RepairBox

An autonomous agent safety engineer that senses agent failures via Arize Phoenix, synthesizes safe patches, replays comparisons, and gates deployments with before/after evidence.

Comment

Inspiration

Production AI agents fail silently. A customer support bot might issue an unauthorized refund, hallucinate cancellation policies, escalate privileges, or disclose PII in its responses. The only evidence of these failures is buried in thousands of trace logs.

We built RepairBox to close the loop on agent safety. Instead of manually inspecting log traces or waiting for support tickets, we wanted to create an autonomous forensic safety engineer that automatically detects failures, builds regression evals, synthesizes targeted patches, and gates deployment with before-and-after evidence.

What it does

Given a failed agent trace from Arize Phoenix, RepairBox autonomously:

Senses: Ingests failed traces at runtime via the Phoenix MCP server. Analyzes: Explores spans and classifies the root cause of the failure using deterministic rules combined with Gemini reasoning. Generates: Synthesizes a regression evaluation case containing assertion checks and forbidden tools directly from the failure context. Patches: Generates a targeted fix (such as tool preconditions, access policy controls, or output filters). Replays: Runs both the baseline and patched agents side-by-side using real Gemini function calling. Gates: Evaluates the results, computes a safety score, and gates deployment until approved by a human developer. Self-improves: Analyzes its own telemetry and past runs to generate global safety policies.

How we built it

RepairBox is built as a complete Python-based pipeline integrated with Google Cloud and Arize Phoenix: Primary Sensing: We configure the @arizeai/phoenix-mcp server as a tool for the agent, enabling runtime introspection of traces and evaluations. Agent Architecture: Built using the Google ADK (Agent Development Kit) to declare tools and agent system instructions, making the pipeline fully Agent Builder-ready. Observability: Every run and replay is instrumented with OpenInference and OpenTelemetry, exporting telemetry back to Arize Phoenix. Safety Gating Metric: We compute a safety patch confidence score $ S_c $ to ensure the proposed patch actually fixes the vulnerability without breaking other functions: Sc =α⋅Adeterm +(1−α)⋅R gemini where $ A_{\text{determ}} $ is the ratio of passed deterministic assertions, $ R_{\text{gemini}} $ is the Gemini-judged compliance score, and $ \alpha \in [0, 1] $ represents the weighting coefficient (defaulting to $ 0.6 $).

A patch is recommended for deployment only if the delta improvement $ \Delta S $ over the baseline is greater than or equal to a gating threshold $ \tau $: ΔS=Sc −Sbaseline ≥τ

Challenges we ran into

Offline vs. Online Portability: Making the system work reliably offline using trace fixtures for testing and evaluation, while supporting seamless live MCP and REST API calls when connected. Generalizing Patch Rules: Avoiding overfitting. A patch designed to solve a single refund failure must not accidentally break normal order flows. We solved this by using multi-turn agent replay sandboxes. Multi-Category Normalization: Mapping trace data across 4 distinct categories (Unsafe Refund, Hallucinated Policy, Privilege Escalation, and Data Leakage) into a single unified TraceCase model.

Accomplishments that we're proud of

Full MCP Integration: Sensing production trace failures dynamically via an MCP tool rather than static file inputs. Robust Test Coverage: Writing 19 end-to-end passing tests covering every failure category from detection to scoring and patch synthesis. Self-Improvement Loop: Implementing the "Arize track bonus" by having the agent read its own logs of past repairs to synthesize global global_policy.json rules. Interactive Incident Console: Designing a UI Pro Max developer web interface to compare baseline and patched behaviors with side-by-side evidence visualization.

What we learned

Observability is for Agents Too: Observability data isn't just for humans. Giving an LLM agent structured access to its own trace logs and evaluations via MCP allows it to diagnose and repair issues with high accuracy. The Detect-Eval-Patch-Gate Pattern is Universal: Regardless of whether a failure is a PII leak or a privilege escalation, the lifecycle of resolving it remains identical.

What's next for RepairBox

Broaden Category Coverage: Add support for detecting instruction-following drift, agent loops, and prompt injection attempts. Slack & CI/CD Integration: Send one-click deployment approval buttons to Slack channels when a patch achieves $ S_c \ge 0.95 $. Multi-Agent Monitoring: Allow RepairBox to continuously listen to multiple production agents simultaneously, acting as a unified guardrail.

Built With

  • cloud-build
  • cloud-scheduler
  • containerization:
  • css-frameworks-&-libraries:-fastapi
  • docker
  • github-actions-observability-&-eval:-arize-phoenix
  • google-adk-(agent-development-kit)-platforms-&-cloud-services:-google-cloud-run
  • google-genai-sdk
  • html
  • javascript
  • jinja
  • languages:-python
  • openinference
  • opentelemetry
  • phoenix-mcp
  • pydantic
  • secret-manager
  • vertex-ai
Share this project:

Updates