TL;DR
Arm released Metis, an open-source AI-driven security code review tool using LLMs and RAG for semantic vulnerability detection across C, C++, Python, Rust, and TypeScript.
Key Points
- Supports 5 languages via plugin architecture: C, C++, Python, Rust, TypeScript with extensible design
- Uses LLM reasoning + RAG for context-aware analysis, moving beyond hardcoded linting rules
- Dual vector store backends: ChromaDB (local, zero-setup) and PostgreSQL with pgvector (scalable)
- CLI and non-interactive modes with customizable security prompts, diff reviews, and incremental indexing
Why It Matters
Traditional static analysis tools miss subtle semantic vulnerabilities in complex codebases. Metis addresses review fatigue by combining LLM reasoning with code context, enabling security engineers to catch logic flaws and design issues that rule-based tools overlook—critical for large legacy systems where manual review is costly.
Source: github.com