Build an Adaptive Python AI Tutor with FastAPI and SQLite
Learn how to build the PyMentor API to review Python code, generate AI feedback via OpenAI, and track mastery in SQLite.
Stock photo for illustration only, not from the actual event
- Create an API for Python code reviews and teaching feedback using OpenAI
- Store attempt history and topic mastery scores in a local SQLite database
- Limit maximum code length to 12,000 characters without executing learner code
- Clamp aggregate mastery scores strictly between 0 and 100
This tutorial is part of a deep-dive series on Agentic Workflows from Gate of AI, focusing on building a compact API named PyMentor designed as an adaptive tutoring service for Python practice. The API accepts a learner identifier, topic, exercise description, and code submission, retrieves the learner's previous mastery score, queries a configured OpenAI model for teaching-oriented feedback, validates the returned JSON, calculates a bounded new score, and records the attempt in SQLite.
The service's scope is intentionally narrow. It does not execute learner code, decide whether a learner passes a course, or replace a human instructor. Instead, it provides a repeatable feedback workflow: identifying a likely issue, recognizing positive elements, offering hints, asking a question, and maintaining progress records. These strict boundaries prevent the API from treating arbitrary submitted Python code as executable input.
Restricting the API from executing untrusted learner code directly is a critical security practice in educational AI tools, effectively eliminating Remote Code Execution (RCE) vulnerabilities that could arise if raw submissions were run natively on the server.
To begin development, create a project directory and a virtual environment using the following POSIX shell commands:
- mkdir pymentor
- cd pymentor
- python3 -m venv .venv
- source .venv/bin/activate
- python -m pip install --upgrade pip
- pip install fastapi "uvicorn[standard]" openai pydantic-settings
- mkdir -p app
For Windows PowerShell, activate the environment using .\.venv\Scripts\Activate.ps1 and create a .env file in the project root to configure your OpenAI API key, model name, database path, and a maximum code character limit of 12,000. Ensure sensitive files are added to .gitignore before proceeding.
For application logic, place the implementation inside app/main.py. The request schema limits incoming data, while Pydantic parses the model output contract. If required fields are missing or mastery deltas fall outside allowed limits, validation fails and returns a safe error response. Additionally, SQLite writes use parameter binding instead of string interpolation to prevent SQL injection risks.
"Do not test for an exact sentence from a language model. Test the response contract: fields should exist, lists should have the expected shape, and mastery should remain within the API’s defined range."
Gate of AI Technical Briefing
Stock photo for illustration only, not from the actual event
Start the development server using uvicorn app.main:app --host 127.0.0.1 --port 8000 --reload, then verify the health endpoint and submit a loop exercise via cURL to /v1/tutor/review for learner learner_42. A successful request returns HTTP 201 along with attempt identifiers, prior scores, updated bounded scores, and validated feedback objects.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment