It will help you improve your skills and understand how to start this journey!
PS: blogpost written in Italian and localized in English by an AI.
One day I found myself thinking: every AI model is different, and each has its own strengths and weaknesses. With Regolo.AI I saw that as example “gemma” is better on UI/UX or that “Mistral” is more picky when does reviews.
As humans, we can read code and often spot bugs without any specialized tools. We can also rely on dedicated static analysis tools when needed. In the AI world, however, different models can complement each other in interesting ways.
I was looking for a project that could be genuinely useful for code analysis: fast (written in Rust), easy to port and configure, and capable of demonstrating how combining multiple models – even from different model families – can produce better results than relying on a single one.
After months of work, Baco Scanner is public. Not the usual bug scanner but something to use at best the LLMs in task without thinking so much, “just reading code” like the humans.
The core idea is intentionally simple.
Most stages execute in parallel whenever possible, allowing multiple models and analysis engines to work simultaneously while keeping the overall scan time practical.
A TOML configuration file defines:
- Which models will analyze the source code, either in agentic mode or standard mode depending on the configuration.
- Each model analyzes the files independently.
- Every prompt can be fully customized or overridden through the configuration file.
- Once all analyses are complete, the system generates a JSON file containing every issue reported by the models.
- Another model reviews the findings, merges duplicate reports that refer to the same issue, and enriches them with additional context.
- A final model generates clear, human-readable descriptions.
- The system produces reports in HTML, JSON, and SARIF formats.
- The configuration file also defines OpenAI-compatible hosts, API keys, rule references, and many other options.
- Semgrep integration, custom rule sets, and many additional features can be enabled through configuration.
The analysis pipeline goes even further.
Using Git, the system automatically attempts to identify the commit that originally introduced each issue. It also searches GitHub, GitLab, and Jira for related tickets or discussions, and includes all of this contextual information directly in the final report.
GitHub: https://github.com/CodeAtCode/baco-scanner
The repository includes a complete example configuration, a sample report generated from a real project, and detailed documentation covering the entire 11-stage analysis pipeline.
P.S. The project already has approximately 80% code coverage. I’m currently working toward 100% coverage while continuing to improve the overall project.
