A multi-agent pipeline that takes a security vulnerability found by GitLab SAST and turns it into a merge-ready fix — automatically. No developer has to touch it until the review step.
Built for the GitLab AI Hackathon. The idea came from a real frustration: scanners are good at finding problems, but the fixing part still falls entirely on developers. A team I was part of had hundreds of unresolved SAST findings that kept piling up because nobody had time to go through them one by one. I wanted to see how far an AI pipeline could go in closing that loop.
Five agents run in sequence. Each one has a specific job and passes its output to the next:
GitLab SAST finding
↓
[1] Context Collector — reads the affected file, finds related tests, checks code style
↓
[2] Analyzer (Claude) — figures out if the vulnerability is actually exploitable
↓ if not → dismisses it and stops here
[3] Fixer — writes the patch and a regression test to go with it
↓
[4] Compliance Mapper — maps the fix to OWASP Top 10, NIST 800-53, CIS Controls
↓
[5] MR Creator — opens a documented merge request with risk score and reviewers
The early-termination step (Agent 2) was something I added after realizing that a lot of scanner findings are false positives. There's no point generating a patch for something that isn't actually exploitable in context — it just creates noise. So if Claude determines it's not exploitable, it logs the reasoning, dismisses the finding, and stops.
The GitLab Duo Agent Platform integration requires a live GitLab instance and credentials. For local exploration there are two options:
Web dashboard (easier to show people):
pip install -r requirements.txt
python dashboard.py
# open http://127.0.0.1:5000This gives you a UI where you can step through the 4 demo scenarios and see the before/after diffs, generated tests, compliance mappings, and the full MR description.
Terminal version:
python demo_runner.pyRun the tests:
python -m pytest tests/ -vagents/ — agent definitions and system prompts (GitLab Duo YAML format)
flows/ — the orchestration flow that chains all 5 agents
tools/ — three Python modules:
gitlab_api.py — wraps GitLab API (MRs, branches, files, reviewers)
compliance_engine.py — maps CWE IDs to OWASP/NIST/CIS controls
dependency_scorer.py — scores dependencies for bloat and known CVEs
demo/ — intentionally vulnerable Express.js app used for testing
tests/ — pytest suite, one file per agent (54 tests total)
dashboard.py — Flask web UI for local demos
demo_runner.py — terminal version of the same demo
This part was more involved than I expected. The compliance_engine.py module builds reverse lookup tables from JSON framework files at startup, so mapping a CWE to its OWASP category or NIST control is just a dictionary lookup — no LLM involved, which keeps it deterministic and fast. The CWE → CIS Controls mapping is a hardcoded dict since there's no clean structured data source for that.
The demo app (demo/vulnerable_app/) has three intentional vulnerabilities — SQL injection (CWE-89), reflected XSS (CWE-79), and a vulnerable lodash version (CVE-2020-8203) — so there's something concrete to run the pipeline against.
The demo scenarios are hardcoded. The real integration with GitLab's security_finding_created webhook exists in the flow YAML but hasn't been tested against a live scanner pipeline end-to-end — that was blocked on GitLab Duo Agent Platform access during the hackathon period.
The Fixer agent generates patches based on Claude's understanding of the code. It works well for clear-cut cases like SQL parameterization or output encoding, but anything involving business logic or complex data flows would need human review before merging.
GitHub support doesn't exist yet — it's currently GitLab-only.
Python 3.11+, Flask, pytest, python-gitlab, PyYAML, Rich
Claude (Anthropic) via GitLab's AI integration
Demo app: Node.js / Express
Compliance data: OWASP Top 10 2021, NIST 800-53 Rev 5, CIS Controls v8
MIT