submit: kestarsheng-code-review-agent

submissions/mcp-hackathon/kestarsheng-code-review-agent/RIGHTS.md

@@ -0,0 +1,24 @@
+# Submission rights declaration
+
+Project: `Code Review Agent`
+Submission slug: `kestarsheng-code-review-agent`
+Submitter: `刘宇珂 (kestarsheng)`
+Date: `2026-09-10`
+
+The submitter confirms that they own, or have sufficient authorization for, the source code, dependencies, service, data, branding, and other materials submitted in this pull request.
+
+Subject to the official program terms, the submitter authorizes X-Agent to retain, reproduce, audit, test, archive, and publish the submitted program artifact for judging, fraud prevention, dispute handling, ecosystem submission, and post-award accountability. Closing the pull request, deleting a fork, or deleting an external repository does not revoke the official archive rights attached to an accepted and rewarded entry.
+
+Third-party components and their licenses:
+- `fastapi` — MIT License
+- `uvicorn` — BSD-3-Clause License
+- `openai` (Python SDK) — MIT License
+- `httpx` — BSD-3-Clause License
+- `pydantic` / `pydantic-settings` — MIT License
+- `python-dotenv` — BSD-3-Clause License
+- `fastmcp` — MIT License
+- `pytest` — MIT License
+
+Exceptions or restrictions: None. All source code in `source/` is original work of the submitter. The service calls DeepSeek's hosted LLM API at runtime; no DeepSeek software is included in the submission.
+
+This template is an operational declaration, not a substitute for event terms reviewed by qualified counsel.

submissions/mcp-hackathon/kestarsheng-code-review-agent/SUBMISSION.md

@@ -0,0 +1,59 @@
+# Code Review Agent
+
+## Capability
+
+- **One-line description:** Triple-engine code review: rule-based static analysis + AST structural analysis + LLM semantic review with cross-validation, returning a structured quality report so AI-generated code can be checked before merge.
+- **Who it helps:** Developers using AI coding tools (Claude Code, Codex, Cursor) and any AI Agent that needs a code-quality gate.
+- **Capability boundary:** Accepts a single code snippet (up to 60 000 chars), a unified diff, multiple files (structured list), or a GitHub PR/commit URL, plus optional language and context. Returns a JSON report with score (0-100), grade (A-D), five-dimension scores (correctness, security, performance, maintainability, best_practice), issues (with source attribution: rule/ast/llm/confirmed, fix_code), strengths and improvements. The rule engine covers 40 built-in rules across 9 languages (Python, JavaScript, TypeScript, Java, Go, Rust, C/C++, Shell, PHP). AST analyzer catches structural issues (undefined vars, unused imports, duplicate defs). Also provides 10 MCP tools, 12 REST endpoints, SARIF 2.1.0 export, code quality metrics, and a CLI for git-diff review. Does not execute, compile, or persist submitted code.
+
+## Live API
+
+- **API base URL:** https://code-review-agent-ashy-six.vercel.app/v1
+- **Health-check URL:** https://code-review-agent-ashy-six.vercel.app/health
+- **Authentication:** none
+- **Rate limits / known limits:** Single request limited by LLM provider timeout (120 s). Max code size 60 000 chars. Free-tier hosting may cold-start.
+- **API contract:** OpenAPI at `/docs`; request `POST /v1/review` body `{"code": string, "language"?: string, "context"?: string}`, response `{"ok": true, "language": string, "model": string, "report": ReviewReport}`. Also supports `POST /v1/review_diff` (unified diff), `POST /v1/review_files` (multi-file batch), `POST /v1/review_pr` (GitHub PR URL), `POST /v1/suggest_fix` (auto-fix), `POST /v1/metrics` (code quality metrics), `POST /v1/sarif` (SARIF 2.1.0 export). MCP endpoint at `/mcp` with 10 tools.
+
+## Source and reproducibility
+
+- **Source repository:** https://github.com/kestarsheng/code-review-agent
+- **Review commit:** `2355ff3`
+- **Source submitted in this PR:** `source/`
+- **Run tests:** `pip install -r requirements.txt && pytest tests/ -v`
+- **Run locally:** `pip install -r requirements.txt && uvicorn app.main:app --reload`
+- **Deploy:** `docker build -t code-review-agent . && docker run -p 8000:8000 code-review-agent`, Render Blueprint from `render.yaml`, or Vercel (current production deployment).
+- **Version binding:** `GET /health` returns `{"status":"ok","commit":"<commit>"}`; `GET /.well-known/xagent-verification.json` returns `{"schemaVersion":1,"slug":"kestarsheng-code-review-agent","commit":"<commit>"}`. The commit is injected via the `COMMIT` environment variable at deploy time.
+
+The API must expose:
+
+```json
+// GET /health
+{"status":"ok","commit":"2355ff3"}
+```
+
+```json
+// GET /.well-known/xagent-verification.json
+{"schemaVersion":1,"slug":"kestarsheng-code-review-agent","commit":"2355ff3"}
+```
+
+## Verification
+
+The reproducible call instructions and redacted example responses are in `verification/README.md`.
+
+- **Health-check result:** `{"status":"ok","commit":"2355ff3..."}`
+- **Capability call:** `POST /v1/review` with `{"code":"def f(x): return x/0","language":"python"}`
+- **Expected error behavior:** Empty body → 422; oversized code → 413; LLM failure → 502 `{"ok":false,"error":"..."}`.
+
+## Security and data handling
+
+- **Data collected:** Submitted code snippet, language hint, optional context. No authentication, no user identifiers.
+- **Purpose and retention:** Code is sent to the configured LLM provider (DeepSeek) for review only. The service does not persist submitted code to any database or log.
+- **Third parties / outbound network calls:** DeepSeek API (OpenAI-compatible protocol) for LLM inference.
+- **Secrets:** No secrets are committed. `LLM_API_KEY` is set as a deployment environment variable and never appears in source.
+- **Known risks / restrictions:** Vercel serverless functions have a 10 s default timeout; long code reviews may approach this limit. The LLM may occasionally produce imperfect JSON; the parser tolerates fenced/embedded JSON.
+
+## Support
+
+- **Team / builder:** kestarsheng (刘宇珂)
+- **Contact:** 2410251355@henu.edu.cn
+- **License / rights:** UNLICENSED — submission-only use for X-Agent AI MCP Hackathon 2026. Submitter owns all source and authorizes review and post-award retention.

