Cybersecurity Analyzer

An AI-powered web application that analyzes Python code for security vulnerabilities using static analysis, agentic orchestration, and LLM reasoning. Semgrep is integrated through an MCP server, all workflows run through the OpenAI Agents SDK, and full observability is enabled via OpenAI Traces.

---

🚀 Overview

The Cybersecurity Analyzer blends multiple layers of intelligent analysis:

• OpenAI Agents SDK to orchestrate multi-step reasoning workflows
• Semgrep static analysis delivered through an MCP server
• FastAPI backend coordinating tools, agents, and LLM calls
• Next.js/React frontend for a clean and intuitive user interface
• OpenAI Traces for deep observability of agentic operations
• Dockerized architecture deployable across Azure, AWS, and GCP
• Terraform to automate infrastructure provisioning

---

🧠 Key Features

🔍 Agentic Code Analysis (OpenAI Agents SDK)

Handles:

• Tool-calling sequences
• Semgrep MCP execution
• LLM reasoning & remediation steps

🛡️ Semgrep via MCP Server

Provides:

• Clean tool boundary
• Portable execution
• Extensibility for new tools
• Auto-discoverable tool interface

📈 Full Observability with OpenAI Traces

Traces include:

• Tool call timelines
• LLM reasoning visualization
• Error debugging
• Performance metrics

🖥️ Modern Frontend (Next.js)

Supports:

• Code upload/paste
• Real-time analysis
• Combined result rendering

⚙️ FastAPI Backend

Manages:

• Agent execution
• Tool calls
• Result merging

☁️ Cloud-Native Deployment

Compatible with:

• Azure Container Apps
• GCP Cloud Run
• AWS App Runner

---

📁 Repository Structure

code-security-analyzer/
├── frontend/
├── backend/
│   ├── api/
│   ├── mcp/
│   ├── agents/
│   └── core/
├── assets/
│   ├── logo.png
│   └── architecture.png
├── terraform/
│   ├── azure/
│   ├── gcp/
│   └── aws/ (planned)
├── Dockerfile
└── .env.example

---

🧩 Technology Stack

Layer	Technology
Frontend	React, Next.js, TailwindCSS
Backend	FastAPI
Agent Orchestration	OpenAI Agents SDK
Static Analysis	Semgrep (via MCP)
Observability	OpenAI Traces
Infra	Docker, Terraform
Deployment	Azure, GCP, AWS

---

🔧 Local Development

1. Clone Repo

git clone https://github.com/emsikes/code-security-analyzer
cd code-security-analyzer

2. Configure Environment

cp .env.example .env

3. Run with Docker

docker build -t code-security-analyzer .
docker run -p 3000:3000 -p 8000:8000 code-security-analyzer

---

☁️ Deployment

Azure Container Apps

cd terraform/azure
terraform init
terraform apply

GCP Cloud Run

gcloud run deploy cybersecurity-analyzer   --source . --platform managed --region us-central1

AWS App Runner

aws apprunner create-service   --service-name cybersecurity-analyzer   --source-configuration ImageRepository={...}

---

🖼️ Architecture Diagram

---

🛠️ Optional: Run Semgrep Manually

semgrep scan --config=auto ./backend

---

🤝 Contributing

PRs welcome!

📄 License

MIT License.