🛡️ SAST LLM Agent

Autonomous Static Application Security Testing (SAST) powered by a local LLM via LM Studio. Detects real OWASP Top 10 and CWE Top 25 vulnerabilities — no cloud API calls required.

📐 Architecture Overview

[Source Code] → Parser (tree-sitter) → Chunks
                              ↓
                    LLM Client (OpenAI-compatible)
                              ↓
              LM Studio / llama.cpp Server (local)
                              ↓
            Post-Processor → FP Filter → SARIF Report
                              ↓
                   CI/CD Integration (GitHub/GitLab)

🚀 Quick Start

1. Prerequisites

• Python ≥ 3.10
• LM Studio ≥ 0.2.23 (or llama.cpp server for headless environments)
• A GGUF model downloaded via LM Studio UI (see configs/model_profiles.yaml)

2. Install Dependencies

pip install -r requirements.txt

3. Start LM Studio Server

1. Open LM Studio → My Models → load a supported GGUF model
2. Go to Developer → Server → start local server on port 1234
3. Verify: curl http://localhost:1234/v1/models should return 200 OK

4. Run the Scan

python -m src.main \
  --api http://localhost:1234/v1 \
  --src ./path/to/your/project \
  --out reports/sarif-report.json \
  --confidence 0.7 \
  --concurrency 6

5. View Results

• SARIF report → upload to GitHub Security or GitLab SAST dashboard
• Console output shows vulnerability summary table with severity and confidence scores

📂 Project Structure

sast-llm-agent/
├── src/                          # Application source code
│   ├── __init__.py
│   ├── main.py                   # CLI entry point
│   ├── llm_client/               # LM Studio API client (OpenAI-compatible)
│   │   ├── __init__.py
│   │   └── client.py             # LLMClient, SASTResult models, system prompt
│   ├── parser/                   # Code parsing & chunking
│   │   ├── __init__.py
│   │   └── chunker.py            # CodeChunker (tree-sitter ready)
│   ├── agent/                    # Scan orchestration
│   │   ├── __init__.py
│   │   └── scanner.py            # SASTScanner (pipeline orchestrator)
│   └── reporters/                # Report generation
│       ├── __init__.py
│       └── sarif.py              # SARIF 2.1.0 reporter
├── tests/                        # Test suite
│   ├── __init__.py
│   ├── test_chunker.py           # Unit tests for chunking logic
│   └── fixtures/                 # Test data (vulnerable code samples)
│       └── vulnerable_sample.py
├── configs/                      # Configuration files
│   ├── model_profiles.yaml       # VRAM-optimized model configurations
│   └── cwe_owasp_mapping.yaml    # CWE → OWASP mapping rules
├── ci/                           # CI/CD pipeline templates
│   ├── github-actions.yml        # GitHub Actions workflow
│   └── gitlab-ci.yml             # GitLab CI configuration
├── docs/                         # Documentation
│   ├── LM_STUDIO_SAST_ARCHITECTURE.md
│   └── EXISTING_TOOLS_AND_GAP_ANALYSIS.md
├── requirements.txt              # Python dependencies
├── .env.example                  # Environment variables template
├── .gitignore                    # Git ignore rules
└── README.md                     # This file

⚙️ Configuration

Model Profiles (VRAM-Optimized)

VRAM	Model	Quantization	Precision	Scan Time (10k LOC)
8 GB	Qwen2.5-Coder-3B-Instruct	Q4_K_M	68%	~4 min
12 GB	Qwen2.5-Coder-7B-Instruct	Q4_K_M	76%	~6 min
16 GB	Qwen2.5-Coder-7B-Instruct	Q5_K_M	79%	~7 min
24 GB	Qwen2.5-Coder-14B-Instruct	Q4_K_M	84%	~9 min

Full details in docs/LM_STUDIO_SAST_ARCHITECTURE.md.

Environment Variables

Copy .env.example to .env and adjust:

LM_STUDIO_API_URL=http://localhost:1234/v1   # LM Studio endpoint
CONFIDENCE_THRESHOLD=0.7                     # Min confidence for findings
CONCURRENCY=6                                # Parallel LLM requests
SCAN_TIMEOUT=45                              # Timeout per chunk (seconds)

🧪 Testing

Run the test suite:

pytest tests/ -v --cov=src

🔗 CI/CD Integration

• GitHub Actions: Copy ci/github-actions.yml → .github/workflows/sast.yml
• GitLab CI: Copy ci/gitlab-ci.yml → .gitlab-ci.yml

Both pipelines use llama.cpp server (identical to LM Studio) for headless execution.

📄 License

MIT — see LICENSE (pending).