Security Fleet Coordinator

Inspiration: Modern software engineering teams are overwhelmed by automated Software Composition Analysis (SCA) alerts. Security dashboards continuously flag vulnerabilities in project dependencies, yet over 70% of these alerts represent dead code or unreachable execution paths. Engineers waste countless hours manually inspecting import trees, bumping version pins, and validating regressions. We built Security Fleet Coordinator to bridge this operational gap: an autonomous, multi-agent remediation fleet that moves beyond static alerts to dynamically verify vulnerability reachability, safely apply patched dependencies, execute test suites, and orchestrate zero-day containment playbooks.

Security Fleet Coordinator automates the entire vulnerability triage and remediation lifecycle through specialized agent orchestration:

AST-Based Reachability Analysis: Parses Python Abstract Syntax Trees (AST) across repositories to verify whether a vulnerable dependency is actively imported in the source code, filtering out false positives.
Intelligent Package Alias Resolution: Automatically bridges discrepancies between distribution package names and runtime module namespaces (e.g., resolving pillow to PIL, pyyaml to yaml, and beautifulsoup4 to bs4).
Safe Multi-File Dependency Patching: Accurately upgrades package pins across requirement manifests while creating timestamped backups (.backup.*) prior to disk writes to ensure full rollback capabilities.
Automated Regression Verification: Executes local test runners (pytest, unittest) immediately after patching to verify that updated packages introduce no breaking changes.
Zero-Day Containment Escalation: If an alert targets an unpatched zero-day, the system bypasses patching and generates isolation protocols, network-level firewall filtering, and emergency incident response playbooks.

Framework: Built with the Google Agent Development Kit (ADK) using a multi-agent hierarchy consisting of a Root Coordinator, Triage Agent, Patch Agent, and Escalation Agent.
Reasoning Engine: Powered by Gemini 3.5 Flash, enabling low-latency multi-step reasoning, contextual routing, and code synthesis across our agent fleet.
Core Engine: Implemented pure Python static analysis utilities leveraging standard library ast, os, and re modules for secure file manipulation and AST traversal.
Containerization & CI/CD: Packaged into a lightweight multi-stage Dockerfile and configured with a Google Cloud Build (cloudbuild.yaml) pipeline for deployment onto Google Cloud Run.

Import Namespace Discrepancies: Standard string matching frequently misidentifies third-party libraries because PyPI package names often diverge from import statements. Building a robust alias resolver combined with AST node visitation (Import, ImportFrom) resolved these edge cases.
Multi-Agent Rate Limiting: Complex multi-turn autonomous interactions rapidly consumed free-tier API quotas. We addressed this by streamlining agent instructions, optimizing tool schemas, and integrating Google Cloud Vertex AI infrastructure.
Safe State Management: Ensuring that automated file updates never corrupted repository manifests required implementing strict timestamped backups and post-patch validation hooks.

Designed a working 4-agent fleet architecture with clean delegation between triage, patching, and escalation responsibilities.
Replaced brittle regex scanning with robust AST analysis, effectively eliminating false positive alert fatigue.
Built a production-grade deployment setup ready for enterprise cloud workloads on Google Cloud Run with automated CI/CD integration.

Best practices in architecting hierarchical agent swarms using the Google ADK.
How to leverage Gemini 3.5 Flash for high-precision code evaluation and tool orchestration without excessive latency.
Techniques for combining deterministic Python static analysis with probabilistic LLM reasoning to ensure safe, repeatable security workflows.

Multi-Language Expansion: Extending AST parsing support beyond Python to JavaScript/TypeScript (package.json), Go (go.mod), and Rust (Cargo.toml).
Automated Pull Request Workflows: Integrating directly with GitHub and GitLab APIs to create automated remediation branches and draft Pull Requests with attached regression test logs.
Semantic Function-Level Reachability: Enhancing the AST engine to verify not just module imports, but whether vulnerable individual functions or methods are actively invoked in application call graphs.