Slack bot that could answer real questions about any public GitHub repo, cite actual code instead of hallucinating, pull in what the team had already discussed about that code in Slack, and make it architecturally impossible for a secret to reach the model: not policy-enforced, structurally enforced.
What it does
Run /ctx connect https://github.com/owner/repo in Slack and within about 30 seconds you can ask plain-English questions like "what does the auth flow do" or "which files should I read first," and get citation-backed answers pulled from real code, plus any relevant Slack tribal knowledge your team has already posted about that part of the codebase.
Secrets (API keys, DB connection strings, JWT tokens, AWS credentials) are detected and stripped at ingestion time, before anything is stored and before any LLM call. Connecting the ContextOS repo indexed 128 files and redacted 16 secrets in under 30 seconds, with answers arriving in under 3 seconds.
There's also Tour Mode (/ctx tour): an instant plain-English onboarding walkthrough of a connected repo, covering what it does, the major components, the 2-3 files to read first, and non-obvious gotchas, generated from the same secret-redacted pipeline in about 15 seconds instead of the 1-3 days it normally takes a senior engineer to walk someone through it.
How I built it
- Slack Bolt (Python, Socket Mode): no public URL required, fast local dev
- ContextOS MCP: an open-source codebase-intelligence library I built separately; ContextBot spawns its MCP server (
contextos serve --stdio <repo_path>) per call and invokespack_contextto select the most relevant, already-redacted files for a question, ranked by keyword match and import centrality - Slack Real-Time Search API (
client.search_messages()) to pull in relevant team discussion alongside the code context - Slack AI / thread summarization: when @mentioned inside a thread, ContextBot summarizes the thread with Groq before reasoning, so it answers with full conversational context
- Groq llama-3.3-70b-versatile for fast (~1.5s) inference
- SQLite for a per-workspace repo registry, active-repo selection, and audit log
- Docker + Render Background Worker for an always-on, auto-deploying $7/month deployment
Multi-repo support means each Slack workspace keeps its own repo registry, switchable with /ctx use <name>, with no state shared across workspaces.
Challenges I ran into
Making secret redaction a structural guarantee rather than a permission check meant redaction had to happen at ingestion, before storage and before any model call, not bolted on afterward. Getting concurrency right was its own problem: per-workspace locking was needed so one long-running index job in one workspace never blocks Q&A in a different workspace, while still preventing a second concurrent connect in the same workspace from racing the first.
I also wanted every failure mode to produce a specific, human-readable Slack message instead of a stack trace or a silent hang. Invalid URLs, non-GitHub URLs, private/nonexistent repos, clone timeouts, and duplicate concurrent connects all needed distinct, clear responses.
Accomplishments that I'm proud of
Fusing three separate challenge technologies, MCP, Slack's Real-Time Search API, and Slack AI thread summarization, into a single /ctx ask request that combines code context and team knowledge into one synthesized answer in about 3 seconds. And doing it with secrets that are structurally incapable of reaching the LLM or a vector store, not just permissioned against it.
What I learned
That the hardest part of a "codebase Q&A" product isn't the LLM call, it's everything around it: ingestion-time safety guarantees, per-workspace concurrency, and turning failure paths into something a non-technical Slack user can actually understand. The MCP server model made composing ContextOS (a separate project) into ContextBot far cleaner than I expected: treat context-selection as its own service instead of baking it into the bot.
What's next for ContextBot
Private repo support with proper auth, a richer App Home surface, and exploring the "Slack Agent for Good" framing further. Tour Mode's onboarding use case is aimed squarely at bootcamp grads and open-source contributors who don't have a mentor available to walk them through an unfamiliar codebase.
Log in or sign up for Devpost to join the conversation.