Inspiration

Code slowdowns hide in harmless-looking commits. A commit called "simplify order loading" can quietly make a page 30x slower, and nobody notices until a user complains. Finding the guilty commit means running git bisect by hand. Fixing it often means trusting a guess. And most "AI debugging" tools give you an answer with no proof. We wanted a tool that shows its evidence at every step.

What it does

You give Culprit a repo and a benchmark command. Then it:

  1. Finds the commit. It searches the git history, timing each candidate in a fresh sandbox, until it finds the exact commit where the benchmark got slower.
  2. Explains why. It profiles the code before and after, then asks NVIDIA Nemotron 3 Ultra for the root cause. The model must cite exact lines, and we check every cited line against the real diff. Tavily web search backs up the finding.
  3. Fixes it. Ultra proposes an edit, which we turn into a real patch.
  4. Proves it. The benchmark runs again on the patched code. A fix is "verified" only if that re-run really came back fast enough.
  5. Locks it in. Ultra writes a small regression test that counts calls instead of measuring time. We keep it only if it fails on the slow commit and passes with the fix. Everything streams live to a dashboard: every git call, sandbox run and model request, with raw responses one click away. You can export a PR-ready write-up and a real .patch file.

How we built it

  • Backend: Python, FastAPI, SQLite. Dashboard: Next.js 16, React 19, Tailwind 4.
  • Two Nemotron models, used on purpose. Nemotron 3 Nano makes the frequent, simple decisions (is this commit slow or fine, which files look most suspicious, does this patch look like cheating). Nemotron 3 Ultra does the hard reasoning (diagnosis, fix, regression test).
  • We don't trust the model blindly. Nano's verdicts are double-checked with plain math. If they disagree, the math wins and the dashboard shows the override.
  • Designed for Nebius Token Factory (model calls and VM-isolated sandboxes), with Tavily for grounding. Low-relevance search results are dropped rather than cited.
  • Offline mode runs the full pipeline on real git history and real benchmarks, with clearly labeled stand-ins for the AI models, so anyone can try it without keys.

Challenges we ran into

I could not get Nebius access. Token Factory needs a payment card to activate an account, and I'm a college student without one. I asked the Nebius team on the hackathon Discord, and they said the card requirement applies to everyone and can't be verified by hand. So the Nebius-specific code (Token Factory endpoint, sandboxes) is written from the public docs and tested with mocked HTTP, but never run live. My hosted demo calls the same Nemotron models through NVIDIA's own API and runs benchmarks in a local sandbox. I say this clearly in the README. Other challenges: keeping benchmark timings fair (every run needs a fresh environment), stopping "fixes" that cheat the benchmark, and a bug we found in our own live demo where one stray citation line made a correct diagnosis get downgraded. We fixed it so that unchanged context lines are dropped, while invented lines still fail the check.

Accomplishments that we're proud of

  • A fix is only ever called "verified" if a real re-run passed. This is enforced in code, not just promised.
  • Every claim is checkable: cited lines are verified, benchmark numbers come only from real runs, and every model request and raw response is visible.
  • Our math check caught a real mistake in a live run: Nano called a commit that was only about 1% slower "regressed", and the arithmetic overruled it.
  • A large automated test suite that runs on real git repos and real sandbox processes.

What we learned

Models are bad at writing diffs by hand, so we have them return exact text edits and build the diff in code. Splitting work between a small and a large model keeps things fast. A strict honesty check is only useful if it's not so strict that it rejects correct answers, and we learned that from our own live demo. And an honest "unresolved" is better than a fix that looks good but was never proven.

What's next for Culprit

Run it on Nebius Token Factory once we have access, confirm the model IDs and sandbox behavior, test it on more real open-source regressions, and support languages beyond Python.

Built With

Share this project:

Updates

Submission history