SiteMedic AI

Autonomous website audit & repair agent that diagnoses real defects, generates minimal patches with NVIDIA Nemotron via Nebius, and validates fixes in an automated review loop.

Comment

Inspiration

Most website audit and SEO tools operate like static reporting dashboards: they run a crawler, dump a list of 50+ warnings on the screen, and leave developers to manually locate source files, diagnose causes, craft code fixes, and pray that nothing breaks layout or accessibility.

We asked: What if a website auditor worked like an autonomous doctor? An agent that doesn't just list symptoms, but diagnoses the root cause, prescribes minimal code patches using open-source models, tests them in an isolated feedback loop, and lets engineers visually inspect and export the verified repair before anything touches production.

What it does

SiteMedic AI is an autonomous website audit and repair agent built for the Nebius × NVIDIA Global AI Hackathon:

  • Evidence-Backed Auditing: Audits public URLs (with rigorous SSRF protections) or uploaded project ZIP files across WCAG Accessibility (WCAG 2.1 A/AA), SEO metadata, heading hierarchy, viewport/HTML doctype quirks, color contrast heuristics, and broken internal links.
  • AI Repair Lab: Inspects verified defect evidence and dispatches surgical repair contexts to NVIDIA Nemotron (nvidia/Nemotron-3.5-Super) hosted on Nebius Token Factory.
  • Bounded 7-Stage Agentic Workflow: Executes Inspect → Diagnose → Plan → Patch → Validate → Revise → Report.
  • Automated Validation Loop: Automatically verifies patched HTML structure, re-runs rule audits, and re-prompts the model up to 2 iterations if checks fail.
  • Diff Review & Production Export: Displays a syntax-highlighted side-by-side diff with added/removed lines, potential side effects, and verification plans—allowing one-click export of unified .diff patches or corrected source files.
  • Zero-Config Demo Mode: Includes a documented sample website with intentional defects that runs immediately without requiring an API key.

How we built it

  • AI Inference Cloud: Nebius Token Factory OpenAI-compatible endpoint (https://api.tokenfactory.nebius.com/v1/).
  • AI Model: NVIDIA Nemotron (nvidia/Nemotron-3.5-Super with nvidia/Nemotron-3-Lightning fallback).
  • Frontend & Server Architecture: Next.js 15 (App Router, Server-side API routes, React 19, TypeScript).
  • Styling: Tailwind CSS v4, Lucide icons, dark charcoal/cyan aesthetic inspired by Linear and Vercel.
  • Deterministic Scanner Engine: Cheerio-based AST HTML parsing with mathematical health scoring: $Score = 100 - (15 \times \text{critical}) - (8 \times \text{high}) - (3 \times \text{medium}) - (1 \times \text{low})$.
  • Security Engineering:
    • DNS resolution checking to block SSRF attempts targeting RFC 1918 private IPs, AWS/GCP cloud metadata (169.254.169.254), and sensitive service ports.
    • ZIP bomb prevention, archive size limits (50MB / 200MB decompressed), and path traversal protection (../).
    • Zero host code execution: all files are audited passively as text.
  • Verification: Vitest suite with 28 automated tests passing.

Challenges we ran into

  1. Minimizing Model Hallucinations in Code Repairs: Language models often attempt to rewrite entire HTML documents or hallucinate replacement URLs and decorative image alt text. We constrained Nemotron using a strict Zod JSON schema and instructed it to emit only minimal unified diffs and flag unverified assumptions.
  2. Safe Verification Loop: Ensuring the repair agent can validate its own fixes without running arbitrary scripts on the host server. We built a structural AST validation check and integrated the scanner's own audit rules directly into the verification stage.
  3. SSRF Hardening: Public URL scanners are prime targets for Server-Side Request Forgery. We implemented multi-layer IP resolution validation against IPv4/IPv6 private ranges before allowing any outbound crawl.

Accomplishments that we're proud of

  • Delivering a real, working agent rather than a mockup or chat wrapper.
  • Seamless dual-mode operation: runs completely offline in demo mode without credentials, and automatically unlocks deep reasoning with NVIDIA Nemotron when a Nebius key is configured.
  • Clean Next.js 15 build with 15 compiled routes and 28/28 automated unit tests passing.

What we learned

  • NVIDIA Nemotron’s structured reasoning capabilities excel at pinpointing root causes and generating surgical diffs when provided with tightly bounded context.
  • Nebius Token Factory offers an ultra-fast, OpenAI-compatible infrastructure that made integrating open-weights models seamless.

What's next for SiteMedic AI

  • Pull Request (PR) automation: Direct integration with GitHub/GitLab to create fix branches and pull requests automatically.
  • Headless browser visual regression testing with Puppeteer / Playwright to capture pixel-perfect before/after screenshot diffs.
  • Continuous website monitoring with scheduled cron audits.

Built With

Share this project:

Updates

Submission history