CodePulse AI — Real-Time Visual Architecture & API Security Auditor

Aditya Verma — Wed, 28 Oct 2026 18:52:53 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Modern cloud infrastructure and microservice topologies are growing far too complex for manual, static security reviews. CodePulse AI is an open-source, local-first DevSecOps agent designed to bridge that gap.

It takes any architecture diagram or API flowchart, inspects its visual layout in real-time, detects security vulnerabilities (such as unprotected gateways, OWASP Top 10 vectors, or unencrypted database connections), and automatically writes executable Kubernetes NetworkPolicy and Terraform remediation patches to secure the system.

Demo

Code

AdityaVermaCode / codeplus-ai

Real-Time Multimodal Architecture & API Security Auditor built with Gemma 4 for Hacktoberfest x OSW Ahmedabad

CodePulse AI 🛡️

Real-Time Visual Architecture & API Security Auditor

Upload any architecture diagram, system design screenshot, or cloud infrastructure image — and get a full AI-powered security audit in seconds. Runs locally on your laptop. No paid subscriptions. No data sent to the cloud (unless you choose to).

How It Works

You upload an image → the AI reads it like a security expert → you get:

A Risk Score out of 100 (Critical / High / Medium / Low)
A list of every vulnerability found, with severity labels
A ready-to-use YAML/code fix for each issue
An OWASP Top 10 compliance check

The tool uses a 3-tier AI fallback so it never fails:

1. Local LM Studio (Gemma 4) — private, on-device, no internet needed
        ↓ if not running
2. Google Gemini 2.5 Flash — cloud fallback (requires API key)
        ↓ if unavailable
3. Anti-Gravity Built-in Engine —

…

View on GitHub

How I Built It

Open-Source AI Core: Powered by local Gemma 4 vision inference running via LM Studio (/v1/chat/completions vision endpoint).
Backend Pipeline: Built with FastAPI, Pydantic, and Pillow, featuring dynamic MIME-type normalization to process multi-format image payloads (forcing webp/png payloads into compatible stream formats for local VLM execution) and customized request timeouts to prevent vision model bottlenecks.
Frontend: Interactive drag-and-drop audit control panel built with Next.js and Tailwind CSS.
Resilience: Implements a multi-tier fallback mechanism (Local Gemma 4 → Cloud Gemini 2.5 Flash → Anti-Gravity Autonomous Safety Net) ensuring 100% operational uptime during live audits.

Why Does Open Innovation Matter?

Security auditing on cloud and network diagrams involves highly sensitive, proprietary infrastructure blueprints that organizations cannot risk uploading to closed, third-party cloud APIs due to strict data privacy regulations.

By building around open-weight models like Gemma 4 with local inference, CodePulse AI proves that enterprise-grade visual threat modeling can be performed 100% on-device—keeping private infrastructure diagrams completely secure on the local host.

Prize Categories

Best Use of Gemma

CodePulse AI: Real-Time Visual Architecture & API Security Auditor 🛡️⚡

Aditya Verma — Wed, 28 Oct 2026 18:38:13 +0000

What is CodePulse AI?

Modern cloud infrastructure and microservices are growing too complex for manual security reviews. CodePulse AI is an open-source, local-first DevSecOps agent designed to bridge that gap. By combining local vision-language models (powered by Gemma 4 via LM Studio) with a FastAPI backend and Next.js frontend, CodePulse AI takes any architecture diagram or API flowchart, analyzes its visual topology, detects security vulnerabilities, and instantly generates concrete Kubernetes NetworkPolicy or Terraform remediation patches.

Key Features

Private & Local-First Intelligence: Executes visual threat modeling locally on your machine using Gemma 4, ensuring sensitive enterprise diagrams never leave your hardware.
Intelligent MIME-Type & Payload Normalization: Built with a robust backend pipeline that resolves multi-format vision constraints (such as normalizing webp/png payloads) to guarantee seamless local VLM parsing.
Tiered Fallback Engine: Features a resilient multi-tier architecture (Local Gemma 4 → Cloud Gemini 2.5 Flash → Anti-Gravity Autonomous Safety Net) ensuring 100% uptime during live demos.
Actionable Remediation: Doesn't just find vulnerabilities (like unprotected gateways or plaintext database connections)—it automatically writes the exact infrastructure code required to fix them.

How It’s Built (Tech Stack)

Frontend: Next.js, Tailwind CSS (Interactive Drag-and-Drop Audit Control Panel)
Backend: FastAPI, Python, Pydantic, Pillow / Image Normalization Pipelines
AI / Vision Inference: Local Gemma 4 running via LM Studio (/v1/chat/completions vision endpoint) with Google AI Studio cloud backups.

Demo Workflow

Drag and drop any microservice topology or system architecture diagram into the web dashboard.
The FastAPI backend normalizes the image stream and pings the local Gemma 4 vision model.
CodePulse AI scans the nodes and outputs a comprehensive threat report complete with a Security Risk Score, detailed vulnerabilities (e.g., OWASP Top 10 vectors), and ready-to-deploy YAML patches.

GitHub Repository
Built For: Global Hack Week & Hacktoberfest 2026 Open-Source AI Challenge.

DEV Community: Aditya Verma