AgentVeil

What it is

• A multi-agent platform that scans a live website plus its GitHub repo, finds security and UX bugs, and opens pull requests with fixes automatically.
• Runs two agents in parallel: one probes the target site for security issues (SQL injection, broken access control, SSRF), the other drives a headless browser through the UI looking for layout breaks, console errors, and accessibility problems.
• A third agent takes whatever gets found, pulls the relevant file from the repo, generates a patch with an LLM, and opens a PR against the user's GitHub repo, closing the loop from detection to fix.

Use cases

• Point it at a side project or small web app to get a quick pass at common security and UX issues without setting up a full pentest or QA process.
• Watch scans happen live on a dashboard (streamed over SSE via Convex) instead of waiting on a batch report.
• Let the Fixer agent open a ready-to-review PR instead of just filing an issue, so a human only has to review and merge.

Tech stack

• Frontend: Next.js (React 18), TypeScript, Tailwind CSS
• Real-time data / DB: Convex (syncs scan results and logs to the dashboard as they're found)
• Agent backends: Python, FastAPI/Uvicorn (Logic Agent, UI Agent, Fixer each run as their own microservice)
• Browser automation: Browser Use (headless Chromium navigation for the UI agent)
• LLMs: MiniMax (minimax-text-01) for code-fix generation, Gemini / OpenAI for scanning and classification
• GitHub integration: GitHub API for repo reads, branch creation, and PR creation
• Deployment: Vercel (frontend), local/venv-based Python services

Project structure

app/                    Next.js app router: landing page, dashboard, API proxy routes
  api/
    fix-workflow/       Route that kicks off the Fixer agent
    run-scan/           Route that kicks off the Logic Agent scan
    ui-analyze/         Route that kicks off the UI Agent scan
components/              Dashboard UI: attack graph, breach feed, logic/UI results panels
convex/                 Convex schema, queries, mutations, and actions (breaches, logs, PR status)
logic_agent/            Security scanner, a generator/discriminator loop that probes endpoints for vulnerabilities
ui_agent/               Headless-browser UX/a11y checker, classifies the site, generates test steps, runs them, filters false positives
fixer/                  Reads the flagged file from GitHub, generates a patch with an LLM, opens the PR
public/                 Static assets (logo)
start_local.sh          Orchestrator script that starts all three Python services plus the Next.js dev server

Setup

1. Install Python agent dependencies. Each agent runs in its own virtual environment:

cd logic_agent && python3 -m venv venv && source venv/bin/activate && pip install -r requirements.txt && deactivate && cd ..
cd fixer && python3 -m venv venv && source venv/bin/activate && pip install -r requirements.txt && deactivate && cd ..
cd ui_agent && python3 -m venv venv && source venv/bin/activate && pip install -r requirements.txt && deactivate && cd ..

2. Set up environment variables. Copy the template and fill in your keys:

cp .env.example .env

BROWSER_USE_API_KEY="..."
MINIMAX_API_KEY="..."
MINIMAX_GROUP_ID="..."
GITHUB_TOKEN="..."   # needs repo scope so the Fixer can push branches and open PRs

3. Install frontend dependencies and connect Convex (requires Node 20+):

npm install
npx convex dev

This writes CONVEX_DEPLOYMENT and NEXT_PUBLIC_CONVEX_URL to .env.local. Leave this terminal running.

4. Start everything. In a new terminal:

sh start_local.sh

This starts the Next.js frontend and all three Python services. It opens http://localhost:3000 automatically. Enter a target website URL and its GitHub repo, then click Analyze.

Requirements

• Node.js 20+
• Python 3.10+
• API keys for Browser Use, MiniMax, and a GitHub personal access token with repo scope