DepShield

Your codebase's last line of defense.

Comment

Inspiration

Every developer has experienced that dreaded 2am production incident caused by a dependency nobody was watching. Tools like Snyk alert you about known CVEs but what about packages that are silently abandoned? No commits for 18 months, declining downloads, 47 open security issues with zero maintainer response. You find out when it breaks.

We built DepShield to close that gap. Not just detect risks, but automatically fix them.

What it does

DepShield is an AI-powered dependency intelligence agent that:

  • Scans any GitHub or GitLab repo - paste a URL, DepShield detects your ecosystem (Node.js, Python, Java, Go) and scans all dependencies in parallel
  • Detects both risk types - known CVEs via OSV.dev plus silent abandonment via commit activity, download trends, and maintainer signals
  • Scores every dependency - risk score (0-100) with AI-generated plain English explanation powered by Gemini on Vertex AI
  • Community Risk Intelligence - powered by Elastic, shows the most commonly risky packages across all scanned repos, co-risky package detection using significant terms aggregation, and full-text search across scan history
  • Autonomous migration agent - Google Cloud Agent Builder analyzes each high-risk package using our MCP server to query Elastic for community patterns, then decides whether migration is needed
  • Auto-creates PRs - for packages needing migration, the agent creates a GitHub PR or GitLab MR with the correct compatible version and AI-transformed source files, not just manifest updates

How we built it

  • Gemini 2.5 Flash on Vertex AI - risk explanation generation, alternative suggestion with community context, and intelligent code transformation during PR creation
  • Google Cloud Agent Builder (Reasoning Engine) - autonomous multi-step agent that queries Elastic, searches the web, fetches migration docs, and decides migration strategy before creating PRs
  • Elastic - three indices powering community intelligence: package risk cache, migration signals, and repo scan history. Features used: nested aggregations for co-risky package detection, significant terms for community patterns, full-text search across scan history, and time-series risk trending
  • Custom MCP Server - deployed on Cloudflare Workers, exposes tools to the agent: query_elastic, search_scan_history, get_risk_leaderboard, find_co_risky_packages, create_github_pr, create_gitlab_mr, transform_file, and index_alternative
  • Cloudflare Workers plus Queues - parallel chunk-based scanning pipeline, KV for real-time progress, D1 for persistent results
  • Next.js plus Tailwind - real-time dashboard with risk scores, CVE details, community intelligence, agent analysis, and PR status
  • OSV.dev plus npm Registry plus GitHub API plus PyPI plus Maven Central - raw data sources for CVE data, package health, and commit activity

Challenges we ran into

  • Elastic nested aggregations - top_risky_packages as a nested type required careful query construction for co-risky package detection using significant terms
  • Gemini code transformation accuracy - getting the AI to correctly transform callback-based request code to async/await axios patterns without breaking existing logic
  • Google Cloud Agent Builder deployment - ADK version incompatibilities with Reasoning Engine caused repeated deployment failures, requiring careful version pinning and pickle serialization debugging
  • Cloudflare KV eventual consistency - parallel chunk processing with KV as the coordination layer caused race conditions in progress tracking, solved by switching to chunk key existence checking instead of atomic counters
  • OSV batch API limitations - the querybatch endpoint only returns vulnerability IDs without descriptions, requiring a second round of parallel fetches to get full CVE details
  • GitHub code search limitations - code search only indexes the default branch and has strict rate limits, solved by switching to the git tree API for file enumeration

What we learned

  • Elastic nested aggregations and significant terms are genuinely powerful for discovering co-occurrence patterns in community data, something no simple key-value store can do
  • Google Cloud Agent Builder makes multi-step agent orchestration significantly easier than manual tool chaining, but the deployment pipeline is sensitive to library versions
  • The gap between alerting and fixing is where real value lives. Most tools stop at detection. Automated code transformation that actually works is hard but worth it
  • Cloudflare Workers edge runtime is powerful for this use case but requires rethinking state management since there is no shared memory between worker instances

What's next for DepShield

  • Full end-to-end migration support for Python, Go, and Java ecosystems with ecosystem-specific code transformation
  • PR review agent that automatically checks migration PRs for correctness before suggesting merge
  • Slack and Discord integration for proactive weekly dependency health reports
  • Elastic semantic search using ELSER for finding similar vulnerability patterns across different package names
  • GitHub App integration to replace PAT-based authentication for better security and UX

Built With

Share this project:

Updates