RepoPilot — Local-First Repository Intelligence

Inspect unfamiliar codebases, search source, and ask questions against a local language model.

RepoPilot combines a FastAPI ingestion/indexing backend, a React interface, and optional Ollama inference. It accepts public GitHub repository URLs or ZIP files, produces an inspectable source tree, and answers questions using bounded repository context.

Architecture priorities: fail-closed import validation, bounded ZIP extraction, collision-safe storage, reproducible tests and explicit local-only security boundaries.

No paid model API key is required. Ollama is optional for source indexing and search.

---

✨ What RepoPilot does

GitHub Repository
       ↓
   Git Clone
       ↓
 Source Indexer
   ↙    ↓     ↘
Search  Health  File Tree
       ↓
Relevant Code Context
       ↓
Ollama + Local LLM
       ↓
Developer Answer

Main features

• 🔗 GitHub repository cloning
• 🌳 Interactive file tree
• 🔎 Real source-code search
• 🧠 Ask AI about the codebase
• 🏗️ Architecture explanation
• ❤️ Repository health score
• 📊 Language and code statistics
• 🔒 Local-first AI
• 🚫 No paid AI API
• 🛡️ Does not intentionally run imported project scripts (Git and ZIP parsing still execute inside the local backend; see the threat model)
• 🌙 Dark mode
• 🎨 Cartoonish / meme-ish student UI

---

Import trust boundaries

The ZIP ingestion security analysis explains validate-first extraction, 50 MiB archive/200 MiB output bounds, duplicate-path and symlink rejection, atomic private directory reservation, and rollback. The GitHub import security analysis explains strict HTTPS URL validation, Git configuration isolation and remaining risks.

Scope: a trusted local developer machine. RepoPilot is not an independently audited sandbox or production-ready unauthenticated Internet service.

Verified HTTP walkthrough

Beyond screenshots, RepoPilot runs a reproducible API smoke test in CI. It uploads and indexes a real ZIP fixture, searches source, exercises repository inventory and safe cleanup, and tests the model request path with a clearly identified deterministic stub. It requires no API keys or running Ollama instance. Check the latest CI run.

🖼️ Screenshots

Dashboard

Repository Analysis

Ask AI

Code Search

Architecture

File Tree

---

🤖 Local AI

RepoPilot uses Ollama instead of a paid cloud AI API.

Recommended starter model:

llama3.2:1b

Install it:

ollama pull llama3.2:1b

Run it:

ollama run llama3.2:1b

You can also change the model through the OLLAMA_MODEL environment variable.

For example:

$env:OLLAMA_MODEL="llama3.2:3b"

A larger model can provide better explanations if your machine has enough RAM.

---

🛠️ Tech Stack

Layer	Technology
Frontend	React
Build tool	Vite
Backend	FastAPI
Language	Python
Local AI	Ollama
LLM	Llama 3.2
Git operations	Git CLI
HTTP	REST API
Styling	Custom CSS
Icons	Lucide React

---

💻 Requirements

Recommended:

• Windows / macOS / Linux
• Python 3.12
• Node.js 18+
• Git
• Ollama
• 8 GB RAM recommended
• Internet connection for cloning public GitHub repositories

Python 3.12 is recommended for a predictable backend setup.

---

🚀 Installation

1. Clone RepoPilot

git clone https://github.com/harshitethic/RepoPilot.git
cd RepoPilot

---

🧠 2. Install Ollama

Install Ollama, then:

ollama pull llama3.2:1b

Test it:

ollama run llama3.2:1b

Keep Ollama running.

---

🐍 3. Backend

Create a Python environment:

py -3.12 -m venv .venv

Activate it:

.venv\Scripts\Activate.ps1

Upgrade pip:

python -m pip install --upgrade pip

Install dependencies:

pip install -r backend\requirements.txt

Start FastAPI:

cd backend
python -m uvicorn app:app --host 127.0.0.1 --port 8000

You should see:

Uvicorn running on http://127.0.0.1:8000

Keep this terminal open.

---

🌐 4. Frontend

Open another terminal:

cd frontend
npm install
npm run dev

Open:

http://localhost:5173

---

🧩 Recommended 3-terminal setup

Terminal 1 — Ollama

ollama run llama3.2:1b

Terminal 2 — Backend

.venv\Scripts\Activate.ps1
cd backend
python -m uvicorn app:app --host 127.0.0.1 --port 8000

Terminal 3 — Frontend

cd frontend
npm install
npm run dev

Then visit:

http://localhost:5173

---

🧪 Try it

Paste a public GitHub repository such as:

https://github.com/fastapi/fastapi

Then click:

Analyze repository

After indexing, try:

Ask AI

Where is the main application entry point?

How does the API request flow work?

Where is authentication handled?

Where is the database connection created?

Code Search

Search for:

router

or:

authentication

or:

FastAPI

Architecture

Click:

Explain architecture

RepoPilot will send relevant repository context to the local Ollama model and generate an explanation.

---

❤️ Repository Health

RepoPilot intentionally uses a transparent heuristic instead of pretending an AI-generated number is an objective engineering metric.

It checks signals such as:

• README
• Tests
• .gitignore
• Package/dependency manifest
• GitHub Actions / CI
• Docker configuration
• Source files
• Project size

For example:

Repository Health

60 / 100

✓ README
✓ Package / Manifest
✗ Tests
⚠ .gitignore
✗ CI / CD Workflow
✗ Docker Support

The score is not a security audit.

