CodeLens AI — Multi-Agent Code Review & Quality Platform

AI as a service to engineering teams. Submit a pull request, diff, or code snippet through the API; a pipeline of four specialist AI agents (built on Microsoft Semantic Kernel in C# / .NET) analyzes it for security, performance, style, and architectural issues; results are stored in PostgreSQL with weekly time-series bucketing; and an Angular dashboard surfaces quality trends, team scores, and automated regression alerts.

---

Architecture

Pipeline: Ingest → Fan-out (Task.WhenAll) → Merge/Dedup → Score → Aggregate (weekly) → Alert (z-score)

Solution layout

Project	Responsibility
CodeLensAI.Core	Domain entities, enums, DTOs, agent abstractions — no dependencies
CodeLensAI.Data	EF Core DbContext, PostgreSQL mapping, migrations
CodeLensAI.Agents	Semantic Kernel agents, orchestration, aggregation, scoring, regression detection
CodeLensAI.Api	ASP.NET Core minimal API, background pipeline worker, Redis cache, GitHub webhook
CodeLensAI.Tests	xUnit unit tests (scoring, regression, parsing, agents)
dashboard/	Angular (standalone components) + ng2-charts/Chart.js UI

---

The four agents

Each submission is fanned out concurrently (Task.WhenAll) to four specialist reviewers, each with a focused system prompt and a structured JSON output contract:

Agent	Looks for
Security	SQL/command injection, XSS, hardcoded secrets, insecure deserialization, weak crypto (OWASP-grounded)
Performance	N+1 queries, unbounded loops, blocking calls in async code, async void, .Result/.Wait() deadlocks
Style	Naming, dead code, complexity, magic numbers, missing null guards (language-adaptive)
Architecture	Separation of concerns, dependency direction, SRP violations, API design — runs only on 50+ line submissions

Findings from all agents are merged, deduplicated (same agent + title + line range), and scored.

Two execution modes

• Azure OpenAI (gpt-4o-mini) via Semantic Kernel IChatCompletionService — set AzureOpenAI:Endpoint and AzureOpenAI:ApiKey. Includes JSON structured output and exponential-backoff retry for 429/5xx.
• Offline heuristic agents (default when no key is configured) — deterministic regex rule-sets that keep the entire platform runnable with zero cloud dependencies. The two implementations share the IReviewAgent interface, so switching is a single DI change.

---

Scoring & alerting

• Per-category score = 100 − (critical×15 + warning×5 + info×1), clamped to [0, 100].
• Composite = mean of the four category scores.
• Weekly aggregation buckets reviews into ISO weeks (e.g. 2026-W26) and averages per category.
• Regression alerts use a z-score over the trailing 4 weeks: if the latest composite sits more than 1.5σ below the window mean, a regression alert is raised (critical below 2.5σ).

---

API

Base path: /api/v1 (versioned via Asp.Versioning). Interactive docs at /swagger.

Method	Route	Purpose
POST	/reviews	Submit code (raw, diff, or GitHub PR URL) — returns 202 + review id
GET	/reviews/{id}	Full review with agent findings
GET	/reviews/{id}/status	Poll pipeline status (Queued/Processing/Complete/Failed)
POST	/teams · GET /teams	Create / list teams
GET	/teams/{id}/dashboard	Aggregated scores, recent trend, active alerts (Redis-cached)
GET	/teams/{id}/trends?weeks=N	Weekly time-series for charts
POST	/webhooks/github	GitHub pull_request webhook → auto-queues a review
GET	/health	Health check (includes DB)

Built-in rate limiting (100 req/min/IP), CORS for the dashboard, and Swagger/OpenAPI.

See CodeLensAI.http for ready-to-run sample requests.

---

Running locally

Prerequisites

• .NET SDK 9.0+
• Node.js 20+
• Docker (for PostgreSQL + Redis) — optional, see in-memory mode below

1. Backend with Postgres + Redis (production-shaped)

docker compose up -d                 # starts postgres:16 + redis:7
dotnet run --project src/CodeLensAI.Api
# migrations are applied automatically on startup; a demo team is seeded

API comes up on http://localhost:5080 (Swagger at /swagger).

2. Backend with zero infrastructure (in-memory)

No Docker, no database, no cloud key needed — great for a quick demo or CI:

dotnet run --project src/CodeLensAI.Api -- --inmemory

This runs against an in-memory store and the offline heuristic agents. Submit the sample from CodeLensAI.http and watch findings appear.

3. Enable real AI analysis (optional)

Set these (env vars or appsettings) and restart:

export AzureOpenAI__Endpoint="https://<your-resource>.openai.azure.com/"
export AzureOpenAI__ApiKey="<key>"
export AzureOpenAI__DeploymentName="gpt-4o-mini"

4. Dashboard

cd dashboard
npm install
npm start          # http://localhost:3000  (expects API at http://localhost:5080/api/v1)

Override the API base in dashboard/src/environments/environment.ts.

---

Tests

dotnet test

Covers weighted scoring & clamping, weekly aggregation, z-score regression detection (including the not-enough-history and flat-history edge cases), structured-JSON parsing (incl. fenced output), language detection, and finding deduplication.

---

Deployment (Azure)

Component	Azure service
API	App Service (Linux, .NET 9) — Dockerfile provided
Database	Azure Database for PostgreSQL Flexible Server
Cache	Azure Cache for Redis
AI	Azure OpenAI Service (gpt-4o-mini)
CI/CD	GitHub Actions (.github/workflows/ci.yml)
Monitoring	Application Insights (wire via APPLICATIONINSIGHTS_CONNECTION_STRING)

The CI workflow builds + tests the .NET solution and builds the dashboard on every push/PR. An optional Azure deploy job is included (commented) — add your publish profile secret to enable it.

---

Tech stack

Backend: C# / .NET 9, ASP.NET Core Minimal APIs, Entity Framework Core, Microsoft Semantic Kernel, BackgroundService queue worker, StackExchange.Redis, Asp.Versioning, Swashbuckle. Frontend: Angular 18 (standalone components, signals), ng2-charts + Chart.js, RxJS polling. Infra: PostgreSQL, Redis, Docker Compose, GitHub Actions, Azure.

---

Configuration reference

Key	Default	Notes
ConnectionStrings:Postgres	local docker creds	PostgreSQL connection string
ConnectionStrings:Redis	localhost:6379	Omit to disable caching (degrades gracefully)
Database:Provider	Postgres	Set InMemory (or pass --inmemory) for infra-free runs
AzureOpenAI:Endpoint / ApiKey	empty	Blank ⇒ offline heuristic agents
AzureOpenAI:DeploymentName	gpt-4o-mini	Azure OpenAI deployment name
AzureOpenAI:ArchitectureLineThreshold	50	Min lines before the Architecture agent runs
GitHub:Token	empty	Lifts rate limits / enables private-repo PR diffs
Cors:Origins	http://localhost:3000	Allowed dashboard origins

---

License

Released under the MIT License.