This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine.
What I Built
Every developer leaves traces. Every repository holds memories. And nothing on GitHub ever tells the whole story at first glance.
I built RepoGhost, an AI-powered GitHub investigation tool that lets you summon a public developer profile, question it about its work, uncover its projects, and investigate the evidence left behind across its repositories.
Enter a GitHub username, and the investigation begins.
What does this developer build? Which technologies appear in their projects? What has changed recently? Which repositories seem worth investigating? What evidence supports their experience with a particular technology? Which projects might need attention, and where could someone contribute?
Instead of giving you one static summary and leaving you to figure out the rest, RepoGhost lets you continue the interrogation. Ask follow-up questions about the account and its public work. Investigate the answers. Follow the source links. Dig deeper.
It's meant to feel like questioning a ghost that has been watching the developer's public GitHub trail.
But this ghost has rules.
It can only speak from the evidence it can find. It doesn't have access to a person's private life, private repositories, or hidden knowledge. When the public trail doesn't support an answer, RepoGhost should expose that limitation instead of inventing a story.
Beyond account investigations, RepoGhost can compare two public GitHub accounts against a specific goal, assess visible project evidence for a role, investigate repository health, and recommend relevant projects and real contribution opportunities.
I also interpreted Ghost in the Machine through the forgotten corners of open source: repositories that have gone quiet, abandoned-looking projects that may still contain valuable ideas, and software whose original purpose deserves another look.
A quiet repository isn't necessarily dead. Sometimes, the evidence simply hasn't been examined closely enough.
RepoGhost is where you go when you want to ask the codebase questions—and see what answers come back from the darkness.
Demo
The ghost is waiting.
Enter a public GitHub username or investigate a repository, then explore the evidence and ask follow-up questions about the account's public work.
Code
Every ghost leaves traces. This one leaves its source code in the open.
Examine the RepoGhost source code on GitHub
The repository contains the application code, configuration examples, and automated tests for the investigation and intelligence workflows.
How I Built It
RepoGhost is built with Node.js, HTML, CSS, and JavaScript. It uses the GitHub REST API to collect public evidence and OpenRouter to run Google's open-weight Gemma 4 26B A4B IT model.
The AI isn't just a decorative chatbot. It helps interpret the evidence collected by the application and powers the project's analysis and account-questioning experience.
The investigation works in several stages:
1. The summoning. A visitor supplies a GitHub username, public profile URL, or repository URL. RepoGhost discovers the relevant public account or project.
2. The trail of evidence. The application collects information such as repository metadata, README content, languages, recent commits, open issues, and release information when available. Account investigations can use public repository information and a bounded sample of recent commits.
3. The interrogation. Gemma helps answer questions and interpret the evidence. Users can ask follow-up questions about a public account's projects, technologies, and recorded activity rather than starting a completely new investigation every time.
4. The source check. RepoGhost validates AI-generated source references against the evidence actually collected. Unsupported references are discarded, and missing evidence is treated as a limitation—not an invitation to invent an answer.
5. The investigation continues. Users can assess a developer's public portfolio for a role, compare two accounts against a goal, investigate potential maintenance risks, or discover projects and contribution opportunities.
I also built the application to handle missing information and upstream failures explicitly. A missing release or README shouldn't automatically mean a repository is dead, and a temporary AI-provider failure shouldn't be disguised as a successful investigation.
The result is a tool that combines deterministic data collection, evidence validation, and AI-assisted interpretation. The model helps interpret what the application discovers; the application is responsible for collecting the evidence and enforcing its validation rules.
Why Does Open Innovation Matter?
A ghost story becomes less convincing when you can't inspect what is happening behind the curtain.
That's one reason open innovation matters to RepoGhost.
The application uses Gemma, an open-weight model, rather than building its intelligence exclusively around one proprietary model. Its prompts, evidence-handling logic, validation rules, and surrounding application code are available for people to inspect, adapt, and improve.
Open weights make the model choice more flexible. RepoGhost's inference configuration is separated from its GitHub evidence collector and frontend. This creates room to experiment with compatible models and inference providers without rebuilding the entire application.
Open code makes the investigation easier to examine. Developers can inspect how information is collected, how the model is instructed to answer, and how the application checks its source references. The goal isn't to make an AI sound omniscient; it's to make its findings easier to question.
Open innovation leaves the door open. The hosted version currently uses OpenRouter, so it requires an internet connection and sends the material needed for inference to the configured provider. It is not an offline application today. However, the separated inference layer creates a path for operators to explore compatible self-hosted open-weight models later.
A closed model could also answer GitHub questions. My argument isn't that open-weight AI magically makes every answer better. It's that developers deserve more choice in how they run, inspect, and adapt the systems they build.
And for a project about investigating public evidence, that matters. The ghost may help interpret the trail, but people should be able to examine how the ghost works.
My Agent Session
Optional: Add a DevRelay agent session link here if available.
The Spirit of It
Imagine discovering a GitHub profile belonging to a developer you've never met.
At first, all you have is a username.
You open their repositories. One project catches your attention. You inspect its README, look at the languages, follow a few commits, and begin to wonder what the developer has actually been building.
Then you start asking questions.
What are their most relevant projects? What technologies can you see evidence of? What changed recently? Which repository should I investigate next? What can the public record tell me about this developer's work?
The username becomes a trail. The trail becomes evidence. And the evidence gives you new questions to ask.
That's the feeling I wanted RepoGhost to create: not just looking at a profile, but summoning its public history and questioning what remains.
The ghost isn't magic. It doesn't know someone's secrets, and it cannot answer every question truthfully when the evidence isn't there. But it can help reveal patterns that might otherwise remain buried in a long list of repositories and commits.
And when the evidence ends, the ghost should say so.
Because the scariest thing an AI can do isn't admit that it doesn't know.
It's confidently tell you a story that never happened.
Prize Categories
- Best Use of Gemma — Gemma powers RepoGhost's AI-assisted repository analysis and account intelligence.
- Best Use of Render — RepoGhost is deployed as a live web application on Render.
Top comments (0)