PatchForge AI

Main page before adding the API key
Main page after adding the API key
Giving the prompt to develop and watching our developer agent working on it
after developing our 2nd agent finding bugs and vulnerblities in the code
after finding the bug our 3rd agent patching the code .2nd and 3rd agent in loop for fixing the code fully
github agent merging the code
the bot here is ready to answer if you have any specific question about security issues and explanation
same we can give our code too to fix issues and github link to it will fetch and our agents will check it issues
the diffrence between the orignal code and patched code shown by coloured lines
the summary of bugs and security issues it find and ready to merge on github
the proof of concept that attacker can attack by this exploit code

Inspiration

With the massive rise of AI-assisted coding (tools like Copilot, Cursor, and ChatGPT), developers are generating code faster than ever. However, AI generators write code to be functional, not necessarily secure. They frequently output code containing security holes like SQL Injection, Command Injection, path traversals, or hardcoded secrets.

We built PatchForge AI to solve this. Our inspiration was to create a fully autonomous, multi-agent SecOps pipeline that acts as a secure buffer. PatchForge automatically inspects, exploits, secure-patches, and submits pull requests for AI-generated or developer-pasted code before it ever makes its way to a production codebase.

What it does

** PatchForge AI ** is an autonomous multi-agent security pipeline that chains 4 distinct Gemini-powered AI agents sequentially to take code from vulnerable to secure:

** AI Developer Agent **: Takes a user prompt and writes the initial codebase.
** CyberSec Auditor Agent *: Scans the code, flags vulnerabilities (CWE/OWASP), maps them to compliance standards, and writes an * "Explain Like I'm the Attacker" Proof-of-Concept (PoC) ** payload to show exactly how the vulnerability would be abused.
** Auto-Patcher Agent **: Securely refactors the source code, fixes the compiler issues, and runs it through a sandboxed compiler self-correction loop.
** Git Automator Agent **: Creates a secure staging branch, commits the fix, and opens a mock Pull Request summarizing the security upgrades.

Key Features:

Labs & Custom Audit Modes: Generate code from scratch or paste your own custom Python/JS/Go scripts to audit them.
Proactive Security Memory: Tracks security vulnerabilities caught during a session. If a developer repeatedly writes code with Command Injection, the Auditor Agent injects memory guidelines into the prompt rules to proactively guide the Developer Agent against repeating mistakes.
Visual Pull Request & Diff Viewer: Compare original and secure patches side-by-side.
Interactive Security Chat: Ask our Gemini security assistant questions directly about scanned findings.
Stitch Ethereal UI: A gorgeous Obsidian dark-mode dashboard styled with custom HSL glassmorphism panels, soft-glowing status alerts, audio synthesis feedback, and a dynamic SVG Security Score Gauge.

How we built it

We built PatchForge AI using a dual-engine architecture:

The Web App: A high-performance dashboard built using React 19 + TypeScript + Vite. We crafted a custom, borderless CSS design system (the "No-Line Rule") mapping out multiple nesting depths (#131313 background, HSL violet and cyan accents).
The AI Orchestration: Orchestrated directly in the browser by fetching structured JSON responses (responseMimeType: 'application/json') from Gemini 2.5 Flash.
The CLI Tool: A standalone Python CLI (agent_cli/) that allows developers to run audits directly in their local terminal, perform syntax checks via standard language linters (e.g., py_compile), and commit patches to Git.

Challenges we ran into

Structured JSON Formatting: Parsing code outputs from LLMs inside JSON can easily break if the model uses bad escape control characters (like \n or \"). We solved this by forcing Gemini's application/json structured output configuration and implementing custom unescaped string handlers.
Simulation vs. Live Execution: Coordinating smooth agent timelines for both preloaded demo scenarios and live API calls required designing a robust state-transition engine that coordinates logs dynamically.
Sequential Context Hand-offs: Transferring data between agents (e.g., ensuring the Patcher Agent knows exactly what vulnerabilities the Auditor Agent flagged) required building custom JSON prompt templates that carry structured context downstream.

Accomplishments that we're proud of

Zero-Error Build & Lint: Achieved absolute code and visual reliability, compiling cleanly with zero TypeScript compiler errors and zero ESLint warnings.
Proactive Security Memory Loop: Creating a system where agents actively learn from the developer's session history to adjust defensive validation prompt rules dynamically.
Attacker Exploit simulator: Making security warnings tangible by rendering a real curl command or code snippet demonstrating how the code could be hacked.
Stunning Design Aesthetics: Creating a dark-void theme that feels premium, highly interactive, and visually stands out from generic hackathon projects.

What we learned

Structured LLM Generation: We learned the power of configuring strict JSON output schemas on Gemini to build reliable agent pipelines.
Agentic Coordination: We discovered how to handle error boundaries for multi-agent workflows, ensuring that if one agent fails (e.g., a sandbox compile check fails), the system can loop back to self-correct rather than crashing.
Defensive Prompt Engineering: We realized that feeding negative context (what bugs not to write) is just as critical as feeding positive requirements to code generation models.

What's next for PatchForge AI

CI/CD Integration: Creating a official GitHub Action that runs the PatchForge audit on every commit, blocking merges if critical vulnerabilities are found.
Dynamic Sandboxed Execution: Transitioning from static syntax checks to spinning up actual Docker micro-containers to execute test suites against security patches.
Multi-File Repositories: Expanding the agent pipeline to analyze entire multi-directory codebases and map dependency graphs.