University of Nevada - Reno
IntelliCode Review: An AI-Powered Platform for Automated Code Quality Analysis with Actionable Feedback
Abstract
dc:description.abstractGetting comprehensive code quality feedback on a Python project today means running at least fiveseparate tools, each with its own configuration format, severity scale, and output schema. Most developers run one or two and skip the rest. Manual review covers some of the gap, but it is slow, reviewer-dependent, and reliably bad at catching security vulnerabilities in unfamiliar code. IntelliCode Review is a web-based platform that runs twelve code quality checks from a single request. Full analysis of a 1000-line Python file completes in 1.41 seconds; analysis of 100-line files completes in 234 milliseconds. It covers security vulnerabilities, cyclomatic and cognitive complexity, bug probability, code clones, refactoring suggestions, dead code, technical debt, documentation coverage, performance hotspots, dependency coupling, and readability. Four of the twelve dimensions use trained machine learning models; the other eight are deterministic AST analysers. The deterministic modules are checked for pipeline correctness but not formally evaluated for precision and recall — that remains future work. The ML results are uneven. A peer-review audit found a label-leakage defect in the original complexity model: the target (cognitive complexity) had been included as an input feature, producing a spurious R2 = 1.000. After correcting this, the XGBoost predictor reaches R2 = 0.676 ± 0.063 and Pearson r = 0.980 against SonarQube. Complexity ranking holds across nine of ten held-out repositories (mean Spearman ρ = 0.795 ± 0.186); the one failure is tiangolo/fastapi, a decorator-heavy codebase whose AST structure sits outside the training distribution. Security is the honest failure case. The RF+1D CNN ensemble reaches in-distribution AUC = 0.963 ± 0.012 on 4,286 CVE-annotated samples — but when evaluated on held-out projects i (Leave-One-Project-Out), AUC collapses to 0.494 ± 0.189, essentially chance. The training data comes from a narrow set of vulnerability categories; projects with different exposure profiles fall outside that envelope entirely. The bug predictor shows the same problem from a different angle: AUC = 0.676 on a random split drops to 0.5687 under a strict temporal split (train on earliest 70% of commits, test on most recent 30%). That is well below the majority-class baseline. Static file metrics do not capture how codebases evolve, and keyword-based SZZ labels impose a ceiling that no architecture overcomes. The pattern classifier required a separate correction. Fourteen input features directly encoded the label-assignment rules, inflating CV F1 from 0.653 to 0.748 — a gap of +0.082 confirmed by Wilcoxon test (p = 0.031). After removing those features, the debiased model reaches CV F1 = 0.657 ± 0.016 (test F1 = 0.683, AUC = 0.846, accuracy = 66.5%), and Cohen’s κ = 0.168 with the independent label source confirms near-chance agreement. The evaluation methodology is probably the most reusable part of this work. Multi-seed variance, LOPO cross-project benchmarks, temporal splits, residual conformal intervals, and SonarQube calibration run together catch things that a single held-out test split misses entirely — leakage, distribution shift, temporal anti-learning, and calibration degradation under shift. All ten diagnostic instruments are in backend/evaluation/ and accept any conforming dataset. The prototype itself runs with Python, Node.js, and a browser. No cloud account, no server, no database required.
Degree
thesis:*- Level thesis:degree_level
- Master’s Degree
- Year dc:date.issued
- 2026
Author and committee
dc:creator, dc:contributor.*- Author dc:creator
-
- Patel, Safaa
- Advisor dc:contributor.advisor
-
- Dasacalu, Sergiu M
- Committee members dc:contributor.committeemember
-
- Harris, Frederick C
- Nair, Aditya G
Subjects
dc:subject × 5Rights
- Language dc:language.iso
- en_US, English
Identifiers
dc:identifier.*- Repository record dc:identifier.uri
- https://scholarwolf.unr.edu/handle/11714/11924
- OAI identifier oai:identifier
- oai:scholarwolf.unr.edu:11714/11924