Stop AI Slop: I Built an Open-Source Security Layer for AI Coding Agents (Python + FastAPI)

Samitha Tharanga Wijesinghe — Tue, 18 Aug 2026 17:34:23 +0000

Stop AI Slop: I Built an Open-Source Security Layer for LLM Coding Agents

As developers, we are shipping code faster than ever thanks to AI assistants like Claude, ChatGPT, and Cursor. But let’s admit an uncomfortable truth: AI makes you faster, but it doesn't automatically make you safer.

AI models prioritize functionality and getting the logic to run over application security. Whenever I ask an AI to write a quick database query or a system utility script, it frequently returns hardcoded secrets, unsafe deserialization methods like pickle, or classic SQL injection vectors.

Instead of manually reviewing every single line or crossing my fingers during CI/CD pipelines, I decided to build a lightweight, Zero-Trust security middleware: Secure-MCP.

What is Secure-MCP?

Secure-MCP is a lightweight, local-first SAST (Static Application Security Testing) middleware designed to intercept and scan LLM-generated Python code before it ever touches a production codebase.

Under the hood, it leverages Python's robust bandit security analyzer, wrapped in a high-performance FastAPI backend, and presented through a clean, modern Glassmorphism web interface.

How It Works (The Architecture)

The Request: The developer (or an automated AI agent) submits a generated code snippet to the /api/v1/scan endpoint.
Secure Sandboxing: The backend securely writes the snippet into a temporary file (tempfile), ensuring no persistent disk pollution, and executes a JSON-formatted static analysis scan via bandit.
The Structured Report: It returns a structured JSON payload breaking down vulnerabilities by severity (High, Medium, Low), complete with exact line numbers and offending code snippets.
Rate Limiting & Protection: Built with slowapi to prevent abuse and protect public endpoint resources.

A Quick Peek at the Code

Here is a snippet showing how the core scanning service handles temporary file execution and safety cleanups:


python
import tempfile
import subprocess
import json
import os

class BanditScannerService:
    @staticmethod
    def scan_python_code(code_string: str):
        # Securely write to a temporary file
        with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as temp:
            temp.write(code_string)
            temp_path = temp.name

        try:
            # Run Bandit static analysis in JSON format
            cmd = ["bandit", "-f", "json", temp_path]
            result = subprocess.run(cmd, capture_output=True, text=True)

            # Parse the JSON report
            report = json.loads(result.stdout) if result.stdout else {"results": []}

            # Aggregate severity counts
            high, medium, low = 0, 0, 0
            for issue in report.get("results", []):
                sev = issue.get("issue_severity")
                if sev == "HIGH": high += 1
                elif sev == "MEDIUM": medium += 1
                elif sev == "LOW": low += 1

            return {
                "status": "completed",
                "total_issues": len(report.get("results", [])),
                "high_severity": high,
                "medium_severity": medium,
                "low_severity": low,
                "results": report.get("results", [])
            }
        finally:
            # Ensure cleanup happens even if something fails
            if os.path.exists(temp_path):
                os.remove(temp_path)

Building Conjecture Forge: An Open-Source AI-Assisted Mathematical Discovery Engine

Samitha Tharanga Wijesinghe — Wed, 29 Jul 2026 16:49:59 +0000

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry.

Project Overview

Conjecture Forge is an open-source, AI-Assisted Mathematical Discovery & Symbolic Computation Engine. Built using Python, FastAPI, SymPy, and React, it automatically parses mathematical expressions, computes precise derivatives, and generates intelligent mathematical hypotheses (conjectures) through a sleek dark-mode Glassmorphism UI.

Bug Fix or Performance Improvement

When users inputted malformed, highly complex, or unstructured mathematical expressions into the web engine, the backend parsing pipeline faced critical bottlenecks:

Uncaught Expression Exceptions: Invalid syntax directly crashed the FastAPI worker threads due to unhandled exceptions thrown by SymPy's parsing engine.
Performance Degradation: Heavy symbolic computations and algebraic simplifications lacked structured error boundaries and safe validation schemas, causing latency spikes in the calculation loop.

Code

Here is the core code implementation for our updated validation and error-resilient computation pipeline:

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
import sympy as sp

app = FastAPI()

class MathRequest(BaseModel):
    expression: str

@app.post("/api/compute")
async def compute_conjecture(data: MathRequest):
    try:
        # Safely parse the expression using SymPy with strict boundary handling
        expr = sp.sympify(data.expression)
        derivative = sp.diff(expr)
        return {
            "original": str(expr),
            "derivative": str(derivative),
            "status": "success"
        }
    except Exception as e:
        # Cleanly intercept parsing failures to prevent backend crashes
        raise HTTPException(status_code=400, detail=f"Invalid mathematical expression: {str(e)}")

My Improvements

To eliminate server crashes and ensure ultra-low latency, we implemented:

Pydantic Validation Guardrails:
Incoming expression payloads are strictly validated before hitting the heavy mathematical core.
Resilient Error-Catching Middleware:
Replaced generic server faults with descriptive, client-safe HTTP exceptions.
Optimized Frontend Integration:
Refactored the React frontend to handle asynchronous streaming and error responses smoothly, keeping the Glassmorphism UI fully responsive.

Best Use of Sentry

To monitor production stability and track complex runtime exceptions in our Python/FastAPI backend, we integrated Sentry Error Monitoring:

Real-time Exception Tracking: Configured Sentry SDK to capture unhandled expression-parsing anomalies and performance bottlenecks instantly.
Distributed Tracing: Monitored the request lifecycle from the React frontend down to the FastAPI/SymPy execution layer, ensuring zero latency degradation during heavy mathematical transformations.

Best Use of Google AI

Conjecture Forge heavily relies on symbolic mathematics and automated pattern parsing, which acts as the foundational layer for AI-driven mathematical hypothesis (conjecture) generation. By combining SymPy's pattern recognition with structured automated evaluation, the engine parses deep mathematical behaviors efficiently, serving as a powerful analytical tool for researchers and students.

DEV Community: Samitha Tharanga Wijesinghe