GitHub - Jaimin2687/aegis-patch: Autonomous software supply chain vulnerability patching engine. Continuously parses dependency trees, synthesizes backported security fixes via LLMs, runs regressions, and generates verified pull requests.

  █████╗ ███████╗ ██████╗ ██╗███████╗    ██████╗  █████╗ ████████╗ ██████╗██╗  ██╗
 ██╔══██╗██╔════╝██╔════╝ ██║██╔════╝    ██╔══██╗██╔══██╗╚══██╔══╝██╔════╝██║  ██║
 ███████║█████╗  ██║  ███╗██║███████╗    ██████╔╝███████║   ██║   ██║     ███████║
 ██╔══██║██╔══╝  ██║   ██║██║╚════██║    ██╔═══╝ ██╔══██║   ██║   ██║     ██╔══██║
 ██║  ██║███████╗╚██████╔╝██║███████║    ██║     ██║  ██║   ██║   ╚██████╗██║  ██║
 ╚═╝  ╚═╝╚══════╝ ╚═════╝ ╚═╝╚══════╝    ╚═╝     ╚═╝  ╚═╝   ╚═╝    ╚═════╝╚═╝  ╚═╝

An Autonomous Engine for Generative Intelligent Security Patching.

Submit a repository. We detect vulnerabilities, synthesize patches, run regression tests, and open Pull Requests — with zero human intervention.

What is AEGIS-PATCH?

AEGIS-PATCH natively replaces hours of manual vulnerability triage and patching by acting as an autonomous security engineer. It continuously monitors, identifies, and resolves dependency and code-level vulnerabilities in your JavaScript/Node.js repositories.

You input a GitHub repository URL, and AEGIS-PATCH executes a complete pipeline:

Generates a dependency graph directly from lockfiles
Cross-references packages against the live OSV.dev vulnerability database
Pipes vulnerable source files into a 4-tier LLM failover engine to synthesize secure, drop-in replacement code
Executes local regression tests to guarantee the patch doesn't break existing functionality
Automatically pushes the patched code and generates a GitHub Pull Request
Streams the entire process in real-time to a stunning, IDE-like dashboard

🎯 Live Demo

Live deployed URL: https://aegis-patch-frontend.vercel.app
Test vulnerable repository for demonstration: https://github.com/Jaimin2687/test-vuln-repo

Paste the test repository URL into the dashboard and click Start Patching to see AEGIS-PATCH in action.

✨ Core Feature Set

🧠 4-Tier LLM Failover Engine (High-Availability Patching)

Patch synthesis requires high uptime and deep reasoning. AEGIS-PATCH uses a cascaded fallback architecture to ensure a patch is always generated, even if primary APIs hit rate limits or downtime. Routing: Groq (llama-3.3-70b-versatile) → Cerebras → Gemini (gemini-2.5-flash).

🔍 Deep OSV Scanner

Instead of relying solely on npm audit, AEGIS-PATCH parses package-lock.json lockfiles directly to build a highly accurate dependency graph. It batches these dependencies and queries the Open Source Vulnerability (OSV.dev) database to extract precise CVSS scores, vulnerable ranges, and CVE identifiers.

🛠️ Smart Patch Synthesis

Once a vulnerability is found, AEGIS-PATCH locates the exact vulnerable entry point in the package's source code. It feeds the raw code, the CVE details, and strict constraints into the LLM engine to synthesize a semantically equivalent but secure replacement.

🛡️ Regression Engine

A patch is useless if it breaks the build. AEGIS-PATCH runs the repository's native test suite (npm test, Mocha, Jest) against the newly patched code in an isolated temp directory. If tests fail, it captures the stderr, feeds it back into the LLM, and iterates until the tests pass.

🔄 Auto-PR Generation

Zero human intervention required. Once the tests pass, AEGIS-PATCH configures a secure remote, commits the patched code to a new branch, pushes to GitHub, and uses the GitHub REST API to open a detailed Pull Request outlining the CVEs fixed, CVSS scores, and testing results.

💻 Real-time Execution Dashboard

Watch the autonomous agent work. The Next.js frontend connects via WebSockets to stream the live pipeline logs, current stage indicators (CLONING → SCANNING → PATCHING → TESTING → COMPLETE), and dynamic vulnerability cards showing severity and CVSS scores as they are discovered.

🌐 Website Vulnerability Scanner

Perform fast, deep web application security assessments on public URLs directly from the dashboard.

