Inspiration
At Infobalt in Vilnius, AWS, Palo Alto, Microsoft, Splunk and Cisco described one shift: attackers use AI agents. You need agents to defend against agents.
What it does
Fortify scans GitHub pushes, attacks a disposable copy, and reports only reproducible issues. It groups duplicates, ranks fixes and gives each issue a copy-ready prompt.
How we built it
GitHub App, FastAPI, PostgreSQL, Redis and Next.js run in Docker. An AI agent plans; Gitleaks, Semgrep, Trivy, ZAP and custom probes provide evidence.
Challenges
Agent output was unreliable, scans strained a small host, and critical is easy while proven is hard. Schemas, batching and cleanup fixed this.
Accomplishments
We built push-to-proof end to end: seven proven issues, 62 findings cut to 21 fixes.
What we learned
Agents provide judgment, not truth; evidence and narrow scope matter.
What's next
Live threat intelligence and sandboxed fix PRs.
Built With
- agentic-ai
- ai-agents
- docker
- docker-compose
- fastapi
- github-app
- github-checks-api
- github-oauth
- github-webhooks
- gitleaks
- hermes-agent
- next.js
- owasp-zap
- postgresql
- python
- react
- redis
- rest-api
- semgrep
- sqlalchemy
- tailwind-css
- trivy
- typescript
- uvicorn
