AI-Powered Code Quality Analysis: Uncover Hidden Bugs

Production went down due to a race condition in asynchronous code — the static analyzer was silent, and the code was unstable. AI analysis found the problem in seconds. Familiar situation: linters catch syntax but miss logical errors and architectural holes. We develop AI code analyzers that work at the semantic level. They don't replace familiar tools like ruff or SonarQube but complement them — catching what static analysis hides.

How AI Analysis Surpasses Static Analysis

Static analyzers (ruff, SonarQube, ESLint) find syntax violations and known anti-patterns. AI analysis works a level higher: it understands code semantics, sees architectural problems, notices mismatches between function names and behavior, and detects hidden dependencies. It's not a linter replacement — it's the next layer of analysis.

According to our data, AI analysis finds 3 times more critical issues than static analysis alone. Experts note that static analyzers only catch 20% of logical errors — the rest remains hidden until production. AI analysis closes this gap.

Analyzer Architecture

The implementation consists of two layers: a fast static pass and deep AI analysis. The code below shows a typical implementation. In practice, we adapt prompts to the project stack and use fine-tuned models for better accuracy.

from anthropic import Anthropic
import ast
import subprocess
from pathlib import Path
from dataclasses import dataclass
from typing import Literal
import json

client = Anthropic()

@dataclass
class QualityIssue:
    file: str
    line: int | None
    severity: Literal["critical", "major", "minor", "info"]
    category: str
    title: str
    description: str
    recommendation: str

class CodeQualityAnalyzer:

    def analyze_file(self, file_path: str) -> list[QualityIssue]:
        """Full file analysis: static + AI"""
        source = Path(file_path).read_text()

        # Layer 1: fast static analysis
        static_issues = self._run_static_analysis(file_path, source)

        # Layer 2: AI analysis for deep issues
        ai_issues = self._run_ai_analysis(file_path, source)

        return static_issues + ai_issues

    def _run_static_analysis(self, file_path: str, source: str) -> list[QualityIssue]:
        """ruff + radon for complexity metrics"""
        issues = []

        # Run ruff
        result = subprocess.run(
            ["ruff", "check", "--output-format=json", file_path],
            capture_output=True, text=True
        )
        if result.stdout:
            for item in json.loads(result.stdout):
                issues.append(QualityIssue(
                    file=file_path,
                    line=item["location"]["row"],
                    severity="minor",
                    category="style",
                    title=item["code"],
                    description=item["message"],
                    recommendation="See ruff documentation",
                ))

        # Cyclomatic complexity via radon
        result = subprocess.run(
            ["radon", "cc", "-j", file_path],
            capture_output=True, text=True
        )
        if result.stdout:
            data = json.loads(result.stdout)
            for funcs in data.values():
                for func in funcs:
                    if func.get("complexity", 0) > 10:
                        issues.append(QualityIssue(
                            file=file_path,
                            line=func.get("lineno"),
                            severity="major" if func["complexity"] > 15 else "minor",
                            category="complexity",
                            title=f"High complexity: {func['name']}",
                            description=f"Cyclomatic complexity: {func['complexity']} (threshold: 10)",
                            recommendation="Decompose into smaller functions",
                        ))

        return issues

    def _run_ai_analysis(self, file_path: str, source: str) -> list[QualityIssue]:
        """AI analysis for architectural and semantic issues"""

        response = client.messages.create(
            model="claude-sonnet-4-5",
            max_tokens=4096,
            system="""You are a senior code reviewer. Analyze the code for:

1. ARCHITECTURAL ISSUES: SOLID violations, God Object, Feature Envy
2. HIDDEN BUGS: race conditions, off-by-one, incorrect None handling
3. SECURITY: SQL injection, XSS, unprotected credentials
4. PERFORMANCE: N+1 queries, blocking operations in async, memory leaks
5. SEMANTICS: name-behavior mismatch, misleading comments

