PatchGhost

Zero-days aren't the biggest risk, the weeks taken to patch them are. PatchGhost is a zero-touch slack agent that cuts remediation to seconds by autonomously opening AI-analyzed patch PRs.

Comment

Inspiration

Every year, billions of dollars in damages stem from a single, frustrating pattern: a critical zero-day vulnerability drops, and it takes organizations weeks to patch it. When Log4Shell hit in December 2021, security teams around the world scrambled for days just to find which of their services were affected — let alone fix them. The industry's Mean-Time-To-Remediation (MTTR) for critical CVEs averages over 60 days.

We asked ourselves: What if the patch was already written and submitted for review before the security team even finished their morning coffee?

That question became PatchGhost — an autonomous agent that doesn't just alert you about vulnerabilities, but actively hunts, analyzes, and patches them in real-time, all from within Slack.

What it does

PatchGhost is a Level-6 autonomous DevSecOps agent that lives entirely inside your Slack workspace. It performs four critical functions with zero human intervention:

Continuous Ecosystem Scanning — A background daemon monitors the OSV.dev vulnerability database and cross-references findings against your live repository manifests (requirements.txt, package.json, go.mod) fetched in real-time via MCP.

Slack-Native Rich Alerts — When a vulnerability is found, PatchGhost delivers interactive Block Kit alerts directly into your security channel — complete with severity badges, advisory counts, and one-click actions.

AI-Powered Threat Intelligence — Integrated with Google Gemini 2.5 Flash, the agent generates contextual threat analyses explaining the attack vector, blast radius, and recommended remediation strategy. You can even ask follow-up questions in natural language via Slack DMs.

Zero-Touch Autonomous Patching — Using the Model Context Protocol (MCP), PatchGhost connects to the official GitHub MCP Server, creates a security branch, rewrites the vulnerable dependency, and opens a Pull Request — all autonomously and in seconds.

The system also supports cross-account patching via a fork-and-pull workflow, allowing any authenticated user to trigger auto-patches against the central repository without needing direct write access.

How we built it

The architecture is a tightly integrated pipeline of four components:

Core Agent (Python + Slack Bolt) The heart of PatchGhost is a Python application using the Slack Bolt SDK. It registers slash commands (/zero-day-scan, /toggle-agent, /sentinel-help), handles interactive Block Kit actions (creating Jira tickets, asking Gemini questions), and manages a background daemon thread that runs proactive scans on a 30-second cycle.

MCP Integration (Model Context Protocol) Rather than hardcoding REST calls to GitHub, we used the official MCP Python SDK to spin up a native stdio subprocess communicating with the @modelcontextprotocol/server-github server. This gives us secure, sandboxed access to GitHub tools: get_file_contents, create_branch, push_files, and create_pull_request. The MCP architecture means our agent speaks the same protocol that any AI assistant uses, making it trivially extensible to new tool servers.

AI Brain (Google Gemini 2.5 Flash) We integrated Gemini via the google-genai SDK to provide two capabilities: (1) automatic threat analysis summaries embedded in Slack alerts, and (2) an interactive Q&A mode where team members can ask natural-language questions about specific vulnerabilities directly in Slack DMs.

Infrastructure (Docker + Google Cloud Run) The entire system is containerized in a multi-runtime Docker image (Python 3.11 + Node.js 20) and deployed to Google Cloud Run. The Node.js runtime is required because the GitHub MCP Server is a TypeScript package. Cloud Run provides automatic scaling, HTTPS, and zero-ops maintenance.

Enterprise Dashboard (React + Vite) A companion web dashboard built with React and Vite provides a real-time security score, dependency inventory, and vulnerability timeline. It's served as static assets from the same Flask backend, keeping the entire system in a single deployable unit.

Challenges we ran into

The MCP push_files Silent Failure The most insidious bug we encountered: the GitHub MCP Server's push_files tool silently throws a 404 Not Found error if the target branch doesn't already exist. There's no helpful error message — just a generic ExceptionGroup from Python's asyncio TaskGroup. We spent hours adding traceback instrumentation before discovering we needed to explicitly call create_branch before push_files. This is undocumented behavior.

Cloud Run Environment Poisoning On Google Cloud Run, calling os.environ.copy() to pass environment variables to the MCP subprocess injected dozens of internal GCP variables that corrupted the Node.js stdio transport. The MCP server would silently hang. We fixed this by manually constructing a minimal environment dictionary with only GITHUB_PERSONAL_ACCESS_TOKEN, PATH, and npm_config_yes.

MCP Response Double-Wrapping The GitHub MCP Server returns get_file_contents results as a JSON string inside the MCP TextContent wrapper. So result.content[0].text is itself a JSON string like {"content": "..."} that must be parsed again via json.loads(). This caused our dependency parser to silently return empty results until we added the second parsing layer.

Deduplication of Slack Alerts Without deduplication, the 30-second scan loop would flood the Slack channel with identical alerts every cycle. We implemented an in-memory alerted_vuln_ids set keyed on the GitHub Security Advisory ID (GHSA) to ensure each vulnerability is only alerted once per container lifecycle.

Accomplishments that we're proud of

True autonomy: PatchGhost goes from vulnerability detection to a merged-ready PR in under 60 seconds with zero human intervention Cross-account forking: Any authenticated GitHub user can trigger auto-patches — the agent dynamically forks, pushes, and opens a PR back to the central repo Multi-ecosystem coverage: Simultaneously scans PyPI, npm, and Go dependencies in a single sweep Production-grade deployment: Fully containerized and deployed on Google Cloud Run with automatic scaling What we learned The Model Context Protocol is incredibly powerful for giving agents secure, sandboxed tool access — but the ecosystem is young, and edge cases (like the push_files branch requirement) are poorly documented. We effectively became MCP debuggers. Building a truly autonomous agent is fundamentally different from building a chatbot. The hardest part isn't the AI — it's the error handling, retry logic, and graceful degradation needed when your agent operates without human supervision. Slack's Block Kit is remarkably flexible for building rich, interactive security workflows. We were able to embed threat analyses, action buttons, and deep links into a single message payload. What's next for PatchGhost SAST Integration: Expand the MCP toolkit so PatchGhost can run static analysis on custom application code, detect logical vulnerabilities, and rewrite insecure functions autonomously Multi-Repo Orchestration: Scale from a single repository to an entire GitHub organization, scanning hundreds of repos in parallel Slack AI Agents Framework: Migrate to the official Slack AI Agents SDK to unlock native assistant-mode conversations and richer context management Real-Time Search API: Integrate Slack's RTS API to let security teams search historical vulnerability alerts and remediation actions across channels

Built With

Share this project:

Updates