QUERY_ RESULTS

Dephyr

Dephyr An autonomous dependency security and migration agent that detects vulnerable dependency usage, analyzes affected code, performs the migration, adapts breaking API changes, and verifies the result through CI/CD before creating a Pull Request. Overview Modern software projects rely heavily on third-party dependencies. When a vulnerability is discovered in one of those dependencies, identifying the vulnerable package is only the beginning of the problem. Security and development teams still have to determine: Which repositories are actually affected? Is the vulnerable functionality even being used? Where is it being used? Does upgrading the dependency introduce breaking API changes? What source code needs to be modified? Do the changes still build and pass tests? What happens when the first attempted migration breaks CI? This process is often manual, repetitive, and time-consuming. Dephyr approaches dependency security as an autonomous engineering problem rather than just a vulnerability-scanning problem. It combines AI agents, AST-based static analysis, dependency intelligence, GitHub automation, and CI/CD feedback to create a closed-loop remediation system. How Dephyr Works   ┌──────────────────────┐ │ CVE / Vulnerability │ │ Detected │ └──────────┬───────────┘ │ ▼ ┌──────────────────────┐ │ AI Agent Investigates│ │ Affected Repos │ └──────────┬───────────┘ │ ▼ ┌──────────────────────┐ │ Rust Analysis │ │ Tree-sitter + AST │ └──────────┬───────────┘ │ ▼ ┌──────────────────────────────┐ │ Find vulnerable dependency │ │ Find imports / API usage │ │ Locate affected call sites │ │ Detect external-input usage │ └──────────────┬───────────────┘ │ ▼ ┌──────────────────────┐ │ Agent Plans Fix │ └──────────┬───────────┘ │ ▼ ┌──────────────────────┐ │ Dependency Migration │ │ + Code Modification │ └──────────┬───────────┘ │ ▼ ┌──────────────────────┐ │ GitHub CI/CD │ └──────────┬───────────┘ │ ┌─────────┴─────────┐ ▼ ▼ PASS FAIL │ │ ▼ ▼ Verified Fix Agent reads CI logs │ │ │ ▼ │ Analyze + Patch │ │ └──────────┬────────┘ ▼ ┌───────────────┐ │ GitHub PR │ └───────────────┘   What Makes Dephyr Different? Traditional vulnerability scanners primarily answer: "Which dependencies are vulnerable?" Dephyr aims to answer the much more useful question: "Where is the vulnerable functionality being used, how does it affect the application, and can we safely remediate it automatically?" Instead of stopping at an alert, Dephyr continues through the entire remediation lifecycle. 1. Dependency Awareness Dephyr identifies vulnerable dependencies within authorized repositories and determines which projects are potentially affected. 2. AST-Based Code Analysis The Rust analysis engine uses Tree-sitter to parse source code and inspect its structure. Rather than relying purely on text matching, it can identify things such as: Dependency imports Vulnerable functions or APIs Function call sites Relevant source locations Basic evidence of external input reaching vulnerable functionality This gives the agent structured evidence about what the application is actually doing. 3. Autonomous Migration Once the agent determines that remediation is necessary, it can migrate the dependency to a patched version and modify affected application code when the dependency's API has changed. For example:   Old dependency │ ▼ vulnerable_api(data) │ │ migration ▼ patched dependency │ ▼ new_api(data, options)   The system can use the code-analysis results to locate affected call sites and adapt them as part of the migration. 4. CI/CD as a Feedback Loop Dephyr does not assume that its first patch is correct. After creating the changes, the repository's CI pipeline becomes a verification mechanism.   Patch ↓ CI ↓ ┌───────────────┐ │ Build / Tests │ └───────┬───────┘ │ ┌───┴───┐ ▼ ▼ PASS FAIL │ │ │ ▼ │ Analyze logs │ │ │ ▼ │ Patch again │ │ │ └──────► CI │ ▼ Verified   When CI fails, Dephyr can inspect the failure, reason about the required change, modify the code, and run the validation cycle again. This creates an autonomous feedback loop rather than a one-shot code generator. System Architecture Dephyr is composed of four primary components: 🧠 AI Agent The agent acts as the decision-making layer. It is responsible for: Planning investigations Interpreting static-analysis results Selecting remediation strategies Reasoning about API migrations Interpreting CI failures Deciding when another iteration is required 🐍 Backend The backend acts as the orchestration and integration layer. It connects the agent to: GitHub CVE / vulnerability data Git repositories CI/CD The Rust analysis engine The frontend 🦀 Rust Analysis Engine The Rust engine is the code-analysis layer. It provides high-performance source-code analysis using: Tree-sitter AST/CST traversal Repository scanning Import detection Function-call analysis Structured analysis results It returns evidence to the agent instead of making the final remediation decision itself. ⚛️ Frontend The frontend provides a security-center style interface where users can see: Repository status Vulnerability findings Code-analysis evidence Agent activity Dependency migrations CI/CD results Pull Request status Remediation progress

