VendorGuard AI

🏆 UiPath Hackathon Judging Matrix Alignment

This project has been deliberately architected to maximize score potential across all official evaluation metrics:

• Business Impact: Automates a mandatory, high-friction compliance task, compressing review times from 2-4 hours to under 2 seconds.
• Platform Usage: Deep deployment of UiPath Maestro Case, API Workflows, Robot actions, and Agentic Human-in-the-Loop configurations.
• Coding Agents Bonus: Built explicitly through collaborative interactions with Claude Code under the UiPath for Coding Agents framework.

💡 Inspiration

Enterprise procurement and IT compliance teams are universally bottlenecked by the mandatory third-party vendor vetting process. Whether maintaining compliance for SOC2, ISO 27001, HIPAA, or PCI-DSS, an analyst must manually dig through vendor websites, audit trust portals, verify SSL expirations, and look up breach histories.

For an organization onboarding 50 vendors a quarter, this burns 100 to 200 hours of highly paid analyst time ($8,000 to $16,000 lost quarterly). We designed VendorGuard AI to completely automate this pipeline using parallel AI agents, feeding the structured outcomes straight into a robust state machine driven by UiPath Maestro Case.

⚙️ Architecture & How It Works

VendorGuard AI splits vendor discovery and risk management into a unified orchestrator pattern:

1. UiPath Maestro Case (Intake): A user submits a vendor onboarding request. The request automatically instantiates a new Case case and triggers an API Workflow call to our backend.
2. FastAPI Gateway (localhost:8000): Captures the payload and fires two decoupled LangGraph agents in parallel.
3. Agent A (SaaS Auditor): Uses a LangGraph ReAct loop to scrape public documentation, capturing compliance certs (SOC2 Type II, ISO27001, FedRAMP, GDPR, HIPAA) and mapping cloud infrastructure hosting regions.
4. Agent B (Threat Intelligence): Interrogates breached database caches, maps bug bounty exposure on platforms like HackerOne/Bugcrowd, evaluates WHOIS domain age risk, and conducts live SSL/TLS handshakes.
5. Risk Scoring Evaluator: Merges both agent score contributions into a clean 1-100 security_score.
6. Maestro Routing Engine:
   • Score ≥ 70 & No Critical Flag: Auto-Approved. A UiPath Robot seamlessly transitions the stage and syncs the vendor approval payload directly into the enterprise ERP procurement module.
   • Score < 70 OR Security Exception: Human Review. Maestro freezes the case, tracks a strict 48-hour SLA, and routes a task directly to a human security analyst with the full AI-generated report embedded inside the form.

🛠️ How We Built It

• Backend Core: Python 3.14 + FastAPI 0.138 + Pydantic v2.
• AI Layer: LangGraph 1.x utilizing non-deprecated graph execution models (langgraph.prebuilt.create_react_agent) backed by Groq's high-speed inference engine (llama-3.3-70b-versatile).
• CLI Engine: An interactive, terminal-safe ANSI visualization dashboard (evaluate_vendor.py) with clean ASCII formatting for immediate developer/judge review without server initialization.
• UiPath Schema: A comprehensive maestro_case_workflow.json completely mapping the 5 lifecycle stages, data schemas, human action forms, and notification rules.
• Bulletproof Testing: 9/9 robust automated tests validating mock environments, validation boundaries, and risk triggers to guarantee a zero-friction judge demo environment.

🚧 Challenges We Ran Into

• LangChain 1.x Breaking Changes: Midway through, we had to refactor the entire engine away from the legacy, deprecated AgentExecutor pattern. Migrating to LangGraph required a complete overhaul of our message state manipulation and graph loop orchestration.
• Terminal Environment Clashes: Standard Unicode badges threw nasty UnicodeEncodeError flags on localized Windows terminal encodings (cp1255). We refactored our visualization outputs into beautifully structured, pure-ASCII visual elements to guarantee compatibility on any machine.
• Review False-Positives: Initial string filtering flagged strings like "No breach history found" as active risks. We hardened the classification boundaries to rely directly on structured tool schemas and strict "CRITICAL" prefixes.

🚀 Accomplishments That We're Proud Of

• Running a stateless, production-ready, typed FastAPI service that completely passes its test matrix on Python 3.14.
• Orchestrating full Human-in-the-Loop boundaries where the AI acts as a smart filter rather than a loose cannon, adhering to strict enterprise governance.
• 100% Co-Authored by Claude Code: Leveraging natural language co-development to design, debug, and ship a complex multi-agent architecture from scratch.

🔮 What's Next for VendorGuard AI

• Q3 2026: Integrating live BreachDirectory and HaveIBeenPwned API streams, alongside automated PDF compliance archive compilation.
• Q4 2026: Implementing scheduled recurring vendor re-assessments directly via Maestro time-triggers, multi-vendor batch CSV processing, and active Slack escalation integrations.

Built With

• claude-code
• github
• groq
• langgraph
• python
• uipath-maestro