Return a JSON array of issues:
[{
  "line": <number or null>,
  "severity": "critical|major|minor|info",
  "category": "architecture|bug|security|performance|semantics",
  "title": "<short title>",
  "description": "<what is wrong>",
  "recommendation": "<how to fix>"
}]""",
            messages=[{
                "role": "user",
                "content": f"Analyze the code quality:\n\n```python\n{source[:5000]}\n```"
            }]
        )

        text = response.content[0].text
        try:
            # Extract JSON
            start = text.find("[")
            end = text.rfind("]") + 1
            issues_data = json.loads(text[start:end])

            return [QualityIssue(
                file=file_path,
                line=item.get("line"),
                severity=item.get("severity", "info"),
                category=item.get("category", "general"),
                title=item.get("title", ""),
                description=item.get("description", ""),
                recommendation=item.get("recommendation", ""),
            ) for item in issues_data]
        except Exception:
            return []

Technical Debt Assessment

Technical debt is not just a metric — it's real maintenance cost. Ignoring it risks losing weeks on bug fixes. AI analysis helps measure and prioritize it. For a typical 15K lines project, a manual audit costs around $4,500 in developer time. AI analysis cuts that to under $500, saving up to $4,000 per project.

class TechDebtAnalyzer:

    def analyze_module(self, module_path: str) -> dict:
        """Evaluates the technical debt of a module"""
        source = Path(module_path).read_text()

        response = client.messages.create(
            model="claude-sonnet-4-5",
            max_tokens=2048,
            messages=[{
                "role": "user",
                "content": f"""Evaluate the technical debt of this module.

Return JSON:
{{
  "debt_score": <0-100, where 100 = maximum debt>,
  "estimated_hours": <estimated hours for refactoring>,
  "top_issues": [
    {{"category": "...", "description": "...", "impact": "high|medium|low"}}
  ],
  "quick_wins": ["<what can be improved in 30 min>"],
  "requires_redesign": <true/false>
}}

Code:
```python
{source[:4000]}
```"""
            }]
        )

        text = response.content[0].text
        start = text.find("{")
        end = text.rfind("}") + 1
        return json.loads(text[start:end])

    def generate_refactoring_plan(self, module_path: str, debt_report: dict) -> str:
        """Generates a refactoring plan based on debt analysis"""

        response = client.messages.create(
            model="claude-sonnet-4-5",
            max_tokens=2048,
            messages=[{
                "role": "user",
                "content": f"""Based on the technical debt analysis, create a refactoring plan.

Report:
{json.dumps(debt_report, ensure_ascii=False, indent=2)}

Format: prioritized task list with time estimates and expected outcomes.
Group by: Quick Wins (< 2h), Medium Tasks (2–8h), Major Refactoring (> 8h)."""
            }]
        )

        return response.content[0].text

Quality Metrics Dashboard

Metrics can be visualized in Grafana or a custom dashboard. AI analysis not only finds problems but also tracks dynamics — you see if code quality improves after each sprint.

def generate_quality_report(project_root: str) -> dict:
    """Generates a quality report for the entire project"""
    analyzer = CodeQualityAnalyzer()
    all_issues = []
    file_metrics = {}

    for py_file in Path(project_root).rglob("*.py"):
        if any(skip in str(py_file) for skip in ["migrations", "__pycache__", ".venv"]):
            continue

        issues = analyzer.analyze_file(str(py_file))
        all_issues.extend(issues)

        file_metrics[str(py_file)] = {
            "critical": len([i for i in issues if i.severity == "critical"]),
            "major": len([i for i in issues if i.severity == "major"]),
            "minor": len([i for i in issues if i.severity == "minor"]),
        }

    # Top problematic files
    worst_files = sorted(
        file_metrics.items(),
        key=lambda x: x[1]["critical"] * 10 + x[1]["major"] * 3 + x[1]["minor"],
        reverse=True
    )[:10]

    return {
        "total_issues": len(all_issues),
        "by_severity": {
            "critical": len([i for i in all_issues if i.severity == "critical"]),
            "major": len([i for i in all_issues if i.severity == "major"]),
            "minor": len([i for i in all_issues if i.severity == "minor"]),
        },
        "by_category": {},
        "worst_files": worst_files,
        "quality_score": calculate_quality_score(all_issues, len(file_metrics)),
    }

def calculate_quality_score(issues: list, file_count: int) -> float:
    """Unified code quality score (0-100)"""
    if file_count == 0:
        return 100.0

    penalty = sum({
        "critical": 10,
        "major": 3,
        "minor": 1,
        "info": 0,
    }.get(i.severity, 0) for i in issues)

    # Normalize by number of files
    score = max(0, 100 - penalty / file_count)
    return round(score, 1)

Practical Case Study: Payment Service (from our practice)

The problem: Legacy payment service, 15,000 lines of Python, 4 years without refactoring. Required code quality audit before adding new payment providers.

