Originally reported by DevOps.com. This article summarizes MuseDev’s July 2020 announcement of the Muse early access program.
What Is MuseDev Muse?
MuseDev announced the early access availability of Muse, a code analysis tool distributed as a GitHub App. Muse is designed to integrate security scanning directly into the pull request workflow, surfacing cybersecurity issues at the point where code changes are proposed — before they reach production.
The tool is positioned as a DevSecOps enabler: rather than relying on a separate security team to audit code after deployment, Muse brings automated security analysis into the hands of the developers doing the work.
The Problem Muse Aims to Solve
Security defects found after an application reaches production are significantly more expensive to fix than those caught during development. Despite broad awareness of this cost, many organizations still lack the tooling to make security analysis a natural part of the development workflow.
Existing code analysis tools used by dedicated security teams tend to produce long lists of vulnerabilities without giving developers sufficient context to understand, prioritize, or remediate the issues. This disconnect between security output and developer workflow is a major barrier to DevSecOps adoption.
How Muse Works
Muse operates through a component called MuseBot, which automatically analyzes each pull request submitted to a connected GitHub repository. Results are delivered as inline code review comments directly in GitHub — the same interface developers already use for peer code reviews.
- Pull request integration: MuseBot triggers on each PR and posts findings as review comments, keeping security feedback in context.
- Fast turnaround: According to MuseDev CEO Stephen Magill, analysis completes in approximately 20 minutes, allowing teams to address findings within the same workflow cycle rather than waiting for an external security report.
- Reduced false positives: Muse bundles and customizes a set of established open source analysis tools — including ErrorProne, Infer, and Pyre — and configures them specifically to reduce alert noise.
- Open API: An open API allows organizations to customize the platform to fit their specific tooling and policy requirements.
Tooling Under the Hood
Rather than building a new analysis engine from scratch, MuseDev curates and configures existing, well-regarded static analysis tools:
- ErrorProne — a Java static analysis tool developed by Google that catches common programming mistakes at compile time.
- Infer — a static analysis tool from Meta (Facebook) that detects bugs such as null pointer exceptions, memory leaks, and concurrency issues in Java, C, C++, and Objective-C.
- Pyre — a performant type checker for Python developed by Meta.
The value-add from MuseDev lies in the curation, configuration, and integration layer that makes these tools produce actionable, low-noise results inside the GitHub pull request experience.
Pricing and Availability
At the time of announcement, MuseDev outlined the following availability tiers:
- Free for open source and public repositories: MuseDev committed to keeping Muse permanently free for open source projects and public GitHub repositories.
- Free for private repositories: Analysis of private repositories was also offered at no cost during the early access period.
- Self-hosted Enterprise edition: A private beta of a self-hosted version supporting GitHub, Bitbucket, and GitLab was available, with general availability targeted for the end of 2020.
- Professional services: MuseDev also offered a professional services team to assist organizations with implementation and configuration.
Company Background
MuseDev was spun out of Galois, a research and development firm specializing in high-assurance cybersecurity. That lineage reflects an emphasis on rigorous, research-backed approaches to security analysis rather than purely commercial tooling.
The Broader DevSecOps Context
DevSecOps — the practice of integrating security into every stage of the software development lifecycle — has been a widely discussed goal for several years. However, organizational adoption has lagged behind the rhetoric. Tools like Muse represent an attempt to close that gap by meeting developers where they already work rather than requiring new processes or separate tooling ecosystems.
By surfacing findings as pull request comments rather than as separate security reports, tools in this category reduce the friction that has historically kept security feedback siloed from development teams. If the tooling is good enough and the noise level low enough, bottom-up adoption by individual development teams becomes a realistic path — even without a top-down mandate from security leadership.