Aegis

In my second year of university, I helped build an NLP system for a healthcare startup with thirteen clinics across two Ottawa hospitals. The product was ready. The users were waiting. They couldn't ship for nine months because of the HIPAA compliance review. Aegis fixes the technical part of that. It scans code for HIPAA Technical Safeguards violations under 45 CFR § 164.312, cites the exact regulation, and shows you how to fix it. The interesting part is how it's built. Aegis uses IBM Bob in a custom Auditor mode I designed. Bob architected the system, built the MCP rules engine that powers the scanner, performed the audits, and generated the remediation pull requests, all documented session-by-session in the bob_sessions/ folder in the repo. What sets Bob apart from per-file static analysis: cross-file reasoning. One of the strongest findings traces a PHI leak across three files, the Patient model defines an SSN field, a route queries it, and a global error handler dumps the error object (containing patient data) to application logs. Bob catches this because it reads full repository context, not isolated files. Stack: Python, tree-sitter, FastAPI, React. Backend deployed on Render, frontend on Vercel. Roadmap: HIPAA Technical Safeguards live today, SOC 2 in two weeks, GDPR Article 32 in four weeks, FedRAMP Moderate in eight weeks, multi-tenant SaaS in three months. Compliance that ships with your code. Live demo: https://aegis-eta.vercel.app