AI Code Review Assistant for Python Code Quality

Code review is where most software defects are caught, yet in student and small-team projects it is often skipped or done superficially — reviewers skim for style while real bugs slip through. Commercial AI reviewers exist but are black boxes, and their training data and rules are hidden. This project builds the review pipeline in the open: Python code is parsed into an abstract syntax tree for exact structural checks (mutable default arguments, bare except clauses, SQL string concatenation, unused imports, deep nesting), while a CodeBERT model fine-tuned on CodeSearchNet suggests missing docstrings and summaries for undocumented functions. Because both layers are visible, the student can explain exactly how each finding is produced — a strong position for a viva. The web demo makes the pipeline tangible: paste any Python function and get an instant, categorized review with fix suggestions.

1. Pasted Python source is parsed with the standard ast module into a syntax tree; syntax errors are reported immediately with line numbers.
2. A set of AST visitor rules walks the tree and records matches — for example, a FunctionDef whose defaults contain a List or Dict node triggers the mutable-default-argument rule.
3. Security patterns are matched against call sites: string-formatted SQL in execute() calls, os.system with f-strings, and hardcoded credential assignments.
4. Undocumented public functions are passed to the fine-tuned CodeBERT model, which generates a draft docstring shown alongside the "missing documentation" finding.
5. Findings are scored by severity, deduplicated, and sorted; the demo renders them with category filters (Bugs, Security, Style, Documentation).
6. The summary panel aggregates counts by severity and category, and every finding links to a suggested fix snippet the student can copy.

Tech stack:

• Python 3.11, ast module (static analysis core)
• Hugging Face Transformers, CodeBERT (microsoft/codebert-base)
• CodeSearchNet Python subset (training data)
• PyTorch (fine-tuning)
• Flask (demo backend) + HTML/CSS/JS (demo frontend)
• pytest (rule test suite)

Dataset & model details

• Dataset: CodeSearchNet (Husain et al., 2019) — 2M+ (function, documentation) pairs mined from open-source GitHub repositories across 6 languages; the Python subset (~457k pairs) is used for fine-tuning. Source: github.com/github/CodeSearchNet.
• Task: Code-to-text generation (draft a docstring/comment for a given Python function) plus AST-based defect detection as the deterministic layer.
• Model: CodeBERT (microsoft/codebert-base, 125M parameters) fine-tuned on CodeSearchNet Python pairs for comment generation; static rules implemented as ast.NodeVisitor subclasses.
• Metrics: BLEU score on a held-out CodeSearchNet Python split for comment generation (design target, not a claimed result); per-rule precision/recall measured on the shipped labeled test suite and reported honestly in the report.

• [AST-based static checks] Deterministic analysis over the Python abstract syntax tree catches structural bugs — mutable default arguments, bare except:, eval() usage, unused imports and variables, and functions with excessive complexity.
• [CodeBERT comment generation] A CodeBERT model fine-tuned on CodeSearchNet Python pairs drafts docstrings for undocumented functions, demonstrating transformer-based code understanding.
• [Security-focused rules] Flags SQL string concatenation, hardcoded credentials, pickle.loads on untrusted data and shell injection patterns, each with a plain-language risk explanation.
• [Severity-ranked findings] Every issue is scored and grouped as Critical, Warning or Suggestion, so the most dangerous problems surface first.
• [Fix suggestions] Each finding ships with a concrete corrected code snippet, not just a complaint — the demo shows before/after for every rule.
• [Live web demo] Paste Python code and get an instant review in the browser: findings list, severity filters, per-rule explanations and an issue summary panel.
• [Rule test suite] Each checker ships with positive and negative test cases, so the report documents exactly what the tool catches and what it misses.

• AST-based static checker source code (18 documented rules)
• Fine-tuned CodeBERT adapter weights for docstring generation
• Training notebook (CodeSearchNet loading, fine-tuning, BLEU evaluation)
• Live web demo wired to the checker and model
• Per-rule test suite with positive/negative cases
• Project report PDF (background, transformer code models, rule design, methodology, results)
• PPT presentation for final review
• Viva Q&A preparation document (ASTs, CodeBERT, BLEU, static vs dynamic analysis)

• Static rules are pattern-based and can miss novel bug shapes; they complement, not replace, human review.
• Comment generation quality is bounded by CodeSearchNet docstring quality, which varies across repositories.
• BLEU is reported as a design target — the report documents the actual achieved score after the training run.
• The checker targets Python 3 only; other languages are out of scope.
• Security rules flag suspicious patterns but do not perform taint tracking, so some findings need human confirmation.