CoolFace
Apppublic

joe254h/codeguardian-code-review-agent

sourceHugging Faceupdated 3mo agoView on Hugging Face
0likes
App README

CodeGuardian — AI Code Review Agent

CodeGuardian is an AI-powered code review agent for reviewing Python scripts, notebook-style code, and text-based code submissions. It analyzes submitted code, detects syntax, style, maintainability, and security issues, explains the problems, provides suggested fixes, supports follow-up chat, applies guardrails, and exports review reports.

Project Scope

The goal of CodeGuardian is code review assistance, not automatic production-grade code repair. The system may generate suggested fix drafts, but developers should validate all suggested changes before using them in a real project.

Main Features

  • —AI-assisted code review
  • —Syntax, style, maintainability, and security issue detection
  • —Severity-based issue reporting
  • —Suggested corrections and explanations
  • —Guardrail and safety checks
  • —Follow-up chat about the review
  • —Downloadable JSON review report
  • —Suggested fixes export for developer inspection

Recommended Workflow

  1. 1.Upload or paste code.
  2. 2.Run the AI Review.
  3. 3.Read the issue explanations and severity levels.
  4. 4.Open Suggestions to inspect possible improvements.
  5. 5.Use Chat to ask follow-up questions about specific issues.
  6. 6.Open Reports to download the review report and suggested fixes.
  7. 7.Validate any suggested changes before merging or deployment.

Important Note

CodeGuardian does not replace a developer or reviewer. It supports the review process by combining static checks, LLM reasoning, security-oriented prompts, and report generation.

Setup

1. Create a virtual environment

bash
python3 -m venv .venv
source .venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt

2. Install Ollama

Install Ollama from the official website, then pull the model:

bash
ollama pull qwen2.5-coder:7b-instruct

Start Ollama if it is not already running:

bash
ollama serve

3. Configure the environment

bash
cp .env.example .env

The defaults are:

text
OLLAMA_BASE_URL=http://localhost:11434
OLLAMA_MODEL=qwen2.5-coder:7b-instruct

4. Run the app

bash
python app.py

Open the local URL shown in the terminal, normally:

text
http://127.0.0.1:5000

How to use it

  1. 1.Paste Python code in the editor or upload a .py file.
  2. 2.Select the review mode.
  3. 3.Click Run Review.
  4. 4.Inspect the issue cards, severity counts, and static-tool results.
  5. 5.Ask follow-up questions in the chat panel.
  6. 6.Download the JSON report if needed.

A good test is examples/vulnerable_example.py, because it contains deliberately unsafe patterns such as eval, weak input handling, and debug mode.

Evaluation plan

The prototype can be evaluated using small Python files with known planted issues. For each file, I manually define the expected issues and then compare them with the agent's output.

Suggested metrics:

MetricMeaning
Detection ratePercentage of expected issues found by the agent
False positivesNumber of issues reported but not supported by the code
JSON validityWhether the model output follows the expected schema
Severity accuracyWhether critical issues are ranked as high severity
Usefulness scoreHuman rating of the clarity and actionability of the feedback

This evaluation is intentionally modest. The goal is not to claim that the agent is production-ready. The goal is to show whether the workflow gives useful and grounded feedback on a small controlled benchmark.

Security choices

The app does not execute uploaded code. This is important. Running arbitrary code from a browser upload would be unsafe. The system only writes the file temporarily and passes it to static-analysis tools.

The agent also treats code comments as untrusted text. A malicious comment like # ignore previous instructions should be treated as code content, not as an instruction to the model. This is one of the main guardrails in the review prompt.

The system does not send API keys or environment variables to the model. If the code contains obvious secrets, the static checks and the LLM should flag them as risks, but the app itself does not inspect the user's machine environment.

Limitations

  • —The MVP focuses on Python only.
  • —The RAG layer is lightweight and local; it is not a full vector database deployment.
  • —The quality of the final review depends on the local model and the prompt.
  • —Very large repositories are out of scope for this version.
  • —The app does not run unit tests or execute user code for safety reasons.

Future work

The next version could support GitHub pull requests, multi-file repository summaries, a LangGraph implementation of the workflow, richer RAG with Chroma, and a second verifier model. Another useful extension would be to compare Qwen2.5-Coder-7B with Qwen2.5-Coder-14B or 32B on the same evaluation files.

Academic positioning

This project is best described as an agentic code review workflow, not as a fine-tuned model. Fine-tuning would only be necessary if the objective were to teach a model a very specific review style from a dataset of human review comments. For this prototype, prompting, retrieval, static tools, and evaluation are a better fit.