Intelligent vulnerability detection and automated code remediation powered by AI
GuardAgent is a sophisticated security platform that combines static code analysis with AI-powered remediation to automatically detect and fix security vulnerabilities in Python code. It leverages a multi-agent architecture with enterprise-grade security controls to provide intelligent, context-aware vulnerability remediation with a self-healing validation loop.
✅ Automated Vulnerability Detection - Static AST analysis identifies common security issues
✅ AI-Powered Remediation - Google Gemini LLM generates secure code patches
✅ Self-Healing Loop - Iterative refinement with compilation validation (max 3 iterations)
✅ Real-Time Streaming - Live pipeline status and execution updates
✅ Interactive UI - Modern, skeuomorphic interface with visual security insights
✅ Comprehensive Logging - Detailed error tracking and refinement history
✅ 🔒 Enterprise Security - Built-in secret redaction, CORS protection, and secure error handling
┌─────────────────────────────────────────────────────────────────┐
│ FRONTEND (React + TypeScript) │
│ Interactive Code Editor & Visualization │
└──────────────────────────┬──────────────────────────────────────┘
│ HTTP Streaming (SSE)
↓
┌─────────────────────────────────────────────────────────────────┐
│ BACKEND (FastAPI + LangGraph) │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ AST Scan │───→│ LLM Patch │───→│ Validation │ │
│ │ & Analyze │ │ (Gemini) │ │ (Compiler) │ │
│ └──────────────┘ └──────────────┘ └────────┬─────┘ │
│ ↓ ↓ │
│ 🔐 Security Layer (Secret Redaction & Error Sanitization) │
│ │
│ ┌─────────────────────┴──────┐ │
│ │ │ │
│ ↓ (on error & max < 3) ↓ │
│ Loop Back Finalize & Exit │
│ │
└─────────────────────────────────────────────────────────────────┘
- Scanning 🔍 - AST-based vulnerability detection
- Analyzing 📊 - Vulnerability classification and severity assessment
- Patching 🔧 - LLM-powered code remediation
- Validating ✓ - Native Python compilation verification
- 🔐 Sanitizing - Secret redaction & error handling
- Complete ✨ - Results delivery with refinement history
- Node.js 18+ (Frontend)
- Python 3.11+ (Backend)
- Google Gemini API Key (Get one here)
# Navigate to backend directory
cd backend
# Create and activate virtual environment
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Set your Gemini API key
export GEMINI_API_KEY="your_api_key_here" # Or set in frontend UI
# Run the FastAPI server
python app/main.py
# Server runs at http://127.0.0.1:8000# Navigate to frontend directory
cd frontend
# Install dependencies
npm install
# Start development server
npm run dev
# UI runs at http://localhost:5173Open your browser and navigate to:
http://localhost:5173
GuardAgent detects the following security vulnerabilities:
| Vulnerability | Detection Method | Remediation Strategy |
|---|---|---|
| SQL Injection | AST pattern matching (string interpolation in queries) | Parameterized queries |
| Command Injection | Detection of os.system(), subprocess.run(shell=True) |
Subprocess with shell=False + arg list |
| Hardcoded Secrets | String literal pattern recognition | Environment variables |
| Eval/Exec | Direct eval(), exec() calls |
Safe parsing alternatives |
| Insecure Deserialization | pickle.loads(), yaml.load() detection |
Secure formats (JSON) |
- React 19 - UI framework
- TypeScript - Type-safe development
- Tailwind CSS - Utility-first styling
- Vite - Next-gen build tool
- Lucide React - Icon library
- FastAPI - High-performance async web framework
- Python 3.11+ - Core language
- LangGraph - Multi-agent orchestration
- Google Genai SDK - LLM integration (Gemini 2.5-Flash)
- AST Module - Static code analysis
- Oxlint - High-performance linter
- Pydantic - Data validation
- CORS Middleware - Cross-origin request handling with whitelisting
- SSE (Server-Sent Events) - Real-time streaming
- Logging - Comprehensive error tracking and audit trails
# Original Vulnerable Code
import sqlite3
def get_user_records(db_path: str, username: str):
conn = sqlite3.connect(db_path)
cursor = conn.cursor()
query = f"SELECT * FROM users WHERE username = '{username}'"
cursor.execute(query)
return cursor.fetchall()GuardAgent Output:
- ✅ Detects SQL injection vulnerability
- 🔧 Patches with parameterized queries
- ✓ Validates syntax and imports
# Original Vulnerable Code
import subprocess
def ping_server(ip_address: str):
command = f"ping -c 1 {ip_address}"
result = subprocess.run(command, shell=True, capture_output=True, text=True)
return result.stdoutGuardAgent Output:
- ✅ Identifies shell=True vulnerability
- 🔧 Converts to safe subprocess list format
- ✓ Removes shell execution risk
Guard-Agent/
├── frontend/ # React + TypeScript UI
│ ├── src/
│ │ ├── App.tsx # Main application component
│ │ ├── components/
│ │ │ ├── Stepper.tsx # Pipeline progress visualization
│ │ │ ├── CodeViewer.tsx # Split code comparison view
│ │ │ ├── VulnerabilityList.tsx # Vulnerability details
│ │ │ └── RefinementHistory.tsx # Iteration tracking
│ │ └── App.css # Skeuomorphic styling
│ ├── package.json
│ └── vite.config.ts
│
├── backend/ # FastAPI + LangGraph
│ ├── app/
│ │ ├── main.py # FastAPI server & /api/remediate endpoint
│ │ ├── ast_analyzer.py # Vulnerability detection
│ │ ├── remediation_graph.py # LangGraph multi-agent pipeline
│ │ └── security.py # 🔐 Secret redaction & sanitization
│ ├── requirements.txt
│ ├── test_backend.py # Unit tests
│ ├── test_security.py # 🔒 Security module tests
│ └── test_adc.py
│
├── README.md # This file
└── .gitignore
cd backend
python test_backend.pyExpected Output:
--- Testing AST Security Scanning ---
Scanned and found 5 vulnerabilities:
[HIGH] eval_exec on line 19: Eval/Exec detected
[HIGH] sql_injection on line 23: SQL Injection
[HIGH] command_injection on line 26: Command Injection
...
