Enterprise codebases fail not just due to syntax errors, but because of:

1. Invisible Logic Breaches: Code that runs but produces incorrect outcomes.
2. Architectural Drift: Intentional patterns being ignored over time.
3. Security Gaps: Hardcoded secrets or unsafe parsing that static linters miss.
4. Review Fatigue: Human reviewers missing subtle concurrency or performance issues.

CodeGuardian solves this by treating code review as an agentic workflow. It doesn't just "check" code; it reasons about it across multiple specialized dimensions.

Powered by the generate_fixes node, CodeGuardian doesn't just point out problems—it proposes solutions.

• Safe-Only Refactoring: Automatically addresses medium-to-high severity issues that have high confidence scores.
• Human-in-the-loop (HITL): Advanced configuration allows for mandatory developer approval before applying security or architectural fixes.

CodeGuardian executes a strictly orchestrated workflow defined in graph.py:

• Static Analysis: Pylint/Flake8/ESLint integration.
• Pattern Matching: Detects anti-patterns and suboptimal "code smells".
• Security Audit: Scans for CWE Top 25, insecure dependencies, and secret leakage.
• Performance Profiling: Identifies N+1 queries, memory bottlenecks, and complexity spikes.
• Testing Assessment: Audits test coverage and identifies "missing edge-case" scenarios.
• Logic Verification: Deep reasoning about function intent vs. implementation.

Manage your entire audit policy with a production-grade YAML spec:

• Define excluded/included directory patterns.
• Set complexity thresholds (Cyclomatic/Cognitive).
• Configure language-specific linter rules.
• Enable/Disable specific agent nodes based on performance needs.

graph TD
 Start((Repo URL/Path)) --> Init[1. Initialization & Mapping]
 Init --> Scope[2. Scope & Framework Discovery]
 
 subgraph "The Reasoning Engine"
 Scope --> Static[3. Static & Linter Check]
 Static --> Pattern[4. Pattern & Design Audit]
 Pattern --> Security[5. Deep Security Audit]
 Security --> Perform[6. Performance Bottleneck scan]
 Perform --> Testing[7. Testing & Coverage Analysis]
 Testing --> Logic[8. Deep Logic Verification]
 end
 
 Logic --> Synth[9. Synthesis & Prioritization]
 
 Synth -- Critical Issues Found --> Fix[10. Autonomous Fix Generation]
 Synth -- "No Fixable/Safe Issues" --> Report[11. Report Generation]
 
 Fix --> Report
 Report --> End((Final GitHub Issues / MD Report))

CodeGuardian generates high-fidelity reports tailored for different stakeholders:

• Markdown Summary: Optimized for GitHub Action logs and PR comments.
• JSON Structured Data: For integration into existing CI/CD dashboards (Datadog/ELK).
• GitHub Issues Integration: Automatically creates and labels issues for discovered vulnerabilities.

### 🕵️ Finding: SEC-024 (Insecure SQL Handling)
- **Severity**: 🔴 CRITICAL
- **Location**: `src/db/manager.py:84`
- **Reasoning**: User-controlled string 'query_tag' is directly interpolated into a raw SQL string, bypassing ORM protections.
- **Recommendation**: Use a parameterized query or the helper method `safe_execute()`.
- **Auto-Fix Generated**: ✅ YES (See PR Preview)

git clone https://github.com/Ismail-2001/Code-Review-and-Debugging-Agent.git
cd Code-Review-and-Debugging-Agent
pip install -r requirements.txt

Create a .env file in the root:

OPENAI_API_KEY=sk-...
# OR
DEEPSEEK_API_KEY=sk-...

Configure your standards in .codeguardian.yml.

# Analyze a local project
python main.py --path /path/to/your/project --severity high
# Analyze a specific branch
python main.py --path /path/to/repo --branch feature/login-security

• LangGraph Orchestrator: Multi-node state machine for reasoning.
• Stateful Memory: Preserves context across analysis phases.
• Configuration Layer: Full YAML-based control.

• Cross-File Dependency Mapping: Detecting issues that span multiple modules.
• RAG-Powered Policies: Auditing code against custom enterprise Wiki/Documentation.
• Interactive Debugger: A CLI loop to chat with the agent about specific files.