Gitzilla: I Turned GitHub Repos into Monsters You Fight with Your Phone (with ~40 AI Agents and 20 Minutes of Sleep)

WIlf Lin — Wed, 28 Oct 2026 01:07:16 +0000

This is a submission for the MLH x DEV Writing Challenge

What I Built

Gitzilla turns GitHub repositories into pixel-art monsters, and turns the phones in your pockets into motion controllers.

One person opens a room on a big screen. Everyone else scans a QR code and plays from their phone's browser: no app, no gamepad. Tilt to move, flick to attack, swipe to dash, draw a circle in the air for your skill. Your repo is your fighter, and somebody else's repo is the boss.

The monster isn't random. Its body is the architecture:

the heart is the most-imported file (highest fan-in);
the limbs are the top components, weighted by lines of code, and breaking one removes the attacks it powers;
circular dependencies (found with Tarjan's SCC algorithm) glow as weak points.

Gitzilla downloads a bounded tarball, parses imports across 9 languages in memory, and fixed rules turn those signals into stats. Flask, with 6,000+ days of history, becomes an ancient abyssal serpent with five limbs. Ripgrep is mostly Rust and spread across many modules, so it fights with a cannon and gets a Firewall skill.

There are three modes:

Co-op Raid: up to 8 players take down one boss. When it dies, the autopsy shows it as a git diff of the broken components, with links to real good first issues ("Adopt an Organ").
PvP Royale: 2–8 players, no respawns, and a shrinking "garbage-collector" zone. You sign in with GitHub and fight as a repo you actually own or maintain. Last hero standing wins.
Classroom: a teacher hosts up to 30 students working through nine beginner Python lessons in an in-browser editor. Every improvement to a student's code damages a shared class boss. The projector never shows who's struggling, and the teacher gets a debrief of what to reteach and who needs help.

Flip a switch and the whole match re-renders in 3D, with every sprite rebuilt from voxels. In Safari on Apple Vision Pro, WebXR puts the arena on your table, and your phone stays the controller.

How the idea evolved

We came to HackPSU with a list of ideas. Then the Mystery Stack was revealed (phone motion control, 4+ players, theme: Rivalry), and we decided to go for it.

One idea on our list was "Repo Kaiju": a developer fighting their own repo. To fit the Mystery Stack, we redesigned it around motion controls and made it a squad-vs-boss fight. Then we added a PvP battle royale, because rivalry is more fun when it's personal. A teammate wasn't sold on the name, so I asked Claude for a pile of alternatives, and we picked Gitzilla.

After that, the project grew one track at a time:

Gemini was already designing our monsters and heroes.
Nittany AI Challenge: I wanted something with real social value, not just fun, so we built Classroom mode.
Vultr: we moved the game server to the cloud.
Solana: we added tamper-evident match records.
We still had time left, so we asked how to make it cooler. The answer was WebXR and Vision Pro.

How we built it: one Claude, ~40 agents

This is the part I most want to share. The whole build ran inside herdr, a terminal workspace for running many coding agents. I started one Claude Code session as the coordinator, and it spun up about 40 other agents inside herdr:

Claude coordinated everything and wrote all the frontend. For visuals, I fed it screenshots of pixel-art games as references and told it to go full "visual maxxing."
Codex, which I ran in ultrafast mode the whole weekend, wrote the game logic, the algorithms and the backend.

The first playable version took 40 minutes.

The collaboration setup was just as important. All four of us SSH'd into one shared dev machine and directed the agents from there. Nobody had to sync branches or ask "wait, which version are you on?". We also took over the meeting room TV and put herdr on it, so the whole room could watch dozens of agents working live: panes scrolling, tasks finishing, new ones spinning up. It doubled as our team dashboard and as entertainment for anyone walking past.

That changed how our team worked. Whenever someone pitched a new feature, I'd say "we... can build that," hand it to the agents, and watch it land. Our bottleneck stopped being typing speed and became how fast we could come up with ideas, test them, and decide.

Everything was verified, not vibed: Vitest for the simulation and contracts, and Playwright for end-to-end playtests with multiple simulated players. We also wrote an automated flash checker, so no frame breaks WCAG 2.3.1 photosensitivity limits.

The hardest part: making motion feel right

The hardest problem wasn't the networking or the parsing. It was turning phone motion into the action you meant. Here's what we kept fighting:

Intuitive: the gestures had to feel natural without a manual. Tilt has to follow the screen in any orientation, on iPhones and iPads alike.
Separate: gestures interfered with each other. A hard flick could also read as a tilt, and a dash could also read as a circle.
No false triggers: a player who's just laughing and waving their phone around shouldn't fire.
No missed triggers: a gesture that was clearly made sometimes didn't register.
Right direction: some moves sometimes went the wrong way.

There was no clever shortcut. We playtested like crazy, with four people swinging phones at a TV, reported every misfire back to the agents, and iterated. What came out: tilt to move, tap or flick to attack, swipe or tip past 50° to dash, and a circle (phone upright) for your skill. There's also a training flow that teaches each gesture, plus touch-only and seated fallbacks so nobody gets left out.

