Give it a ticket. Get back a pull request.
🔗 Live: https://devai-64.onrender.com · API: https://dev-64-447r.onrender.com/health
Dev64 AI is a full-stack AI coding agent platform. Users connect their GitHub repositories and chat with an AI agent that works inside a sandboxed cloud container. The agent reads the repo, plans, writes code, runs commands and tests, commits, pushes, and hands back a reviewable pull request — all without ever touching the user's machine or their main branch.
- Key Features
- Tech Stack
- Project Structure
- How It Works (Flow)
- AI Skills & Capabilities
- API Overview
- Getting Started
- Environment Variables
- Outcomes
- Business Benefits
- Who It Helps
- Chat with an AI coding agent that operates inside a real, sandboxed copy of your GitHub repository.
- GitHub native — OAuth connection, repository browser, automatic branch creation, commits, pushes, and pull requests.
- Sandboxed by default — every session runs in an isolated Upstash Box container. Your machine and your
mainbranch stay untouched. - Automatic session management — AI-generated session titles, feature branch names, base-commit snapshots, and full revert support.
- Natural-language code search — the agent understands questions like "how does auth work?" and finds the right files (warpgrep).
- Readable diffs — every file edit returns a line-by-line diff with add/delete stats, rendered in the chat UI with reasoning attached.
- Live streaming UI — reasoning, tool calls (read/write/edit/bash/git/commit/push/search), diffs, and text stream in real time.
- Extensible — users can install agent skills (
npx skills add ...) and register custom API tools that the agent can call. - Auth — email/password with bcrypt, JWT in HTTP-only cookies, plus Google OAuth sign-in.
- Dark/light themes with a polished shadcn/ui + Tailwind design system.
| Layer | Technology |
|---|---|
| Runtime | Node.js + TypeScript |
| Web framework | Express 5 |
| Database / ODM | MongoDB + Mongoose 9 |
| Auth | Passport (JWT strategy), passport-jwt, bcrypt, HTTP-only cookies, Google OAuth + GitHub OAuth |
| AI SDK | Vercel AI SDK (ai v6) — streamText, tool, UIMessageStream |
| LLM provider | AICredits (OpenAI-compatible gateway, https://api.aicredits.in/v1) — model deepseek/deepseek-v4-flash (1M context, 284B/13B MoE) via @ai-sdk/openai; fallback: Morph morph-dsv4flash |
| Code search | Morph warpgrep via @morphllm/morphsdk — SWE-bench F1 0.72, <6s retrieval, $0.003/search |
| Web search tool | @exalabs/ai-sdk |
| Payments | Razorpay (UPI/cards/netbanking, INR) — order → verify + server webhooks; prepaid credits (1 credit = ₹1) |
| Sandbox / container | Upstash Box (@upstash/box) — files, shell exec, git ops, PR creation |
| MCP integration | @modelcontextprotocol/sdk — users can attach stdio/HTTP MCP servers as agent tools |
| Testing | Vitest + supertest + mongodb-memory-server (backend), Vitest + Testing Library + Playwright (frontend) |
| Validation | Zod (schemas for all routes) |
| Other | CORS, cookie-parser, dotenv, rate limiting (in-memory), tsup/tsx/nodemon tooling |
| Layer | Technology |
|---|---|
| UI framework | React 19 + TypeScript |
| Build tool | Vite 8 |
| Styling | Tailwind CSS v4 + shadcn/ui + Radix UI primitives |
| Data fetching | TanStack React Query (v5) + Axios |
| Routing | React Router v7 |
| AI / streaming | ai SDK (readUIMessageStream, @ai-sdk/react) |
| Rendering | streamdown (Markdown, code, math/KaTeX, Mermaid diagrams) |
| Animation | Motion (framer-motion), tw-animate-css |
| Forms | react-hook-form + zod resolvers |
| UX | sonner (toasts), next-themes (theming), lucide-react icons, Geist font |
