arm/metis

Metis is an open-source, AI-driven tool for deep security code review

What it solves

Metis addresses the challenge of security code review in complex or legacy codebases where traditional static analysis tools often struggle. It helps engineers identify subtle vulnerabilities and improve secure coding practices while reducing the manual effort and fatigue associated with deep security audits.

How it works

Metis is an agentic AI framework that uses Large Language Models (LLMs) to perform semantic analysis of source code. Unlike traditional linters, it does not rely on hardcoded rules. Instead, it uses a plugin-based system to parse code (via Tree-sitter), build a codebase graph, and perform reasoning-based reviews. It supports various vector database backends (ChromaDB, PostgreSQL, Qdrant) to store and retrieve codebase context, and it can validate its own findings or those from third-party security tools to reduce false positives.

Who it’s for

It is designed for security engineers and developers working on large, complex, or legacy software projects who need an automated, extensible, and AI-driven approach to deep code security analysis.

Highlights

  • Deep Reasoning: Uses LLMs for semantic understanding rather than simple pattern matching.
  • Broad Language Support: Supports over 20 languages, including C, C++, Rust, Go, Python, and Solidity, with an extensible plugin architecture.
  • Flexible Integration: Compatible with major LLM providers (OpenAI, Anthropic, Gemini, AWS Bedrock) and local inference engines (vLLM, Ollama, llama.cpp).
  • Evidence-Based Triage: Validates findings and produces SARIF-formatted output, allowing it to act as both a standalone reviewer and a triage assistant for existing security tools.

Related

  • Project
    google/mantis

    Mantis is an open‑source, AI‑driven toolkit that automates security reviews of code. It uses LLM agents to build threat models, generate exploit tests, and suggest patches, all within a sandboxed, configurable workflow. The project is experimental and intended only for isolated environments; all findings require manual verification.

  • Project
    agentgg-dev/agentgg

    agentgg is a CI-ready, agentic static application security testing (SAST) scanner. Its LLM agents read and reason about code—following imports and confirming findings—to reduce false positives, supporting whole-repo scans and git-diff PR reviews.

  • Project
    msoedov/agentic_security

    An open-source vulnerability scanner for LLMs and agent workflows that protects AI systems from jailbreaks, fuzzing, and multimodal attacks.

  • Project
    tophant-ai/aibeat

    AI Beat is a security evaluation framework that audits LLMs and AI agents by analyzing both their text responses and their underlying runtime execution traces to detect hidden safety risks.

  • Project
    Wholiver/metis

    Metis is an open-source coding agent that runs as a desktop app, terminal tool, or Skill, letting each project define its own agent architecture. It automates planning, coding, review, and testing through editable workflows and automatic task tiers.