# AI tooling for static analysis

The analyzer stays the oracle in every entry here, and AI works around
it: authoring rules, triaging findings, proposing the fix. The field
moves quickly, and these entries may be out of date.

## Static analysis and linters

[Copilot Autofix](https://docs.github.com/en/code-security/concepts/code-scanning/copilot-autofix-for-code-scanning) suggests fixes for [CodeQL](https://codeql.github.com)
findings; [Semgrep](https://semgrep.dev/) Assistant authors rules and triages findings.
The strongest evidence is from automated program repair deployed
internally at scale: Meta's [Sapfix](https://engineering.fb.com/2018/09/13/developer-tools/finding-and-fixing-software-bugs-automatically-with-sapfix-and-sapienz/) (Marginean et al. 2019)[^marginean2019] and
[Getafix](https://engineering.fb.com/2018/11/06/developer-tools/getafix-how-facebook-tools-learn-to-fix-bugs-automatically/) (Bader et al. 2019)[^bader2019], which learn fix patterns from past
edits. Google's [Big Sleep](https://projectzero.google/2024/10/from-naptime-to-big-sleep.html) searches for vulnerabilities
rather than repairing them, and it has found real CVEs in open-source
code.

## Clone detection

No AI-specific tool exists. A clone
detector ([jscpd](https://github.com/kucherenko/jscpd), [PMD CPD](https://pmd.github.io/),
[Simian](https://harukizaemon.com/simian)) is the oracle; a general-purpose agent consumes
the report and proposes the de-duplication.

## Dead-code detection

A detector ([knip](https://knip.dev), [Vulture](https://github.com/jendrikseipp/vulture)) flags the candidates,
but confirming a removal is *safe* needs a second oracle: the test
suite plus whole-program reachability. No AI-specific dead-code tool
exists; a general agent drives the detector and the suite.

## References

[^marginean2019]: Marginean, Alexandru, Johannes Bader, Satish Chandra, et al. 2019. "[SapFix: Automated End-to-End Repair at Scale](https://eecs481.org/readings/SapFix-Automated-End-to-End-Repair-at-Scale-v2.pdf)." *2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)*, 269–78. <https://doi.org/10.1109/ICSE-SEIP.2019.00039>.
[^bader2019]: Bader, Johannes, Andrew Scott, Michael Pradel, and Satish Chandra. 2019. "[Getafix: Learning to Fix Bugs Automatically](https://arxiv.org/pdf/1902.06111)." *Proceedings of the ACM on Programming Languages* 3 (OOPSLA): 159:1–27. <https://doi.org/10.1145/3360585>.