gitguard_anbu

🛡️ GitGuard — Autonomous Multi-Agent GitHub Security & Quality Guardrails 💡 Project Overview GitGuard is an autonomous, multi-agent developer security platform that protects software repositories from leaked secrets, OWASP vulnerabilities, subtle logic defects, and performance regressions. Operating as a native GitHub App, GitGuard inspects every git push and Pull Request with sub-second parallel AI agents, providing automated consensus arbitration and 1-Click Git remediation. 🔌 Seamless Native GitHub App Integration GitGuard installs directly into any personal account or enterprise organization with a single click. It connects to GitHub's event bus via webhooks to automatically monitor pushes, manage commit statuses, and post line-by-line Check Run annotations without interrupting local developer workflows. 📊 Continuous Multi-Agent Repository Health Dashboard Every repository monitored by GitGuard receives a dynamic 30-day health scorecard and composite score (0–100, Pristine A+). Development leads can track pull request pass rates, prevented credentials, security blockers, and individual agent performance trends at a glance. ⚙️ Autonomous Policy Enforcement & Multi-Agent Debate Mode Teams have granular control over how and when guardrails trigger. GitGuard features a groundbreaking Multi-Agent Debate Mode: when specialized agents disagree on severity, an automated cross-examination round evaluates real-world exploitability to eliminate false positives before posting blocking verdicts. 🎛️ Customizable Agent Pipeline & Severity Merge Gates Engineering leaders can customize which agents are mandatory versus optional for their organization: SecretAgent: Zero-tolerance credential interception (OpenAI keys, AWS secrets, GitHub PATs). BugAgent: AST-aware analysis catching unhandled null dereferences and race conditions. SecurityAgent: OWASP Top 10 SAST engine scanning SQLi, SSRF, and command injections. CommitAgent: Enforces Conventional Commits standards and semantic versioning. SEOAgent & HealthAgent: Audits Core Web Vitals and computes repo health rubrics. Teams can configure blocking thresholds (e.g., block only on HIGH/CRITICAL) and set minimum health scores required to pass pull requests. ⚡ Live Commit Stream & 1-Click Auto-Solve Remediation GitGuard doesn't just block broken code—it fixes it. When a vulnerability or bug is detected, the 1-Click Auto-Solve Engine generates the minimal required patch, commits the remediation directly to a new branch, and opens an auto-remediation PR on GitHub, marked with an Auto-Solved badge in the audit ledger. 🏗️ Technical Architecture Multi-Agent Orchestration: LangGraph state graph coordinating parallel specialist agents with consensus arbitration. Ultra-Fast LLM Inference: Groq LPU (openai/gpt-oss-120b, qwen-2.5-coder-32b) delivering sub-second analysis, backed by Google Gemini 1.5 Flash fallback. Zero-Token Fast Path: Clean commits bypass LLMs deterministically, saving API costs and slashing queue latency. Distributed Queue & Ingestion: Next.js 14 App Router, BullMQ, and Upstash Redis for resilient background webhook processing. Persistence & Real-Time Sync: Google Firebase Admin & Firestore for immutable audit logs, team policies, and health rubrics. Instant Alerts: Automated Slack webhook notifications and Nodemailer security dispatches. 🏆 Why GitGuard Stands Out Traditional CI scanners are slow, noisy, and burden developers with manual remediation tickets. GitGuard replaces reactive scanning with an autonomous, proactive shield that catches vulnerabilities at commit time, arbitrates consensus through multi-agent debate, and fixes the code automatically.