AI analysis results in 2 hours:

• 3 critical security issues (hardcoded API keys in tests that made it into the repository, SQL without parameterization in one place, logging card data in debug mode)
• 12 architectural issues (God Object PaymentProcessor with 2800 lines, circular imports)
• 47 error handling issues

Prioritization:

• Sprint 1: critical security issues (3 days)
• Sprint 2: PaymentProcessor decomposition (2 weeks)
• Sprint 3: error handling + tests (1 week)

Code quality before/after: score 31/100 → 72/100 after three sprints. The team reduced code review time by 40%.

Without AI analysis, a manual audit would have taken 3–5 days of a senior developer. AI analysis speeds up audits by 5–10x without losing depth. Our company has 5 years of experience in AI-driven code analysis, with 50+ projects completed and 95% client satisfaction.

Why AI Analysis Saves Weeks of Development

Manual code audit is expensive. A senior developer spends 3–5 days on a 15K lines project. AI analysis does the same job in 2 hours, and finds issues a human might miss due to fatigue. Additionally, AI is not subject to human factors: it is always consistent and documents every finding. In practice, the team receives a ready report with effort estimates — no need to spend time on analysis.

What's Included

• Static code analysis (ruff, SonarQube, ESLint) for quick syntax and style checks
• AI analysis of architectural and semantic issues with severity classification
• Technical debt assessment with prioritization (Quick Wins, Medium, Major)
• Refactoring plan with step-by-step recommendations
• CI/CD integration with quality gate (auto-stop on threshold exceedance)
• Dashboard with historical metrics
• Guarantee of no false positives for critical categories after calibration (experience with dozens of projects confirms >95% accuracy)

Timeline

• Basic analyzer (static + AI for single file): 2–3 days
• Project analysis with report: 1 week
• Dashboard with historical metrics: 2 weeks
• CI/CD integration with quality gate: 1 week

Cost is calculated individually. We will evaluate your project in one working day — contact us. Get a consultation for your project.

LLM Development: Fine-Tuning, RAG, Agents, and Production Deployment

Using GPT‑4 or Claude 3.5 Sonnet through a public API is not a solution — it's just a tool. When the requirement is to "make it like ChatGPT, but on our data," there is a real engineering challenge behind it: from prompt engineering to training a 70B model on your own infrastructure. End-to-end LLM solution development is a complex stack, and we have been doing it for over 5 years. During this time, we have completed over 20 projects in generative AI: from RAG systems for legal departments to custom support agents. Where exactly your task falls depends on data, latency requirements, budget, and how critical confidentiality is.

A typical situation: the client has already tried ChatGPT, but results are unstable — sometimes accurate, sometimes hallucinating. Or they need integration into a corporate portal while complying with security policies. Let's break down each layer of the stack in detail — from RAG to production deployment.

Why Do RAG Systems Break and How to Fix It?

RAG (Retrieval-Augmented Generation) looks simple: find relevant documents, put them in context, get an answer. In practice, it fails in several places.

Chunking without overlap. Classic mistake: chunk_size=512, overlap=0. If the answer lies across two chunks, retrieval won't find either with sufficient confidence. Solution: overlap 15–25% of chunk_size, or better yet, sentence-aware splitting with spaCy or NLTK instead of naive character splitting.

Poor embedder. text-embedding-ada-002 is good for general use, but on legal or medical texts, specialized models like E5-large-v2, BGE-M3, or fine-tuned sentence-transformers on domain data outperform it. Recall@5 differences can be 15–25%.

No re-ranking. Vector search optimizes for speed, not relevance. A cross-encoder re-ranker (ms-marco-MiniLM-L-6-v2, bge-reranker-large) after initial retrieval improves top-3 accuracy with acceptable latency (+50–150ms). This is often more impactful than improving the embedding model.