| Testing | Vitest + @testing-library/react (unit/component), Playwright (E2E) |
Mern AI-Coding-Agent/
├── backend/ # Express + TypeScript API
│ ├── src/
│ │ ├── app.ts # Express app (exported for tests), index.ts listens
│ │ ├── index.ts # Server entry (Express app, DB connect, production static hosting)
│ │ ├── config/ # env, database, passport (JWT), http-status
│ │ ├── controllers/ # auth, session, github, custom-tool, skill, payment controllers
│ │ ├── routes/ # auth, session, github, tools, skills, payments + router index
│ │ ├── services/ # business logic (auth, session, message, github, skill, custom-tool, payment)
│ │ ├── models/ # Mongoose models (User, Session, Message, GithubAccount, Skill, CustomTool, Payment)
│ │ ├── middleware/ # asyncHandler, errorHandler, rateLimit, validate, passport
│ │ ├── validators/ # Zod schemas (auth, session, github)
│ │ ├── lib/
│ │ │ ├── ai/ # AI agent core
│ │ │ │ ├── prompt.ts # System prompt for the coding agent
│ │ │ │ ├── morph-provider.ts # LLM provider factory (AICredits + Morph via createOpenAI)
│ │ │ │ ├── tools/github-tools.ts # list, grep, read, write, edit, bash, git tools
│ │ │ │ └── warpgrep-tool.ts # natural-language code search tool
│ │ │ ├── sandbox.ts # Upstash Box factory
│ │ │ └── social-oauth/ # Google + GitHub OAuth, token encryption, state handling
│ │ ├── types/ # Express Request augmentation
│ │ └── utils/ # AppError, bcrypt, cookie helpers, env getter
│ ├── test/ # Vitest E2E (supertest + in-memory MongoDB)
│ │ ├── setup.ts / helpers/mongo.ts
│ │ ├── smoke.test.ts / e2e/api.test.ts
│ ├── skills/ # SKILL.md rule packs loaded by AI agents (9 files)
│ ├── doc/ # backend bug-fix notes
│ ├── https/ # REST client files (auth/github/health/session)
│ └── package.json
│
├── Frontend/ # React + Vite SPA
│ ├── src/
│ │ ├── App.tsx / main.tsx # App shell + entry
│ │ ├── routes/ # Router config + route guards
│ │ ├── layouts/ # base-layout (public) & app-layout (authenticated + sidebar)
│ │ ├── pages/
│ │ │ ├── landing/ # Marketing site (hero, capabilities, workflow, pricing, FAQ…)
│ │ │ ├── auth/ # Sign in / Sign up
│ │ │ ├── home/ # /new — new chat session
│ │ │ ├── session/ # /session/:slugid — persisted chat session
│ │ │ └── not-found/
│ │ ├── components/
│ │ │ ├── chat/ # Chat interface, chat input, empty state, tool-part cards
│ │ │ ├── ai-elements/ # Message, reasoning, chain-of-thought, commit, markdown, shimmer…
│ │ │ ├── sidebar/ # Session list, nav, session search, credits balance pill
│ │ │ ├── settings/ # Settings dialog (skills & tools, payments, theme, GitHub connect)
│ │ │ ├── ui/ # shadcn/ui components
│ │ │ ├── diff-Viewer.tsx # Unified diff renderer
│ │ │ └── route-guards.tsx # Auth redirects
│ │ ├── hooks/ # use-chat-stream, use-user, use-mobile
│ │ ├── lib/ # axios client, api methods, env, utils
│ │ ├── test/ # Vitest setup (jsdom + jest-dom)
│ │ └── types/ # auth, session, github, tool types
│ ├── e2e/ # Playwright E2E specs (landing, auth, route guards)
│ ├── skills/ # SKILL.md rule packs loaded by AI agents (7 files)
│ └── package.json
│
└── .github/instructions/ # Codacy instructions
┌────────────┐ 1. Sign up / Sign in (email+password or Google)
│ USER │ 2. Connect GitHub account (OAuth — repo, read:user, read:org)
│ (React UI)│ 3. Pick a repository + describe the task
└─────┬──────┘
│ POST /api/session/chat (SSE/UIMessage stream)
▼
┌─────────────────────────────────────────────────────────────────┐
│ BACKEND (Express + Vercel AI SDK) │
│ │
│ 1. Create/load Session (slugId) │
│ 2. Generate session title + feature branch name (AICredits LLM) │
│ 3. Create/reuse Upstash Box sandbox container │
