Inspiration
In early 2026, my VPS was compromised. SSH keys were exposed through a misconfigured HTTP server, and API credentials were leaked before I even knew what happened.
The scariest part wasn't the breach itself — it was not knowing what to do next. Stop billing? Revoke keys? Check logs? As a solo developer, I had no playbook.
NekoGuard Agent was born from that experience.
What it does
NekoGuard Agent is an AI-powered incident response agent for non-expert developers who experience credential breaches.
When a breach occurs, it:
- Detects threats via screenshot analysis (Google Cloud alert emails, VPS logs) using Gemini Vision
- Assesses severity using the NeuroState engine (NORMAL / ALERT / EMERGENCY)
- Executes the CAT Protocol automatically:
- Containment: Restrict SSH access to personal IP only
- API Revocation: Immediately disable compromised API keys
- Triage: Generate incident report with damage assessment
How I built it
- Google Cloud Agent Builder for agent orchestration
- Gemini Vision for multimodal screenshot analysis
- Dynatrace MCP for real-time log monitoring
- NeuroState Engine for alert level determination
- Python for CAT Protocol execution on VPS
Challenges
- Designing a response flow that works for developers with no security background
- Balancing automation speed with safety (some actions are irreversible)
- Making the agent work externally so it survives even if the VPS itself is compromised
What I learned
The most important lesson: the first 5 minutes matter most. Stopping billing and revoking API keys before investigating prevents the majority of financial damage.
NekoGuard automates exactly those critical first steps.
Log in or sign up for Devpost to join the conversation.