A CLI-based security vulnerability scanner combining static analysis, LLM-powered discovery, and ticket cross-referencing (generated with Regolo.AI). Example Report | Regolo.AI
- 27+ scanning phases: Indexing → Semgrep → CWE MoE Routing → CPG-guided slicing → LLM Static Analysis → Hunt/Validate/IndependentVerify → Exploit Synthesis → LLM Discovery → Verification → Rule Synthesis → Ticket Cross-Ref → Git Analysis → Cross-File Analysis → Confidence Scoring → AI Aggregation → Reporting
- Parallel execution: Semgrep + LLM discovery concurrent; verification phases run in parallel
- CWE-aware MoE: BM25 RAG retrieval from CWE knowledge base, routes to specialized analysis paths
- CPG-guided slicing: Precise data-flow extraction via code property graphs
- Exploit synthesis: Auto-generates PoC payloads with sandbox validation
- Rule synthesis: LLM→semgrep rule generation (MoCQ pattern)
- Checkpoint/resume: Crash recovery after each phase
- Multiple outputs: JSON, HTML, SARIF
- Config-driven: TOML config with env var overrides
- Ticket integration: GitHub, GitLab, Bugzilla, Jira
cargo build --release
./target/release/baco --versioncp config.example.toml myproject.toml
baco scan --config myproject.toml- Architecture - PhaseGraph pipeline
- Configuration - Settings, LLM config, prompts
- Research Integration - Design decisions
Codecov:
