# Jean-Cedrik Dorelas(canary-agent)

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Jean-Cedrik Dorelas](https://cerebralvalley.ai/u/jcedrik)
- **GitHub:** https://github.com/jcedrik/canary-agent
- **Demo video:** https://www.loom.com/share/ab07d1d862434f78ba36e63356db0c47
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1327

canary-agent secures the code that AI agents write. As LLM agents generate a growing share of production code, they introduce the failure modes classic scanners miss: prompt injection, excessive agency, leaked secrets, unvalidated model output. canary-agent takes findings from canary (my open-source LLM-security scanner, published before the hackathon and used here as an off-the-shelf input) and uses Meta’s Muse Spark to decide which findings are real and why, rank them by exploitability (does untrusted data reach a tool, a shell, or a secret?), write a fix, and prove the fix by re-running the scanner and the project’s own tests. On top of canary it adds its own deterministic AST detectors: intra-procedural taint tracking from untrusted source to dangerous sink, agentic-specific rules, and real tree-sitter parsing for JS/TS. Every finding maps to the OWASP Top 10 for Agentic Applications. It runs as a CI/PR gate that fails the build when a confirmed finding reaches a tool or a secret, and it plugs into Muse Code over MCP so Meta’s coding agent is checked in real time and fixes a vulnerability before the file is ever saved. Measured against 77 findings I reviewed by hand: 90% agreement, 95% precision on what it confirms, 97% precision on the high-signal rules you gate a build on.

## More from Meta Global AI Developer Hackathon

- [FraudShield AI](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1324)
- [Kliqstr](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1325)
- [Farado Agency — Sentinel](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1326)
- [Survey QA Agent](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1328)
- [Unreal AI Playtester](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1329)
- [guruswami-ai](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1330)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/1327. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt