/analyze

RAPTOR LLM-based vulnerability analysis

Overview

The /analyze command performs LLM-based analysis of existing SARIF findings from previous security scans. It provides deep adversarial thinking, exploitability assessment, and detailed vulnerability explanations.

Syntax

python3 raptor.py analyze --repo <path> --sarif <sarif-file> [options]

Parameters

repo · string · required

Absolute path to the code repository

sarif · string · required

Path to SARIF file containing scan findings

max-findings · integer

Maximum number of findings to analyze (default: unlimited)

What It Does

1. Loads existing SARIF findings from previous scans
2. Analyzes each vulnerability with LLM
3. Applies adversarial thinking and attack surface mapping
4. Assesses exploitability and impact
5. Identifies root causes and attack vectors
6. Generates detailed analysis reports

When to Use

Use /analyze When:

• You already have SARIF files from previous scans
• Want to re-analyze findings without re-scanning
• Need deeper insight into specific vulnerabilities
• Combining scanner output from multiple tools
• Performing iterative analysis

Use /agentic When:

• Starting from scratch (no existing findings)
• Want end-to-end workflow
• Need both scanning and analysis

Examples

Analyze Existing Scan Results

# First, run a scan
python3 raptor.py scan --repo /path/to/code

# Then, analyze the results
python3 raptor.py analyze --repo /path/to/code --sarif out/scan_*/findings.sarif

Analyzes findings from a previous scan.

Analyze Specific Findings

python3 raptor.py analyze --repo /path/to/code --sarif findings.sarif --max-findings 5

Focuses on the first 5 most critical findings.

Combine Multiple Scanners

# Run Semgrep
python3 raptor.py scan --repo /path/to/code

# Run CodeQL
python3 raptor.py codeql --repo /path/to/code

# Analyze combined results
python3 raptor.py analyze --repo /path/to/code --sarif combined-findings.sarif

Analyzes findings from multiple security tools.

Analysis Capabilities

Adversarial Thinking

The LLM applies offensive security mindset:

• Attack surface identification
• Exploitation path discovery
• Bypass technique analysis
• Chaining vulnerability assessment

Exploitability Assessment

Evaluates practical exploitability:

• Exploitable: Clear path to code execution
• Likely exploitable: High confidence with some constraints
• Difficult: Primitives exist but hard to chain
• Unlikely: Blocked by mitigations
• Ruled out: False positive or unexploitable

Root Cause Analysis

Identifies underlying issues:

• Input validation failures
• Trust boundary violations
• Unsafe API usage
• Logic flaws
• Design weaknesses

Output Structure

out/analyze_<timestamp>/
├── analysis-report.md       # Detailed findings
├── findings-analyzed.json   # Structured results
├── exploitability-matrix.csv
└── recommendations.md       # Fix guidance

Analysis Report Format

# Vulnerability Analysis Report

## VULN-001: SQL Injection in user_login()

**Severity**: Critical  
**Exploitability**: Exploitable  
**Location**: src/auth.py:142

### Root Cause
Unsanitized user input concatenated into SQL query.

### Attack Vector
1. Attacker provides malicious input: `admin' OR '1'='1`
2. Query becomes: `SELECT * FROM users WHERE name='admin' OR '1'='1'`
3. Authentication bypass achieved

### Impact
- Complete authentication bypass
- Database enumeration possible
- Potential privilege escalation

### Recommendations
- Use parameterized queries
- Implement input validation
- Apply principle of least privilege

Use Cases

• Re-analyzing findings without re-scanning
• Getting second opinion on scanner results
• Prioritizing vulnerability remediation
• Understanding complex vulnerabilities
• Security research and documentation

Progressive Loading

When analysis completes, RAPTOR automatically loads tiers/analysis-guidance.md for enhanced adversarial thinking capabilities.

The analysis uses progressive context loading:

1. Initial Analysis: Base LLM knowledge
2. Enhanced Analysis: Loads offensive security guidance
3. Exploit Development: Loads exploit constraint analysis
4. Recovery: Loads error recovery protocols if needed

Related Commands

/scan

Generate SARIF findings to analyze

/codeql

Deep static analysis for complex issues

/validate

Validate exploitability before analysis

/exploit

Generate exploits from analysis

Notes

• Requires existing SARIF file from previous scan
• Analysis quality depends on LLM model capabilities
• Use with /validate for exploitability verification
• Output includes prioritization for remediation
• For security research and authorized testing only