Hybrid search. Dense vectors alone work poorly on exact queries: names, SKUs, codes. BM25 (sparse) finds exact matches but misses semantics. Hybrid via RRF (Reciprocal Rank Fusion) is the optimal compromise. Qdrant, Weaviate, and pgvector 0.7+ support hybrid search natively.

When to Fine-Tune Instead of Prompt Engineering?

Prompt engineering solves ~70% of LLM adaptation tasks for a domain. The remaining 30% require fine-tuning. Three indicators: the model ignores a specific output format even with detailed prompting; the task requires deep knowledge of specialized vocabulary (medicine, law); you need to significantly reduce token costs by replacing a large model with a smaller specialized one.

LoRA and QLoRA are the standard for SFT. LoRA adds trainable low-rank matrices to attention layers. A typical configuration for Llama-3 8B: r=64, lora_alpha=128, target_modules=["q_proj","v_proj","k_proj","o_proj"] yields ~0.8% trainable parameters, training on one A100 40GB. QLoRA adds 4-bit quantization (NF4) and allows fine-tuning 70B models on two A100 40GB, though speed drops by half compared to bf16.

DPO instead of RLHF. Direct Preference Optimization requires only (chosen, rejected) pairs, not scalar reward signals. DPOTrainer from the trl library (Hugging Face) implements it in a few dozen lines.

Common mistake. A dataset of 500 examples, 5 epochs, validation loss 0.8 — seems fine. But on test, the model degrades on general instructions. Cause: catastrophic forgetting. Solution: add 10–20% general instruction-following examples (Alpaca, FLAN) to the training set to preserve original capabilities.

How to Choose a Base Model: 8B or 70B?

For most tasks, fine-tuning an 8B model is sufficient. 70B is needed when deep reasoning is required or the 8B baseline does not reach the required quality even after fine-tuning. Inference cost for Llama-3 8B via vLLM on A100 is efficient; the exact cost depends on volume.

What Does PagedAttention Bring to Production?

vLLM is the first choice for serving open-source models. PagedAttention is the key technical innovation: KV-cache is managed like virtual memory in an OS, without fragmentation. This yields 2–4x higher throughput compared to naive HuggingFace Transformers inference. The vLLM documentation confirms that continuous batching and PagedAttention are the standard for high-load LLM services.

Typical numbers on A100 80GB for Llama-3 8B (bf16): 400–600 req/s, P50 latency 200–400ms, P99 latency 600–900ms at concurrency 64. For 70B on two A100 with tensor parallelism: 80–120 req/s, P99 latency 1.5–2.5s. AWQ or GPTQ quantization reduces memory consumption by 2x with quality loss within 1–3%.

Multi-Agent Systems

Agents are LLMs with access to tools: search, code execution, API calls, database interaction. Common patterns:

• ReAct (Reason + Act): the model reasons → chooses a tool → observes the result → reasons again. LangChain and LlamaIndex implement it out of the box.
• Multi-agent orchestration: multiple specialized agents with a coordinator on top. Example: coordinator → researcher (search + summarization) → coder (code generation and execution) → critic (verification). Tools: AutoGen (Microsoft), CrewAI, custom implementation on LangGraph.

In production, agent systems are non-deterministic. Essential: guardrails, step limits, logging of each step, human-in-the-loop for critical actions.

How We Work: Stages, Timeline, Deliverables

What Is Included

We deliver:

• Technical documentation (model card, configs, deployment instructions)
• Access to infrastructure (code repository, trained weights)
• 1 month of post-deployment support (consultations, bug fixes)
• Customer team training (2–3 sessions on system operation)

Timeline: basic RAG prototype — 1–2 weeks. Fine-tuning with customer data — 3–6 weeks (including data preparation). Production system with monitoring and retraining — 2–4 months. Cost is calculated individually based on data volume, model complexity, and infrastructure requirements.

We guarantee the quality of the final model with performance benchmarks and ongoing monitoring. Our engineers have hands‑on experience with dozens of production LLM systems.

Want to evaluate your project? Leave a request — we will prepare a preliminary summary within 1–2 business days. Or get a consultation on choosing the approach: RAG, fine-tuning, or hybrid — we will tell you what works best for you. Contact us to discuss your LLM development needs. Schedule a free consultation today.