What I learned

Honestly? This was the first time I realized I'm way more capable than I thought. With the right orchestration, one person directing a fleet of agents can ship what used to take a whole team a month. The skill that mattered most wasn't writing code. It was knowing what to build, breaking it into pieces, and refusing to accept "it works on my machine" until four real phones agreed.

Demo

Play it: https://gitzilla.wilflin.me (open ?screen=1 on a big screen, then join from your phones)
Guided demo deck: https://gitzilla.wilflin.me/demo
Devpost: https://devpost.com/software/gitzilla
Code: https://github.com/gfhdhytghd/Gitzilla

Partner Technologies

Gemini API: the art director, never the referee

Gemini designs every monster and hero. For each public repo, we send it signals from the analysis, such as the repo's own identifiers, components and age. It returns schema-constrained JSON: a name, an epithet, a palette, taunts, and attack and limb names. Flask became "WSGI-Ouroboros."

The key design decision: Gemini never sets combat stats or drives the boss AI. Stats are deterministic and come from the code analysis, so the game stays fair and explainable, and Gemini makes it feel alive. Every response is validated locally before anything renders.

Gemini worked really well for this, and structured output made it safe to plug straight into the game. Our one worry was rate limits during a live demo with a room full of people, so we built a fallback chain: Gemini → DeepSeek → deterministic designs. The game never blocks on a model call.

Gemini also narrated our pitch video, using Gemini TTS.

Auth0: GitHub sign-in that actually means something

In a royale, "your repo vs. my repo" only matters if it's really your repo. Farhan built the Auth0 integration:

sign-in is GitHub-only, through an Auth0 GitHub social connection (OIDC + PKCE);
the server fetches the GitHub identity token through the Auth0 Management API, and that token never leaves our server;
the server uses it to check, through the GitHub API, that you own a non-fork repo or maintain a public one, and re-checks at match start.

The same identity links your phone as the controller for your seat on a big screen or a Vision Pro. Farhan said the experience was really smooth: the GitHub connection plus the Management API gave us exactly the trust boundary we needed without building auth ourselves.

Vultr: from a tunnel to a real cloud

At first, the backend ran on my personal laptop, tunneled to my own server with nps/npc. That's fine for a demo, but fragile for a real event. So we moved the authoritative game server to a Vultr Cloud Compute instance, where it handles rooms, the 30 Hz simulation, 20 Hz WebSocket snapshots, repo analysis, the classroom engine and receipt storage.

My part was creating the account, adding credit and handing over an API key. Codex did the rest: a dedicated systemd service, Caddy for TLS, and a deploy script that ships immutable git revisions, backs up state, health-checks the fresh process and rolls back automatically if anything's off.

What I liked most is that Vultr is a compute platform that scales easily and on demand. We could start small and grow if Gitzilla takes off, at a price that's reasonable for a student project.

Solana: a leaderboard you can't quietly rewrite

This was my first blockchain project ever. Before this, I'd only used crypto, never built on it. Claude and Codex walked me through every step of the setup:

Signed receipts: after an eligible royale, every player can download an Ed25519-signed match receipt. No wallet is needed to play.
Optional anchoring: sign one message with Phantom or Solflare, and Gitzilla sponsors a Solana devnet Memo transaction carrying the receipt ID and a salted SHA-256 digest. No names, repos or code go on-chain.
"⛓ Verified on Solana" leaderboard: each snapshot is hashed into a Merkle tree, and the root is anchored in a single devnet Memo. Each row has a verify button that checks its inclusion proof in your browser.

To be precise about what this proves: it makes the server's recorded history tamper-evident, so it can't be silently rewritten after anchoring. It doesn't prove fair gameplay.

I was genuinely surprised that it just worked. Our first anchor finalized on devnet at slot 514,986,981, from a real two-player royale.

Hackathon Experience

I attended HackPSU Fall 2026 at Penn State.

Our team came together in a slightly roundabout way. Eva, Farhan and Nareh had formed a team on Discord, and Eva, whom I'd met at OpenAI DevDay, invited me to join. We ended up with a pretty clean split:

I did the main coding, which really meant directing the agents;
Nareh owned the UI design and hand-drew the Gitzilla logo;
Farhan built the Auth0 integration and polished details in Cursor;
Eva ran everything else: organization, every piece of paperwork and our UX testing.

The weekend was strange in the best way. Because the agents shipped so fast, we had time a hackathon usually doesn't give you: we walked downtown twice for proper sit-down meals, and we even watched Harry Potter and the Goblet of Fire together. The rest of the time we brainstormed, playtested, and swung our phones at a TV like maniacs. I slept for about 20 minutes, face-down on the desk. My agents didn't stop once. My teammates got a more civilized 2–4 hours.

The moment I'll remember most came near the end, when I showed my teammates the Vision Pro build. Same match, now sitting on a real table, with the phone still in your hand as the controller. They thought it was absolutely insane.

Gitzilla started as a joke about technical debt being a monster. By Sunday it had become a party game, a rivalry engine, a classroom tool and an XR demo. Your codebase is a monster. Come fight it. 🦖

DEV Community: WIlf Lin