Autonomous Software Engineering Platform for Intelligent Code Review, Security Analysis, Bug Detection, Auto-Fix Generation, and CI/CD Validation.
DevPilot AI is an enterprise-grade AI-powered software engineering platform. It acts as an Autonomous Senior Software Engineer that automatically reviews pull requests, detects bugs, performs security audits, analyzes performance bottlenecks, generates code fixes, and validates CI/CD pipelines directly inside GitHub.
By combining Large Language Models (LLMs), Static Analysis Engines, Containerized Sandboxing, and a Multi-Agent AI System, DevPilot AI accelerates the Software Development Life Cycle (SDLC) with minimal human intervention.
Modern software teams spend significant time on manual and repetitive tasks:
- 🔍 Manual Code Reviews
- 🛡️ Security Vulnerability Detection
- ⚡ Performance Optimization
- 📏 Coding Standard Enforcement
- ✅ Pull Request Validation
- 📉 Technical Debt Analysis
Human reviewers are expensive and limited by time. DevPilot AI solves this by providing instant, intelligent feedback directly inside GitHub Pull Requests.
| Feature | Description |
|---|---|
| 🧠 AI Code Review | Automatically reviews logic errors, code smells, anti-patterns, and maintainability issues. |
| 🛡️ Security Scanner | Detects SQL Injection, XSS, CSRF, hardcoded secrets, and insecure dependencies (Semgrep, Bandit, GPT). |
| ⚡ Performance Analyzer | Identifies O(n²) bottlenecks, inefficient loops, memory leaks, and N+1 queries. |
| 🛠️ Auto Fix Generator | Suggests precise patch diffs for identified issues, ready to be applied. |
| 🧪 AI Test Case Generator | Automatically creates Unit, Integration, Edge Case, and Regression tests (Pytest, Jest). |
| 📊 Technical Debt Analyzer | Measures Maintainability Index, Cyclomatic Complexity, Duplication, and Doc Coverage. |
| 🚦 Pull Request Risk Score | Calculates a comprehensive risk score based on security, performance, and complexity metrics. |
| 🤖 Smart Approval System | Configurable rules to automatically approve PRs, request changes, or block merges. |
| 📈 Developer Dashboard | Analytics for reviews, bugs, security findings, resolution time, and repository health. |
DevPilot AI operates on an event-driven architecture triggered by GitHub webhooks, utilizing a scalable worker queue and containerized analysis environments.
flowchart TD
A([Developer Opens Pull Request]) --> B[GitHub Webhook]
subgraph Gateway Layer
B --> C{FastAPI Gateway}
C --> D[(Redis Queue)]
end
subgraph Processing Layer
D --> E[Celery Worker]
E --> F[Docker Sandbox]
F --> G[Repository Clone]
G --> H[Static Analysis Engine]
end
subgraph AI Multi-Agent System
H --> I{Multi-Agent Coordinator}
I --> J[Security Agent]
I --> K[Performance Agent]
I --> L[Code Quality Agent]
I --> M[Test Gen Agent]
J --> N[Review Aggregator]
K --> N
L --> N
M --> N
end
subgraph Outputs
N --> O[GitHub Review Comment]
N --> P[Dashboard Analytics]
N --> Q[Auto Fix Generator]
end
Instead of relying on a single monolithic LLM prompt, DevPilot utilizes specialized AI agents working collaboratively to analyze code from multiple perspectives.
flowchart LR
A([Code Diff]) --> B[🛡️ Security Agent]
A --> C[⚡ Performance Agent]
A --> D[✨ Quality Agent]
A --> E[🧪 Test Agent]
B --> F{Coordinator Agent}
C --> F
D --> F
E --> F
F --> G([Final Review Report])
The platform ensures a robust and secure pipeline from code submission to analysis reporting.
sequenceDiagram
participant GitHub
participant API as FastAPI Gateway
participant Docker as Sandbox Environment
participant AI as Multi-Agent AI
GitHub->>API: Pull Request Event (Webhook)
activate API
API->>Docker: Create Isolated Sandbox
activate Docker
Docker->>Docker: Clone Repository securely
Docker->>AI: Send Code for Analysis
activate AI
AI-->>Docker: Return Findings (Security, Bugs, etc.)
deactivate AI
Docker-->>API: Aggregated Results
deactivate Docker
API->>GitHub: Post Review Comments & Fixes
deactivate API
DevPilot AI is built with modern, scalable technologies across the stack.
- Python 3.12 - Core programming language.
- FastAPI - High-performance web framework for the API gateway.
- SQLAlchemy & Pydantic - ORM and data validation.
- LangGraph & LangChain - Frameworks for multi-agent workflows.
- OpenAI GPT-4o & Claude Sonnet - Foundation models powering the agents.
- PostgreSQL - Relational database for persistent storage.
- Redis - In-memory data store for caching and message queues (Celery).
- Docker & Docker Compose - Containerization and local orchestration.
- GitHub Actions - CI/CD pipeline automation.
- Prometheus & Grafana - Monitoring and observability.
- Semgrep & Bandit - Static Application Security Testing (SAST).
erDiagram
USERS ||--o{ REPOSITORIES : "owns"
REPOSITORIES ||--o{ REVIEWS : "contains"
REVIEWS ||--o{ FINDINGS : "generates"
USERS {
UUID id PK
string email
string github_id
}
REPOSITORIES {
UUID id PK
string repo_name
}
REVIEWS {
UUID id PK
string pr_number
string status
}
FINDINGS {
UUID id PK
string severity
text issue
text suggestion
}
devpilot-ai/
├── backend/
│ └── app/
│ ├── api/ # API routes and endpoints
│ ├── services/ # Core business logic
│ ├── agents/ # LangGraph multi-agent definitions
│ ├── github/ # GitHub API integrations
│ ├── security/ # SAST tools integration (Semgrep, Bandit)
│ ├── sandbox/ # Docker sandbox management
│ ├── database/ # SQLAlchemy models and migrations
│ ├── workers/ # Celery background tasks
│ └── core/ # Configurations and dependencies
├── frontend/ # Developer Analytics Dashboard (React/Next.js)
├── docker/ # Dockerfiles and compose configs
├── docs/ # Extended documentation
├── tests/ # Pytest suites
├── scripts/ # Utility scripts for setup and deployment
└── .github/ # GitHub Actions workflows
| Metric | Target |
|---|---|
| Review Time | < 60 Seconds |
| Security Detection Rate | > 90% |
| PR Analysis Latency | < 30 Seconds |
| Auto Fix Accuracy | > 85% |
This project is licensed under the MIT License.