GhostRepo: A Local Autopsy for Abandoned Repositories, with Gemma Doing the Talking

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Every abandoned repository has a story, but the people who could tell it have usually moved on. What's left is a stale README, a few hundred commits, and a dependency file nobody has touched in years.

GhostRepo investigates repositories like these on your own machine and helps you plan their resurrection.

Point it at a local repository, choose Summon Ghost, and let it perform an autopsy.

Here's what it does:

• Examines programming languages, frameworks, Git history, dependencies, configuration, documentation, and tests. It also runs Ruff on Python code.
• Reports verified findings, each backed by evidence, a source file, and its detection method.
• Uses a locally running Gemma model to interpret those facts, keeping AI-generated findings separate and clearly labeled.
• Builds a prioritized resurrection plan and drafts a new README.
• Proposes code changes as downloadable diffs for you to review. GhostRepo never applies patches automatically.

My interpretation of the theme is simple: a quiet repository is a ghost, not necessarily a corpse.

A project with no recent commits might be finished, stable, or simply waiting for someone to discover it. GhostRepo deliberately avoids declaring a project abandoned based on commit age alone.

Demo

GhostRepo is designed as a local-first tool. It doesn't require accounts or a hosted AI service, and its API is intended to remain accessible only locally.

To try it yourself:

1. Install Ollama.
2. Pull the model:

ollama pull gemma3:4b

1. Clone the repository:

git clone https://github.com/SHWETANK-SAURABH/GhostRepo.git
cd GhostRepo

1. Start the application:

docker compose up --build

1. Clone a project you want to investigate into workspace/ and open:

http://localhost:3000

See the repository README for complete setup instructions and configuration details.

Code

The complete source code is available on GitHub:

GhostRepo — View Source Code

SHWETANK-SAURABH / GhostRepo

GhostRepo

Every abandoned repository has a story. Let's bring it back to life.

GhostRepo investigates a local repository and helps you prepare a safe recovery plan. Deterministic analyzers collect the facts. A model running on your own machine can then interpret them. Nothing is uploaded, and nothing in the scanned repository is executed or changed.

What it does

• Investigates languages, frameworks, Git history, dependencies, configuration, documentation and tests, and runs Ruff on Python code.
• Reports verified findings with severity, evidence, source file, confidence and detection method.
• Adds AI interpretation from a local Ollama model, kept separate from verified findings and labeled.
• Builds a resurrection plan in priority order, with verification steps and rough effort estimates.
• Drafts a README from verified facts and marks anything it could not confirm.
• Proposes patches as diffs you review and approve before download. GhostRepo never applies them.
• Exports reports as Markdown or JSON, with secrets…

View on GitHub

How I Built It

The stack is FastAPI, SQLite, Next.js, and Gemma 3 (gemma3:4b), running locally through Ollama.

One of the most important architectural decisions was this:

The language model never reads the repository directly.

Instead, GhostRepo follows a controlled evidence-based pipeline:

1. Collect facts: Plain Python analyzers inspect repository metadata, Git history, dependency manifests, configuration, documentation, and tests. They don't execute the repository's code.
2. Build evidence: The collected facts become structured evidence records with unique IDs. Sensitive values are redacted.
3. Ask Gemma: The local model receives the evidence as untrusted data and is instructed to cite evidence IDs when making claims.
4. Validate everything: The application validates the response schema, redacts the output again, checks every evidence reference, and applies additional claim-validation rules.
5. Present results: Verified findings and AI-generated interpretations appear separately. The model cannot turn an unsupported guess into a verified finding.

If Ollama isn't running, deterministic findings, recovery plans, README drafts, patches, and exports still work.

What Testing the Real Model Taught Me

Testing with mocks was useful, but testing against the actual model exposed problems I hadn't anticipated.

1. Structured output wasn't actually working.

Ollama rejected my original JSON schema with failed to parse grammar. A JSON-mode fallback hid the error and sometimes returned {}, which only became obvious when analyzing larger repositories.

I simplified the schema and added a live integration test that calls the real model without relying on that fallback.

2. The model ignored some of my instructions.

I explicitly told Gemma not to treat commit age as evidence of abandonment. It still rated inactivity as critical and occasionally claimed vulnerabilities or abandonment without supporting evidence.