│ 4. Clone repo, checkout feature branch, snapshot base commit │
│ 5. Build agent: system prompt + tools │
│ └── tools: list · grep · read · write · edit · bash · │
│ git_status · commit · git_push · web_search · │
│ codebase_search (warpgrep) · user skills · custom tools │
│ 6. streamText → agent plans → runs tools → streams reasoning, │
│ diffs, tool results, text back to the UI │
│ 7. Agent commits (conventional) and pushes the branch │
│ → emits "PR ready" event to the UI │
└────────────┬────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ UI: user reviews diffs & reasoning, then clicks "Create PR" │
│ POST /api/session/:slugId/pull-request │
│ → Box creates PR against the repo's default branch │
│ │
│ Safety: POST /api/session/:slugId/revert resets the sandbox │
│ back to the base commit — nothing is ever lost on main │
└─────────────────────────────────────────────────────────────────┘
- Create a session — the client generates a
slugIdand the user picks a GitHub repo. - Workspace spin-up — the backend provisions an isolated Upstash Box, clones the repo, checks out an AI-named feature branch (e.g.
dev64/add-login-form-a1b2c3), and records the base commit hash. - Agentic loop — for every message, the AI streams reasoning, calls tools to inspect and modify the repo, runs build/tests via
bash, and emits a readable diff for each edit. - Commit + push — the agent stages everything and commits with a conventional message, then pushes the branch.
- PR ready — the UI shows a commit bar; the user can create the pull request directly from the chat.
- Revert — any time, the user can reset the sandbox to the original base commit.
The agent loop runs on DeepSeek V4 Flash via AICredits (deepseek/deepseek-v4-flash, 1M-token context, 284B total / 13B active MoE) with Morph as fallback and Morph warpGrep for semantic code search:
- Reasoning / chain-of-thought — the model streams its
reasoningparts, shown as a collapsible panel in the UI. - Web search —
web_searchtool (via@exalabs/ai-sdk) for docs, errors, and package research. - Semantic code search —
codebase_search(Morph warpgrep) understands natural-language queries and returns relevant file snippets with context (SWE-bench F1 0.72, <6s retrieval, $0.003/search). - File system + shell —
list,grep,read,write,edit,bashoperate inside the sandbox. - Git automation —
git_status,commit,git_push; PR creation via the dedicated endpoint. - Model switching — all chat model references live in
backend/src/services/session.service.ts; the provider graph inlib/ai/morph-provider.tsexposes both AICredits (primary) and Morph (fallback), so models are swappable per task or budget. - SKILL.md skills — users upload Markdown skills (YAML frontmatter:
name,description+ instruction body) via the settings UI orPOST /skills/upload. Installed skills are stored per user, toggled on/off, and injected into the system prompt. Repo rule-packs for AI agents also ship asSKILL.mdfiles inbackend/skills/andFrontend/skills/. - MCP servers — users can attach stdio or HTTP (streamable) MCP servers (name, description, command/env or URL, JSON input schema). Their tools are exposed to the agent as
mcp__<server>__<tool>and executed via@modelcontextprotocol/sdk. - Custom tools — users can register API-backed tools (GET/POST + headers/body, JSON input schema) or code tools (TypeScript/JS functions compiled with
new Function), all Zod-validated at runtime. - UI design intelligence — the system prompt encodes 2026-grade design rules (Dribbble-quality UI, Tailwind + shadcn/ui, Motion, modern gradients/bento grids), so UI tasks produce polished results.
