File size: 5,289 Bytes
8325dd1 3c067f0 a3ecd30 8325dd1 a3ecd30 3e631d0 a3ecd30 0e9cb33 a3ecd30 8325dd1 a3ecd30 3bc3287 a3ecd30 8325dd1 a3ecd30 3bc3287 a3ecd30 8325dd1 a3ecd30 1c77a4c 3e631d0 de6f25f 0e9cb33 3e631d0 3bc3287 8325dd1 a3ecd30 cbb7e42 a3ecd30 a495074 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 | ---
title: SwarmAudit
sdk: gradio
sdk_version: 6.14.0
app_file: app.py
pinned: false
license: mit
---
# SwarmAudit
Paste any public GitHub URL. Get a structured multi-agent code audit in minutes.
SwarmAudit is an AI-agent code review system for the AMD Developer Hackathon. It clones a public repository, filters and chunks source files, runs specialized review agents, and returns a severity-ranked report with file references and suggested fixes.
The local MVP runs in mock-first mode, so the demo works without waiting for ROCm, vLLM, or MI300X infrastructure. The inference layer is designed to switch to a vLLM-compatible Qwen2.5-Coder endpoint later.
## MVP
SwarmAudit currently runs with a mock-first LLM interface so the demo is not blocked by ROCm, vLLM, or AMD MI300X setup. The current graph is:
```text
GitHub URL -> Crawler -> Chunker -> [Security Agent + Performance Agent + Quality Agent + Docs Agent] -> Synthesizer -> Report
```
## Demo Status
Working locally:
- Gradio UI with live agent progress
- FastAPI `/health` and `/audit` endpoints
- GitHub clone and repo scan on public repos
- Four analysis agents plus synthesizer
- Prioritized report display with full raw finding totals preserved
- Hugging Face Spaces-style `app.py` entrypoint
Smoke-tested repos:
- `https://github.com/psf/requests`
- `https://github.com/pallets/itsdangerous`
Example output is available in [`examples/requests_report_excerpt.md`](examples/requests_report_excerpt.md).
## Architecture
```mermaid
flowchart LR
U[User enters GitHub URL] --> API[FastAPI / Gradio]
API --> C[Crawler Agent]
C --> F[File Filter]
F --> K[Chunker]
K --> S[Security Agent]
K --> P[Performance Agent]
K --> Q[Quality Agent]
K --> D[Docs Agent]
S --> Y[Synthesizer Agent]
P --> Y
Q --> Y
D --> Y
Y --> R[Structured Audit Report]
```
The graph is intentionally modular: each agent returns strict Pydantic findings, and the synthesizer merges, deduplicates, prioritizes, and formats the final report.
## Quick Start
```bash
python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt
```
Run the FastAPI backend:
```bash
uvicorn app.main:app --reload
```
If port 8000 is busy on Windows, use:
```bash
uvicorn app.main:app --reload --port 8001
```
Health check:
```bash
curl http://127.0.0.1:8000/health
```
Audit endpoint:
```bash
curl -X POST http://127.0.0.1:8000/audit \
-H "Content-Type: application/json" \
-d '{"repo_url":"https://github.com/psf/requests"}'
```
Run the Gradio demo:
```bash
python -m app.ui.gradio_app
```
For Hugging Face Spaces-style startup:
```bash
python app.py
```
The Gradio app includes example repos, a live agent progress panel, and a structured markdown report panel.
The launcher binds to `0.0.0.0` and uses `PORT` when provided, which matches hosted Gradio deployment expectations.
## Configuration
Copy `.env.example` to `.env` for local overrides. Default inference mode is:
```text
LLM_PROVIDER=mock
```
Later, set `LLM_PROVIDER=vllm` and point `LLM_BASE_URL` at an OpenAI-compatible vLLM endpoint running Qwen2.5-Coder.
Key safety limits:
```text
MAX_FILES=200
MAX_FILE_SIZE_KB=250
MAX_CHARS_PER_CHUNK=12000
CLONE_BASE_DIR=.swarm_audit_tmp
```
## Report Schema
Each finding includes:
- title
- severity: CRITICAL, HIGH, MEDIUM, LOW
- file path and line range
- description
- why it matters
- suggested fix
- agent source
Reports preserve full finding totals while displaying a prioritized subset for readability. High-severity findings are shown first, repeated low-severity findings are summarized, and warnings explain when lower-priority findings are hidden from the demo report.
## Current Agents
- Security Agent: flags hardcoded secrets, disabled TLS verification, and dynamic code execution.
- Performance Agent: flags HTTP calls without timeouts, blocking sleep inside async functions, nested loops, file reads in loops, and synchronous Node.js filesystem calls.
- Quality Agent: flags long functions, high branch density, large source sections, unresolved TODO/FIXME/HACK comments, and very short symbol names.
- Docs Agent: flags incomplete README guidance and public Python symbols missing docstrings.
- Synthesizer Agent: deduplicates findings, sorts by severity, and builds the final report.
## Hugging Face Spaces
SwarmAudit is ready to launch as a Gradio Space with the root `app.py` entrypoint. Keep `LLM_PROVIDER=mock` for a reliable public demo, then switch to `LLM_PROVIDER=vllm` when an AMD MI300X-hosted Qwen2.5-Coder endpoint is available.
See [`HF_SPACES_DEPLOY.md`](HF_SPACES_DEPLOY.md) for the deployment checklist.
Recommended Space settings:
- SDK: Gradio
- App file: `app.py`
- Python: 3.11 or newer
- Default env: `LLM_PROVIDER=mock`
## AMD MI300X Roadmap
The current code path is intentionally mock-first. The next inference phase is:
1. Start a Qwen2.5-Coder vLLM server on AMD Developer Cloud.
2. Expose an OpenAI-compatible `/v1/chat/completions` endpoint.
3. Set `LLM_PROVIDER=vllm`, `LLM_BASE_URL`, and `LLM_MODEL`.
4. Add LLM enrichment to agent findings while keeping static rules as deterministic guardrails.
5. Add a benchmark tab with MI300X latency and throughput numbers.
## Tests
```bash
python -m pytest
```
|