A CLI-based security vulnerability scanner combining static analysis, LLM-powered discovery, and ticket cross-referencing (generated with Regolo.AI). Example Report | Regolo.AI
- 20 scanning phases: Indexing → Semgrep → LLM Static Analysis → CWE Routing → LLM Discovery → LLM Verification → SecurityAgent Verification → Ticket Cross-Ref → Git Analysis → Cross-File Analysis → Confidence Scoring → AI Aggregation → Threat Modeling → Root Cause Dedup → Multi-Verifier → Auto-Patching → CVE Bootstrap → PoC Compiler → Variant Search → Reporting
- Parallel execution: Indexing, Semgrep, and LLM Static Analysis run concurrently; 17 sequential phases follow
- CWE-aware MoE: BM25 RAG retrieval from CWE knowledge base, routes to specialized analysis paths
- CPG-guided slicing: Precise data-flow extraction via code property graphs (module exists, not yet wired to pipeline)
- Exploit synthesis: Auto-generates PoC payloads with sandbox validation (module exists, not yet wired to pipeline)
- Rule synthesis: LLM→semgrep rule generation (MoCQ pattern) (module exists, not yet wired to pipeline)
- Checkpoint/resume: Crash recovery after each phase
- Multiple outputs: JSON, HTML, SARIF
- Config-driven: TOML config with env var overrides
- Ticket integration: GitHub, GitLab, Bugzilla, Jira
cargo build --release
./target/release/baco --versioncp config.example.toml myproject.toml
baco scan --config myproject.toml- Architecture - PhaseGraph pipeline
- Configuration - Settings, LLM config, scanner phase flags, prompts
- Research Integration - Design decisions based on 30 academic papers plus triage patterns inspired by Claude-BugHunter
Codecov:
