A full-stack MERN GitHub, with the winning ideas of the GitLab AI Hackathon 2026 built in — running on your real commits, not mockups.
What this is. A GitHub-style platform — repos, branches, merges, forks, issues, cloud file storage — wrapped in an AI/analysis layer drawn from all seven GitLab AI Hackathon 2026 winners. Two winners' actual Python code runs as microservices here; the rest are ported with line-by-line attribution in
ACKNOWLEDGMENTS.md. Every feature computes on live data from your own commits and files — nothing is hardcoded.
| Stack | |
|---|---|
| Frontend | React + Vite (frontend-main/) |
| Backend | Node + Express + MongoDB (backend-main/) |
| Winner engines | FastAPI + tree-sitter/HDBSCAN & RedAgent's real package (graphdev-engine/, redagent-engine/) |
| Storage | Backblaze B2 (files ≤ 25 MB) · MongoDB fallback |
| AI | Anthropic Claude → OpenRouter → Gemini (first key set) |
- 🧬 Two winners' real code actually runs — GraphDev's tree-sitter/HDBSCAN engine and RedAgent's own Python package are vendored in and served as FastAPI microservices; the Node app calls them and falls back to JS only if they're down.
- 🛡️ A security scanner that finds real bugs — the Security tab flagged a live committed API key and weak crypto in this very repo. Every finding ships with a CWE id, exact line, and fix.
- 🚦 Every commit is graded — a policy-as-code risk gate returns GO / REVIEW / BLOCK with a traceable evidence breakdown, and auto-opens a remediation issue on BLOCK.
- 🧠 The repo remembers — pre-mortems, institutional memory, onboarding briefings, and a conversational "Ask" all reason over your real commit history.
- 🌱 Nothing is mocked — carbon estimates, dependency graphs, migration audits, and seed data all compute on the files and commits you actually pushed.
- 🏆 Credits — hackathon winners
- 📸 Screenshots
- 🛡️ Security Sentinel (RedAgent)
- 🐍 The winners' real Python engines
- 🚀 Running it locally
- 🧩 Feature list & attribution
- 🗂️ Project layout
Every advanced feature traces back to one of these winning projects. Their real
code (GraphDev, RedAgent) runs as microservices here; the rest are ported with
full attribution in ACKNOWLEDGMENTS.md.
| Winner (prize) | Repository | How it's used here |
|---|---|---|
| RedAgent — Most Impactful | gitlab.com/…/35629156 | real package vendored + running in redagent-engine/ |
| GraphDev — Grand Prize | gitlab.com/…/35368827 | real tree-sitter engine running in graphdev-engine/ |
| LORE — Grand Prize | gitlab.com/…/35153311 | pre-mortem, memory, health, onboarding, Ask (ported) |
| Time-Traveler — Most Technically Impressive | gitlab.com/…/34562572 | migration auditor, rollback, revert, Data Smith (ported) |
| Launch Control — Easiest to Use | no public repo | policy-as-code risk gate + auto-remediation (from write-up) |
| GreenPipe — Green Agent Prize | no public repo | SCI carbon accounting + region routing (methodology) |
| Department of Incidents — Auth0 Grand Prize | no public repo | incident post-mortem + approval gate (from write-up) |
0 — Cover page. The logged-out landing page: hero with a live commit
scorecard mock (risk-gate verdict, six-axis health radar, score bars), the
six-reviewer panel with severity weights, numbered steps, a dark stat band,
and a "Ship the commit. Not the incident." CTA — all in the settled light
palette (warm-white canvas, black pill buttons, teal + mint accents).
1 — Dashboard. Left sidebar nav (Dashboard/Explore/Issues/Stars/Profile),
white stat tiles, the live cross-repo Risk-Gate activity feed (see the 🚫 60
BLOCK next to green GOs), and the Platform toolbox listing every feature.
2 — Repository page. Segmented pill tabs (Code · Commits · Issues · Health
· Graph · Security · Settings), the file browser, branch/merge controls, and
the About side panel with stars/branches/commits/issues/files and language dots.
