CodeGuardianAI

Autonomous multi-agent AI code review & DevSecOps platform.

---

What is CodeGuardian?

CodeGuardian is an autonomous AI-driven code review platform that acts as a tireless first line of defense for your codebase. It listens for GitHub Pull Request events and immediately orchestrates a team of specialized AI agents to review the incoming code changes.

Instead of relying on a single AI prompt, CodeGuardian deploys a Security Agent, Quality Agent, Test Gap Agent, and Documentation Agent to scrutinize the PR from different angles. It then aggregates, deduplicates, and scores their findings, posting a comprehensive and structured Markdown report directly back to GitHub in seconds.

The Real-World Problem It Solves

Modern software teams move incredibly fast, making thorough manual code reviews a major bottleneck.

• Reviewers are often pressed for time and suffer from "review fatigue."
• Critical security vulnerabilities, missing test coverages, or architectural anti-patterns easily slip through the cracks.
• Senior engineers spend hours nitpicking syntax and documentation rather than focusing on complex business logic and system design.

CodeGuardian solves this by automating the routine and rigorous aspects of code review. It catches OWASP vulnerabilities, enforces maintainability, highlights untested code paths, and ensures documentation is up-to-date before a human ever looks at the PR. This significantly accelerates the CI/CD pipeline, reduces human error, and frees up engineering time for high-impact work.

How It Was Made

CodeGuardian was built using a cutting-edge, AI-native technology stack designed for concurrency and deep context awareness:

• Orchestration (LangGraph): The core workflow is modeled as a LangGraph state machine. This allows the system to fan-out and run all four specialist AI agents concurrently (asyncio.gather), drastically reducing review times.
• LLM Engine (Groq & LangChain): It leverages Groq's ultra-fast inference API (running models like Llama 3) via LangChain to provide rapid reasoning and analysis of code diffs.
• Context Engine / RAG (ChromaDB & Gemini): To ensure reviews are project-specific, CodeGuardian uses a Retrieval-Augmented Generation (RAG) pipeline. It embeds the codebase and coding standards using Google Gemini embeddings and stores them in a ChromaDB vector database. When a PR arrives, relevant context is dynamically injected into the agents' prompts.
• Static Analysis Integration: It doesn't rely on AI alone. It integrates deterministic static analysis tools like Semgrep, Bandit, and Gitleaks to catch hardcoded secrets and known vulnerabilities, passing these findings to the LLM for contextual reasoning.
• Backend (FastAPI & Docker): The entire system is exposed via a high-performance FastAPI webhook receiver, fully containerized with Docker for simple deployment (e.g., to platforms like Render).

Architecture Diagram

flowchart TD
    GH[GitHub PR Event] -->|Webhook POST| API[FastAPI Backend]
    
    subgraph CodeGuardian LangGraph Pipeline
        API --> Fetch[Fetch PR Context]
        Fetch --> Index[Index Context in RAG]
        Index --> SupNode[Supervisor Node]
        
        %% Parallel Agent Execution
        SupNode -->|Fan-out| SA[Security Agent\n+ Semgrep/Bandit]
        SupNode -->|Fan-out| QA[Quality Agent]
        SupNode -->|Fan-out| TGA[Test Gap Agent]
        SupNode -->|Fan-out| DA[Documentation Agent]
        
        SA & QA & TGA & DA --> SupAgent[Supervisor Agent]
        
        SupAgent -->|Deduplicate & Score| Format[Format Report]
    end
    
    Format --> Comment[Post PR Comment]
    Comment -->|Markdown Report| GH
    
    subgraph RAG System
        DB[(ChromaDB Vector Store)]
        Index -.->|Store Code & Standards| DB
        SA & QA & TGA & DA -.->|Retrieve Context| DB
    end

Loading

Demo & Screenshots

CodeGuardian in Action

Features Preview

---

Quick Start

Prerequisites

Tool	Version
Python	3.12+
Docker & Docker Compose	v3.9+
Git	Any recent version
Groq API Key	https://console.groq.com
Google Gemini API Key	https://aistudio.google.com
GitHub PAT	repo scope required

1. Clone the Repository

git clone https://github.com/your-org/CodeGuardian.git
cd CodeGuardian/CodeGuardian_v2

2. Configure Environment Variables

cp backend/.env.example backend/.env

Open �ackend/.env and fill in your values:

# Required
GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
WEBHOOK_SECRET=your-random-secret-here
GROQ_API_KEY=gsk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
GEMINI_API_KEY=your-gemini-api-key

# Optional -- defaults shown
APP_ENV=development
LLM_MODEL_NAME=llama-3.1-8b-instant
RAG_ENABLE=true

Tip: Generate a secure webhook secret with:

python -c "import secrets; print(secrets.token_hex(32))"

3. Start with Docker Compose

docker-compose up --build

The API will be available at http://localhost:8000

4. Register GitHub Webhook

Development Tip: Use ngrok http 8000 to expose your local server to the internet and get a public URL for GitHub webhooks.

1. Go to your GitHub repo > Settings > Webhooks > Add webhook
2. Payload URL: https://your-domain.com/webhook/github (or your ngrok URL)
3. Content type: application/json
4. Secret: The value of WEBHOOK_SECRET in your .env
5. Events: Select Pull requests

---

Running Locally (Without Docker)

cd backend

# Create virtual environment
python -m venv venv
.\venv\Scripts\activate        # Windows
# source venv/bin/activate     # macOS/Linux

# Install dependencies
pip install -r requirements.txt

# Start the server
uvicorn app.main:app --reload --port 8000

---

Running Tests

cd backend

# Run all tests
pytest tests/ -v

# Run specific test module
pytest tests/test_agents.py -v
pytest tests/test_supervisor.py -v
pytest tests/test_rag.py -v

# Run with HTML report
pytest tests/ --html=report.html

---