CodeSentinel 🛡️

Autonomous Multi-Agent Code Security Intelligence 5 AI agents that hunt, debate, patch, and report vulnerabilities — in under 60 seconds.

---

The Problem CodeSentinel Solves

• 3.5 million unfilled cybersecurity jobs globally (ISC2 2024)
• $4.88 million average cost of a data breach (IBM 2024)
• 194 days mean time to remediate known vulnerabilities
• Existing tools (Snyk, Dependabot) are rule-based, not intelligent — they find, but they don't reason, debate, or fix

CodeSentinel is the first multi-agent security swarm that doesn't just detect vulnerabilities — it argues about them, reaches consensus, and autonomously generates secure patches.

---

Architecture

graph TD
    User([User / GitHub Repo]) -->|URL or Code| UI[Streamlit UI Dashboard]
    UI -->|Start Scan| SENTINEL{SENTINEL Orchestrator<br>Google ADK}
    
    subgraph Swarm[CodeSentinel Swarm Network]
        SENTINEL -->|Routes Code| SCANNER[SCANNER Agent]
        SCANNER -->|Extracts Vulns| ANALYZER[ANALYZER Agent]
        
        SCANNER -.->|Priority Task Queue| DEBATE[DEBATE Layer]
        ANALYZER -.->|CVSS Scores| DEBATE
        
        DEBATE -->|Consensus| PATCHER[PATCHER Agent]
        PATCHER -->|Secure Code| REPORTER[REPORTER Agent]
    end
    
    subgraph MCPServers[MCP Tool Servers]
        SCANNER -->|AST Parsing| CodeMCP[Code MCP]
        ANALYZER -->|CVE Lookup| CVEMCP[CVE MCP]
        PATCHER -->|Diff Gen| PatchMCP[Patch MCP]
        REPORTER -->|SARIF Export| ReportMCP[Report MCP]
    end
    
    REPORTER -->|Security Advisory| UI

Loading

---

🏆 Kaggle Capstone Project Criteria Mapping

CodeSentinel was built for the Kaggle 5-Day AI Agents: Intensive Vibe Coding Capstone Project. Here is how we fulfill the required concepts:

1. Agent / Multi-agent system (ADK): We implemented a 5-agent swarm using the Google ADK, complete with an Orchestrator, Priority Agent Queues, and Adversarial Debate loops.
2. MCP Server: We created scoped Model Context Protocol (MCP) tool servers for the agents to interact with CVE databases and generate patches.
3. Security Features: Before code is sent to the LLM backend, it is sanitized, and the system is strictly limited to static analysis (no arbitrary code execution of user payloads).
4. Deployability: Fully container-ready and accessible via an intuitive Streamlit dashboard.
5. Antigravity: The entire project was vibe-coded using the Antigravity agentic IDE (see Video Demo).

---

Features

✅ 5-Agent Swarm — Specialized agents using Google ADK framework
✅ Adversarial Debate — Agents challenge each other's severity assessments
✅ 4 MCP Servers — Typed tools for code analysis, CVE lookup, patching, reporting
✅ CVSS 3.1 Scoring — Industry-standard severity calculation
✅ Auto-Patching — Generates secure replacement code with explanations
✅ CVE-Grade Reports — Professional security advisories in Markdown + SARIF
✅ 10 Vulnerability Types — SQL injection, XSS, XXE, SSRF, command injection, and more
✅ GitHub Integration — SARIF output compatible with GitHub Security tab
✅ No Code Leaves Local — Private by design; your code never hits external servers

---

Quick Start

Prerequisites

• Python 3.11+
• Gemini API Key (free tier works)
• Git

Installation

# Clone the repository
git clone https://github.com/yourusername/codesentinel.git
cd codesentinel

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Configure environment
cp .env.example .env
# Edit .env and add your GEMINI_API_KEY

Run CodeSentinel

# Start the Streamlit web app
streamlit run app.py

# Or scan via CLI
python -m codesentinel scan --url https://github.com/example/repo
python -m codesentinel scan --file path/to/code.py

---

Agents

Agent	Role	Tools
Sentinel	Root orchestrator — routes tasks, coordinates swarm	All sub-agent outputs
Scanner	Static analysis — finds vulnerability patterns	Code MCP: AST parsing, pattern search
Analyzer	CVE intelligence — CVSS scoring, exploit status	CVE MCP: NVD, OSV, CVSS calculator
Patcher	Secure remediation — generates + validates fixes	Patch MCP: diff generation, templates
Reporter	Documentation — CVE-grade reports	Report MCP: CVSS badges, SARIF export

---

Supported Vulnerability Types

CWE	Type	Typical CVSS
CWE-89	SQL Injection	9.8 Critical
CWE-79	Cross-Site Scripting (XSS)	6.1 Medium
CWE-798	Hardcoded Credentials	9.8 Critical
CWE-611	XML External Entity (XXE)	9.1 Critical
CWE-502	Insecure Deserialization	9.8 Critical
CWE-22	Path Traversal	7.5 High
CWE-916	Weak Password Hashing	7.5 High
CWE-918	Server-Side Request Forgery	8.6 High
CWE-78	Command Injection	9.8 Critical
CWE-639	Insecure Direct Object Reference	6.5 Medium

---

Output Formats

• Streamlit Dashboard — Live agent activity + findings visualization
• Markdown Report — Professional CVE advisory format
• JSON — Machine-readable findings for CI/CD integration
• SARIF — GitHub Security Advisory compatible format

---

Built With

• Google ADK — Multi-agent orchestration framework
• Google Gemini 1.5 Flash — LLM backbone for all agents
• MCP (Model Context Protocol) — Typed tool servers
• Streamlit — Web interface
• Antigravity IDE — AI coding assistant used to build this

---

Competition

Built for Kaggle's 5-Day AI Agents: Intensive Vibe Coding Capstone. Track: Agents for Business | Concepts: Multi-agent ADK, MCP Servers, Antigravity, Security Features, Agent Skills, Deployability

---

License

MIT License — see LICENSE for details.