Inspiration
Security is the ultimate bottleneck in modern software development. While tools like Snyk and SonarQube identify vulnerabilities, they remain passive, leaving developers with massive "To-Do" lists they don't have time to finish. We wanted to move from passive detection to autonomous remediation. We asked: "What if security could be a self-healing process that fixes code before a hacker ever sees it?"
What it does
CodexAegis is an autonomous DevSecOps platform. A user drops a GitHub URL, and a multi-agent swarm takes over:
Map: It visualizes the repository’s architecture as a live service graph.
Attack: A Chaos Monkey Agent launches simulated, sandboxed exploits (like SQLi or API rate-limit bypasses) to find real failure points.
Detect: An Observability Agent captures telemetry and stack traces from the crash.
Heal: A Patching Agent uses Gemini 1.5 Pro to rewrite the code, validates the fix in a sandbox, and opens a production-ready GitHub Pull Request automatically.
How we built it
The Brain: We utilized Gemini 1.5 Pro for its massive context window (allowing it to analyze the entire codebase at once) and Gemini 1.5 Flash for high-speed agent orchestration.
Orchestration: Built with Python and a multi-agent framework to manage the "Live Fire" loop.
The Sandbox: We used E2B/Docker to create secure, isolated environments where the Chaos Monkey could safely "attack" code without risking production data.
The Frontend: A Next.js dashboard featuring React Flow for the interactive Infrastructure Graph and Socket.io for real-time log streaming.
Challenges we ran into
The biggest hurdle was Agent Orchestration. Getting an LLM to not just write code, but to understand why a specific exploit worked and how to fix it without breaking business logic, required complex "Self-Correction" loops. We also had to navigate AI safety filters; we had to carefully prompt our agents to ensure they were acting as "Ethical Researchers" within a controlled sandbox.
Accomplishments that we're proud of
We successfully closed the loop from Exploit to PR. Watching the system detect a SQL injection, visualize the "red alert" on the dashboard, and then giving the right way to solve the issues just by copying the pre-made hit commands.
What we learned
We learned that AI Agency is the next frontier. Large Language Models are great at writing text, but their true power is unlocked when they are given "tools"—the ability to run code, analyze logs, and interact with Git. We also discovered that 1.5 Pro’s long context window is a game-changer for DevSecOps, as it allows the AI to understand the relationship between distant files in a microservice architecture.
What's next for codexaegis
We want to expand CodexAegis into Live Production Self-Healing. The goal is to integrate with Kubernetes clusters to detect live attacks, spin up a "Shadow Clone" of the service, develop a patch in real-time, and hot-fix the production environment. We also plan to support more complex languages like Rust and Go to bring autonomous security to the entire software stack.
An autonomous action that autonomously delivers a clean, tested Pull Request to GitHub in under 60 seconds that will feel like magic. We plan to build a custom Architecture Mapper that translates a messy folder structure into a beautiful, logical service map.
Log in or sign up for Devpost to join the conversation.