An Offline, Multi-Language Code Vulnerability Detection Plugin with Graph Neural Networks and LLM-Guided Explanations

Early detection of software vulnerabilities is essential for building trustworthy and secure systems. Traditional static analysis tools are largely rule-based, leading to high false positive rates and limited adaptability, while modern cloud-based solutions raise privacy, cost, and offline usability concerns. This paper presents VISION-IDE, an offline, multi-language code vulnerability detection plugin for Visual Studio Code that integrates Graph Neural Networks (GNNs) with LLM-guided explanations. Inspired by the VISION framework’s counterfactual augmentation strategy, the proposed system enhances robustness by mitigating spurious correlations in vulnerability datasets. Source code is transformed into unified Code Property Graphs combining AST, CFG, and data flow representations, enabling deep semantic analysis. Detected vulnerabilities are localized and explained using a locally deployed Large Language Model, which generates human-readable explanations and validated code fixes without external data transmission. Experimental evaluation on the NIST Juliet Test Suite demonstrates competitive detection accuracy with low inference latency suitable for real-time IDE integration. The results indicate that combining graph-based learning, counterfactual augmentation, and local LLM explainability provides a practical, privacy-preserving solution for secure software development.