Back to results

University of Nevada - Reno

IntelliCode Review: An AI-Powered Platform for Automated Code Quality Analysis with Actionable Feedback

Abstract

dc:description.abstract

Getting comprehensive code quality feedback on a Python project today means running at least fiveseparate tools, each with its own configuration format, severity scale, and output schema. Most developers run one or two and skip the rest. Manual review covers some of the gap, but it is slow, reviewer-dependent, and reliably bad at catching security vulnerabilities in unfamiliar code. IntelliCode Review is a web-based platform that runs twelve code quality checks from a single request. Full analysis of a 1000-line Python file completes in 1.41 seconds; analysis of 100-line files completes in 234 milliseconds. It covers security vulnerabilities, cyclomatic and cognitive complexity, bug probability, code clones, refactoring suggestions, dead code, technical debt, documentation coverage, performance hotspots, dependency coupling, and readability. Four of the twelve dimensions use trained machine learning models; the other eight are deterministic AST analysers. The deterministic modules are checked for pipeline correctness but not formally evaluated for precision and recall — that remains future work. The ML results are uneven. A peer-review audit found a label-leakage defect in the original complexity model: the target (cognitive complexity) had been included as an input feature, producing a spurious R2 = 1.000. After correcting this, the XGBoost predictor reaches R2 = 0.676 ± 0.063 and Pearson r = 0.980 against SonarQube. Complexity ranking holds across nine of ten held-out repositories (mean Spearman ρ = 0.795 ± 0.186); the one failure is tiangolo/fastapi, a decorator-heavy codebase whose AST structure sits outside the training distribution. Security is the honest failure case. The RF+1D CNN ensemble reaches in-distribution AUC = 0.963 ± 0.012 on 4,286 CVE-annotated samples — but when evaluated on held-out projects i (Leave-One-Project-Out), AUC collapses to 0.494 ± 0.189, essentially chance. The training data comes from a narrow set of vulnerability categories; projects with different exposure profiles fall outside that envelope entirely. The bug predictor shows the same problem from a different angle: AUC = 0.676 on a random split drops to 0.5687 under a strict temporal split (train on earliest 70% of commits, test on most recent 30%). That is well below the majority-class baseline. Static file metrics do not capture how codebases evolve, and keyword-based SZZ labels impose a ceiling that no architecture overcomes. The pattern classifier required a separate correction. Fourteen input features directly encoded the label-assignment rules, inflating CV F1 from 0.653 to 0.748 — a gap of +0.082 confirmed by Wilcoxon test (p = 0.031). After removing those features, the debiased model reaches CV F1 = 0.657 ± 0.016 (test F1 = 0.683, AUC = 0.846, accuracy = 66.5%), and Cohen’s κ = 0.168 with the independent label source confirms near-chance agreement. The evaluation methodology is probably the most reusable part of this work. Multi-seed variance, LOPO cross-project benchmarks, temporal splits, residual conformal intervals, and SonarQube calibration run together catch things that a single held-out test split misses entirely — leakage, distribution shift, temporal anti-learning, and calibration degradation under shift. All ten diagnostic instruments are in backend/evaluation/ and accept any conforming dataset. The prototype itself runs with Python, Node.js, and a browser. No cloud account, no server, no database required.

Degree

thesis:*
Level thesis:degree_level
Master’s Degree
Year dc:date.issued
2026

Author and committee

dc:creator, dc:contributor.*
Author dc:creator
  • Patel, Safaa
Advisor dc:contributor.advisor
  • Dasacalu, Sergiu M
Committee members dc:contributor.committeemember
  • Harris, Frederick C
  • Nair, Aditya G

Subjects

dc:subject × 5

Rights

Language dc:language.iso
en_US, English

Identifiers

dc:identifier.*
Repository record dc:identifier.uri
https://scholarwolf.unr.edu/handle/11714/11924
OAI identifier oai:identifier
oai:scholarwolf.unr.edu:11714/11924

Chain of custody

source
Harvested from
University of Nevada - Reno
Base URL
scholarwolf.unr.edu/server/oai/request
Last updated
2026-07-27
Source record
OAI-PMH GetRecord
citation

Patel, Safaa. IntelliCode Review: An AI-Powered Platform for Automated Code Quality Analysis with Actionable Feedback. Master’s Degree thesis, 2026. https://scholarwolf.unr.edu/handle/11714/11924