arm/metis

What is it?

Key features

• 01Uses LLM semantic reasoning instead of hardcoded rules to find vulnerabilities.
• 02Validates findings from its own analysis and third-party SARIF tools to reduce false positives.
• 03Supports many languages through a plugin system, including C/C++ with CodeGraph reachability.
• 04Works with multiple LLM providers, including local models via Ollama, vLLM and llama.cpp.
• 05Offers ChromaDB by default, with PostgreSQL pgvector and Qdrant as optional vector backends.
• 06Reviews whole directories, single files or patch diffs, with JSON or SARIF output.

Use cases

• Security reviews of large or legacy C/C++ codebases where rule-based tools produce too much noise.
• Reviewing pull request patches for security issues before merge.
• Triaging findings from existing SAST tools to separate likely real issues from false positives.
• Running security analysis with locally hosted models when source code cannot leave the network.

Quick start

1. 1

   Clone the repository

   git clone https://github.com/arm/metis.git
2. 2

   Create a virtual environment and install dependencies

   uv venv && uv pip install .
3. 3

   Export your OpenAI API key

   export OPENAI_API_KEY="your-key-here"
4. 4

   Run analysis against a codebase

   uv run metis --codebase-path "/path/to/src" --verbose

Things to know

• !Requires an LLM provider; the default is OpenAI, which needs an API key.
• !Vector indexing needs an embedding provider unless the selected backend supplies embeddings.
• !Language coverage varies, with some languages getting only basic review.

In collections

Topics

FAQ

What is metis?

Open-source, LLM-driven security code review tool that finds vulnerabilities by semantic reasoning rather than fixed rules, built by Arm's Product Security Team. Metis is an agentic AI framework for deep security code review. Instead of relying on hardcoded rules like traditional linters or static analyzers, it uses large language models to reason about code semantics, aiming to catch subtle vulnerabilities in large or legacy codebases. It also validates findings from its own analysis and from third-party SARIF output, gathering evidence to reduce false positives.

Is metis free to use? What license does it have?

metis is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is metis still maintained?

Actively maintained. The last commit to metis was on Nov 5, 2026.

What can I use metis for?

Security reviews of large or legacy C/C++ codebases where rule-based tools produce too much noise. Reviewing pull request patches for security issues before merge. Triaging findings from existing SAST tools to separate likely real issues from false positives. Running security analysis with locally hosted models when source code cannot leave the network.

How do I install metis?

Clone the repository: git clone https://github.com/arm/metis.git Create a virtual environment and install dependencies: uv venv && uv pip install . Export your OpenAI API key: export OPENAI_API_KEY="your-key-here" Run analysis against a codebase: uv run metis --codebase-path "/path/to/src" --verbose

Where can I get metis?

The source code and installation instructions are on GitHub: https://github.com/arm/metis