3 — Health Audit (LORE). Grade + score, real risk-gate verdict bars
(1 GO / 0 REVIEW / 1 BLOCK), commits audited, average risk score, and language
breakdown — all computed from this repo's real commits.
4 — Carbon (GreenPipe) · Security Inventory (LORE) · Onboarding (LORE).
Real SCI carbon estimate with greenest-region routing, secret scan, files with
risky history, commit-activity sparkline, and the AI onboarding-briefing button.
5 — Graph (GraphDev) + Data Smith (Time-Traveler). Dependency graph + BFS
ripple + circular-import detection (powered by the real Python tree-sitter
engine), and the AI seed-data generator that reads your schema.
6 — Explore. Search and browse every public repository; clickable owner
names link to public profiles.
7 — Profile. Achievements (earned/locked with hints), personal Risk-gate
record chips, followers/following, and the green contribution heatmap.
8 — Issues (cross-repo). Open/Closed segmented tabs listing issues across all
your repositories — including the auto-remediation issues the risk gate opens.
9 — Commits + Risk Gate. Every commit carries its live verdict chip — note
the 🚫 BLOCK 60 on the commit that added config/secrets.txt next to the
✅ GO 0 commits — plus per-commit Revert and AI Review buttons.
10 — Sign in. Clean split-screen auth with floating product chips and the
black pill button.
The Commits tab additionally shows, per commit: the GO/REVIEW/BLOCK verdict chip, the 🌱 carbon chip, the ↩️ Revert button, the expandable risk-gate evidence panel (Launch Control), and the AI Review and Pre-mortem buttons (LORE). The Settings tab has visibility toggle + delete.
The Security tab statically scans every file pushed to a repo for the four
adversarial vulnerability classes RedAgent (GitLab AI Hackathon, Most
Impactful) hunts at runtime — prompt injection, false-data trust, state
corruption, privilege escalation — plus classic SAST: SQL/command injection,
eval, weak crypto, hardcoded secrets, XSS, and insecure transport. Every
finding carries a CWE id, exact line, severity, and a fix, and the repo gets
a 0–100 posture score, letter grade, and SECURE / REVIEW / AT RISK / CRITICAL verdict (Time-Traveler's "start high, subtract penalties, floor" model).
Proof — the engine run against this repository's own source (60 files):
posture: 40 | grade: D | verdict: CRITICAL | filesScanned: 60 | findings: 2
byClass: {"secret":1,"crypto":1}
[CRITICAL] CWE-798 Hardcoded secret / credential — backend-main/.env:39
[HIGH] CWE-327 Weak hash used (MD5/SHA-1) — backend-main/config/storage.js:59
Live in the app (real screenshots):
The Security tab — animated posture ring, CRITICAL/grade verdict, per-class
bars, and the severity filter — on a demo repo with real vulnerabilities:
Line-accurate findings on the demo service — hardcoded API key (CWE-798,
CRITICAL), TLS verification disabled (CWE-295), MD5 password hash (CWE-327) —
each with the real code snippet and a concrete fix:
RedAgent's real engine, live. The badge in the corner says it all — real RedAgent engine. Their vendored Python package's Code-Analyzer →
Hypothesis-Generator pipeline mapped this repo's attack surface and ranked the
adversarial hypotheses (prompt injection / false data / state corruption) with
the mutation and expected failure for each:
Both are genuine: a live API key committed to .env, and a SHA-1 hash in the
storage layer. Nothing is mocked — the scanner reads real file contents from the
same store the file browser uses. Powered by
backend-main/services/securitySentinel.js
via GET /repo/:id/security, rendered by RepoSecurity.jsx (posture ring,
severity filter pills, per-class bars, and dark-terminal finding cards).
RedAgent's real engine runs on top of this. redagent-engine/ vendors
RedAgent's actual redAgent Python package and runs their real Code-Analyzer →
Hypothesis-Generator pipeline (their exact agent prompts) as a FastAPI service.
