Urgent.News

What's breaking now, across thousands of outlets.

Tech

How I Built Lazarus: Autonomous Legacy Resurrection with Kiro Specs, Custom MCP, and Differential Fuzzing

Engineering teams sit on unmaintained legacy JavaScript modules they are afraid to touch because manual rewrites introduce silent edge-case regressions. For Kiroween 2026 (Frankenstein category), I built Lazarus — an autonomous legacy resurrection engine that stitches an isolated execution sandbox together with a 4-agent Kiro Crew and fast-check property-based differential fuzzing. Live Operating…

In the world of software development, legacy JavaScript modules often pose challenges due to their difficult-to-maintain nature. Kiroween 2026, a hackathon category known as Frankenstein, inspired engineer Anjarkar to create Lazarus, an autonomous legacy resurrection engine.

Lazarus is a sophisticated system that combines an isolated execution sandbox with a 4-agent Kiro Crew and fast-check property-based differential fuzzing. Live demonstration of Lazarus can be found at https://lazarus-yf0a.onrender.com, while the source code and related artifacts are available on GitHub at https://github.com/anjarkar25-max/lazarus.

One significant issue with legacy code is the potential for silent edge-case regressions during manual rewrites. For example, the expression (n / 2) | 0 works for positive integers but not for negative odd integers like -3. Traditional unit tests might not catch such discrepancies, making Lazarus a promising solution.

To ensure behavioral parity between the original and modernized code, Lazarus employs an isolated sandbox and a custom MCP server. The sandbox, located at src/sandbox/, executes untrusted legacy code in a locked-down Node child process with strict memory, timeout, filesystem, and network restrictions. The custom MCP server, found in lazarus-sandbox/, allows agents to safely probe legacy expressions via stdio.

At the heart of Lazarus lies a 4-Agent Kiro Crew, consisting of Archaeologist, Architect, Necromancer, and Exorcist, which are defined in .kiro/agents/. The Archaeologist probes boundary inputs to capture baseline runtime traces, the Architect synthesizes observed behavior into formal Kiro specifications, the Necromancer modernizes the code to ES2022+, and the Exorcist runs fast-check differential fuzzing to check for behavior divergence.

To ensure the system's reliability, Lazarus is engineered using Kiro Spec-Driven Development. Each subsystem is designed with formal requirements, architecture designs, and implementation task lists outlined in .kiro/specs/. Additionally, repository-wide steering guidelines, established at .kiro/steering/, and an automated on-save Vitest hook ( .kiro/hooks/run-tests-on-save.json ) verify 86 passing tests across 10 suites, ensuring Lazarus's robustness.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

An MCP Tool Schema Is Not an Authorization Check: A Laravel Design Pattern

An MCP tool can be wonderfully easy to call. That is exactly why a write-capable tool deserves more scrutiny than a read-only one. Imagine an assistant with a refund_invoice tool.

  • MCP tool schema alone does not handle authorization
  • Server handles input validation, access controls
  • Laravel gates and policies used for authorization decisions

A tiny Python helper for source-grounded content repurposing

A content-repurposing workflow has two different jobs: assembling a consistent draft pack, and deciding whether the draft actually says what the source supports. A script can help with the first job.

  • Python script simplifies content repurposing from articles or transcripts
  • Script performs draft creation and source verification, no API key needed
  • Manual review required to ensure factual accuracy and originality

openat2 Path Confinement Still Needs a Trusted Directory Descriptor

openat2 Path Confinement Still Needs a Trusted Directory Descriptor A service that accepts a user-supplied filename has two problems to solve.

  • openat2() call helps prevent path resolution outside intended directory
  • RESOLVEBENEATH option restricts pathnames to designated directory tree
  • Proper error handling crucial to identify policy issues and attacker-controlled input

More from Saturday 14 November →