Dicklesworthstone/ultimate_bug_scanner

What it solves

Ultimate Bug Scanner (UBS) addresses the issue of AI coding agents (like Claude Code, Cursor, and Codex) introducing subtle, critical bugs—such as null pointer crashes, XSS vulnerabilities, and missing await calls—that are costly and time-consuming to debug in production. It acts as a quality guardrail for AI-generated code by flagging likely bugs early in the development cycle.

How it works

UBS is a language-aware meta-runner that auto-detects multiple languages (including JavaScript/TypeScript, Python, C/C++, Rust, Go, Java, Ruby, Swift, C#, and Elixir) within a single repository and executes per-language scanners. These scanners are lazily downloaded and verified via SHA-256 checksums to ensure supply-chain security.

Key technical mechanisms include:

• AST Analysis: Uses tools like ast-grep and custom AST walkers for deep analysis of resource lifecycles (e.g., detecting missing Close() calls in Go or with blocks in Python).
• Taint Analysis: Tracks data flow to identify security holes like open redirects and SQL injection in Java and Go.
• Unified Reporting: Merges results from various scanners into a single report in formats like JSON, SARIF, or a specialized LLM-optimized "TOON" format.
• Integration: Can be wired into Git pre-commit hooks or AI agent loops via machine-readable outputs and JSON schemas.

Who it’s for

Developers using AI coding agents who want to automate bug detection and security auditing. It is also designed for CI/CD pipelines to prevent regressions through baseline comparisons and strict failure profiles.

Highlights

• Multi-language Support: Unified scanning for a wide array of modern programming languages.
• Agent-Optimized: Provides machine-readable formats (JSON, TOON) and documentation specifically for AI agents to consume.
• Supply-Chain Security: Pinned checksums and Minisign/Cosign support for verifying downloaded modules.
• Resource Lifecycle Tracking: Specialized heuristics to find leaks in sockets, files, and subprocesses.
• CI/CD Ready: Supports baseline diffing, HTML reports, and SARIF output for integration into professional workflows.