CyberMesh

CyberMesh autonomously secures prompts, code, deployments, and runtime systems using coordinated AI agents, live threat intelligence, and Dynatrace-powered observability.

Comment

CyberMesh: Autonomous AI Security Mesh

Inspiration

In the modern cloud-native era, security teams are perpetually overwhelmed. The average enterprise deployment pipeline is bogged down by a fragmented array of static analyzers, manual code reviews, and disconnected threat intelligence feeds. We realized that while AI is being used to write code faster, the security infrastructure needed to protect that code hasn't kept pace. We were inspired to build CyberMesh, an autonomous, multi-agent AI security mesh that doesn't just passively scan for vulnerabilities, but actively orchestrates security across the entire lifecycle—from the moment a user submits a prompt, to the CI/CD pipeline, all the way to production runtime.

What it does

CyberMesh is a unified, real-time security command center powered by a swarm of specialized AI agents:

  • AI Gateway Agent: Acts as an intelligent firewall. It intercepts incoming LLM prompts in real-time, detecting prompt injections, jailbreak attempts, and actively sanitizing Personally Identifiable Information (PII) like emails and SSNs using Data Loss Prevention (DLP) before they ever reach an upstream model.
  • DevSecOps Agent: Performs deep, full-repository Abstract Syntax Tree (AST) analysis. Give it a public GitHub URL, and it concurrently traverses the entire source tree, passing the context into Gemini 1.5 Pro's massive context window to identify architectural vulnerabilities and emit AI-driven remediation steps.
  • Threat Intel Agent: Automatically extracts dependency graphs (package.json) from the repository and cross-references them live against the official OSV.dev database to identify active CVEs and zero-day exploits in the supply chain.
  • Runtime Agent: Listens to production telemetry via WebHooks (simulating infrastructure monitors like Dynatrace) to catch latency spikes, CPU anomalies, and memory leaks.
  • Nexus Orchestrator: The "brain" of the mesh. It aggregates data from all localized agents via WebSockets, calculates a real-time composite security score, and can autonomously BLOCK or PASS CI/CD deployments based on the holistic threat landscape.

How we built it

CyberMesh is built on a modern, decoupled monolithic architecture deployed on Render.

  • Frontend: Built with React, Vite, and TypeScript. We used Tailwind CSS for rapid styling, motion/react for fluid micro-animations, Recharts for live telemetry visualization, and reactflow to map the live neural graph of agent orchestration.
  • Backend: Powered by Node.js and Express, heavily utilizing Socket.io for bi-directional, real-time event broadcasting to the UI.
  • AI Integration: The core intelligence is driven by Google Gemini 1.5 Pro, utilizing its industry-leading 2-million token context window to perform holistic whole-repository analysis rather than fragmented file-by-file scans.
  • Resilience Engineering: To ensure production-grade reliability, we implemented an OpenRouter Cascade Fallback. If the native Gemini API fails or rate-limits, the system seamlessly routes the analysis through OpenRouter using gemini-2.0-flash-lite.
  • Database: We utilized Supabase (PostgreSQL) to persist historical CVE threats and track deployment verification pipelines.

Challenges we ran into

Building an autonomous mesh that operates in real-time came with significant technical hurdles:

  1. GitHub API Rate Limiting: Our initial DevSecOps agent fetched repository files sequentially, which was painfully slow and frequently triggered GitHub's unauthenticated rate limits. We solved this by implementing a highly concurrent Promise.all fetching mechanism hitting raw.githubusercontent.com directly, backed by token authentication.
  2. Context Window Management: Feeding an entire repository into an LLM is challenging. We had to carefully structure our prompts to ensure the AI didn't hallucinate and could precisely pinpoint file names and line numbers for vulnerabilities.
  3. UI State Synchronization: Because agents operate asynchronously, keeping the React dashboard perfectly in sync with the backend state was difficult. We implemented a robust WebSocket event system where "mock" placeholder data is instantly hydrated and replaced the moment a live anomaly or OSV.dev threat is detected.

Accomplishments that we're proud of

  • True Autonomy: Watching the Nexus Orchestrator autonomously block a simulated deployment because the Intel Agent found a live CVE in a dependency—without any human intervention—feels like magic.
  • The PII/DLP Filter: Successfully turning Gemini into an active Data Loss Prevention firewall that seamlessly redacts sensitive user data before it reaches external services.
  • Beautiful, Reactive UI: We achieved a deeply immersive, "Command Center" aesthetic that doesn't just look cool, but is entirely driven by live WebSocket data streams. The floating point math is stable, the animations are buttery smooth, and the data is actionable.

What we learned

  • Concurrent fetching is critical for AI applications. You cannot have users waiting minutes for sequential network requests before the LLM even begins thinking.
  • LLM Fallback Networks: Relying on a single API provider for a critical security tool is a single point of failure. Implementing our OpenRouter fallback cascade taught us how to design resilient AI microservices.
  • WebSockets over Polling: For a security dashboard, HTTP polling is too slow and resource-intensive. WebSockets are absolutely mandatory for real-time threat visualization.

What's next for CyberMesh

We envision CyberMesh evolving into a plug-and-play enterprise solution. The immediate next steps include:

  1. Private Repository Support: Implementing OAuth to allow the DevSecOps agent to scan private enterprise repositories.
  2. Auto-Remediation: Upgrading the DevSecOps agent to not just suggest fixes, but autonomously generate Pull Requests with the patched code.
  3. Custom Threat Matrices: Allowing organizations to upload custom compliance frameworks (SOC2, HIPAA) so the Nexus Orchestrator can base its deployment blocks on specific regulatory rules.

Built With

Share this project:

Updates