A professional static-analysis agent for C/C++ memory corruption discovery using ADK, LiteLLM, and Tree-sitter. Designed for large codebases with a safe query translation layer, bottom-up function contracts, and an iterative multi-agent pipeline.
- Multi-agent orchestration — Explicit workflow phases with loop termination and phase handoff
- Tree-sitter indexing — Full-project AST, call graph, and symbol discovery
- Safe query translation — Structured JSON → valid Tree-sitter S-expressions (agents never write raw queries)
- Bottom-up analysis — Function contracts reduce context load; leaf functions analyzed first
- Interprocedural dataflow — Call graph and argument mapping for taint propagation
- CFG construction — Branches, loops,
goto, andswitch/casehandling
flowchart TD
U[User Input] --> C[Coordinator Pipeline]
C --> PL[Project Learning Agent]
PL -->|project_profile.json| S0[Project Profile]
C --> L[Analysis Loop]
L --> SD[Sink Discovery Agent]
SD --> SI[Sink Inventory]
L --> TA[Taint Analysis Agent]
TA --> TF[Taint Flows]
L --> EX[Exploitability Agent]
EX --> EF[Exploit Findings]
C --> RG[Report Agent]
RG --> R[Reports]
subgraph Tools
T1[Index Project]
T2[AST Query]
T3[Structured Query Builder]
T4[Call Graph]
T5[Dataflow]
T6[CFG]
T7[Macro Expansion]
T8[Git Analysis]
T9[Function Context]
T10[Contracts]
end
PL --> T1
PL --> T2
PL --> T7
PL --> T8
SD --> T3
SD --> T4
TA --> T5
TA --> T9
TA --> T10
EX --> T6
EX --> T9
RG --> T9
The analysis loop runs until a high-confidence exploitability threshold is met or the maximum iteration count is reached.
flowchart TD
Start[Index Project] --> PL[Project Learning]
PL --> LoopStart[Loop Start]
LoopStart --> SD[Sink Discovery]
SD --> TA[Taint Analysis]
TA --> EX[Exploitability]
EX -->|Exploitability >= 0.7 and Confidence >= 0.8| Stop[Exit Loop]
EX -->|Else| LoopStart
Stop --> RG[Report Generation]
RG --> Done[Final Output]
Agents provide a structured JSON spec (node types, fields, relations). A query builder translates it into a valid Tree-sitter query and applies semantic filters (ancestor, descendant, sibling).
sequenceDiagram
participant LLM as Agent (Intent)
participant QB as Query Builder
participant TS as Tree-sitter
LLM->>QB: JSON Spec (node types, fields, relations)
QB->>TS: Valid S-expression Query
TS-->>QB: Raw Matches
QB-->>LLM: Filtered Matches
Leaf functions are analyzed first; their contracts are stored in memory. Callers use these contracts instead of reloading callee bodies.
flowchart TD
L0[Leaf Function] --> C0[Generate Contract]
C0 --> Store[SymbolTable Contracts]
Store --> Caller[Caller Analysis]
Caller --> Check[Validate Contract Conditions]
agent/
├── agent.py # Multi-agent pipeline and prompts
├── core/
│ ├── ast_cache.py # AST cache management
│ ├── tree_sitter_parser.py
│ ├── call_graph.py # Call graph builder
│ ├── symbols.py # Symbol table and contracts
│ └── project_index.py # Project index orchestration
├── tools/
│ ├── ast_tools.py # AST, dataflow, CFG, structured queries
│ ├── git_tools.py # Git commit analysis
│ ├── project_tools.py # Project profile writer
│ └── validation_tools.py
├── requirements.txt
└── .env.example
pip install -r agent/requirements.txtCopy agent/.env.example to agent/.env and set your OPENROUTER_API_KEY (and optionally OPENROUTER_MODEL).
./run.sh
# or: uv run adk webProvide project_path and an optional objective (e.g. find crashes).
Example:
project_path=/path/to/your/cpp-project
objective=find memory corruption bugs
Found a non-trivial or interesting bug? Open an issue with a clear description and minimal repro. Helpful reports may be acknowledged in the Hall of Fame.
This project is licensed under a custom No-Redistribution, No-Sale license. See LICENSE for full terms. In short: you may use and modify it for your own use, but you may not redistribute, copy, sell, or distribute it under another name.
See HALL_OF_FAME.md for contributors who reported notable bugs.