6 Scan Modules:
- Headers: Audits HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) for misconfigurations and weaknesses.
- SSL/TLS: Evaluates certificate validity, issuer, expiration, protocol versions, cipher suites, and TLS strength.
- Tech Detection: Identifies server engines, backend frameworks, CMSs, and public version footprints.
- Cookie Security: Checks Secure, HttpOnly, and SameSite flags across all active session cookies.
- Info Disclosure: Detects exposed sensitive paths (.env, .git/HEAD, server-status, elmah.axd, phpinfo.php, wp-config.php, swagger.json, etc.).
- AI Recommendations: Uses the 4-Tier LLM engine to synthesize contextual remediation guidance for discovered findings.
SSRF Protection: Built-in host and IP validation blocking private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, metadata.google.internal).
Endpoints:
- POST /api/scan-website — Triggers a new website vulnerability scan
- GET /api/scan-website/history — Retrieves historical scan results

🛠️ Technology Stack

⚡ Backend & Infrastructure

Layer	Technology
Server Runtime	Node.js (Raw `http` + Event-driven architecture)
Real-time Comm	`ws` (WebSockets)
Orchestration	Native child processes (`execFile`) for safe isolation
HTTP Client	`undici` (high-performance fetch)

🎨 Frontend & UI

Layer	Technology
Framework	Next.js 15 (App Router)
Styling	Tailwind CSS v4
Theme	Deep void dark mode, glassmorphism, pulse animations
State	React Hooks (`useEffect`, `useState`) + Custom WebSocket hooks

🧠 Intelligence & Data

Layer	Technology
Vulnerability DB	OSV.dev REST API
LLM Orchestration	Custom Failover Pipeline (Groq, Cerebras, Gemini)
Git Integration	`simple-git` + Octokit (GitHub API)

🗺️ Pipeline Architecture

graph TD
    A[Frontend UI] -->|POST Repo URL| B(Pipeline Orchestrator)
    A -->|POST Target URL| W[Web Vulnerability Scanner]
    W -->|SSRF Check & 6 Scan Modules| W1[Headers / SSL / Tech / Cookies / Info Disclosure]
    W1 -->|Raw Findings| H[LLM Failover Engine]
    H -->|AI Recommendations| W2[Web Scan Results & History]
    B --> C[Repo Ingestor]
    C -->|Clone & Parse Lockfile| D[Vuln Scanner]
    D -->|OSV.dev Batch Query| E{Vulns Found?}
    E -->|No| F[Complete Pipeline]
    E -->|Yes| G[Patch Synthesizer]
    G -->|Extract vulnerable code| H
    H -->|Groq / Cerebras / Gemini| I[Synthesize Patch]
    I --> J[Regression Engine]
    J -->|npm test| K{Tests Pass?}
    K -->|No - retry limit| H
    K -->|Yes| L[PR Generator]
    L -->|Push & Create PR| F

🏗️ Project Structure

.
├── backend/
│   ├── server.js                 # HTTP + WebSocket entry point + Web Scanner API routes
│   ├── src/
│   │   ├── core/                 # Config, Pipeline Orchestrator, EventBus
│   │   ├── llm/                  # Prompts, Failover logic, Provider integrations
│   │   ├── modules/              # Ingestion, Scanning, Patching, Regression, PRs, webScanner.js
│   │   └── utils/                # Logger, Process Runner, depGraph parser
│   └── temp/                     # Isolated clone directories (auto-cleaned)
│
├── frontend/
│   ├── src/
│   │   ├── app/                  # Next.js App Router (page.js, dashboard/web-scanner/page.js, layout)
│   │   ├── components/           # Terminal, StatusPanel, VulnCard, UrlInput

│   │   └── lib/                  # WebSocket hook, Log formatters
│   └── public/                   # Static assets
│
└── task-distribution.md          # Internal team task tracking

🚀 Getting Started

Prerequisites

Node.js 18+
Git installed and available in PATH
GitHub Personal Access Token (with repo scope)
At least one LLM API Key (Groq, Cerebras, or Gemini)

1. Clone & Install

git clone https://github.com/Jaimin2687/aegis-patch.git
cd aegis-patch

Install Backend Dependencies:

cd backend
npm install

Install Frontend Dependencies:

cd ../frontend
npm install

2. Environment Configuration

In the backend/ directory, create a .env file:

# LLM API Keys (all free tier) - Includes failover pool support
GROQ_API_KEY=gsk_your_primary_key_here
GROQ_API_KEY_2=gsk_your_backup_key_here
GEMINI_API_KEY=AIzaSy_your_key_here
CEREBRAS_API_KEY=csk-your_key_here

