ContriBLens
ContribLens: AI agent scans GitHub repos for verified security flaws and turns them into beginner-friendly first-contribution plans.
Built at AgentX Hackathon 2026
Team Error 404: Abhinav Shukla, Kartikey, Kartik Tiwari, Ankit Gupta Ji
Built with Next.js 15 (App Router), React 19, TypeScript (strict), Tailwind CSS, Zod, Vitest, Gemma 4 / Gemini 2.5 Flash (LLM), Supabase PostgreSQL, OSV.dev, Vercel
About the project
ContribLens is an AI-agent-powered GitHub security scanner that solves two of open source's biggest problems at once: maintainers drowning in security triage backlogs, and aspiring contributors who don't know where to begin. It scans any public GitHub repository — read-only, bounded (max 60 files / 15 MB), with zero code execution — using a deterministic rule engine that checks GitHub Actions misconfigurations (over-permissive tokens, unpinned action SHAs), cross-references dependency manifests against the live OSV.dev vulnerability database, detects secrets with in-memory redaction, and audits repository health.
Every finding is grounded with a SHA-256 cryptographic evidence hash — no hallucinated vulnerabilities, ever. On this verified foundation, a 7-tool AI agent planner (fetch tree → read files → rule scan → CVE lookup → explain → draft) generates plain-English explanations — what happened, why it matters, and how to fix it — plus a 0–100 contribution readiness score.
For beginners, ContribLens turns each verified finding into a targeted 1–2 file contribution route with step-by-step test plans and a maintainer-reviewable issue draft, converting real security work into genuine first contributions. A live action log makes the agent's reasoning fully transparent, and cross-session memory lets it learn from past interactions.
Safety is engineered in, not bolted on: secrets are redacted before storage or AI prompting, critical findings are locked behind a Disclosure Guard that guides users to private responsible disclosure, and a Human Approval Gate ensures the agent drafts but never publishes — no autonomous PRs or issues.
Built with Next.js 15, React 19, TypeScript (strict), Zod validation on every input and AI output, and backed by 700+ tests, ContribLens delivers professional-grade security analysis that is verifiable, explainable, and beginner-friendly.
Code verifies. AI explains. Human approves.