Inspiration Security teams today are overwhelmed. Vulnerabilities pile up in repositories, logs flood SIEMs, and incidents take hours to correlate manually. I wanted to build something that collapses the entire security operations cycle — prevention, detection, and response — into a single autonomous pipeline.
What it does SecOps Agent scans any GitLab repository and produces a full incident report in under 20 seconds. It detects hardcoded secrets, vulnerable dependencies, and CI/CD misconfigurations (GitLab MCP), ingests findings into Elasticsearch and builds a MITRE ATT&CK kill chain from correlated events (Elastic MCP), then correlates runtime anomalies with the kill chain (Dynatrace MCP). The final report includes an executive summary, full attack timeline, and a prioritized remediation playbook — downloadable in Markdown and JSON.
How I built it FastAPI backend with Server-Sent Events for real-time streaming, orchestrating three MCP integrations sequentially. Gemini 3 via Google Cloud Agent Builder drives the intelligence layer. Deployed on Google Cloud Run.
Challenges Correlating three MCP integrations into a coherent narrative — not just parallel tool calls — required careful orchestration. Making Elastic the true intelligence layer (kill chain correlation, risk scoring) rather than just a log store was the core technical challenge.
What I learned How to build real agentic pipelines where each phase feeds the next, and how Elastic's ECS schema enables meaningful cross-source correlation at speed.
Log in or sign up for Devpost to join the conversation.