awesome ai apps - Moses Yebei

The Problem

Building production LLM apps means assembling RAG pipelines, agents, memory, and MCP tooling from scratch each time. This repo is a portfolio of 8 self-contained projects (advance_ai_agents, mcp_ai_agents, memory_agents, simple_ai_agents, rag_apps, starter_ai_agents, course, fine_tuning) showing working patterns for each, so a team can crib a reference implementation instead of designing one.

What This Does

It's a collection of ~70 examples, not one codebase. The substantial projects: advance_ai_agents/ai-hedgefund (a TypeScript/Motia workflow with parallel analyst steps and a Dockerfile), advance_ai_agents/conference_agnositc_cfp_generator (a scraper + vector-search pipeline for conference talks), and mcp_ai_agents/doc_mcp (an MCP server with GitHub loading, RAG ingestion, and a SQLite repository). Recurring techniques: vector embeddings via NebiusClient (advance_ai_agents/conference_agnositc_cfp_generator/src/config/nebius_client.py), LangChain agents, and memory-backed chat.

How It Is Wired

Each project has its own entry point. The CFP generator's main (scripts/create_search_indexes.py) reaches 39 functions, calls a model for inference, and reads/writes files. platform_adapters.py owns the network scraping. nebius_client.py is the inference hub, called from 5 files. The doc_mcp server's run (mcp_starter/main.py) reaches 66 functions; repository.py owns the database. The ai-hedgefund workflow routes through ServiceFactory (9 importers, instability 0.36) and types (10 importers, 0 outgoing), making those the highest-blast-radius modules. No circular dependencies were found (0 of 212 files). The import graph is clean; the main cost of change is the duplicated step logic, not tangled dependencies.

How To Use It

Setup: pip install -r requirements.txt per Python project (e.g. advance_ai_agents/candidate_analyser/requirements.txt); bun install for ai-hedgefund; docker build for its Dockerfile.
Configuration: copy env.example to .env in each project—ai-hedgefund/env.example and memory_agents/job_search_agent/.env.example.local-backup (which is committed and should be rotated) hold the keys.
Running: invoke each project's main.py directly, e.g. python advance_ai_agents/conference_agnositc_cfp_generator/scripts/create_search_indexes.py. The README documents per-project commands; individual run instructions are in each subdirectory's README.

Real-World Use

A team building a conference-talk recommender can lift the CFP generator's flow: scrape platform_adapters.py → embed with nebius_client.py → store via corpus_manager.py (Couchbase). The doc_mcp server gives a working MCP + RAG + SQLite reference for tool-integration work.

Code Health & Issues

Static analysis (measured, not opinion) found 90 findings: 28 high, 62 medium. Key ones:

High – Deep nesting (30 instances): mcp_ai_agents/doc_mcp/src/database/repository.py hits indentation depth 7. Fix with guard clauses.
High – Duplicated code (347 repeated 6-line blocks across 54 files), concentrated in ai-hedgefund/steps/. Extract shared helpers.
Medium – Broad exception handling (29 instances): bare except in repository.py swallows errors.

SDLC observations from structure: only 1 test file against 211 source files; .env.example.local-backup is committed; lint.yml has no permissions declaration and no dependency scan; Dockerfile uses a mutable base tag with no non-root USER; 17 blobs over 5MB (a 58.8MB demo.gif) bloat every clone.

The Bottom Line

A solid reference library for common AI patterns, strongest on RAG and agent workflows. It's not a deployable product—pick a project, copy the pattern, and treat the duplication and missing tests as the cost of a broad portfolio.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

666 files

Python184
Markdown93
TOML79
TypeScript24
YAML14
Jupyter Notebook10

ReactFlaskDockerLangChainVector storeCUDA

Module dependencies

The 10 most depended-upon modules of 209, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0__ai_hedgefund_services_types["types"] n1_ervices_utils_ServiceFactory["ServiceFactory"] n2_ents_doc_mcp_src_core_config["config"] n3__doc_mcp_src_core_exceptions["exceptions"] n4__mcp_src_database_repository["repository"] n5_gents_doc_mcp_src_core_types["types"] n6_c_mcp_src_github_file_loader["file_loader"] n7_mcp_src_ui_components_common["common"] n8_ts_doc_mcp_src_rag_ingestion["ingestion"] n9_ts_doc_mcp_src_github_client["client"] n4__mcp_src_database_repository --> n2_ents_doc_mcp_src_core_config n4__mcp_src_database_repository --> n5_gents_doc_mcp_src_core_types n9_ts_doc_mcp_src_github_client --> n2_ents_doc_mcp_src_core_config n9_ts_doc_mcp_src_github_client --> n3__doc_mcp_src_core_exceptions n9_ts_doc_mcp_src_github_client --> n5_gents_doc_mcp_src_core_types n6_c_mcp_src_github_file_loader --> n3__doc_mcp_src_core_exceptions n6_c_mcp_src_github_file_loader --> n5_gents_doc_mcp_src_core_types n6_c_mcp_src_github_file_loader --> n9_ts_doc_mcp_src_github_client n6_c_mcp_src_github_file_loader --> n4__mcp_src_database_repository n8_ts_doc_mcp_src_rag_ingestion --> n2_ents_doc_mcp_src_core_config n8_ts_doc_mcp_src_rag_ingestion --> n3__doc_mcp_src_core_exceptions n8_ts_doc_mcp_src_rag_ingestion --> n4__mcp_src_database_repository n8_ts_doc_mcp_src_rag_ingestion --> n6_c_mcp_src_github_file_loader

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium8

low2

Commit a lockfile beside the manifesthigh

advance_ai_agents/candidate_analyser/pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Remove the committed .env and rotate what it holdshigh

memory_agents/job_search_agent/.env.example.local-backup

A tracked .env is the most common route for a working key to reach a public clone, and it is the file the app actually loads, so the value is usually live.

Fix: git rm --cached the file, add it to .gitignore, rotate every credential it names, commit a .env.example with empty values.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/lint.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Pin the container base image by digestmedium

advance_ai_agents/ai-hedgefund/Dockerfile

motiadev/motia:latest (mutable tag)

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a pre-commit secret gatemedium

a secret-shaped file is tracked and no repo-level gate is visible

Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.

Fix: Add a pre-commit hook scanning staged content, and enable push protection.

Move large binaries to Git LFS or out of the repositorymedium17 occurrences

rag_apps/resume_optimizer/demo.gif

17 blobs over 5MB: demo.gif 58.8MB, demo.gif 37.9MB, demo.mov 32.9MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/lint.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

advance_ai_agents/ai-hedgefund/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Expand the test suite; it cannot cover this codebasemedium

1 test files against 211 source files (ratio 0.005)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow

.github/workflows/lint.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.