RepoPilot

RepoPilot is an open-source GitHub repository analysis and problem-solving tool based on FastAPI and LangChain; the backend and complete test suite are now finished and open-sourced, while the frontend is still under development.

When tested with ollama/ollama, RepoPilot gave it a D rating because of its official install command curl -fsSL https://ollama.com/install.sh | sh; this is not a malicious verdict but a reminder to read the script before running it.

Packing requests into the AWS Lambda zip hits a wall: the urllib3 it bundles imports content removed in Python 3.12; after rewriting the GitHub scraper with the standard library, the RepoPilot package shrank from 400KB to 13KB.

RepoPilot chose Nova Pro over Claude because the task is essentially narration rather than reasoning, and the scores were already determined by Python; in narration scenarios Nova Pro is cheaper per token and fast enough.

RepoPilot's 0-100 score consists of five weighted dimensions: security 30%, trustworthiness 25%, maintenance 20%, maturity 15%, and documentation quality 10%, with every point traceable to signals in repository metadata and files.

RepoPilot's tech stack includes: Amazon Nova Pro on Amazon Bedrock for reasoning and narration, AWS Lambda (python3.12) hosting the Agent, Amazon API Gateway in front for the Web UI to call, a local CLI based on the Strands Agents SDK, and seven pure-Python tools that feed inputs to the scoring engine.

In RepoPilot's architecture, the 0-100 score, severity flags, and version detection are all computed deterministically in Python and can be unit-tested without touching AWS; the LLM only narrates the facts produced by the tools and never touches the score.

The first version of RepoPilot's security scanner produced false positives because the Flask documentation mentions 127.0.0.1; after tuning it now ignores localhost and private address ranges while still catching public-IP installers.

RepoPilot is an AWS Agent that points at any public GitHub repository and gives a 0-100 trust score within one or two minutes while flagging dangerous installation steps, built by Sarvar Nadaf.

The whole RepoPilot project has 25 tests, including 200 random repositories, to prove the weighted formula never produces contradictory results and that severe flags always cap the grade.

The core architectural requirement of RepoPilot is modularity, avoiding merging the repository parser, context builder and LLM integration into one hard-to-maintain large service.

RepoPilot's frontend uses Vue 3 and TypeScript, the backend is Python and FastAPI, code analysis relies on the TypeScript Compiler API / ts-morph, authentication uses Auth0, and background processing uses asynchronous tasks and workers.

RepoPilot's indexing pipeline uses different strategies for different languages: JavaScript and TypeScript use the TypeScript compiler ecosystem (ts-morph), Python uses the Python AST, and Java uses comment-aware source scanning.

RepoPilot uses AST parsing to extract structured information such as imports and exports, functions and classes, method signatures, relationships between source files, and relevant code snippets.

After AST parsing, RepoPilot builds a repository dependency graph in which nodes represent files or modules and edges represent reference relationships (such as imports), used to traverse related dependencies starting from a selected file to collect context.

RepoPilot completely separates the code analysis pipeline from the AI generation pipeline, with the flow being: Git repository → repository parser → dependency graph → context builder → prompt builder → LLM provider → generated tests or AI response.

RepoPilot's context builder is responsible for selecting and trimming relevant code snippets from the repository based on the dependency graph and task type, outputting a structured context object; the prompt builder receives that object and applies task-specific templates to generate LLM instructions.

RepoPilot supports generating test cases by describing business scenarios in natural language; the system needs to map scenario keywords to repository entities, then combine them with the dependency graph to locate the implementation code and generate tests.

The author of RepoPilot believes that AI-generated tests still require developer review and execution, and that AI-generated tests do not automatically equal a proof of correctness.

The author of RepoPilot believes that deterministic code analysis (AST) and generative AI are complementary: AST provides structural information, and the LLM helps interpret that information and generate output.