The Security tab shows the attack-surface map and RedAgent's ranked adversarial
hypotheses for the repo's real source — e.g. a critical prompt-injection
hypothesis on get_repository_file.content. The JS scanner above is the offline
fallback when the engine container is down.
Two winners' actual code runs as microservices next to the app — not JS reimplementations:
GraphDev engine (graphdev-engine/) — GraphDev's actual FastAPI +
tree-sitter + HDBSCAN parser stack, on port 8900.
RedAgent engine (redagent-engine/) — RedAgent's actual redAgent Python
package is vendored in verbatim (redagent-engine/redAgent/), and the service
runs their real Code-Analyzer → Hypothesis-Generator pipeline using their exact
agent system prompts (from their scripts/run_flow_analysis.py), on port 8910.
# option A: Docker (both engines)
docker compose up graphdev-engine redagent-engine
# option B: run directly
cd graphdev-engine && pip install -r requirements.txt && uvicorn engine:app --port 8900
cd redagent-engine && pip install -r requirements.txt && uvicorn engine:app --port 8910The Node backend calls them at GRAPHDEV_ENGINE_URL (default
http://127.0.0.1:8900) and REDAGENT_ENGINE_URL (default
http://127.0.0.1:8910), and falls back to built-in JS logic if a service is
down. Verified: GraphDev's tree-sitter extracts real code units and edges;
RedAgent's engine returns a real attack-surface map + 3 ranked adversarial
hypotheses. With no AI key set, RedAgent's engine uses its own mock responses
(shipped in their script) so it still runs offline.
Requires Node 22 LTS (a newer default node may break jsonwebtoken),
MongoDB, and a .env in backend-main/.
# backend (port 3002)
cd backend-main
/usr/local/bin/node index.js start
# frontend (port 5173)
cd frontend-main
npm run dev.env keys: MONGODB_URI, JWT_SECRET_KEY, OPENROUTER_API_KEY (for AI
features), and B2_KEY_ID / B2_APPLICATION_KEY / B2_BUCKET / B2_BUCKET_ID
(for cloud storage). AI features degrade gracefully to a deterministic fallback
when no AI key is present.
| Feature | What it does |
|---|---|
| Repositories | Create, public/private toggle, delete (cascades to files/commits/issues) |
| File upload + code viewer | Commit files; syntax-highlighted viewer for 20+ languages |
| Branches + merge | Create/switch branches; source-wins merge |
| Fork | Clone another user's repo under your account |
| Commit diffs | Per-file green/red unified diffs with +/− stats |
| Stars | Star repos; dedicated Stars page |
| Issues | Open/close/delete; cross-repo Issues page |
| Cloud storage | Backblaze B2 (25 MB), MongoDB inline fallback |
| Follow users | Follow/unfollow, public profiles, followers/following |
| Profile | Contribution heatmap, achievements, getting-started checklist |
Each of these computes on your real commits/files/schema, verified end-to-end.
| Feature | How it works (dynamic) | Ported from |
|---|---|---|
| Risk Gate | Scores every commit's real changes → GO/REVIEW/BLOCK with an evidence breakdown | Launch Control (policy-as-code) |
| Repo Memory | Queries your DB for past REVIEW/BLOCK commits touching the same files; escalates the verdict | LORE |
| One-click Revert | Applies stored reverse-diffs; refuses on conflict | Time-Traveler |
| SQL Migration Auditor | Parses your real .sql diffs; penalty model + exact rollback SQL |
Time-Traveler migration_auditor.yml |
| Auto-remediation | A BLOCK commit auto-opens an issue with evidence + rollback plan | Launch Control |
| AI Pre-mortem | LLM reads your issue + repo history → failure predictions, questions, spec | LORE SPECFORGE prompt |
| AI Code Review | LLM reviews your real diff in layers (memory/security/intelligence/correctness) | LORE GUARDKEEPER prompt |
| Health Audit | Aggregates your commits → grade, verdict mix, languages, activity | LORE health auditor |
| Onboarding Briefing | LLM reads your real files/commits → new-contributor guide | LORE ONBOARDING prompt |
