Architecture review with AI: from diagram to pull request
The Cyber Resilience Act requires a description of your product's design and architecture and a risk assessment. In many teams that is a diagram someone drew a year ago that no longer matches reality. The Secupipe architecture review builds that description from your code, reviews it and suggests improvements, right in your pipeline.
From code to an architecture model
The review runs as a job on your CI runner, in the same container as Autofix and the code scan. First it collects facts without AI: package manifests, Dockerfiles, Compose, Kubernetes, Terraform, CI files, exposed ports, the names of environment variables and the hosts the code talks to. Then an AI agent describes the architecture:
- Components: services, jobs, frontends, databases, storage and third-party services.
- Trust zones: users and clients, edge (proxy, CDN, gateway), application, data, third parties.
- Data flows: who talks to whom, over which protocol, with which authentication, encrypted or not.
- SBOMs: every component is linked to the SBOM your pipeline uploads for it. One click on the component shows all packages and vulnerabilities.
Secupipe draws the diagram from the model. Unencrypted connections are marked red, and every component shows its number of findings. The diagram is rebuilt on every run, so it stays current.
Three reviewers, one challenger
Three agents work on the model in parallel:
- Security: a STRIDE threat model for every data flow that crosses a zone boundary. Is there authentication and authorization at the entry point? Are tenants separated? Are there rate and size limits? Where do the secrets live?
- CRA Annex I: the essential requirements, as far as the repository shows them. Secure defaults, access control, encryption, logging, a way to delete user data, SBOM, a channel for vulnerability reports and secure updates.
- Structure and operations: layering and coupling, single points of failure, missing timeouts, configuration in code instead of the environment, backups.
Every finding needs evidence with file and line. A script checks that those files and lines exist; findings with made-up evidence are dropped. Then another agent tries to refute each finding. Only what holds up reaches Secupipe.
Findings you accept on purpose are marked with a reason. The agents stop reporting them, and they no longer count for the release gate. What is new since the last run, and what is gone, is visible at a glance.
The overall architecture of a project
A product rarely lives in one repository. Secupipe groups repositories into projects, for example shop-api, shop-web and shop-site into the project shop. After each review another agent merges the models of all repositories: the same component seen from several repositories becomes one node, and flows between repositories are added. It reads no source code for this, only the models and findings.
The result is 5 to 15 improvement suggestions for the architecture as a whole. They don't repeat the individual findings; they combine them: one hardened deployment path instead of three different ones, one source for secrets, a rehearsed recovery. Each suggestion names the benefit, the effort (days, weeks, months), the priority and the findings it resolves.
From finding to pull request
You can request an AI fix for any finding. When the fix run starts, an agent implements the recommendation in the repository, runs build and tests and opens a pull request with an explanation. Nothing is merged automatically; your team reviews the pull request.
Not everything can be fixed in code. If, say, a server has no backup, the agent reports "not possible" and writes down what a person needs to do. If build or tests fail after the change, there is no pull request. Changes to CI workflows are never taken over.
Your code stays with you
- The review runs on your CI runner. The reviewing agents can only read and never execute code from your repository.
- Secupipe never sees source code. It receives the model, the diagram and findings with file path and line.
- The source code goes to the AI provider whose key you configure: Anthropic, Amazon Bedrock or Google Vertex in an EU region, or a local LLM in your network.
- You decide when it runs: on demand in your CI, on pull requests or on a schedule.
Tried on ourselves first
Before offering the review we ran it on our own products: Secupipe and ioffice.one, each with three repositories for API, web app and website. Each project got an overall architecture with 33 components and 14 improvement suggestions. They ranged from a consistently secured supply chain and one deployment path with rollback to rehearsed backups. The first AI fix, timeouts for the HTTP server including a test, took the agent a few minutes.
How to set it up
The architecture review is part of the AI module. In GitHub Actions one job is enough, started on demand:
on:
workflow_dispatch:
jobs:
architecture:
runs-on: ubuntu-latest
container: ghcr.io/costa-chown/secupipe-autofix:1
steps:
- uses: actions/checkout@v5
with: { fetch-depth: 0 }
- run: secupipe-archreview
env:
SECUPIPE_TOKEN: ${{ secrets.SECUPIPE_TOKEN }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
REPO: ${{ github.repository }}
The same container works for GitLab CI and other systems. The results are in Secupipe under Architecture; download the report with the diagram as Markdown for your technical documentation.
Start for free Check an SBOM for free