Repeating the prompt more firmly wasn't a solution.

Instead, I added code-level claim policies that reject unsupported conclusions. Live runs subsequently discarded findings such as "Long Inactivity" and "Outdated Dependencies" when the available evidence didn't justify them.

3. Test fixtures looked like leaked credentials.

Some example credentials in test folders were being classified as critical secrets.

I adjusted the detection policy so matches in test and example paths receive lower severity rather than being treated like confirmed production credential leaks.

Security: Treat Every Repository as Untrusted

A repository can contain more than just source code.

For example, its .git/config can specify programs for Git to execute through certain configuration settings.

To address this, GhostRepo overrides Git settings such as core.fsmonitor during Git operations. I also added a hostile Git configuration test to verify that those programs aren't executed.

Ruff runs with --isolated, preventing repository-specific configuration from silently changing the checks.

The broader principle is that repository contents are data to inspect, not instructions to follow.

Current Limitations

GhostRepo is an MVP, and there are some deliberate limitations:

• Patches currently add missing project files and .gitignore entries. It doesn't yet propose arbitrary source-code fixes.
• Static analysis currently covers Python through Ruff.
• Dependency manifests are inspected offline, so GhostRepo cannot confirm whether a package is currently outdated or vulnerable.
• Tests are discovered but not automatically executed.
• Gemma can still produce incorrect interpretations. A valid evidence citation proves that the evidence exists, not that the model interpreted it correctly.
• I've tested gemma3:4b; compatibility with other Ollama models still needs further testing.

Building With an AI Coding Agent

I built GhostRepo with the assistance of a hosted AI coding agent, working from my own project brief and architecture decisions.

That distinction matters: the coding assistant helped build the application, but the open-weight model running inside GhostRepo performs the actual repository analysis.

Why Does Open Innovation Matter?

People revive old code for many reasons, and some of that code is private: a former employer's internal tool, a client project, or a personal side project with credentials still buried somewhere inside it.

Sending an entire repository to a cloud AI API just to understand its current condition isn't always a good trade.

Running Gemma locally changes that.

• Repository evidence stays on the developer's machine.
• Inference doesn't require an external AI account.
• There are no per-token API charges.
• Developers can inspect and modify the analysis pipeline.
• The model can be replaced with another compatible Ollama model.

I also restricted the configured Ollama endpoint to a local allowlist, so changing a setting can't silently redirect repository evidence to an arbitrary external service.

During a full walkthrough with the real model, I sampled the application's processes 240 times and observed no connections to non-loopback addresses.

That's useful evidence, but not proof of complete network isolation. I haven't yet tested the entire application with the network physically disconnected.

There's another reason open innovation matters here.

A tool designed to resurrect abandoned software shouldn't depend on a proprietary service that might itself disappear someday.

With the model downloaded locally, GhostRepo can continue working without an account, an API subscription, or an external inference service.

One licensing distinction is worth mentioning: Gemma's weights are openly available, but its terms are not an OSI-approved open-source license and include use restrictions. I've documented those terms in the repository and included Apache-2.0-licensed Qwen3 as an alternative worth exploring.

The Spirit of It

Día de los Muertos isn't about declaring people gone. It's about remembering them and keeping their stories present.

That's the philosophy I wanted GhostRepo to embody.

A repository's last commit isn't necessarily its final chapter. There may still be useful ideas, working code, and knowledge worth preserving.

An autopsy usually ends with a cause of death. GhostRepo's ends with a list of what's still there and what someone can do next.

For a final test, I ran GhostRepo on itself, a project that was only hours old.

The result?

• Health indicator: 62
• Ruff issues: 0
• Finding: No license file detected.

The missing license was intentional at that point, but the finding was correct.

I liked that result. A tool that simply flatters its own creator wouldn't be much use when investigating someone else's ghosts.

Sometimes resurrection starts with being honest about what's broken.

Prize Categories

Best Use of Gemma

Gemma 3 (gemma3:4b) runs locally through Ollama and powers GhostRepo's AI analysis. Its output is validated against collected evidence, checked for unsupported claims, and kept separate from deterministic findings.