🐕 BugHound

Static analysis tool for TypeScript/JavaScript that detects bugs, security vulnerabilities, and code quality issues — with automated fixes.

Quick Start

npm install -g bughound
bughound scan --path ./project

Key Features

89 Pattern Detection

| Category | Count | Examples | |----------|-------|----------| | Bug | 31 | Race condition, memory leak, logic error | | Security | 25 | XSS, SQL injection, SSRF, hardcoded secrets | | Code Quality | 10 | Magic number, deep nesting, missing validation | | Architecture | 7 | Layer violation, missing pagination | | DevOps | 13 | Missing Dockerfile, CI/CD, .gitignore | | Frontend | 5 | Missing alt text, key prop, error boundary | | Testing | 3 | Missing test file, no assertions | | GraphQL | 3 | Introspection, N+1 query | | Cloud | 6 | S3 public, GCP IAM, Azure misconfig |

Auto-Fix

BugHound doesn't just detect bugs — it provides fixes you can apply immediately:

bughound fix BUG-001          # Fix a single bug
bughound fix-all              # Fix all auto-fixable bugs

AI-Powered Code Review

BugHound has built-in AI agents for deep security and architecture review:

# AI review with static analysis + LLM deep analysis
bughound ai --path .                        # Uses default provider (Ollama)
bughound ai --provider openai               # OpenAI GPT-4
bughound ai --provider gemini               # Google Gemini
bughound ai --provider ollama --model llama3 # Local, free

# Review a single file
bughound ai --file src/auth.ts --provider openai

# JSON output for automation
bughound ai --format json

Interactive AI Chat

Ask AI about your codebase in real-time:

bughound chat --provider openai     # Start interactive chat
bughound chat --provider ollama     # Local, free

# In chat mode:
> /explain BUG-001       # Deep explanation of a specific bug
> /fix BUG-015           # AI suggests best fix
> /review src/auth.ts    # Deep security review of a file
> What are the security risks in this codebase?

AI Configuration

Set up AI provider once:

bughound ai-config --setup                  # Interactive wizard
bughound ai-config --provider openai --model gpt-4o
bughound ai-config --provider gemini --api-key $KEY

Or use environment variables:

export OPENAI_API_KEY=sk-...               # Auto-selects OpenAI
export GOOGLE_API_KEY=...                   # Auto-selects Gemini
export BUGHOUND_AI_PROVIDER=ollama          # Force provider
export BUGHOUND_AI_MODEL=llama3             # Custom model

| Provider | Setup | Cost | |----------|-------|------| | Ollama | Install from ollama.com | Free, local | | Qwen | DASHSCOPE_API_KEY env var | Pay per token, Alibaba Cloud | | OpenAI | OPENAI_API_KEY env var | Pay per token | | Gemini | GOOGLE_API_KEY env var | Free tier available | | Custom | Any OpenAI-compatible endpoint | Depends |

CI/CD Integration

Fail your pipeline when critical bugs are found:

bughound scan --ci --fail-on critical

Report Export

bughound scan --format html       # HTML report
bughound scan --format sarif      # GitHub Code Scanning
bughound scan --format markdown   # GitHub Issues
bughound scan --format junit      # CI Dashboards

GitHub PR Review

Automatically post review comments on pull requests:

bughound scan --pr-review --pr-number 123 --github-token $TOKEN

Compliance Reports

Generate audit-ready compliance reports:

bughound scan --compliance gdpr
bughound scan --compliance soc2
bughound scan --compliance hipaa

Developer Scorecard

Track code quality per developer:

bughound scan --scorecard

Configuration

Create a bughound.json file at your project root:

{
  "exclude": ["**/node_modules/**", "**/dist/**"],
  "severity": ["critical", "high"],
  "minConfidence": "likely"
}

Integrations

VS Code

Extension available on the marketplace. Bugs appear as warnings in the editor when you save files.

Pre-commit Hook

#!/bin/sh
bughound scan --ci --fail-on critical || exit 1

GitHub Action

- name: Scan
  run: npx bughound scan --ci --fail-on critical

AI Assistants (Qwen Code / Cursor)

BugHound has built-in AI agents that work standalone — no external AI tool needed. Other AI assistants can also integrate via bughound audit --format json for structured output.

Full integration guide in AGENTS.md.

Full Documentation

• Integration Guide - IDE, project, and GitHub setup
• AI Agent Guide - Qwen Code, Cursor, and CI automation

Pattern List

View all 89 patterns:

bughound patterns

Changelog

See CHANGELOG.md for full release history.

License

MIT