How to use Gemini to coordinate code security scans
CypherAI uses Gemini Pro orchestration and Gemini Flash specialists through Google ADK, adding policy-session context and structured logging to code scans.
dev.to
Prompt to try
Editorial adaptation, not the source author’s exact prompt. Replace bracketed inputs and review tool permissions first.
Build a prototype scan pipeline for [code repository] with Google ADK. Use Gemini for orchestration and separate security, compliance, performance, and policy roles. Return severity, line references, and remediation; record [approved historical context] and log scan decisions and durations.
Reach people exploring AI agents
See placements →What happened
The author reports building CypherAI with specialist scanning agents, session-based policy context, and scan instrumentation during the five-day course.
Reported by stealthwhiz on dev.toHow the agent did it
- Split scan responsibilities into specialist agent roles.
- Configure Gemini Pro orchestration and Flash specialists with ADK.
- Add session management to the Policy Engine.
Where a person stepped in
The supplied excerpt does not describe human review or approval of individual scan findings; the author describes logging and evaluation metrics.
A person approved each step before the agent continued.
The author built CypherAI during a five-day AI agents course, using a coordinator and specialized agents rather than one assistant responsible for every review concern. The described roles cover security vulnerabilities, compliance, performance, and policy decisions, with a root orchestrator coordinating their work.
Gemini Pro handles orchestration, while Gemini Flash powers the specialist tasks. The implementation uses Google's Agent Development Kit to structure agent definitions and execution. The included security-agent instructions ask for OWASP Top Ten analysis, including SQL injection, XSS, and hardcoded secrets, with severity, line numbers, and remediation.
The author then added session management to the Policy Engine, tracking developer patterns, team conventions, and false-positive history. The supplied example adjusts severity based on previous fixes or dismissals. Later instrumentation logs risk score, decision, scan duration, finding count, and false-positive rate.
The post reports fast scans and improvements in cost and false positives, but the supplied figures include inconsistent comparative claims. This account therefore focuses on the described implementation rather than treating those comparisons as validated performance evidence. The excerpt does not describe a human approval process for individual findings. Who it's for: developers prototyping coordinated code-review agents and adding context and observability to their scan pipeline.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: dev.to · stealthwhiz
Frequently asked questions
Which models handled which roles?
The author used Gemini 1.5 Pro for the root orchestrator and Gemini 1.5 Flash for four specialist agents.
What metrics were logged?
The example logs risk score, decision, scan duration, finding count, and false-positive rate.
More details
Remaining steps
- Track developer patterns and false-positive history.
- Instrument risk scores, decisions, durations, and findings.
About this account
The root orchestrator coordinates specialist analysis, while a Policy Engine uses session context to adapt decisions based on recorded scan history.
Platform: dev.to. Attribution: https://dev.to/stealthwhiz/from-2-week-security-reviews-to-07-second-ai-scans-my-journey-building-cypherai-cf2. Prompt: Suggested (written by Agents In Use, not the author's). Sourced by the Agents In Use pipeline.
Credit: stealthwhiz on dev.to
Source published 6 Dec 2025
Source checked 14 Oct 2026
Tools and topics
Gemini 1.5 Pro · Gemini 1.5 Flash · Google ADK · InMemorySessionService · Python logging
Code scanning · Google ADK
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.