dephyr

Dephyr

An autonomous dependency security and migration agent that detects vulnerable dependency usage, analyzes affected code, performs the migration, adapts breaking API changes, and verifies the result through CI/CD before creating a Pull Request.

Overview

Modern software projects rely heavily on third-party dependencies. When a vulnerability is discovered in one of those dependencies, identifying the vulnerable package is only the beginning of the problem.

Security and development teams still have to determine:

Which repositories are actually affected?
Is the vulnerable functionality even being used?
Where is it being used?
Does upgrading the dependency introduce breaking API changes?
What source code needs to be modified?
Do the changes still build and pass tests?
What happens when the first attempted migration breaks CI?

This process is often manual, repetitive, and time-consuming.

Dephyr approaches dependency security as an autonomous engineering problem rather than just a vulnerability-scanning problem.

It combines AI agents, AST-based static analysis, dependency intelligence, GitHub automation, and CI/CD feedback to create a closed-loop remediation system.

How Dephyr Works

                 ┌──────────────────────┐
                 │   CVE / Vulnerability │
                 │       Detected        │
                 └──────────┬───────────┘
                            │
                            ▼
                 ┌──────────────────────┐
                 │   AI Agent Investigates│
                 │   Affected Repos      │
                 └──────────┬───────────┘
                            │
                            ▼
                 ┌──────────────────────┐
                 │    Rust Analysis     │
                 │  Tree-sitter + AST   │
                 └──────────┬───────────┘
                            │
                            ▼
             ┌──────────────────────────────┐
             │ Find vulnerable dependency   │
             │ Find imports / API usage     │
             │ Locate affected call sites   │
             │ Detect external-input usage  │
             └──────────────┬───────────────┘
                            │
                            ▼
                 ┌──────────────────────┐
                 │   Agent Plans Fix    │
                 └──────────┬───────────┘
                            │
                            ▼
                 ┌──────────────────────┐
                 │ Dependency Migration │
                 │ + Code Modification  │
                 └──────────┬───────────┘
                            │
                            ▼
                 ┌──────────────────────┐
                 │      GitHub CI/CD    │
                 └──────────┬───────────┘
                            │
                  ┌─────────┴─────────┐
                  ▼                   ▼
                PASS                 FAIL
                  │                   │
                  ▼                   ▼
           Verified Fix        Agent reads CI logs
                  │                   │
                  │                   ▼
                  │             Analyze + Patch
                  │                   │
                  └──────────┬────────┘
                             ▼
                     ┌───────────────┐
                     │   GitHub PR    │
                     └───────────────┘

What Makes Dephyr Different?

Traditional vulnerability scanners primarily answer:

"Which dependencies are vulnerable?"

Dephyr aims to answer the much more useful question:

"Where is the vulnerable functionality being used, how does it affect the application, and can we safely remediate it automatically?"

Instead of stopping at an alert, Dephyr continues through the entire remediation lifecycle.

1. Dependency Awareness

Dephyr identifies vulnerable dependencies within authorized repositories and determines which projects are potentially affected.

2. AST-Based Code Analysis

The Rust analysis engine uses Tree-sitter to parse source code and inspect its structure.

Rather than relying purely on text matching, it can identify things such as:

Dependency imports
Vulnerable functions or APIs
Function call sites
Relevant source locations
Basic evidence of external input reaching vulnerable functionality

This gives the agent structured evidence about what the application is actually doing.

3. Autonomous Migration

Once the agent determines that remediation is necessary, it can migrate the dependency to a patched version and modify affected application code when the dependency's API has changed.

For example:

Old dependency
      │
      ▼
 vulnerable_api(data)
      │
      │ migration
      ▼
 patched dependency
      │
      ▼
 new_api(data, options)

The system can use the code-analysis results to locate affected call sites and adapt them as part of the migration.

4. CI/CD as a Feedback Loop

Dephyr does not assume that its first patch is correct.

After creating the changes, the repository's CI pipeline becomes a verification mechanism.

Patch
  ↓
CI
  ↓
┌───────────────┐
│ Build / Tests  │
└───────┬───────┘
        │
    ┌───┴───┐
    ▼       ▼
  PASS     FAIL
    │       │
    │       ▼
    │   Analyze logs
    │       │
    │       ▼
    │    Patch again
    │       │
    │       └──────► CI
    │
    ▼
Verified

When CI fails, Dephyr can inspect the failure, reason about the required change, modify the code, and run the validation cycle again.

This creates an autonomous feedback loop rather than a one-shot code generator.

System Architecture

Dephyr is composed of four primary components:

🧠 AI Agent

The agent acts as the decision-making layer.

It is responsible for:

Planning investigations
Interpreting static-analysis results
Selecting remediation strategies
Reasoning about API migrations
Interpreting CI failures
Deciding when another iteration is required
🐍 Backend

The backend acts as the orchestration and integration layer.

It connects the agent to:

GitHub
CVE / vulnerability data
Git repositories
CI/CD
The Rust analysis engine
The frontend
🦀 Rust Analysis Engine

The Rust engine is the code-analysis layer.

It provides high-performance source-code analysis using:

Tree-sitter
AST/CST traversal
Repository scanning
Import detection
Function-call analysis
Structured analysis results

It returns evidence to the agent instead of making the final remediation decision itself.

⚛️ Frontend

The frontend provides a security-center style interface where users can see:

Repository status
Vulnerability findings
Code-analysis evidence
Agent activity
Dependency migrations
CI/CD results
Pull Request status
Remediation progress