Large Language Models (LLMs) face critical challenges when analyzing security vulnerabilities in real world codebases: token limits prevent loading entire repositories, code embeddings fail to capture inter procedural data flows, and LLMs struggle to generate complex static analysis queries. These limitations force existing approaches to operate on isolated code snippets, missing vulnerabilities that span multiple functions and files. We introduce codebadger, an open source Model Context Protocol (MCP) server that integrates Joern's Code Property Graph (CPG) engine with LLMs. Rather than requiring LLMs to generate complex CPG queries, codebadger provides high level tools for program slicing, taint tracking, data flow analysis, and semantic code navigation, enabling targeted exploration of large codebases without exhaustive file reading. We demonstrate its effectiveness through three use cases: (1) navigating an 8,000 method codebase to audit memory safety patterns, (2) discovering and exploiting a previously unreported buffer overflow in libtiff, and (3) generating a correct patch for an integer overflow vulnerability (CVE-2025-6021) in libxml2 on the first attempt. codebadger enables LLMs to reason about code semantically across entire repositories, supporting vulnerability discovery, patching, and program comprehension at scale.

翻译：大语言模型（LLM）在分析真实代码库中的安全漏洞时面临关键挑战：token限制导致无法加载完整仓库、代码嵌入难以捕获跨过程数据流、且LLM难以生成复杂的静态分析查询。这些局限迫使现有方法只能处理孤立代码片段，从而遗漏跨函数和文件的漏洞。我们提出codebadger——一个集成Joern代码属性图（CPG）引擎与LLM的开源模型上下文协议（MCP）服务器。不同于要求LLM生成复杂CPG查询，codebadger提供程序切片、污点追踪、数据流分析和语义代码导航的高层工具，无需穷尽文件读取即可实现大规模代码库的定向探索。通过三个案例验证其有效性：（1）在包含8000个方法的代码库中审计内存安全模式；（2）发现并利用libtiff中此前未报告的缓冲区溢出漏洞；（3）首次尝试即为libxml2中的整数溢出漏洞（CVE-2025-6021）生成正确补丁。codebadger使LLM能够跨整个仓库进行语义化代码推理，支持大规模漏洞发现、补丁生成和程序理解。