Secure review needs context, not just more findings.
Static analyzers can surface useful evidence, but raw output often mixes production risk with tests, examples, generated files, dependencies, and other low-signal contexts. The difficult part is not only finding patterns—it is deciding what deserves an engineer’s attention.
CodeGuardian AI was designed as a complete local review workflow: controlled repository intake, safe workspace preparation, multi-scanner analysis, normalized evidence, file-context classification, risk prioritization, local AI explanation, and report export.
Selected risky snippets are interpreted through local Ollama inference rather than sending an entire repository to a remote model.
From repository intake to a reviewable report.
Analysis pipeline
A review pipeline, not an AI wrapper.
Controlled intake
Accepts public GitHub repository URLs for shallow local cloning or ZIP uploads with path-traversal-safe extraction.
Purposeful indexing
Indexes relevant project files while skipping binary, oversized, heavy, generated, dependency, and build-artifact content.
Layered analysis
Combines Semgrep, Bandit, custom Python AST rules, and secrets scanning into one normalized finding model.
Useful output
Produces security explanations and exports machine-readable JSON alongside professional PDF reports.
Risk is shaped by where code lives.
The primary risk view is intentionally context-aware. Findings are enriched with file classifications such as production, test, fixture, example, demo, documentation, generated, dependency, and build artifact. Actionable production-grade evidence drives the main result by default, reducing non-production noise without erasing the underlying scanner record.
- Normalize scanner-specific output before prioritization.
- Preserve evidence while separating primary risk from contextual noise.
- Send selected risky snippets—not the full codebase—to the local model.
- Treat AI interpretation as an explanatory layer over deterministic evidence.
A local-first application stack.
Application
FastAPI · SQLite · Next.js · TypeScript · Tailwind CSS
Analysis
Semgrep · Bandit · Python AST rules · Secrets scanning
Intelligence
Ollama · Mistral · Local inference
Outputs
Normalized findings · JSON export · PDF reporting