RepoAI-OS

RepoAI OS links to any repository and provides evidence-based responses, including architecture mapping, security scanning, Git change-impact analysis, and code search with file/line citations.

Comment

Inspiration

Understanding an unfamiliar codebase is slow and risky. Whether it is a legacy project, an open-source repository, or code written months ago, developers spend valuable time tracing dependencies, locating business logic, and estimating the impact of small changes. Most AI coding tools can explain code, but their answers are often difficult to verify.

RepoAI OS was built to make repository understanding evidence-based. Every insight should be traceable back to the source code, with files and line references — not generated from assumptions.

What it does

RepoAI OS connects to a local repository or public GitHub project and creates an engineering-intelligence layer for it.

  • Evidence-backed code search with file and line references
  • Automatic architecture mapping for languages, imports, functions, endpoints, and tests
  • Git change-impact analysis to identify affected files, endpoints, and tests before merging
  • Rule-based security scanning for exposed secrets, injection risks, unsafe dynamic execution, JWT issues, and floating dependencies
  • Auto-generated repository overview, architecture, API, and test-intelligence documentation
  • Optional OpenAI-grounded Q&A restricted to retrieved code excerpts, with confidence scoring
  • An MCP server that lets other AI agents search and investigate repositories through scoped tools

How we built it

RepoAI OS uses a Node.js backend to parse source files, build searchable code chunks, extract repository structure, and connect tests to the source they cover. Git diff data powers change-impact analysis across working-tree, commit-history, and remote changes.

Security findings are generated through deterministic local rules rather than an LLM, keeping scans repeatable and auditable. The optional OpenAI Responses API integration answers questions only from retrieved repository excerpts and falls back to local evidence when AI is unavailable.

GitHub OAuth and MongoDB support authenticated, persistent use cases, while local JSON storage keeps the project usable in a simple local-first setup. The same repository capabilities are exposed through a stdio MCP server with scoped, expiring access tokens.

Challenges we ran into

  • Enforcing grounded AI responses so answers stay within retrieved evidence instead of producing plausible but unsupported explanations
  • Tuning local security rules to provide useful findings without overwhelming users with false positives
  • Handling Git change-impact edge cases across renamed files, partial commits, working-tree changes, and remote history
  • Preserving a useful no-API-key, local-first experience while making optional AI features available

What we learned

AI-assisted developer tools become far more trustworthy when the evidence layer comes first. Building repository search, structure analysis, and security checks before adding an LLM makes every answer easier to verify — and gives developers useful insight even without sending code to an external AI service.

Built With

Share this project:

Updates