codexstar69/bug-hunter

Adversarial AI bug hunter with auto-fix skill for Claude Code, Cursor, Codex CLI, GitHub Copilot CLI, Kiro CLI, Opencode, Pi Coding Agent, and more. Multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs — then fixes them autonomously on a safe branch.

What it solves

Bug Hunter addresses the problem of "false-positive overload" in AI code reviews. Many tools flag potential issues that are not actually reachable or harmful, leaving developers to manually verify every claim. Bug Hunter uses an adversarial process to ensure that only evidence-backed, confirmed bugs are reported, reducing noise and uncertainty.

How it works

The system uses a multi-stage, adversarial pipeline where different roles challenge each other:

  1. Hunter: Identifies potential bugs and provides evidence.
  2. Skeptic: Actively attempts to disprove the Hunter's claims by tracing code and checking for defensive measures.
  3. Referee: Independently reviews the evidence from both sides to issue a final verdict of "Real Bug," "Not a Bug," or "Manual Review."

This process is preceded by a deterministic risk triage that prioritizes high-risk files and is followed by optional verification steps (like running tests or static checks) to confirm findings.

Who it’s for

It is designed for developers using AI coding agents (such as Claude Code, Cursor, Windsurf, or GitHub Copilot) who want to perform rigorous, security-focused code audits without the distraction of unverified or low-quality alerts. It is suitable for teams that require measurable, evidence-backed security and behavioral correctness in their codebase.

Highlights

  • Adversarial Verification: Findings must survive a challenge from a "Skeptic" role before being confirmed.
  • Scan-Only Default: The tool defaults to reporting mode; it will never edit your files unless you explicitly request a fix and provide authorization.
  • Measurable Quality: Provides metrics like precision, recall, and F1 scores to track the effectiveness of the audit.
  • Adaptive Execution: Automatically selects between fast, balanced, or high-assurance profiles based on the risk and scope of the code.
  • Hybrid Verification: Can perform static checks, type checks, and security-static checks to validate findings.
  • Broad Compatibility: Integrates as a skill into most popular file-based AI coding agents.

Related

  • Project
    cloudflare/security-audit-skill

    A coding-agent skill that implements a structured, six-phase security audit workflow to systematically discover and verify vulnerabilities in a codebase.

  • Project
    capitalone/VulnHunter

    An agentic AI security tool that identifies exploitable vulnerabilities in source code by simulating attacker paths and using a falsification engine to minimize false positives.

  • Project
    awarexone/Agentic-Bug-Hunter

    An AI-powered command-line tool that automates the entire bug bounty lifecycle, from reconnaissance and vulnerability scanning to report generation.

  • Project
    Gabson0x/bountyforge

    An AI-powered pentesting framework for Claude Code that uses parallel specialized agents to audit smart contracts and web APIs, validating findings through a multi-gate process to generate submission-ready bug bounty reports.

  • Project
    XiNian-dada/Fuck_My_Shit_Mountain

    An evidence-based code auditing skill for AI coding agents that performs deep-dive technical reviews across 26+ engineering dimensions to identify hidden risks and architectural flaws.