- 1 credit = ₹1. Signup gives ₹10 free; each agent turn costs 2 credits (atomic debit, gated at the start of every chat request).
- Top-up packs: ₹50 → 50, ₹100 → 110 (+10 free), ₹250 → 300 (+50 free), ₹500 → 650 (+150 free) — paid via Razorpay (UPI/cards/netbanking), order → client checkout →
verifyendpoint, plus server-side webhooks with signature validation for automatic crediting. - Packs are defined in
backend/src/services/payment.service.ts(PAYMENT_PACKS); the frontend checkout lives inFrontend/src/components/settings/payment-dialog.tsx.
Base URL: http://localhost:3000/api (see Frontend/src/lib/env.ts / VITE_BASE_API_URL).
| Method | Endpoint | Description |
|---|---|---|
| POST | /auth/register |
Register (name, email, password) |
| POST | /auth/login |
Login → JWT in HTTP-only cookie |
| GET | /auth/me |
Current user + GitHub connection status |
| POST | /auth/logout |
Logout |
| GET | /auth/google · /auth/google/callback |
Google OAuth |
| GET | /github/connect |
GitHub OAuth URL |
| GET | /github/callback |
GitHub OAuth callback |
| GET | /github/repos |
List user's GitHub repos |
| DELETE | /github/disconnect |
Disconnect GitHub |
| GET | /session/all |
Paginated, searchable session list |
| GET | /session/:slugId |
Session detail + messages |
| POST | /session/chat |
Streaming agent chat (UIMessage stream) |
| POST | /session/:slugId/pull-request |
Create a PR for the session branch |
| POST | /session/:slugId/revert |
Reset sandbox to base commit |
| GET/POST/PUT/DELETE | /tools |
CRUD for custom tools (API, MCP, code) |
| GET/POST | /skills · /skills/upload · /skills/install |
List, upload SKILL.md, install npm skills |
PATCH /skills/:skillId/toggle · DELETE /skills/:skillId |
Enable/disable or uninstall a skill | |
| GET | /payments/balance |
Current credit balance |
| POST | /payments/order |
Create a Razorpay order (₹10–₹1000) |
| POST | /payments/verify |
Verify payment signature + credit balance |
| POST | /payments/webhook |
Razorpay webhook (server-side crediting) |
| GET | /health |
Health check |
- Node.js 18+
- MongoDB instance
- AICredits API key (primary LLM) + Morph API key (code search / fallback)
- Upstash Box API key
- Razorpay key id + secret (test keys work; webhook optional for local dev)
- GitHub OAuth app + Google OAuth app credentials
cd backend
npm install
cp .env.example .env # fill in the variables (see below)
npm run dev # starts nodemon on http://localhost:3000cd Frontend
npm install
npm run dev # Vite dev server (default port shown in the terminal)The frontend expects the API at http://localhost:3000/api by default. Override with VITE_BASE_API_URL.
# Backend — unit + API E2E (Vitest + supertest + in-memory MongoDB)
cd backend
npm test # or npm run test:watch
# Frontend — unit/component tests (Vitest + Testing Library, jsdom)
cd Frontend
npm test
# Frontend — browser E2E (Playwright; starts the Vite dev server automatically)
cd Frontend
npx playwright testTest layout:
backend/src/**/*.test.ts— unit tests (validators,sanitizeUIMessages, skill frontmatter parsing, payment packs/signatures). Model-backed tests usemongodb-memory-serverviatest/helpers/mongo.ts.backend/test/e2e/api.test.ts— full API E2E against the Express app (app is exported fromsrc/app.ts): auth flow with JWT cookies, sessions, payments (mock Razorpay, real HMAC webhook signatures), SKILL.md upload/toggle.Frontend/src/**/*.test.ts(x)— utils, API client methods (mocked axios), component tests (e.g.payment-dialog).Frontend/e2e/*.spec.ts— Playwright: landing page content, auth-form client validation, protected-route redirects. Auth endpoint is stubbed viapage.route()so tests run without a backend.
