Inspiration
AI agents can now write code, open issues, trigger workflows, and prepare payment or release actions. For Web3 teams, a small repository change can create real financial risk: unsafe approvals, missing access checks, weak tests, bad release notes, or payment-flow mistakes.
Web3 Repo Risk Review Agent is built to help teams catch those risks before they ship.
What it does
The agent reviews GitLab project context and produces an actionable Web3 risk review. It can summarize repository or merge-request risk, flag smart-contract and payment-safety issues, suggest missing tests, and turn findings into clear release guidance for developers.
The goal is not to replace a formal audit. The goal is to give builders a fast AI-assisted review layer before code reaches production.
How I built it
The planned implementation uses Gemini and Google Cloud Agent Builder for agent reasoning, with a partner MCP integration for project context. The first track target is GitLab because repository, issue, and merge-request context maps naturally to developer security workflows.
The Web3-specific risk model is based on prior work around AI-agent payment safety, smart-contract QA, and security contest triage.
Challenges
The main challenge is making the agent useful instead of noisy. A good security agent should not only say "this might be risky"; it should explain why, point to the affected workflow, and suggest the next concrete action.
What is next
Next steps are to connect a live GitLab MCP runtime once endpoint eligibility is available, add authenticated read-only merge request context ingestion, and expand the Web3 risk rules with more repository scenarios and regression tests.
Log in or sign up for Devpost to join the conversation.