What bugs does Locus detect?

Locus checks for six deterministic safety violations: unmatched delimiters (using Dijkstra stack scan), blocking std::sync::Mutex calls across .await points, unguarded division by zero, array indexing without bounds checks, unguarded .unwrap() or .expect() calls, and ReDoS catastrophic backtracking in regular expressions.

The core 6-pass AST safety verification runs in 9.04 microseconds (0.009 ms) per check. The symbol graph indexer processes files at 27.15 microseconds per file, and the MCP JSON-RPC dispatch averages 42.32 microseconds per round-trip.

How much does it cost?

Locus is free for individuals, students, open-source projects, and teams under 5 developers. Commercial internal use is $150 USD per developer per year. SaaS or cloud OEM embedding is $10,000 USD per year.

How does it save token budget?

Locus's AstDiffEngine strips function bodies while preserving signatures, achieving 50–80% token savings in LLM context windows. In one benchmark, indexing 8 files saved 74.8% of tokens via AST skeleton extraction.

Large Language ModelsAI Coding AssistantsAI Safety & AlignmentHacker NewsAug 21, 2026Aug 21, 2026, 22:00 JST

Locus: Rust safety firewall for AI code agents runs in under 0.05ms

Send on LINE

3 Key Points

What happened
A developer named Ahmed Shadi released locus-engine, a pure Rust tool that checks AI-generated code for six categories of bugs—unclosed delimiters, async mutex deadlocks, division-by-zero, array bounds overflow, unguarded .unwrap() calls, and ReDoS regex attacks—in 9.04 microseconds per check. It also compresses code context by 50–80% and integrates with AI IDEs (Claude Code, Cursor, VS Code) via the Model Context Protocol.
Why it matters
Modern AI code agents (Claude Code, Cursor, Copilot, Devin) frequently generate syntax errors and concurrency bugs that crash or hang systems. Locus catches these deterministically before they reach production, and it saves LLM token budget by extracting only function signatures instead of full file bodies—solving what the author identifies as two core bottlenecks in automated code generation pipelines.
What to watch
Locus is available free for individuals and open-source projects; commercial licenses cost $150 USD per developer per year for internal use or $10,000 USD per year for SaaS/cloud OEM. It ships as a CLI tool (locus check, locus graph, locus patch), a Rust library crate, and an MCP server runnable via locus mcp.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

Ahmed Shadi's locus-engine addresses a specific pain point in AI-assisted development: modern code-generation agents (Claude Code, Cursor, Copilot, Devin) hallucinate syntax errors, concurrency bugs, and unsafe patterns that can cause runtime panics or hangs. The tool performs deterministic, non-probabilistic safety checks using a 6-pass AST (abstract syntax tree) verification pipeline that runs in microsecond time—orders of magnitude faster than traditional linters (ESLint, Clippy) which spawn separate processes and take 250–1,500 milliseconds.

A secondary bottleneck the body identifies is context window waste: feeding entire source files into LLM prompts squanders up to 80% of token budget on repetitive function bodies rather than high-level contracts. Locus's skeleton extraction preserves only signatures, achieving 50–80% savings in the test cases shown (one indexing run saved 74.8% across 8 files).

The tool is built in 100% safe Rust with zero external dependencies, ships as a standalone CLI, Rust library, and Model Context Protocol server, and uses FIPS 180-4 SHA-256 caching for deduplication. Ahmed Shadi has published the tool under Business Source License 1.1, with free tier access for open-source and teams under 5 developers, and commercial licensing at $150/seat/year for internal use or $10,000/year for SaaS embedding.

FAQ

What bugs does Locus detect?: Locus checks for six deterministic safety violations: unmatched delimiters (using Dijkstra stack scan), blocking std::sync::Mutex calls across .await points, unguarded division by zero, array indexing without bounds checks, unguarded .unwrap() or .expect() calls, and ReDoS catastrophic backtracking in regular expressions.
How fast is it?: The core 6-pass AST safety verification runs in 9.04 microseconds (0.009 ms) per check. The symbol graph indexer processes files at 27.15 microseconds per file, and the MCP JSON-RPC dispatch averages 42.32 microseconds per round-trip.
How much does it cost?: Locus is free for individuals, students, open-source projects, and teams under 5 developers. Commercial internal use is $150 USD per developer per year. SaaS or cloud OEM embedding is $10,000 USD per year.
How does it save token budget?: Locus's AstDiffEngine strips function bodies while preserving signatures, achieving 50–80% token savings in LLM context windows. In one benchmark, indexing 8 files saved 74.8% of tokens via AST skeleton extraction.

Hacker NewsRead Original Article

Send on LINE

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.