Empirical Tool-Calling Agent — Not Just Plain Diff Comments

Autonomous PR Security & Code Review for Developers

DevGuard AI acts as an active security engineer on every pull request. It executes AST static linters, checks OSV vulnerability databases, and runs tests before rendering structured inline feedback.

Agentic Multi-Step Loop

The LLM orchestrator chooses tools, inspects outputs, and refines findings up to 5 iterations before producing inline PR annotations.

Real Tool Integration

Wraps AST linter checks, OSV.dev vulnerability databases for package.json, and unit test suites for zero hallucinations.

Inline GitHub Review Annotations

Posts formatted reviews with 1-click GitHub copyable suggestions, severity tagging (Critical, Warning, Info), and file line markers.

System Architecture & Tool Orchestration Pipeline

1. GitHub Webhook

Triggers on PR opened / synchronize, verifies HMAC-SHA256 signature.

2. Agent Orchestrator

Groq Llama 3.3 70B with Gemini 2.5 Flash fallback evaluates PR diff and chooses execution tools.

3. Tool Verification

Runs AST linter, OSV vulnerability scan, and test suite runner to gather concrete evidence.

4. GitHub Review Post

Posts structured findings with inline line comments & suggested code replacement fixes.