| Security Inventory | Scans your real file contents for hardcoded secrets | LORE health auditor |
| Security Sentinel | Static scan of your real source → RedAgent's 4 vuln classes + SAST, each with CWE + line + fix; posture score/grade/verdict | RedAgent |
| LORE Ask | Conversational search — asks Claude your question, grounded in this repo's real commits + risk-gate history | LORE (Ask agent) |
| Incident Post-Mortem | The agent writes a blameless post-mortem from your real REVIEW/BLOCK history (summary, timeline, root cause, action items) | Department of Incidents |
| Dependency Graph + ripple | Parses your real imports; BFS to find impact of a change | GraphDev |
| Circular-import detection | DFS over the import graph | LORE validate.py::_detect_cycles — ported line-by-line |
| Carbon Footprint | SCI formula on your real commit sizes; greenest-region routing | GreenPipe methodology |
| Data Smith | LLM reads your real schema → realistic seed INSERT rows |
Time-Traveler data_smith.yml |
GraphDev's and RedAgent's real Python code runs here as microservices (see above). The remaining winners are GitLab-cloud AI agents whose infrastructure cannot run inside a MERN app, so their algorithms were ported to Node/JS:
- GraphDev's UMAP + Three.js 3D viewer (kept the 2D SVG graph + real clustering)
- Time-Traveler's Docker shadow-clones on a GCP VM (kept the migration auditor + Data Smith)
- The GitLab Duo Agent Platform runtime itself (LORE/Launch Control/GreenPipe agents)
Launch Control and Department of Incidents have no public repo (private authors), so their features were rebuilt from the written descriptions, not their source. From Department of Incidents specifically: the incident post-mortem (the agent publishes a post-mortem write-up), the human-in-the-loop approval gate (the risk gate + revert confirmation), and the audit-trail activity stream (the cross-repo Risk-Gate feed on the dashboard). Its Auth0 Token Vault identity-chaining is an infrastructure concern that a single MERN app can't reproduce.
| Winner (prize) | Represented by |
|---|---|
| GraphDev (Grand) | Python tree-sitter engine, HDBSCAN clustering, BFS ripple, Graph tab |
| LORE (Grand) | Pre-mortem, AI review, repo memory, health audit, onboarding, LORE Ask |
| Time-Traveler (Technical) | SQL migration auditor + rollback SQL, one-click revert, Data Smith |
| RedAgent (Impactful) | Security Sentinel — 4 vuln classes + SAST |
| Launch Control (Easiest) | Policy-as-code risk gate, GO/REVIEW/BLOCK, auto-remediation |
| GreenPipe (Green) | SCI carbon accounting + greenest-region routing |
| Department of Incidents (Auth0 Grand) | Incident post-mortem, approval gate, audit-trail feed |
backend-main/
services/
riskEngine.js # risk gate, memory, SQL auditor, secret scan
securitySentinel.js # RedAgent Security Sentinel — SAST + 4 vuln classes
aiReviewer.js # AI review, pre-mortem, onboarding (LORE prompts)
depGraph.js # dependency graph, BFS ripple, LORE DFS cycle detection
carbon.js # GreenPipe SCI carbon accounting
dataSmith.js # Time-Traveler seed-data generator
controllers/ · models/ · routes/ · config/
frontend-main/
src/components/
dashboard/ · repo/ · user/ · auth/ (repo/RepoSecurity.jsx = Security tab)
graphdev-engine/ # GraphDev's REAL tree-sitter + HDBSCAN engine (FastAPI)
redagent-engine/ # RedAgent's REAL package + agent pipeline (FastAPI)
redAgent/ # ← their actual Python package, vendored verbatim
docker-compose.yml # runs both winner engines as containers
docs/screenshots/ # feature screenshots
ACKNOWLEDGMENTS.md # per-feature attribution to winner repos
Built by combining the seven winning ideas of the GitLab AI Hackathon 2026 into one platform.
Every algorithm is credited in ACKNOWLEDGMENTS.md · GraphDev & RedAgent run their real code.
Run on Node 22 LTS · MongoDB · optional Docker for the winner engines