Note:
npx playwright install chromiumis required once before running E2E tests.
| Variable | Purpose |
|---|---|
PORT |
Server port (default 3000) |
NODE_ENV |
development / production |
BASE_URL |
Public backend base URL (used for OAuth redirects) |
FRONTEND_URL |
Frontend origin (CORS + OAuth redirect) |
MONGO_URL |
MongoDB connection string |
JWT_SECRET |
JWT signing secret |
JWT_EXPIRES_IN |
Token lifetime (default 7d) |
MORPH_API_KEY |
Morph API key (warpgrep code search + LLM fallback) |
AI_CRDITS_API_KEY |
AICredits API key (primary LLM provider) |
UPSTASH_BOX_API_KEY |
Upstash Box API key (sandboxes) |
RAZORPAY_KEY_ID / RAZORPAY_KEY_SECRET |
Razorpay payment gateway (test keys fine) |
RAZORPAY_WEBHOOK_SECRET |
Razorpay webhook signature secret (32+ chars) |
GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET |
GitHub OAuth app |
GITHUB_OAUTH_STATE_SECRET |
OAuth state signing secret |
GITHUB_TOKEN_ENCRYPTION_KEY |
Encrypts stored GitHub access tokens |
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET |
Google OAuth app |
GOOGLE_OAUTH_STATE_SECRET |
OAuth state signing secret |
| Variable | Purpose |
|---|---|
VITE_BASE_API_URL |
API base URL (default http://localhost:3000/api) |
VITE_RAZORPAY_KEY_ID |
Razorpay key id for the checkout (checkout.razorpay.com script) |
- Ticket → PR in one sitting. The agent plans out loud, writes the code, runs builds/tests, and delivers a branch with a reviewable PR — no more copying snippets into an editor.
- Every change is a readable diff. Each edit shows add/delete stats, the patch, and the reasoning behind it, so reviews take minutes instead of archaeology.
- Safe by design. All work happens in an isolated sandbox on a feature branch. Nothing touches
main; every merge still requires human approval; the sandbox can be reverted to the session's starting commit at any time. - Context-aware code. The agent indexes and semantically searches the entire repo before writing, so changes land where they belong and match the team's existing conventions and stack.
- Faster delivery cycles — routine features and bug fixes are implemented and pushed in minutes, cutting the median ticket-to-PR time dramatically.
- Reduced developer burnout — engineers stay in the reviewer's seat and focus on architecture, edge cases, and high-value work while the agent clears the backlog.
- Lower onboarding cost — new developers can offload "how does this codebase work?" questions to the agent's semantic search and see working diffs immediately.
- Predictable, auditable work — conventional commits, readable diffs, per-session feature branches, and PR approval gates keep the process reviewable and repeatable.
- Controlled spend — sessions are per-session sandboxes; infrastructure (Upstash Box) and model usage are metered, and models are swappable per task/budget.
- Standards enforcement — the system prompt encodes repo-aware coding and design rules, keeping output consistent with the team's style guides.
- Offload boilerplate, bug fixes, refactors, and "small" features to the agent.
- Explore unfamiliar codebases through natural-language code search.
- Review line-level diffs with reasoning instead of wall-of-code PRs.
- Stay in full control: approve every commit, push, and pull request.
- Clear a shared backlog faster with pooled sessions and consistent output.
- Keep
mainprotected — the agent never works outside a sandboxed branch. - Standardize code quality and design through shared, repo-aware prompts and skills.
- Describe an idea or paste a ticket and receive a real, mergeable pull request.
- Connect any GitHub repo, watch the agent work in real time, and review the result like a stakeholder.
ISC — see backend/package.json.