Build · 3h 30m · ₹0
A real-time repository health auditor running parallel 6-dimension static analysis (Radon, Bandit, CI/CD, Tests) with live SSE event streaming and a 4-tier LLM fallback chain.
What it does
The mechanics, data flow, and user interaction model behind RepoRadar.
Paste any public GitHub repository URL to receive an interactive 6-dimensional health score across Code Quality (Radon cyclomatic complexity & maintainability index), Documentation, Dependencies, Test Coverage, CI/CD configuration, and Security (Bandit static AST scanning for secrets & unsafe calls). Six async analyzers execute concurrently via asyncio.gather against a shallow git clone (--depth 1), streaming real-time completion events over Server-Sent Events (SSE) that animate the radar chart spoke-by-spoke. A 4-tier fallback synthesis chain (Groq → Gemini → Local Ollama → Deterministic Jinja2 template) generates a prioritized fix list validated against strict Pydantic JSON schemas with embeddable SVG badges and OG preview cards.
Technical Highlights
- Parallel 6-dimension async analyzer using asyncio.gather across shallow git clones (--depth 1)
- Real-time Server-Sent Events (SSE) protocol streaming dimension scores to animate radar chart spokes live
- 4-Tier resilient LLM synthesis chain: Groq Llama 3.3 → Gemini 2.5 Flash → Local Ollama → Deterministic template
- Strict Pydantic JSON schema validation rejecting malformed LLM outputs with instant fallback
- Static analysis foundation powered by industry-standard tools (Radon AST complexity + Bandit security scanner)
Why it matters
The architectural judgment, practical engineering decisions, and core problems solved.
Evaluating open-source dependencies or vetting candidate portfolios usually requires manual inspection across multiple files and config folders. RepoRadar delivers true reliability engineering: parallel analysis driven by actual tool execution (not fake progress timers), strict schema validation that automatically rejects and falls through malformed LLM outputs, and a final zero-API-key deterministic fallback template ensuring the tool remains 100% operational even during total upstream AI outages.
Open-source due diligence before adding third-party npm/pip packages to production codebases
Engineering manager & maintainer repository hygiene audits and continuous repo grading
Candidate portfolio code review and technical depth assessment for hiring teams
Embeddable SVG health badge generation for open-source project READMEs
System architecture
End-to-end execution pipeline running across FastAPI, Radon, Bandit, Groq / Gemini, Server-Sent Events, React 19.
Executes git clone --depth 1 to fetch target repository in < 2 seconds into isolated temp directory
Runs 6 concurrent analysis modules (complexity, security, docstrings, tests, workflows, deps)
Pushes per-dimension score payloads as they finish to render dynamic radar chart spokes
Routes aggregate metrics through Groq -> Gemini -> Ollama -> Deterministic Jinja template
Emits dynamic embeddable README SVG badges and social OG preview image cards
The path
Step-by-step implementation guide. Verbatim code snippets, configurations, and prompts.
Configuring Parallel Asyncio Analyzers with Radon & Bandit
Write non-blocking analyzer wrappers that inspect Python ASTs for cyclomatic complexity and security vulnerabilities.
Verbatim Code / Config
async def analyze_repo(repo_path: str, send_sse: Callable):
tasks = [
run_radon_complexity(repo_path, send_sse),
run_bandit_security(repo_path, send_sse),
check_documentation(repo_path, send_sse),
check_test_coverage(repo_path, send_sse),
check_cicd_pipelines(repo_path, send_sse),
check_dependencies(repo_path, send_sse)
]
return await asyncio.gather(*tasks)Streaming Real-Time Dimension Events via SSE in FastAPI
Create an SSE streaming endpoint that dispatches individual analyzer outcomes to the frontend as soon as each thread resolves.
Verbatim Code / Config
@app.get('/api/analyze/stream')
async def stream_analysis(url: str):
async def event_generator():
async for event in run_pipeline(url):
yield f'data: {json.dumps(event)}\n\n'
return StreamingResponse(event_generator(), media_type='text/event-stream')Building the 4-Tier Resilient LLM Fallback Chain
Implement a cascade of LLM providers with Pydantic JSON validation that falls through to deterministic templates if outputs are invalid.
Verbatim Code / Config
async def synthesize_report(metrics: RepoMetrics) -> HealthReport:
for provider in [call_groq, call_gemini, call_ollama]:
try:
raw = await provider(metrics)
return HealthReport.model_validate_json(raw)
except (ValidationError, Exception):
continue
return generate_deterministic_template(metrics) # ₹0, 0 API keys requiredGenerating Dynamic Embeddable SVG Badges
Create an endpoint that constructs dynamic SVG badges color-coded by grade (A: green, B: blue, C: yellow, F: red) for GitHub READMEs.
Verbatim Code / Config
@app.get('/badge/{repo_id}.svg')
def render_badge(repo_id: str):
score = get_cached_score(repo_id)
color = '#10b981' if score >= 80 else '#f59e0b' if score >= 60 else '#ef4444'
return Response(content=f'<svg>...<text>{score}/100</text></svg>', media_type='image/svg+xml')Where it broke
The failure mode, root-cause breakdown, and resolution discovered during development.
The Tell
“LLM outputs frequently contained markdown wrappers (like ```json ... ```) that broke standard JSON.parse() and crashed client rendering.”
Why it failed
Even with strict prompt instructions, upstream LLM providers occasionally wrapped output in markdown code blocks or appended trailing commentary, causing JSON parse errors.
The Fix
Added a regex JSON extraction filter (re.search(r'\{.*\}', output, re.DOTALL)) paired with strict Pydantic model validation. If parsing still fails, the engine automatically catches the error and falls through to the next provider in the cascade.
What it cost
₹0 to build and run permanently within verified free tiers.
| Service / Tool | Cost | Free Tier Limits |
|---|---|---|
| FastAPI & Python | ₹0 | Open-source asynchronous backend runtime |
| Radon & Bandit | ₹0 | Open-source static analysis and security AST toolsets |
| Groq Cloud & Google Gemini | ₹0 | Free tier API tiers (Groq 30 RPM, Gemini 15 RPM) |
| Ollama Local Engine | ₹0 | Runs local quantized Llama 3 model on local machine |
| React 19 & Tailwind CSS v4 | ₹0 | Open-source frontend hosted on Vercel / GitHub Pages |
Make it yours
Three concrete variations you can build and ship using this exact foundation.
- 01
Docker Image Security & Layer Optimizer: Clones Dockerfiles, runs Hadolint static analysis, and computes image layer size optimizations.
- 02
Smart Contract Solidity Auditor: Analyzes Ethereum smart contracts with Slither and Mythril to flag reentrancy vulnerabilities.
- 03
Frontend Bundle Size & Web Vitals Predictor: Analyzes package.json and webpack/vite configs to forecast bundle bloat before deployment.
Where next
Ready to ship RepoRadar?
Review the architecture, clone the prompt and implementation steps, and deploy your live URL for ₹0.