Prism.

Prism is an AI-powered code review and documentation platform: paste code into a Monaco editor, or point it at a GitHub repository or pull request, and it flags security, quality, and performance issues across seven languages (JavaScript, TypeScript, Python, Go, Java, Rust, PHP), generates documentation, and lets you ask questions about an entire codebase in natural language.

It is a full product rather than an API wrapper: a Next.js frontend, an Express API with hand-written analysis engines, a Weaviate vector database for retrieval, and GPT-4 reserved for the places where a language model actually earns its cost — all orchestrated with Docker Compose.

The core design decision in Prism: not every review needs an LLM. There are two analysis modes, and the split is deliberate:

• Pattern mode — fast, free, deterministic analysis (Acorn parses JavaScript; per-language rules cover the rest). It catches hardcoded credentials, SQL injection and XSS patterns, command injection risks, missing error handling, empty catch blocks, N+1 queries, synchronous file I/O, and memory-leak patterns.
• LLM mode — GPT-4, orchestrated through LangChain, for the analysis regexes cannot reach: intent-level bugs, architectural feedback, and contextual fix suggestions.

Every issue comes back with a severity (critical / high / moderate / low), the offending line, and an actionable suggestion:

{
  "type": "hardcoded-credentials",
  "severity": "critical",
  "message": "Hardcoded password detected",
  "line": 1,
  "suggestion": "Use environment variables for sensitive data"
}

Prism can ingest an entire repository into Weaviate, an open-source vector database. Code is chunked, embedded, and indexed; a question like “where is authentication handled?” runs a semantic search over the embeddings, and the matching chunks are handed to the model as context — so answers cite actual code instead of hallucinating structure.

The pipeline is three endpoints — /api/rag/ingest, /api/rag/search, and /api/rag/ask — backed by an ingestion service, a semantic search service, and an analyzer that stitches retrieved context into prompts.

The GitHub integration is where Prism stops being a demo and starts being a tool. It can analyze a whole repository, review just the diff of a pull request, and authenticate through GitHub OAuth (NextAuth.js) for private repos.

It also runs as CI: a GitHub Actions workflow posts each pull request to Prism’s webhook endpoint, and every PR receives an automated review comment — an AI-generated summary of what the PR does, a category (feature / bugfix / refactor), an impact level, security findings with fix suggestions, and breaking-change warnings. Without an OpenAI key it degrades gracefully to pattern-based analysis instead of failing.

Three services, orchestrated with Docker Compose:

• Frontend — Next.js (App Router) with the Monaco editor for a VS-Code-quality editing experience, and NextAuth.js handling GitHub OAuth.
• Backend — Express.js exposing the analysis, documentation, GitHub, and RAG endpoints, with separate analyzer services for security, quality, and performance behind them.
• Weaviate — the vector store powering RAG, persisted to disk.

Like FlashKV, the repo ships with an 11-part learning-docs series explaining how each piece works — writing documentation someone else can learn from is part of how I finish projects. Source on GitHub · Live demo.