AI-Powered Docker Repo Auditor

Six LLM agents read what three scanners found and report what is wrong with a container image. When an agent fails, the report says so rather than quietly scoring on less evidence.

View the repository on GitHub →

Code graph

Interactive code graph

Every symbol in the repo across Python, TypeScript and Terraform, extracted from tree-sitter ASTs. It is live below - search a symbol, click a node to see its neighbours, untick a community to fade it out.

2,226
nodes
4,800
edges
133
communities
0
import cycles
▶ Open full screen →
The interactive code graph, showing coloured community clusters
Graph report
Community hubs, most-connected nodes, surprising connections.
Documentation
The portal - architecture, operations, audits and design records.
README
What was built, quick start, the API and the CI gates.

What a report looks like

A full scan report for alpine:3.20 showing score, findings and per-agent timings

A real scan of alpine:3.20. In the agent panel, Vulnerability analysis reports “nothing to analyse” at 0 ms rather than being omitted, because Trivy genuinely found zero vulnerabilities. The other five agents ran in 1.8s to 4.0s.

Choosing an image

Registry
Type a reference, or take a preset.
My images
Whatever is on the daemon, with sizes.
Upload
A docker save tar, streamed to disk.

Learning trail

  1. Scanner layer - Trivy runner and deterministic reduction
  2. The CVE analyst - structured output and fail-loud parsing
  3. Parallel agents, visible degradation, failure isolation
  4. Dependent agents, the fan-in, degraded inputs
  5. The evaluation harness - recall, precision, stability
  6. Persistence - hot/cold tables, tenant keys, the Decimal problem
  7. The queue - FIFO groups, visibility arithmetic, idempotency
  8. The API - verifying tokens, limiting cost, object-level authz
  9. Real-time progress - why in-memory fan-out cannot work
  10. The frontend - two kinds of state, backoff, honest degradation
  11. Containerisation - layers, ghosts, scanning your own work
  12. Infrastructure - build order, encoded fixes, what it costs
  13. CI/CD - OIDC, matrices, rollback, the gate that matters
  14. Observability - instruments for the failures that never raise