submissions/mcp-hackathon/kestarsheng-code-review-agent/source/.env.example

@@ -0,0 +1,10 @@
+# LLM (OpenAI-compatible protocol)
+LLM_BASE_URL=https://api.deepseek.com/v1
+LLM_API_KEY=sk-xxxxxxxxxxxxxxxx
+LLM_MODEL=deepseek-chat
+LLM_TIMEOUT_SECONDS=120
+
+# Deployment identification
+COMMIT=dev
+HOST=0.0.0.0
+PORT=8000

submissions/mcp-hackathon/kestarsheng-code-review-agent/source/.github/workflows/code-review.yml

@@ -0,0 +1,76 @@
+name: Code Review Agent
+
+on:
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get PR diff
+        run: |
+          git diff origin/${{ github.base_ref }}...origin/${{ github.head_ref }} > pr.diff
+          echo "DIFF_LINES=$(wc -l < pr.diff)" >> $GITHUB_ENV
+
+      - name: Skip if empty
+        if: env.DIFF_LINES == '0'
+        run: echo "No changes to review"; exit 0
+
+      - name: Review with Code Review Agent
+        run: |
+          RESPONSE=$(curl -s -X POST \
+            https://code-review-agent-ashy-six.vercel.app/v1/review_diff \
+            -H "Content-Type: application/json" \
+            -d "$(jq -Rs '{diff: .}' < pr.diff)")
+
+          echo "$RESPONSE" > review_result.json
+
+          SCORE=$(echo "$RESPONSE" | jq -r '.report.score // 0')
+          ISSUES=$(echo "$RESPONSE" | jq -r '.report.issues | length')
+          CRITICAL=$(echo "$RESPONSE" | jq -r '[.report.issues[] | select(.severity == "critical")] | length')
+
+          echo "::notice::Score: $SCORE/100 | Issues: $ISSUES | Critical: $CRITICAL"
+
+          if [ "$CRITICAL" -gt "0" ]; then
+            echo "::error::Found $CRITICAL critical issues. Review failed."
+            exit 1
+          fi
+
+      - name: Export SARIF
+        if: always()
+        run: |
+          python3 -c "
+          import json, sys
+          data = json.load(open('review_result.json'))
+          report = data.get('report', {})
+          sev_map = {'critical': 'error', 'major': 'error', 'minor': 'warning', 'info': 'note'}
+          results = []
+          for i in report.get('issues', []):
+              results.append({
+                  'ruleId': str(i.get('rule_id') or 'llm'),
+                  'level': sev_map.get(i.get('severity', 'info'), 'note'),
+                  'message': {'text': str(i.get('title', '')) + ' — ' + str(i.get('description', ''))},
+                  'locations': [{'physicalLocation': {
+                      'artifactLocation': {'uri': str(i.get('file', 'diff'))},
+                      'region': {'startLine': int(i.get('line', 1))},
+                  }}],
+              })
+          sarif = {'\$schema': 'https://json.schemastore.org/sarif-2.1.0.json', 'version': '2.1.0', 'runs': [{'tool': {'driver': {'name': 'Code Review Agent', 'version': '1.0'}}, 'results': results}]}
+          json.dump(sarif, open('results.sarif', 'w'), indent=2)
+          "
+
+      - name: Upload SARIF to GitHub Code Scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: code-review-agent

submissions/mcp-hackathon/kestarsheng-code-review-agent/source/.gitignore

@@ -0,0 +1,23 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+
+# Environment & secrets
+.env
+.env.*
+!.env.example
+
+# IDE / OS
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db
+
+# Build / logs
+dist/
+build/
+*.log
+.vercel

submissions/mcp-hackathon/kestarsheng-code-review-agent/source/Dockerfile

@@ -0,0 +1,16 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app ./app
+COPY web ./web
+
+ENV HOST=0.0.0.0
+ENV PORT=7860
+
+EXPOSE 7860
+
+CMD ["python", "-m", "app.main"]