sashiko-dev/sashiko

Agentic review of Linux Kernel code changes

What it solves

Sashiko is an agentic code review system specifically designed to reinforce the Linux kernel by automating the detection of bugs, architectural flaws, and security vulnerabilities in proposed patches. It aims to reduce the burden on human maintainers by identifying issues that often slip through manual review processes.

How it works

Sashiko uses a multi-stage review protocol that mimics a team of specialized reviewers. It ingests patches from mailing lists (lore.kernel.org), GitHub PRs, GitLab MRs, or local git repositories. The process consists of two main phases:

  1. Analysis Stages: Parallel checks for specific categories of issues, including architectural goals, implementation correctness, execution flow (logic errors), resource management (leaks/UAF), locking (concurrency), security (buffer overflows), and hardware-specific constraints.
  2. Consolidation Stages: Sequential steps that deduplicate findings, resolve conflicts between different analysis results, verify the remaining concerns to filter false positives, and finally generate a polite, standard email reply for the Linux Kernel Mailing List (LKML).

Who it’s for

It is primarily intended for Linux kernel maintainers and developers who want to automate the initial screening of patches to improve code quality and security.

Highlights

  • Kernel-Specific Intelligence: Uses specialized prompts and a multi-stage protocol tailored for C code and kernel-level constraints.
  • LKM Integration: Built-in support for monitoring mailing lists via NNTP and integrating with GitHub/GitLab webhooks.
  • Self-contained: Works with various LLM providers (Gemini, Claude, GitHub Copilot) without requiring external agentic CLI tools.
  • High Bug-Detection Rate: Demonstrated ability to find a significant percentage of bugs in upstream commits that had previously passed human review.

Related

  • Project
    google/mantis

    A portable toolkit and agentic framework for automating the discovery, reproduction, and patching of software vulnerabilities to build more secure code.

  • Project
    Giskard-AI/giskard-oss

    An open-source Python library for testing and evaluating agentic systems, providing tools for automated red-teaming, vulnerability scanning, and LLM-as-judge evaluations.

  • Project
    masoncl/review-prompts

    A collection of specialized AI prompts and workflows for code review, debugging, and verification in the Linux kernel, systemd, and iproute projects.

  • Project
    arm/metis

    An agentic AI security framework for deep security code review that uses LLMs to detect subtle vulnerabilities and reduce false positives through integrated triage.

  • Project
    gameworkerkim/vibe-investing

    A comprehensive AI-driven investment ecosystem that combines multi-LLM agentic pipelines, quant regime classifiers, and corporate disclosure monitors to optimize financial decision-making.