lintsinghua/DeepAudit

DeepAudit – AI‑powered multi‑agent code security auditor

What it is – DeepAudit is a web‑based platform that automatically audits source code for security flaws. It drives a multi‑agent workflow (Orchestrator → Recon → Analysis → Verification) that:

1. Detects the project’s language/framework.
2. Collects an attack surface map.
3. Uses a Retrieval‑Augmented Generation (RAG) knowledge base together with static‑analysis (AST) to spot vulnerabilities.
4. Generates PoC scripts and runs them in an isolated Docker sandbox to confirm exploitability.
5. Produces a polished report (PDF/Markdown/JSON).

Why it matters – Traditional SAST tools suffer from high false‑positive rates, miss business‑logic bugs, and cannot prove that a finding is exploitable. DeepAudit tackles these three gaps by giving the AI a reasoning loop and a sandbox for live verification, while keeping data on‑premise (supports local LLMs via Ollama). The authors claim the closed‑source version has already uncovered dozens of CVEs.

---

Key features (as described in the README)

Feature	What you get
Multi‑Agent audit engine	Separate agents for planning, reconnaissance, analysis and PoC verification work together autonomously.
RAG‑enhanced reasoning	A knowledge base of security patterns is consulted to reduce noise and improve semantic understanding of code.
Local LLM support	Can run Llama‑3, DeepSeek, etc. via Ollama, so source code never leaves your network.
Sandboxed PoC execution	PoC scripts are built and run inside a Docker‑based sandbox; failures trigger automatic retries/re‑analysis.
Real‑time UI	Live audit‑flow logs, an “intelligent dashboard” showing project security posture, instant analysis of pasted code or uploaded files.
Project management	Import from GitHub, GitLab, Gitea; manage multiple projects in one UI.
Report generation	One‑click export to PDF, Markdown or JSON, with a professional‑looking security report.
Docker‑first deployment	Pre‑built images for frontend, backend and sandbox; one‑liner docker compose start‑up (with Chinese mirror options).

---

Architecture at a glance

DeepAudit (micro‑service)
├─ backend (Python 3.11+, FastAPI)
│   ├─ agents/            # orchestrator, recon, analysis, verification
│   ├─ core/              # config, sandbox interface
│   ├─ services/          # RAG & LLM wrappers
│   └─ models/            # DB schemas (PostgreSQL)
├─ frontend (React 18, TypeScript)
│   └─ Zustand state store, UI components
├─ docker/
│   ├─ sandbox/           # Docker image used for PoC execution
│   └─ postgres/          # DB container
└─ docs/                  # user docs, CVE list

---

Getting started (quick‑start)

1. One‑line Docker deployment (recommended):

   curl -fsSL https://raw.githubusercontent.com/lintsinghua/DeepAudit/v3.0.0/docker-compose.prod.yml \
     | docker compose -f - up -d
   

2. Chinese‑mirror variant (faster in China): replace the compose URL with docker-compose.prod.cn.yml or pull the three images from ghcr.nju.edu.cn.
3. After containers are healthy, open http://localhost (or the host you mapped) to reach the UI.
4. Use the Agent Audit entry to import a repository (GitHub/GitLab/Gitea) or paste code, then let the system run automatically.

---

Who might use it

• Security teams that need automated, repeatable code reviews integrated into CI/CD.
• Developers looking for a quick “security sanity‑check” before shipping.
• Bug‑bounty platforms that want to pre‑screen submissions.
• Enterprises with strict data‑privacy rules, because the tool can run entirely on‑premise with local LLMs.

---

License & community

• License: AGPL‑3.0 (open‑source backend & frontend; a closed‑source commercial edition is also mentioned).
• Stars / forks: visible on GitHub, with a small but active community.
• Contributions: Users are encouraged to report newly discovered vulnerabilities via the Issues page; the project maintains a public CVE list.

---

Bottom line

DeepAudit is a genuine software project that combines modern LLM‑driven reasoning, RAG knowledge bases, and container‑sandboxed PoC verification to deliver a more intelligent, low‑false‑positive code security audit platform. Its public repository provides the full stack (FastAPI backend, React/TS frontend, Docker deployment) and can be run locally without sending code to external services.