Chakraview: A Hybrid Static-Analysis and Local-Llm Prototype for Vulnerability Detection and Mitigation Guidance in Open-Source Software

Open-source software benefits from rapid, distributed development, but reviewing it for security weaknesses is labour-intensive, and developers need findings that are explained and actionable. We present Chakraview, a prototype that combines a rule-based static stream with a locally hosted large language model (DeepSeek-Coder 6.7B Instruct served through Ollama). Uploaded Python, C/C++, PHP, and Java files or ZIP archives are parsed with Tree-sitter, analysed by both streams, fused by a weighted score (0.6 × LLM confidence + 0.4 × static flag), and reported with CWE labels, explanations, and suggested mitigations. We document the architecture, analyse the fusion rule, and report two preliminary checks: seven functional checks recorded in project documentation, and a reproducible measurement of the static stream on four developer-written files containing 29 seeded vulnerable lines, of which 23 were flagged (22 under the correct CWE); all misses were injection-type flaws needing data-flow reasoning. The LLM stream, the fusion score, and the generated fixes have not been evaluated on labeled data, and suggested fixes are not compiled, tested, or rescanned. Chakraview is therefore a preliminary system prototype, not a validated detector. We specify a held-out evaluation protocol comparing static-only, LLM-only, and fused analysis, with separate tests of localization, calibration, and mitigation correctness.