VCAIST

Inspiration

With the rise of vibe-coders and AI-based businesses, Many people own or depend on software they did not build or understand. VCAIST addressed this to give non-technical app owners a plain-English, visual way to understand their software, identify risks, and make informed decisions while keeping humans in control.

What it does

VCAIST connects to a local project folder or public GitHub repository and turns the application into an understandable control room. The platform:

• Summarizes the application’s purpose, users, and features.
• Detects routes and state-driven screens in a page carousel.
• Compares two applications side by side.
• Maps navigation to approved source files.
• Generates project-specific entity relationship diagrams.
• Runs business, security, and system-design safety checks.
• Provides a permission-based AI Change Assistant with Original and Proposed previews.
• Protects ignored files, environment variables, and secrets from inspection.
• Each user signs in and works within an isolated browser session, preventing access to other users’ imported projects.

How we built it

We used GPT-5.6-sol ultracode with Codex to translate requirements into code, doing debugs, and rendering problems, building test cases, improve security, and prepare deployments.

We built VCAIST with Next.js, React, TypeScript, Clerk authentication, and Vercel. The analysis pipeline detects frameworks, routes, UI states, source relationships, assets, schemas, and application data types without executing arbitrary imported builds. Static applications run inside a network-isolated sandbox, while framework applications receive source-backed visual reconstructions.

Challenges we ran into

The greatest challenge, because I also used codex, was supporting highly varied project structures without treating every application as the original financial demo. Applications may use static HTML, Next.js routes, client-side tabs, imported components, local images, downloadable files, or interactive JavaScript. We also had to reconstruct useful interfaces without executing untrusted production builds. Other challenges included safely handling ignored files, preserving images and downloads, preventing source-code fragments from appearing in previews, separating users’ sessions, supporting multiple AI providers, and generating ERDs that reflect the selected project rather than a generic template.

Accomplishments that we're proud of

We are proud that VCAIST has become a publicly deployed, authenticated platform rather than only a visual prototype. It now includes:

• Project-specific overviews and user stories.
• Multi-page and state-driven screen detection.
• Interactive, isolated application previews.
• Side-by-side application comparison.
• Consent-first AI change planning.
• Source-backed App Maps and read-only code inspection.
• Dynamic ERDs derived from application schemas and types.
• Severity-ranked business, security, and architecture findings.
• Privacy safeguards that exclude secrets before analysis.
• A production build backed by 38 automated regression tests.

What we learned

The most important thing I learned was the use of AI, that is, the more detailed the project description, the better, the resulting product will be, and that it is possible to make that without needing many iterations.

What's next for VCAIST

Next, we plan to make the platform able to retrieve source files from clouds or google drive. We also want the AI model to generate better responses, possibly using RAG.

Built With

• codex
• css
• node.js
• npm
• react
• typescript
• vercel