AST Scanner Test: SUCCESS
--- Testing LangGraph Pipeline Compilation ---
LangGraph Compilation Test: SUCCESS
All backend checks passed successfully!
cd backend
python test_security.pyExpected Output:
--- Running Security Module Tests ---
1. test_sanitize_text_specific_secret: PASSED
2. test_sanitize_text_regex_patterns: PASSED
3. test_redact_secrets_recursive: PASSED
All Security Module Tests PASSED successfully!
GET /api/healthResponse:
{
"status": "healthy"
}POST /api/remediate
Content-Type: application/json
{
"code": "import sqlite3\ndef get_user(username):\n cursor.execute(f\"SELECT * FROM users WHERE name = '{username}'\")",
"api_key": "your_gemini_api_key_here" // Optional (uses env var if not provided)
}Response: Server-Sent Events (streaming JSON)
{
"original_code": "...",
"patched_code": "...",
"vulnerabilities": [...],
"error_logs": [...],
"iteration_count": 1,
"pipeline_step": "analyzing",
"history": [...],
"compile_success": false,
"error_message": null
}# Backend (.env or system variables)
GEMINI_API_KEY=your_api_key_here
CORS_ALLOWED_ORIGINS=http://localhost:5173
# Frontend (.env.local)
VITE_API_URL=http://127.0.0.1:8000Edit backend/app/remediation_graph.py to change the model:
# Current default: gemini-2.5-flash
response = client.models.generate_content(
model='gemini-2.5-flash', # ← Change model here
contents=prompt,
)GuardAgent implements enterprise-grade security controls to protect sensitive data:
- Pattern-Based Detection: Identifies API keys, tokens, and credentials using regex patterns
- Supported Patterns:
- Google Gemini API Keys (
AIzaSy*) - Stripe API Keys (
sk_test_*,sk_live_*) - Bearer Tokens and JWT-style credentials
- Google Gemini API Keys (
- Recursive Scanning: Redacts secrets from nested structures (dicts, lists, strings)
- Context-Aware: Sanitizes both error messages and pipeline logs
- Strict Whitelist: Only allows requests from localhost development ports
- Production Ready: Configure
allow_originsfor production deployments - Credentials Disabled: Prevents cookie/session leakage
- Global Exception Handler: Captures unhandled exceptions with automatic secret sanitization
- Sanitized Tracebacks: All error logs have secrets redacted before logging
- Audit Trail: Comprehensive logging for debugging without exposing credentials
- Pydantic Models: All API requests validated against strict schemas
- Type Safety: TypeScript on frontend, Python type hints on backend
- Safe Compilation Only: Uses Python's
compile()function for syntax validation - No
eval()orexec(): Prevents arbitrary code execution
# ❌ DON'T: Hardcode API keys
GEMINI_API_KEY = "AIzaSy..."
# ✅ DO: Use environment variables
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
# ✅ DO: Use frontend UI for temporary keys
# Keys are automatically sanitized before loggingAll security features are tested in backend/test_security.py:
# Test specific secret redaction
python -m pytest backend/test_security.py::test_sanitize_text_specific_secret -v
# Test regex pattern detection
python -m pytest backend/test_security.py::test_sanitize_text_regex_patterns -v
# Test recursive redaction
python -m pytest backend/test_security.py::test_redact_secrets_recursive -vContributions are welcome! Areas for enhancement:
- Support for JavaScript/TypeScript vulnerability detection
- Extended vulnerability taxonomy
- Custom LLM model integration
- Persistent result storage & database
- GitHub Actions integration
- Performance benchmarking suite
- Docker containerization
- Advanced encryption for secret storage
| Metric | Typical Value |
|---|---|
| AST Analysis Time | 50-100ms |
| LLM Patching Time | 2-5s (Gemini 2.5-Flash) |
| Compilation Validation | 10-50ms |
| Secret Redaction Overhead | <5ms |
| Max Refinement Iterations | 3 |
| Average Total Runtime | 3-8s |
- Skeuomorphic Design - macOS/Windows-inspired aesthetic
- Real-Time Pipeline Visualization - Step-by-step progress tracking
- Split Code View - Side-by-side original vs. patched code
- Vulnerability Highlighting - Interactive vulnerability markers
- Refinement History - Detailed iteration tracking with error logs
- Responsive Layout - Optimized for desktop viewing
- Secure Error Display - Sanitized error messages without sensitive data leakage
This project is open source and available for educational and research purposes.
- v1.1 - Multi-language support (JavaScript, Java, Go)
- v1.2 - Docker deployment with docker-compose
- v1.3 - GitHub integration & CI/CD plugins
- v1.4 - 🔐 Advanced secret vaulting & encryption
- v2.0 - Advanced dataflow analysis & taint tracking
- Demo Mode: Leave API key blank to see hardcoded examples
- Custom Code: Edit the Python code textarea directly
- Error Analysis: Check the "Instrumentation" panel for refinement details
- Syntax Learning: Each iteration shows compiler feedback
- Security First: All API keys are automatically redacted from logs and error messages
For issues, questions, or security concerns, please:
- Open an issue on GitHub
- Contact the maintainers
- Report security vulnerabilities responsibly
If you discover a security vulnerability, please email the maintainers directly instead of using the issue tracker. We take security seriously and will respond promptly.