Free program analysis focused on bugs that matter to you.
Install, configure, and adopt Bento in seconds. Runs 100% locally.
- Find bugs that matter. Bento automatically enables and configures relevant analysis based on your dependencies and frameworks, and it will never report style-related issues. You won’t painstakingly configure your tooling.
- Get started immediately. Bento doesn’t force you to fix all your preexisting issues today. Instead, you can archive them and address them incrementally when it makes sense for your project.
- Go fast. Bento installs in 5 seconds and self-configures in less than 30. Its tools check your code in parallel, not sequentially.
$ pip3 install bento-cli
See our Bento introductory blog post to learn the full story.
r2c is on a quest to make world-class security and bugfinding available to all developers, for free. We’ve learned that most developers have never heard of—let alone tried—tools that find deep flaws in code: like Codenomicon, which found Heartbleed, or Zoncolan at Facebook, which finds more top-severity security issues than any human effort. These tools find severe issues and also save tons of time, identifying hundreds of thousands of issues before humans can. Bento is a step towards universal access to tools like these.
We’re also big proponents of opinionated tools like Black and Prettier. This has two implications: Bento ignores style-related issues and the bikeshedding that comes with them, and it ships with a curated set of checks that we believe are high signal and bug-worthy. See Three things your linter shouldn’t tell you for more details on our decision making process.
To get started right away with sensible defaults:
$ bento init && bento check
To set aside preexisting results so you only see issues in new code:
$ bento archive
Bento is at its best when run automatically. See Integrations for details.
Command Line Options
$ bento --help Usage: bento [OPTIONS] COMMAND [ARGS]... Options: -h, --help Show this message and exit. --version Show current version bento. --base-path DIRECTORY Path to the directory containing the code, as well as the .bento.yml file. --agree Automatically agree to terms of service. --email TEXT Email address to use while running this command without global configs e.g. in CI Commands: archive Adds all current findings to the whitelist. check Checks for new findings. disable Turn OFF a tool or check. enable Turn ON a tool or check. init Autodetects and installs tools. install-hook Installs Bento as a git pre-commit hook. To get help for a specific command, run `bento COMMAND --help`
bento check may exit with the following exit codes:
0: Bento ran successfully and found no errors
2: Bento ran successfully and found issues in your code
3: Bento or one of its underlying tools failed to run
Running Bento in CI
If you use CircleCI, add the following job:
version: 2.1 jobs: bentoCheck: executor: circleci/python:3.7.4-stretch-node steps: - checkout - run: name: "Install Bento" command: pip3 install bento-cli && bento --version - run: name: "Run Bento check" command: bento --agree --email <YOUR_EMAIL> check
Otherwise, you can simply install and run Bento in CI with the following commands:
$ pip3 install bento-cli && bento --version $ bento --agree --email <YOUR_EMAIL> check
bento check will exit with a non-zero exit code if it finds issues in your code (see Exit Codes). To suppress this behaviour you can pipe its output to
$ bento --agree --email <YOUR_EMAIL> check || true
Otherwise, address the issues or archive them with
If you need help setting up Bento with another CI provider please open an issue. Documentation PRs welcome if you set up Bento with a CI provider that isn't documented here!
Running Bento as a Git Hook
Bento can automatically analyze your staged files when
git commit is run. Configured as a Git pre-commit hook, Bento ensures every commit to your project is vetted and that no new issues have been introduced to the codebase.
To install Bento as a Git hook:
$ bento install-hook
If Git hooks ever incorrectly block your commit, you can skip them by passing the
--no-verify flag at commit-time (use this sparingly):
$ git commit --no-verify
Bento’s Git hook can save the round-trip time involved with fixing a failed build if you’re using Bento in CI.
Help and Community
Need help or want to share feedback? We’d love to hear from you!
- Email us at firstname.lastname@example.org
- Join #bento in our community Slack
- File an issue or submit a feature request directly on GitHub — we welcome them all!
We’re constantly shipping new features and improvements.
- Sign up for the Bento newsletter — we promise not to spam and you can unsubscribe at any time
- See past announcements, releases, and issues here
License and Legal
Please refer to the terms and privacy document.
Copyright (c) r2c.