nano-analyzer - A minimal LLM-powered zero-day vulnerability scann

项目说明

Nano-analyzer

A minimal LLM-powered zero-day scanner by AISLE.

!aisle-nano-analyzer-diagram

> Research prototype for demonstration purposes. This is a simple, single-file harness that is able to detect real zero-day . Note that it is a prototype, biased towards C/C++ memory safety bugs, and will produce false positives. We are sharing it as-is in the spirit of open research — expect sharp corners.

What it does

Nano-analyzer is a simple single-file Python scanner that sends source code through a three-stage LLM pipeline:

1. Context generation — a model writes a security briefing about the file: what it does, where untrusted data flows, which buffers exist and how big they are.
2. scan — the same model, primed with the context, hunts for zero-day bugs function by function and outputs structured findings.
3. Skeptical triage — each finding is challenged o rounds by a skeptical re that can grep the codebase to (or refute) defenses. An arbiter makes the final call.

Results are saved as Markdown and JSON files for human review.

Current limitations

This is a v0.1 prototype. Please keep the following in mind:

Setup

Requirements

Install

API keys

Set your API key as an en :

The scanner determines which key to use based on the model name: if it contains a /, it routes through OpenRouter; otherwise it uses the OpenAI API directly.

Usage

Basic scan

Common options

All flags

| Flag | Default | Description |
|------|---------|-------------|
| path | *(required)* | File or directory to scan |
| --model | gpt-5.4-nano | Model for all stages (context, scan, triage) |
| --parallel | 50 | Max concurrent scan API calls |
| --triage-threshold | medium | Triage findings at or above this se |
| --triage-rounds | 5 | Triage rounds per finding |
| --triage-parallel | 50 | Max concurrent triage API calls |
| --max-connections | parallel + triage-parallel | Total API call cap |
| --min-confidence | 0.0 | Only show findings above this confidence (0.0–1.0) |
| --project | directory name | Project name used in triage prompts |
| --repo-dir | auto | Repo root for grep lookups (auto: parent dir for files, scan dir for folders) |
| --output-dir | ~/nano-analyzer-results/<timestamp>/ | Where to sa |
| --max-chars | 200,000 | Skip files larger than this |
| -- | off | Show per-round triage progress |

Output

Results are saved to ~/nano-analyzer-results/<timestamp>/ (or --output-dir):

How triage works

When a scan finds a medium-or-abo issue, the triage pipeline kicks in:

1. A skeptical re examines the finding against the actual code and can grep the codebase to or refute claimed defenses.
2. This repeats for multiple rounds (default: 5), with each re seeing prior arguments and encouraged to find *new* e rather than rehash old points.
3. A final arbiter reads all rounds and makes a VALID/INVALID call.
4. The confidence score (e.g. 80% \[VVIVV→V\]) reflects the fraction of rounds that said VALID.

Findings that survi are written to the findings/ directory with full reasoning chains.

Disclaimer

This tool is a research prototype. It is not a replacement for professional security audits, manual code review, or established static analysis tools. Do not rely on it as your sole security assessment. Use at your own risk.

License

Apache License 2.0

项目信息

开发语言：Python

Star 数：362

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A minimal LLM-powered zero-day vulnerability scanner by AISLE.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。