KYRO
KYRO turns security findings into approved AI fixes, tested code and independently verified evidence.
Built at NovaStark Hacks 2026
Team Night Raid: Gaurav Wakle, Rudransh Jaiswal, Savinay Pathak, Pranad Bhale
Built with React, TypeScript, Vite, Python, FastAPI, SQLAlchemy, Alembic, SQLite, PostgreSQL, Docker, Qwen, Ollama, llama.cpp, Tree-sitter, Semgrep, OSV-Scanner, Trivy, GitHub Actions
About the project
Developers receive security alerts but still need to investigate their relevance, identify compatible fixes and check for regressions. KYRO connects these steps in one local-first software security and engineering workspace.
KYRO retrieves authorized GitHub repositories, indexes source code and dependencies, and runs Semgrep, OSV-Scanner and Trivy. It preserves scanner evidence and explains contextual priority. A local Qwen model proposes a remediation plan. After explicit approval, KYRO applies the change inside a restricted Docker workspace, runs builds and tests, independently rescans the code and generates a reviewable evidence report.
Our recorded calculator example completed this workflow: findings changed from 22 to 21, with zero new findings. Four original tests, six additional regression tests and twelve sandbox checks passed. The remaining 21 findings are disclosed. We also demonstrate rejection of an unsafe patch and bounded recovery after an interrupted job.
KYRO aims to reduce manual investigation and make AI-generated changes easier to review. It currently runs locally through Docker. Public hosting, public URL-only repository import and live product-generated remediation pull-request acceptance remain pending.