PreVise/ agent console
PIPELINE IDLE — AWAITING NEXT SCAN
Predictive Visual Security Engine

Code review
that doesn't blink.

PreVise runs a multi-agent pipeline — built on IBM Bob — that reads a pull request the way four specialists would: one hunting for security holes, one for logic errors, one for missing tests, one for stale documentation. Findings are aggregated, ranked, and can be auto-patched with a re-scan gate before anything ships.

See the pipeline Browse the rule catalogue
bob_orchestrator — scan report
app/auth.py
S-01CRITICALSECRET_KEY hardcoded in source
S-04CRITICALweak JWT signing configuration
L-04HIGHunhandled jwt.decode() exception
app/crud.py
S-02CRITICALf-string SQL injection risk
S-03HIGHplain-text password comparison
L-01HIGHtransfer_funds missing balance guard
L-02MEDIUMdivide_balance: no zero-division guard
7 findings · 4 critical/high auto-fixable · gated by pytest before merge
01 — Architecture

One orchestrator, four specialists.

Bob dispatches the scan, then gates the fix behind a real test run.
Entry point IBM Bob Orchestrator — scan → report → approve → fix → verify
↓
SecuritySentinel
CorrectnessLogic
CoverageTestPilot
DocumentationDocsGuard
↓
Merge & dedupe Review Aggregator → ReviewReport (Markdown + JSON)
Live view PreVise Dashboard — approve, reject, fix
02 — Agents

Each agent owns one failure mode.

Every agent exposes the same contract: scan_file, scan_directory, list[Finding].
agents/sentinel.py

Sentinel

Security scanner — hardcoded secrets, SQL injection, plain-text passwords, weak JWT config, unauthenticated endpoints.

agents/logic.py

Logic

Correctness scanner — missing balance guards, division by zero, implicit None returns, unhandled decode exceptions.

prism/reviewers/test_pilot.py

TestPilot

Coverage scanner — missing test files, assertion-free tests, untested functions, absent edge cases and auth tests.

prism/reviewers/docs_guard.py

DocsGuard

Documentation scanner — broken file references, undocumented or missing routes, absent docstrings.

agents/aggregator.py

Aggregator

Merges every agent's findings, deduplicates by file/line/rule, classifies severity into one ReviewReport.

agents/fix_agent.py

Fix Agent

Applies approved patches keyed by rule ID, then re-scans the touched files to confirm the fix actually landed.

03 — Rule Catalogue

Reference findings from the demo app.

app/ ships with 7 intentional bugs used to exercise the full pipeline end to end.
S-01 · CRITICALSECRET_KEY hardcoded directly in source
S-02 · CRITICALSQL injection via f-string query construction
S-03 · HIGHPasswords stored and compared as plain text
S-04 · CRITICALWeak JWT — hardcoded HS256 signing key
L-01 · HIGHtransfer_funds executes with no balance check
L-02 · MEDIUMdivide_balance has no zero-division guard
L-04 · HIGHdecode_access_token leaves jwt.decode() unhandled
T- / D-series12 further checks across test coverage and docs drift
04 — Runtime

What it's built with.

The demo API and the agents that review it are separate, deliberately.
FastAPI 0.111 SQLAlchemy 2.0 python-jose (JWT) passlib (bcrypt) Flask 3.x dashboard pytest + pytest-asyncio IBM Bob orchestration
# run the demo API pip install -r requirements.txt uvicorn app.main:app --reload # run the full scan → fix → verify pipeline python -m agents.bob_orchestrator app/ --fix --run-tests