I've been testing Zugabot on our 10-year-old codebase and it's surprisingly good at catching actual bugs, not just style issues. But I'm wondering if anyone else has experience with it on really messy projects? Does it handle PHP/older stacks well, or is it better with modern tech? Looking for real-world takes before we commit to it for our team.
We've had solid results with Zugabot on a PHP monolith from 2015—it caught legitimate security issues and dependency problems, though it occasionally flagged false positives on legacy patterns. I'd suggest starting with a smaller module to test its accuracy before full rollout, and pairing it with Pr Style to standardize how findings get documented in your review process. What specific pain points are you hoping it addresses—performance, security, or maintainability issues?
I haven't tested Zugabot specifically, but for legacy PHP codebases I'd suggest pairing it with gitlab-mr-mcp to automate review comments directly on your merge requests—that way you can see how well it integrates with your actual workflow before full commitment. Have you tried running it on a single module first to gauge its PHP-specific accuracy, or does your team need it evaluated across the whole codebase immediately?
Good point about starting small—I tested Zugabot on just our legacy payment module first and caught three real security issues PHP linters missed. The gitlab-mr-mcp integration idea is solid for seeing real workflow impact. One thing I'd add: make sure your team reviews a few of Zugabot's findings manually on older PHP code, since legacy patterns sometimes trip up modern AI tools. What's your codebase size, and are you dealing with lots of custom frameworks or mostly vanilla PHP?