Skip to content

Back to the catalog

Metis
github.comrepo

Metis

Metis is an open-source agentic AI security code review framework built by Arm's Product Security Team that uses LLMs for semantic vulnerability detection rather than hardcoded rules. It performs deep security review across codebases (with C/C++ reachability analysis via a code graph), validates and triages findings from itself or third-party SAST tools to reduce false positives, and annotates SARIF output. It supports multiple LLM providers (OpenAI, Azure OpenAI, Anthropic, Gemini, AWS Bedrock, vLLM, Ollama, llama.cpp, LiteLLM) and vector-store backends (ChromaDB, PostgreSQL/pgvector, Qdrant) for RAG-based codebase indexing and querying.

TL;DR Arm's open-source LLM agent for deep security code review, reachability-aware C/C++ analysis, and SARIF-based SAST triage.
Open original ↗
Document

What it is

Metis is Arm Product Security Team's agentic AI code-review framework, installable from github.com/arm/metis via uv or Docker. Beyond what the summary states, the page documents the concrete setup, run commands, and a non-obvious configuration-merge model that an evaluator needs before trying it.

How it works

Reviews emphasize source-local, deterministic evidence collection with a plugin-based language system, rather than broad vector retrieval. It runs a configurable "review graph" (see docs/execution-graph.md) and a SARIF triage flow (docs/triage-flow.md). Review checkpoints with project-local resume storage are enabled by default. Literal tokenizer markers like <|endoftext|> in reviewed source are treated as ordinary text. Optional compilation-database filtering exists for C/C++.

What to do

Install (virtualenv recommended), with optional backend extras:

uv venv
uv pip install .
uv pip install '.[postgres]'
uv pip install '.[qdrant]'
uv pip install '.[all-providers]'

Or Docker:

git clone https://github.com/arm/metis.git
cd metis
docker build -t metis .

Set a provider key and run against a codebase:

export OPENAI_API_KEY="your-key-here"
uv run metis --codebase-path "/path/to/src" --verbose

Interactive mode exposes init and review_code:

uv run metis --interactive --codebase-path "/path/to/src"

Docker run mounts the codebase at /metis and passes env vars:

docker run --rm -it -v "$PWD:/metis" -e "OPENAI_API_KEY=${OPENAI_API_KEY}" metis --codebase-path /metis --verbose --output-file /metis/results/review.json

Backend selection: --backend chroma|postgres|qdrant (default chroma). Add extra review guidance via --custom-prompt PATH, or drop a .metis.md in the project root (auto-used if present).

Caveats

Configuration merge semantics are sharp-edged and worth reading before relying on a custom metis.yaml: a selected non-packaged config does not inherit packaged llm_provider, embedding_provider, or query sections — llm_provider is required; the others have runtime fallbacks. execution, codegraph, reachability, triage, and hnsw_kwargs each replace the whole packaged mapping rather than merging; when execution is present it must be the complete graph. Non-empty model_tools/capabilities/threat_model merge recursively, but empty mappings replace (and an empty model_tools is then restored to required defaults). Embedding provider is only needed when the chosen vector backend does not itself supply both embedding models (affects index, ask, update).

Technologies named here

Techniques named here

  • Deep Reasoning / semantic code review via LLMs
  • Deterministic Local Evidence collection
  • Issue validation / false positive reduction
  • CodeGraph Reachability analysis
  • Patch/diff review
  • SARIF triage
  • Repository/threat-model memory ingestion

Related in AI Security