Bridging Code Property Graphs and Language Models for Program Analysis

1. Problem Statement

Large Language Models (LLMs) face significant hurdles when applied to real-world software vulnerability management (SVM) in large codebases. The paper identifies three critical limitations:

• Token Limits: Modern repositories (e.g., GGML with 8,000+ methods) exceed the context windows of even the most advanced LLMs, forcing analysis to be restricted to isolated snippets. This misses inter-procedural vulnerabilities that span multiple files and functions.
• Lack of Semantic Depth in Embeddings: Retrieval-Augmented Generation (RAG) systems rely on syntactic similarity. They fail to capture complex semantic relationships required for security analysis, such as data flow propagation (e.g., "function A's return value flows into function B's buffer write") or control dependencies across abstraction layers.
• Inability to Generate Complex Queries: While Code Property Graphs (CPGs) offer powerful static analysis via query languages like CPGQL, LLMs struggle to generate correct, non-trivial CPGQL queries due to a lack of domain-specific training data. This leads to hallucinations and syntactically invalid queries, making automated graph traversal unreliable.

Consequently, current approaches force a trade-off: either analyze small, isolated code (missing cross-function bugs) or attempt to load massive contexts (exceeding token budgets and degrading reasoning quality).

2. Methodology: The codebadger Framework

The authors introduce codebadger, an open-source Model Context Protocol (MCP) server designed to bridge the gap between LLMs and static analysis engines (specifically Joern).

• Architecture:

  • Intermediary Role: codebadger acts as a server between an LLM agent and the Joern CPG engine.
  • Session-Based Workflow: The LLM initiates a session (create_cpg_session) to generate a CPG for a target repository. The server caches this graph and returns a session_id.
  • Tool Abstraction: Instead of asking the LLM to write raw CPGQL, codebadger exposes high-level, semantic tools. The server translates these high-level calls into optimized CPGQL queries, executes them via Joern, and returns structured results (JSON, code snippets) to the LLM.

• Key Tools & Algorithms:

  • Program Slicing: Uses backward slicing (Algorithm 2) to isolate code relevant to a specific variable or call site, reducing noise by up to 90%.
  • Taint Tracking: Implements forward data flow analysis (Algorithm 1) to trace untrusted inputs (sources) to sensitive operations (sinks), identifying potential injection or overflow paths.
  • Semantic Navigation: Tools like get_codebase_summary, find_taint_sources, find_taint_sinks, get_call_graph, and get_data_dependencies allow the LLM to navigate the codebase semantically rather than linearly.
  • Implementation: Built on FastMCP (v2.12.4) using Streamable HTTP. It runs in Docker containers with Joern for isolation and uses Redis for state management and caching.

3. Key Contributions

1. Novel Integration: The first system to integrate Joern's CPG engine with LLMs via the Model Context Protocol (MCP), enabling LLMs to perform static analysis without mastering domain-specific query languages.
2. Semantic Reasoning at Scale: Demonstrates that LLMs can reason about entire repositories (e.g., 8,000 methods) by navigating semantic dependencies rather than reading files, effectively bypassing token limits.
3. Automated Vulnerability Lifecycle: Provides a unified framework for code comprehension, vulnerability discovery, exploit generation, and patching.
4. Open-Source Tool: Releases codebadger to the community to facilitate agentic security workflows.

4. Results and Use Cases

The paper validates codebadger through three distinct use cases using Claude Sonnet 4.5 as the LLM agent:

• Use Case 1: Large-Scale Code Comprehension (GGML Library)

  • Task: Audit memory safety across 8,667 methods and 198,006 calls.
  • Outcome: The agent identified unbounded alloca usage, integer overflows in allocation calculations, and unchecked pointer arithmetic. It achieved this by summarizing the codebase and targeting specific taint sources/sinks, avoiding exhaustive file reading.

• Use Case 2: Discovery of Unreported Vulnerabilities (libtiff)

  • Task: Analyze tif_getimage.c for buffer overflows.
  • Outcome: The agent discovered a previously unreported heap-buffer-overflow caused by col_offset pointer arithmetic.
  • Validation: The agent generated a Proof-of-Concept (PoC) exploit, confirmed the crash using AddressSanitizer (ASAN), and verified that the fix (added in a later commit) addressed the specific logic flaw.

• Use Case 3: Vulnerability Patching (libxml2 - CVE-2025-6021)

  • Task: Patch an integer overflow in xmlBuildQName leading to a buffer overflow.
  • Outcome: Using backward slicing and data dependency tracing, the agent identified the root cause (integer overflow in len + lenp + 2).
  • Quality: The agent generated a correct patch on the first attempt without human intervention. The patch closely mirrored the official fix implemented by the library maintainers, including proper type casting to size_t and overflow checks.

5. Significance and Impact

• Paradigm Shift: Moves LLM-based security analysis from "reading code" to "analyzing semantics." It allows LLMs to act as expert security analysts who navigate call graphs and data flows rather than just pattern-matching text.
• Overcoming Hallucinations: By offloading complex graph traversal to Joern and providing structured results, codebadger significantly reduces the hallucination rate associated with LLMs generating raw static analysis queries.
• Scalability: Enables the analysis of codebases that are orders of magnitude larger than LLM context windows, making automated vulnerability management feasible for enterprise-scale projects.
• Future Directions: The paper suggests that while codebadger handles static analysis well, future work should focus on integrating dynamic analysis (e.g., race conditions) and scaling quantitative evaluations across diverse benchmark datasets.

In summary, codebadger successfully demonstrates that combining the reasoning capabilities of LLMs with the rigorous structural analysis of Code Property Graphs creates a powerful, scalable, and accurate system for modern software vulnerability management.