Inspiration
Code review is the bottleneck on every team. Reviewers spend hours on diffs and still miss real security bugs. Hardcoded secrets get merged. SQL formatting slips through. An unsafe eval() lands in production. I wanted to know: can a Gemini 3 agent catch the bugs humans miss most, automatically, with human approval before posting? MergeGuard is the answer.
What it does
Drop a GitLab merge request URL in, and the agent fetches the diff through GitLab's official MCP server, sends each file through Gemini 3.1 Pro on Vertex AI with a structured JSON schema, and posts findings ordered by severity — with explicit human approval before any write action.
How I built it
Platform-agnostic review engine in pure Python: diff parser, structured-output Gemini prompt, line-mapped findings. Google ADK root_agent in agents/gitlab_reviewer/agent.py wired to the GitLab MCP server. Same engine powers a CLI, GitHub Action, Slack bot, and GitHub App webhook.
Challenges I ran into
Vertex AI model naming — gemini-3.1-pro-preview only available in global location, not regional. GitHub push protection caught a .env.bak file before it hit the public repo.
Accomplishments I'm proud of
49 unit tests, CI green. Real reviews catching SQL injection and eval-based RCE with concrete fix suggestions. One core, five surfaces.
What I learned
Structured output with response_schema turns flaky text-parsing into a deterministic pipeline. MCP composes cleanly with ADK — zero glue code for tool dispatch.
What's next
Inline diff-hunk comments, GitHub PR parity, repo-level config via .mergeguard.yml.
Log in or sign up for Devpost to join the conversation.