DEV Community

Rishi Banota
Rishi Banota

Posted on

"I Built BugSeer — an Offline, Explainable Bug-Risk Predictor (Your Code Never Leaves Your Machine)"

#devtools

Most "AI code review" tools hand you a score and expect you to trust it. I don't. So I built BugSeer — a tool where every single point of risk traces back to named, inspectable evidence.

And it runs 100% offline. No cloud, no API keys, no telemetry. Your source code never leaves your machine.

BugSeer demo

The problem with "trust me, it's risky"

When a static analyzer says src/payment.py is a 96/100 defect risk, what do you do? You can't argue with a number. You either blindly refactor or ignore it.

BugSeer's rule is different: show the receipts.

🔥 src/payment.py   96/100 (critical)
████████████████████████████████████████
static 102  ·  git 70  ·  raw 172 pts

  ⎇ +40 High bug-fix density   [bugfix-density]
      9 of 10 commits (90%) look like bug fixes.

  ◆ +27 No error handling       [no-error-handling]
      4 I/O, network, parsing calls and zero try/catch.

  ◆ +25 Deeply nested control flow [deep-nesting]
      Max nesting 3, max block depth 7 (threshold 3).
Enter fullscreen mode Exit fullscreen mode

You can push back on that. That's the entire point.

How it works (5 phases, all local)

  1. Rule-based static analysis — parses with ast (Python) or tree-sitter (19+ langs). Flags no-error-handling, deep nesting, god-files, swallowed exceptions, etc.
  2. Git intelligence — reads git log locally: change frequency, bug-fix density, revert history, fix-follow rate.
  3. Learn from your bugs — bugseer train fits a model on your repo with a temporal split, so it's predictive, not circular.
  4. Project heat map — colour-coded tree, or a React dashboard via bugseer serve.
  5. "What if?" simulator — bugseer impact predicts what breaks if you touch a file.

The honesty guarantees (why I trust it)

A prediction you can't trust is worse than none:

  • Metrics are out-of-fold (5-fold CV), never training-set scores.
  • Probabilities clamped to 2–95% — a few dozen samples don't justify certainty.
  • Too little signal? It says so and falls back to rules instead of fitting noise.

Example from my own training run:

✓ Model trained
  Estimator      sklearn.GradientBoostingClassifier
  ROC AUC (5-fold)  0.7652
  Learned to look at:
    largest parameter list   █████████ 24.5%
    comment ratio            █████ 14.8%
    ownership concentration  ████ 10.0%
Enter fullscreen mode Exit fullscreen mode

Try it 

pip install -e ".[all]"     # or just: pip install -e .

bugseer scan .              # rank files by risk
bugseer explain src/payment.py   # full reasoning for one file
bugseer heatmap .           # colour-coded project tree
bugseer impact src/db.py    # "what if I change this?"
bugseer train .             # learn from your own bug history
Enter fullscreen mode Exit fullscreen mode

Works in CI too:

- run: pip install -e ".[parsers]"
- run: bugseer scan . --fail-over 85 --ignore-tests
Enter fullscreen mode Exit fullscreen mode

Why I built this

I'm a student developer (3rd-year BE IT). I kept shipping code I thought was fine and finding out otherwise weeks later. The existing tools were either cloud-locked or black boxes. BugSeer is my attempt at something I'd actually use: fast, private, and willing to explain itself.

It's open source under MIT. Stars, issues, and PRs welcome — especially if you break it. 👉 github.com/rishibanota/Bugseer

If you try it on your own repo, tell me what it got right (or wrong) in the comments.

Top comments (0)