It is simply a quick project-quality signal.

---

🔒 Security & privacy

RepoPilot is deliberately conservative.

It does:

• Clone public GitHub repositories
• Read source/documentation files
• Search source code
• Send selected code context to your local Ollama server

It does NOT:

• Execute cloned repository code
• Run npm install inside the cloned repository
• Run arbitrary repository scripts
• Require OpenAI/Gemini API keys
• Upload your repository to a cloud AI service

The local clone directory is ignored by Git:

backend/repos/

---

📁 Project Structure

RepoPilot/
│
├── backend/
│   ├── app.py
│   ├── requirements.txt
│   │
│   ├── repos/
│   │
│   └── services/
│       ├── analyzer.py
│       ├── github.py
│       └── ollama.py
│
├── frontend/
│   ├── package.json
│   ├── package-lock.json
│   ├── vite.config.js
│   │
│   └── src/
│       ├── main.jsx
│       └── styles.css
│
├── screenshots/
│   ├── dashboard.png
│   ├── repository-analysis.png
│   ├── ask-ai.png
│   ├── code-search.png
│   ├── architecture.png
│   └── file-tree.png
│
├── .github/
│   └── workflows/
│       └── ci.yml
│
├── .gitignore
└── README.md

---

🔌 API

The FastAPI backend exposes:

GET  /api/health
POST /api/analyze
POST /api/search
POST /api/ask
POST /api/architecture

Local repository inventory and cleanup

RepoPilot can list and delete its own imported repository copies:

• GET /api/repositories — inventory (file count, size, update time)
• DELETE /api/repositories/{repo_id} — delete one import
• POST /api/repositories/cleanup — bounded stale-import cleanup

Cleanup is a dry run by default. Send {"max_age_hours":24} to preview; send {"max_age_hours":24,"dry_run":false} to delete those imported copies. The retention range is 1–720 hours. No cleanup runs automatically. Imported repository count is capped by REPOPILOT_MAX_REPOSITORIES (default 100). Invalid IDs, symlinks, and paths outside RepoPilot's import directory are refused.

Deletion is irreversible. Copy any modified repository contents elsewhere before cleanup. This is a local-only API with no authentication; do not expose it to the public Internet.

Health

GET /api/health

Checks whether Ollama is reachable and reports available models.

Analyze

POST /api/analyze

Clones and indexes a public GitHub repository.

Search

POST /api/search

Searches indexed source files.

Ask

POST /api/ask

Builds relevant code context and asks the local LLM.

Architecture

POST /api/architecture

Generates an architecture explanation using repository context.

---

🧠 Why this is a good college project

RepoPilot combines several real engineering concepts in one application:

React
  +
FastAPI
  +
Git
  +
Code indexing
  +
Search
  +
Local LLM
  +
REST APIs
  +
Repository analysis

It is also easy to demonstrate in a viva:

"Give me a GitHub repository and I can locally clone it, inspect it, search its code, analyze project health, and ask an open-source local LLM questions about its architecture."

That's a much better demonstration than a static AI chatbot.

---

🧪 Development checks

The repository now includes GitHub Actions for basic regression checks on pushes and pull requests:

• Backend dependency installation and Python bytecode compilation
• Frontend dependency installation with the committed lockfile
• Frontend production build

Run the same frontend build locally with:

cd frontend
npm ci
npm run build

For the backend, a quick syntax check is:

python -m compileall -q backend

These checks are intentionally lightweight: they catch broken imports, syntax errors, dependency drift, and frontend build failures without executing cloned third-party repositories.

---

🚧 Current limitations

This version intentionally supports public GitHub repositories only.

It does not currently:

• Analyze private repositories
• Execute project code
• Build dependency graphs
• Parse every programming language with a full AST
• Perform a real security audit
• Guarantee that the LLM's explanation is correct

The AI is only as reliable as the repository context and local model.

---

🔮 Future ideas

Possible upgrades:

• ZIP repository upload
• Private GitHub OAuth
• GitHub App integration
• AST-based code analysis
• Dependency graph visualization
• Call graph visualization
• Git commit history analysis
• Security smell detection
• Automatic README generation
• Local embeddings / RAG
• Multiple Ollama models
• Export architecture report as PDF
• Repository comparison
• Code-quality trends

---

👨‍💻 Built by

@harshitethic

Built by @harshitethic

❤️ For his college bhais

Made for students who want to build, understand, customize, and actually explain their projects in the viva.

No fake demo.

No:

"Please enter your OpenAI API key"

Just clone it, run it, understand it, and make it better. 🚀

---

⭐ If you found it useful

Star the repository ⭐

Fork it 🍴

Break it 💀

Fix it 🔧

And most importantly:

Understand your code before your viva. 😭

---

License

MIT License.

Import security and deployment boundaries

RepoPilot now accepts credential-free HTTPS GitHub repository URLs only, isolates Git subprocesses from host Git configuration overrides, and reserves import directories atomically to prevent random-ID collisions from deleting existing workspaces.

Read the GitHub import security model for the network-free regression suite and explicit limitations. RepoPilot remains a local developer tool; it is not a sandbox or an audited public multi-user service.

Local-only API boundary

RepoPilot's unauthenticated FastAPI backend now rejects non-loopback clients by default, including requests carrying spoofed forwarding headers. See the local-only API trust boundary for regression tests, reverse-proxy caveats and instructions to avoid public exposure. This is not authentication or multi-tenant isolation.