01IMT Atlantique · Final-year project (Procom) · team of 4·2025–26
Argus — real exploitability of C++ CVEs
An agent that answers the real question: can this vulnerability actually be reached in this code? It builds the call graph of a C++/CMake project with tree-sitter, fetches CVEs and public exploits, traces data flow back from every risky call, then a local model writes an exploitability report. The code never leaves the server.
LLM-judge benchmark with cross-review: up to 8.8/10 after consensus, and a correct 0 for the CVE-free project.
Python/FastAPI/tree-sitter/Ollama/SQLite/Docker/Next.js
- 1C++ call graphtree-sitter
- 2CVEs & public exploitsNVD · ExploitDB
- 3Data flow traced backtaint
- 4Exploitability reportlocal LLM
LLM judge score /10 · raw → after consensus







