NestAI
An award-winning secure-code analysis CLI where adversarial Red and Blue AI agents evaluate software, a controller verifies findings, and the system generates a consolidated security report. Placed second out of 23 teams.
May 2025
Overview
NestAI is a secure-code analysis CLI built for a KSU AI Club hackathon. It uses adversarial agents to challenge and verify security findings before reporting them.
Problem
Security reviews often produce disconnected findings without a consistent way to challenge, verify, and prioritize them.
Solution
A Red Agent searches for weaknesses, a Blue Agent evaluates defenses, and a controller correlates their evidence into one severity-ranked HTML report.
Architecture
- 01Source input
- 02Red Agent
- 03Blue Agent
- 04Controller verification
- 05HTML security report
Technical decisions
- Use opposing analysis roles to reduce one-sided conclusions.
- Route all findings through a controller instead of merging raw agent output.
- Generate a portable HTML report so results can be reviewed without the CLI.
Biggest challenge
Multiple agents can repeat, contradict, or overstate findings unless evidence is normalized before prioritization.
Results and impact
- Placed second out of 23 teams in the KSU AI Club hackathon.
- Deployed three specialized agents and generated one consolidated report per analysis run.
Metric context: Competition result from the KSU AI Club hackathon: second place among 23 participating teams.
Testing
- Agent-output schema checks
- Finding deduplication review
- Report generation checks
Reflection
A stronger next version would benchmark findings against known vulnerable repositories and display confidence alongside severity.