Universal AI Code Review System (v0.2)
154 patterns, security taint tracking, PR risk scoring, and code explanation. Reviews in under 1 second, entirely on your machine.
The Problem
Commercial code review tools are slow, cloud-dependent, expensive, and do either pattern matching or AI reasoning. Never both. Teams need fast, private, accurate reviews that also catch security vulnerabilities, missing test coverage, and risky PRs without sending code to third-party servers.
The Solution
A hybrid review engine combining 154 deterministic patterns with AI reasoning in a multi-pass pipeline. v0.2 added security taint tracking (source-to-sink analysis with CWE/OWASP mapping), PR risk scoring (weighted 1-10 across 8 factors), a code explanation command powered by the codebase index, test coverage gap detection, and dependency vulnerability scanning against 42+ known vulns. It builds a persistent codebase index on first run, then does incremental updates in 60ms.
System Architecture
Key Technical Decisions
Regex-only parsers instead of heavy AST frameworks. No Java or Python runtime needed unlike SonarQube. Runs anywhere Node runs.
Call graph, schema graph, and column registry stored in .code-review/ for instant incremental reviews instead of re-parsing the entire repo.
v0.2 added a 222-line taint tracker that traces data from user input sources through the codebase to dangerous sinks (SQL, exec, innerHTML). Detects sanitizer functions and maps findings to CWE/OWASP.
8-factor scoring: auth logic changes, DB schema mods, missing tests, dependency changes, config file edits, error handling removal, API surface changes, and file count. Gives teams a 1-10 risk score per PR.
Tracks which findings developers fix vs ignore. Uses TF-IDF similarity to auto-suppress false positives. No cloud ML, fully local.
Results