# GitHub Personal Access Token (repo scope - needed to open PRs)
GITHUB_TOKEN=ghp_your_token_here

# Server Config
PORT=3001
FRONTEND_URL=http://localhost:3000

# Pipeline Config
MAX_RETRIES=5
TEST_TIMEOUT_MS=30000
MAX_MEMORY_MB=512

# Web Scanner Config
SCANNER_RESTRICT_ACCESS=false
SCANNER_ALLOWED_EMAILS=admin@example.com
SCANNER_RATE_LIMIT_MAX=5

3. Run Locally

You need to run both the backend and frontend simultaneously.

Start Backend (Port 3001):

cd backend
npm start

Start Frontend (Port 3000):

cd frontend
npm run dev

Open http://localhost:3000 in your browser. Paste a vulnerable repository URL and watch AEGIS-PATCH go to work.

🌐 Production Deployment (Vercel & Render)

AEGIS-PATCH is pre-configured with vercel.json and render.yaml for seamless zero-config cloud deployment.

1. Deploy Backend to Render (Free Tier)

Go to Render Dashboard and create a New Blueprint Instance (or Web Service).
Connect your repository. Render will auto-detect render.yaml.
In the environment section, enter your secret API keys:
- GROQ_API_KEY and GROQ_API_KEY_2 (backup)
- CEREBRAS_API_KEY
- GEMINI_API_KEY
- GITHUB_TOKEN (Must have repo permissions)
Deploy! Copy your Backend URL (e.g., https://aegis-patch-backend.onrender.com).

2. Deploy Frontend to Vercel

Import your repository into Vercel.
In Project Settings, set the Root Directory to frontend (Vercel auto-configures Next.js parameters via vercel.json).
Add the following Environment Variable:
- NEXT_PUBLIC_BACKEND_URL: Paste your Render backend URL (e.g., https://aegis-patch-backend.onrender.com)
Deploy! Your interactive dashboard will instantly connect to your Render daemon over real-time WebSockets.

(Note: Our intelligent backend CORS configuration dynamically authorizes any verified Vercel preview or production domain automatically!)

Built for the modern security architect. Focus on shipping, let AI handle the patching.

Name		Name	Last commit message	Last commit date
backend		backend
frontend		frontend
test-vuln-repo		test-vuln-repo
.gitignore		.gitignore
BACKEND_CHANGES.md		BACKEND_CHANGES.md
README.md		README.md
implementation_plan.md		implementation_plan.md
overview.md		overview.md
package-lock.json		package-lock.json
package.json		package.json
render.yaml		render.yaml
system-truth.md		system-truth.md
task-distribution.md		task-distribution.md

Navigation Menu

Repository navigation

About

Repository files navigation

What is AEGIS-PATCH?

🎯 Live Demo

✨ Core Feature Set

🧠 4-Tier LLM Failover Engine (High-Availability Patching)

🔍 Deep OSV Scanner

🛠️ Smart Patch Synthesis

🛡️ Regression Engine

🔄 Auto-PR Generation

💻 Real-time Execution Dashboard

🌐 Website Vulnerability Scanner

🛠️ Technology Stack

⚡ Backend & Infrastructure

🎨 Frontend & UI

🧠 Intelligence & Data

🗺️ Pipeline Architecture

🏗️ Project Structure

🚀 Getting Started

Prerequisites

1. Clone & Install

2. Environment Configuration

3. Run Locally

🌐 Production Deployment (Vercel & Render)

1. Deploy Backend to Render (Free Tier)

2. Deploy Frontend to Vercel

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

What is AEGIS-PATCH?

🎯 Live Demo

✨ Core Feature Set

🧠 4-Tier LLM Failover Engine (High-Availability Patching)

🔍 Deep OSV Scanner

🛠️ Smart Patch Synthesis

🛡️ Regression Engine

🔄 Auto-PR Generation

💻 Real-time Execution Dashboard

🌐 Website Vulnerability Scanner

🛠️ Technology Stack

⚡ Backend & Infrastructure

🎨 Frontend & UI

🧠 Intelligence & Data

🗺️ Pipeline Architecture

🏗️ Project Structure

🚀 Getting Started

Prerequisites

1. Clone & Install

2. Environment Configuration

3. Run Locally

🌐 Production Deployment (Vercel & Render)

1. Deploy Backend to Render (Free Tier)

2. Deploy Frontend to Vercel

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages