Code exception analysis method and device, storage medium and program product

Abstract

The embodiment of the invention provides a code exception analysis method and device, a storage medium and a program product. In the embodiment of the invention, in the preset plug-in, the global knowledge graph is constructed through the logic syntax tree of the plurality of original business codes, so that intelligent anomaly analysis is carried out on the modified to-be-detected codes, multi-language and heterogeneous programming styles and complex dependency limitation are broken through, and cross-language and cross-file analysis is supported; change code snippets and associated influence code snippets thereof are accurately identified, and a data basis is tamped and analyzed; the analysis depth is deepened and the accuracy is improved through a multi-dimensional anomaly analysis large model and four-dimensional collaborative analysis in combination with an adaptive review rule and a knowledge graph; and finally, performing correction based on the generated repair scheme. Through the technical fusion of an MCP protocol, a multi-AI model, a syntax tree and a knowledge graph, the high efficiency, accuracy and real-time performance of code examination and repair are realized, and the service development quality and the system operation stability are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a code anomaly analysis method, device, storage medium, and program product. Background Technology

[0002] In modern software development, code review is a crucial step in ensuring code quality and system stability. Traditional code review methods primarily rely on manual review or static analysis tools. Manual review is inefficient, susceptible to human error, and ill-suited for large-scale codebases and complex business logic. While existing static analysis tools can detect syntax and structural issues, their rules are rigid, making them ill-suited for complex logic and diverse programming styles. Furthermore, they lack cross-language support and cross-file dependency analysis capabilities. Summary of the Invention

[0003] This application provides a code anomaly analysis method, device, storage medium, and program product to address the shortcomings of manual code review, such as low efficiency, difficulty in handling large-scale codebases and complex business processes, and the rigid rules of existing static analysis tools, which are unable to adapt to complex logic and diverse programming styles, and lack cross-language support and cross-file dependency analysis. The aim is to enable the analysis to handle large-scale codebases and complex business processes, adapt to complex logic and diverse programming styles, and fully support cross-language and cross-file dependency analysis, thereby achieving efficient, accurate, and real-time code detection and improving the overall quality of software development and operational stability.

[0004] This application provides a code anomaly analysis method applied to an AI-based large-scale model code detection plugin. The code detection plugin is developed based on the MCP protocol and can call various MCP tools provided by the MCP server for code detection. The method includes: receiving business code to be detected, the business code belonging to a target business, the target business being associated with a global knowledge graph, the global knowledge graph being constructed based on the logical syntax tree of multiple original business codes under the target business; based on the multiple original business codes and the global knowledge graph, identifying changed target code segments in the code to be detected, as well as other code segments in the business code to be detected and other business codes affected by the target code segments, as differential code information; and inputting the differential code information and the global knowledge graph into an AI-based multi-dimensional anomaly analysis tool. The system analyzes a large-scale model, invoking at least one MCP analysis tool provided by the MCP server. Based on review rules adapted to the business code to be inspected and a global knowledge graph, it collaboratively performs anomaly analysis on the discrepancies in the code from the dimensions of code structure, code semantics, code security, and unified code standards, obtaining the anomaly analysis results corresponding to the code to be inspected. If the anomaly analysis results indicate that the code to be inspected is abnormal, it invokes an AI-based remediation suggestion model. Based on the anomaly analysis results and preset code remediation rules, it generates at least one code remediation suggestion described in natural language. The code remediation suggestion and the discrepancy information are input into the AI-based code remediation model, which invokes the MCP remediation tool provided by the MCP server to remediate the discrepancy information based on the code remediation suggestion, thus obtaining the remediated business code.

[0005] This application also provides an electronic device, including: a memory and a processor; the memory for storing a computer program; and the processor, coupled to the memory, for executing the computer program to implement the steps in the above method.

[0006] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps in the above-described method.

[0007] In this application embodiment, various tools for code detection are developed based on the MCP protocol to facilitate invocation by various models, thereby expanding the capabilities of large models. In the code detection plugin pre-developed by integrating AI large models and the MCP protocol, a global knowledge graph constructed based on the logical syntax tree of multiple original business codes under the target business performs code anomaly analysis on the modified business code to be detected. This eliminates the need to focus on the complex logic, diverse programming styles, and diverse programming languages ​​of multiple original business codes, thus achieving full cross-language support and cross-file dependency analysis. Furthermore, in the process of identifying discrepancy code information, it can not only identify the target code segment that has changed in the code to be detected, but also identify other code segments outside the target code segment that are affected by the target code segment. This provides a sufficient data foundation for subsequent anomaly analysis and helps improve the accuracy of code anomaly analysis. Furthermore, the AI-based multi-dimensional anomaly analysis model calls the MCP analysis tool. Based on the review rules adapted to the business code to be detected and the global knowledge graph, it collaboratively performs anomaly analysis on discrepancy code information from the dimensions of code structure, code semantics, code security, and unified code specifications, obtaining anomaly analysis results. This multi-dimensional collaborative analysis increases the depth and accuracy of code anomaly analysis, providing accurate data for generating code repair suggestions. Furthermore, the AI-based repair suggestion model generates code repair suggestions based on the anomaly analysis results, allowing the AI ​​code repair model to call the MCP repair tool to repair the discrepancy code information. The combination of the MCP protocol, multiple AI models, logical syntax trees, and knowledge graphs improves the accuracy of code repair. In summary, the fully automated code anomaly analysis process described above can efficiently, accurately, and in real-time review and fix code based on a thorough understanding of code structure, semantics, security, and standards, thereby improving the overall quality of target business development and operational stability. Attached Figure Description

[0008] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0009] Figure 1 A flowchart illustrating a code exception analysis method provided for an exemplary embodiment of this application;

[0010] Figure 2a A schematic diagram of the structure of a multi-dimensional anomaly analysis model provided in an exemplary embodiment of this application;

[0011] Figure 2b A flowchart illustrating a subtask execution logic provided for an exemplary embodiment of this application;

[0012] Figure 2c A flowchart illustrating another subtask execution logic provided for another exemplary embodiment of this application;

[0013] Figure 2d A flowchart illustrating yet another subtask execution logic provided for yet another exemplary embodiment of this application;

[0014] Figure 2e A flowchart illustrating another code anomaly analysis method provided as another exemplary embodiment of this application;

[0015] Figure 3 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0017] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0018] Additionally, it should be noted that when user interaction operations or triggering operations are involved in the embodiments of this application, these operations include, but are not limited to, various interaction methods such as touch operations, gesture operations, voice operations, head movement operations, and eye movement operations. Touch operations include, but are not limited to, click operations, double-click operations, long-press operations, swipe operations, pinch operations, or mouse hover operations. Swipe operations include, but are not limited to, straight-line swipes and curved-line swipes.

[0019] Building upon the aforementioned background technology, and addressing the technical problems of low efficiency in manual code review, difficulty in handling large-scale codebases and complex business processes, and the limitations of existing static analysis tools with rigid rules that cannot adapt to complex logic and diverse programming styles, as well as deficiencies in cross-language support and cross-file dependency analysis, this application embodiment develops various tools for code detection based on the MCP protocol to facilitate invocation by various models, thereby expanding the capabilities of large models. In the code detection plugin pre-developed by integrating AI large models and the MCP protocol, a global knowledge graph constructed based on the logical syntax tree of multiple original business codes under the target business is used to perform code anomaly analysis on the modified business code to be detected. This eliminates the need to focus on the complex logic, diverse programming styles, and diverse programming languages ​​of multiple original business codes, thus achieving full cross-language support and cross-file dependency analysis. Furthermore, during the identification of discrepancy code information, it can not only identify the target code segment that has changed in the code to be detected, but also identify other code segments outside the target code segment that are affected by the target code segment. This provides a sufficient data foundation for subsequent anomaly analysis and helps improve the accuracy of code anomaly analysis. Furthermore, the AI-based multi-dimensional anomaly analysis model calls the MCP analysis tool. Based on the review rules adapted to the business code to be detected and the global knowledge graph, it collaboratively performs anomaly analysis on discrepancy code information from the dimensions of code structure, code semantics, code security, and unified code specifications, obtaining anomaly analysis results. This multi-dimensional collaborative code anomaly analysis increases the depth and accuracy of code anomaly analysis, providing accurate data for generating code repair suggestions. Furthermore, the AI-based repair suggestion model generates code repair suggestions based on the anomaly analysis results, enabling the AI ​​code repair model to call the MCP repair tool to repair the discrepancy code information. By combining the MCP protocol, multiple AI models, logical syntax trees, and knowledge graphs, the accuracy of code repair is improved. In summary, the fully automated code anomaly analysis process described above can efficiently, accurately, and in real-time review and fix code based on a thorough understanding of code structure, semantics, security, and standards, thereby improving the overall quality of target business development and operational stability.

[0020] The following describes in detail a solution provided by an embodiment of this application, with reference to the accompanying drawings.

[0021] Figure 1This application provides a code anomaly analysis method, which is a fully automated process applied to a code detection plugin based on a large model. The code detection plugin is developed based on the Model Context Protocol (MCP) and can call various MCP tools for code detection provided by the MCP server.

[0022] In this embodiment, the code detection plugin can be deployed privately, and it can execute the steps in the following embodiments of the code anomaly analysis method, ensuring data security and privacy during the code anomaly analysis process. Furthermore, the code detection plugin can be elastically scaled using automated operation and maintenance tools (such as Kubernetes) to meet code anomaly analysis needs of different scales.

[0023] The MCP protocol is an open standard protocol designed to unify the interaction methods between large models and external data sources, tools, and services. Its core functions include: context data injection, injecting external resources such as files, databases, and API responses into the model's prompt words or working memory; function routing and invocation, allowing large models to dynamically call registered tools (such as Search Customer Data); and prompt word orchestration, modularizing and assembling prompt words in real time to reduce the consumption of processing the smallest data unit at a time and improve output quality. The MCP protocol adopts a client-server architecture. Applications (such as code anomaly detection applications with the aforementioned code anomaly detection plugin) connect to various MCP servers (such as Google Drive and databases) through an MCP client.

[0024] A large model refers to a model that has been pre-trained or fine-tuned using sample data from its relevant domain, and whose parameters meet the set parameter quantity requirements. The parameter quantity requirement is not specifically limited and can have different definitions in different scenarios or domains. For example, in some scenarios or domains, a large model refers to a model with a parameter scale reaching tens of billions, hundreds of billions, or even trillions. However, this definition of the model's parameter quantity is merely an example and does not constitute a limitation on the technical solution of this application. A large model can be an AI model, such as an AI large language model with powerful language understanding and generation capabilities.

[0025] In practical applications, code detection plugins can run within an Integrated Development Environment (IDE) or a Continuous Integration (CI) pipeline. An IDE refers to the local development environment used by the developer (such as IntelliJ IDEA, VS Code, Eclipse, etc.), and plugins are installed as extensions or packages to trigger code detection in real time. Plugins integrated into an IDE are called IDE plugins, such as the CodeGuru-Review plugin for IntelliJ IDEA, the MCP-AI-CodeLens plugin for VS Code, and the MCP-Assist plugin for Eclipse. A CI pipeline refers to a continuous integration platform (such as GitHub Actions, GitLab CI, Jenkins, Azure DevOps, etc.) where code detection runs as a build step or container task, automatically performing code detection with each pull request (PR). Plugins integrated into a CI pipeline are called CI pipeline plugins, such as the mcp-code-scan action plugin for GitHub Actions, the mcp-analyze job plugin for GitLab CI, and the MCP-Code-Review plugin for Jenkins. More specifically, the plugin can act as an MCP Client, establishing a connection with the MCP Server and sending code and other related data to the server.

[0026] like Figure 1 As shown, this code anomaly analysis method includes:

[0027] 101. Receive the business code to be tested. The business code to be tested belongs to the target business. The target business is associated with a global knowledge graph. The global knowledge graph is constructed based on the logical syntax tree of multiple original business codes under the target business.

[0028] 102. Based on the global knowledge graph of anomaly detection in multiple original business codes, identify the target code segment that has changed in the code to be detected for anomaly detection, as well as other code segments in the business code to be detected for anomaly detection and other business codes that are affected by the target code segment of the anomaly detection, as difference code information;

[0029] 103. Input the anomaly detection difference code information and the anomaly detection global knowledge graph into the AI-based multi-dimensional anomaly analysis model, call at least one MCP analysis tool provided by the MCP server, and perform anomaly analysis on the anomaly detection difference code information in collaboration from the dimensions of code structure, code semantics, code security and unified code specifications, based on the review rules adapted to the business code to be detected and the anomaly detection global knowledge graph, to obtain the anomaly analysis results corresponding to the code to be detected;

[0030] 104. If the anomaly analysis results indicate that the code to be detected is abnormal, call the AI-based repair suggestion model, and generate at least a code repair suggestion described in natural language based on the anomaly detection and anomaly analysis results and the preset code repair rules.

[0031] 105. Input the anomaly detection code repair suggestions and anomaly detection difference code information into the AI-based code repair model, call the MCP repair tool provided by the anomaly detection MCP server, and repair the anomaly detection difference code information based on the anomaly detection code repair suggestions to obtain the repaired business code.

[0032] In this embodiment, an application may contain multiple services. For a target service among these services, there may be multiple original business codes. When the target service version needs updating or bug fixes occur, these original business codes need to be modified. Modification methods include, but are not limited to, adding, deleting, and altering code. After all the original codes under the target service have been modified, code anomaly analysis can be performed on the modified code. If the anomaly analysis results indicate that the modified code has anomalies, code repair can be performed. Alternatively, during the modification process of the multiple original business codes under the target service, before all modifications are completed, code anomaly analysis can be performed on the code segments with independent semantics that have been modified in real time. If the anomaly analysis results indicate that the modified code has anomalies, code repair can be performed in real time. The code segments in the modification state undergoing real-time code anomaly analysis and repair can be referred to as the business code to be detected. This avoids subsequent code modifications becoming abnormal due to anomalies in the previously modified code, improving code development efficiency and the efficiency of target service version upgrades. In the following embodiments of this application, the main focus is on the modification process of multiple original business codes under the target business. Before all modifications are completed, code anomaly analysis can be performed on the code segments with independent semantics that have been modified in real time, and code repair can be performed in real time when the anomaly analysis results indicate that there are anomalies in the modified code.

[0033] When there is a need for code anomaly analysis, a code anomaly detection request can be triggered to the code detection plugin to activate it. This allows the plugin to execute the fully automated process described in steps 101-105 of the code anomaly analysis method above. The code anomaly detection request includes: the business code to be detected, multiple original business codes, and a global knowledge graph; or, the code anomaly detection request includes: path information / identifier information of the business code to be detected, path information / identifier information of multiple original business codes, and path information / identifier information of the global knowledge graph. This allows the code detection plugin, upon receiving the code anomaly detection request, to obtain the corresponding business code to be detected, multiple original business codes, and the global knowledge graph based on the path information / identifier information of the business code to be detected, the multiple original business codes, and the global knowledge graph, respectively. Alternatively, the code anomaly detection request may contain the business code to be detected, multiple original business codes, and partial information from the global knowledge graph, as well as partial information from the path information / identification information of the business code to be detected, multiple original business codes, and the global knowledge graph. Based on the partial information from the path information / identification information of the business code to be detected, multiple original business codes, and the global knowledge graph, another part of information not included in the code anomaly detection request, other than the aforementioned partial information from the business code to be detected, multiple original business codes, and the global knowledge graph, may be obtained, etc. This embodiment does not limit this.

[0034] In this embodiment, the business code to be detected belongs to the target business, which contains multiple original business codes. Each original business code can be considered a file (such as a class file). The target business is associated with a global knowledge graph, which is pre-constructed based on the abstract syntax tree (AST) of the multiple original business codes under the target business. The abstract syntax tree is a tree-like representation of the original business code structure, where each node represents a construct (such as a variable declaration, function call, etc.) in the original business code. The global knowledge graph is a special type of graph database that graphically (directed graph) displays the entities and entity relationships contained in the business code; in other words, the directed graph contains multiple nodes and multiple connecting edges. Furthermore, the global knowledge graph also includes additional data such as schema layer metadata, attribute data, community and hierarchy summaries, real-time status and change logs, external indexes and pointers, and compliance and audit metadata. Among them, the schema layer metadata includes an ontology and a data dictionary. An ontology can also be viewed as a standardized definition system that clearly defines the structural characteristics, attribute sets, and relationship rules of core entities such as "classes, methods, and parameters." Entities are specific entries retrieved from this standardized definition system, such as a class named OrderService, a method named callableTotal, and a parameter named Amount. In other words, ontology and entity are different concepts. An ontology can be likened to the template of a "person," specifying characteristics such as name, age, and occupation; an entity can be likened to the person "Zhang San," whose name is "Zhang San" and age is "25." An ontology includes, but is not limited to: defining entity types, entity relationship types, attribute constraints, and inheritance levels. A data dictionary includes, but is not limited to: a unified namespace, ID rules, version numbers, and naming conventions. Attribute data includes node attributes and edge attributes. Node attributes include, but are not limited to: class name, method signature, field type, visibility, annotations, and source code coordinates (file # row # column). Edge attributes include, but are not limited to: weight (call frequency, similarity), timestamp, Git Commit SHA, and audit fingerprint. Community and hierarchical summaries include, but are not limited to: community detection results and hierarchical summaries. Community detection results refer to high-cohesion subgraphs and their high-level summaries, used for macro-risk partitioning. Hierarchical summaries refer to abstract views across repositories and languages, supporting switching between global and local searches. Real-time status and change logs include node and edge lifecycles and change traceability chains. Node and edge lifecycles include, but are not limited to: creation, modification, and deletion events and their corresponding incremental version numbers. Change traceability chains refer to the fix chain fingerprints generated by each incremental syntax tree parsing.External indexes and pointers include coordinate-node indexes and vector index pointers. The coordinate-node indexes are key-value (KV) tables with "file#starting row#starting column" as the key and node ID as the value, used for millisecond-level positioning. Vector index pointers point to embedded representations in the vector database and support semantic similarity retrieval. Compliance and audit metadata includes security tags and compliance rules. Security tags characterize whether sensitive fields are involved and whether a security baseline scan has been passed. Compliance rules include boolean flags such as "must be done through the API gateway" and "direct access to the database (DB) is prohibited." In summary, the global knowledge graph is logically divided into a "data layer (fact triples)" and a "schema layer (metadata ontology)." At the physical level, it uses a hybrid storage system of graph database, key-value indexes, and vector libraries, preserving the associative advantages of the graph structure while supporting high-concurrency, low-latency real-time updates and detection traceability.

[0035] In the following embodiments of this application, for ease of description and distinction, the ontology can be divided from another perspective. The entities contained in the ontology and the attribute data related to the entities can be collectively referred to as entity data, and the entity relationships contained in the ontology and the attribute data related to the entity relationships can be collectively referred to as entity relationship data.

[0036] In this embodiment, when constructing a global knowledge graph corresponding to multiple original data, a logical syntax tree corresponding to each original business code can be constructed first. Then, a global knowledge graph can be constructed based on the logical syntax trees corresponding to the multiple original business codes, serving as the global knowledge graph associated with the target business. The business code to be detected and the original business code are relative concepts. For example, the target business may involve multiple version upgrades. Regarding the modifications made to the code in the Nth version upgrade, the code before the modification in the Nth version upgrade (the code after the modification in the N-1th version upgrade) can be called the original code, while the code during or after the modification process can be called the business code to be detected.

[0037] In constructing the logical syntax tree corresponding to multiple original business codes, the logical syntax tree for each original business code can be constructed simultaneously in parallel to improve the efficiency of syntax tree construction, thereby improving the efficiency of code anomaly detection. Optionally, constructing the logical syntax tree for each original business code includes: identifying the programming language type of each original business code among multiple original business codes (the programming language type of each original business code may be the same or different); dynamically loading a syntax parser corresponding to the identified programming language type, the syntax parser embedding the syntax rules of that language; performing lexical and syntactic analysis on the corresponding original business code using the loaded syntax parser, and storing the analysis results as a standardized tree data structure to obtain the logical syntax tree corresponding to each original business code. The standardized tree data structure includes uniformly defined node types (referred to as nodes) and attribute data, connection edge types (referred to as connection edges) and attribute data. Node types represent entities, connection edges represent entity relationships, node attribute data represents entity attribute data, and connection edge attribute data represents entity relationship attribute data. The technical solution provided in this embodiment enables the logical syntax trees generated by different programming languages ​​to be comparable and interoperable. Moreover, the dynamic loading of the parser and the generation of standardized tree data structures solve the problems of inconsistent code languages, inconsistent logical syntax tree formats, and difficulty in interoperability in multilingual code analysis, thereby realizing cross-warehouse (business) and cross-language code analysis.

[0038] In this embodiment, there may be certain relationships between multiple original business codes under the target business. In other words, there may be certain relationships between the logical syntax trees corresponding to multiple original business codes. After constructing the logical syntax trees corresponding to multiple original business codes, a global logical syntax tree corresponding to multiple original business codes under the target business can be constructed based on the logical syntax trees corresponding to multiple original business codes and the relationships between each logical syntax tree.

[0039] Optionally, a global knowledge graph is constructed based on the logical syntax trees corresponding to multiple original business codes. This includes: performing cross-file semantic analysis on multiple logical syntax trees to identify and extract entity data and entity relationship data. The entity data contains multiple entities, and the entity relationship data contains multiple first entity relationships. First entity relationships can be considered as explicit syntax relationships, including: function call relationships, class inheritance relationships, interface implementation relationships, variable reference relationships, and module dependency relationships. Based on the entities and first entity relationships, an initial knowledge graph is constructed, where entities serve as nodes in the knowledge graph, and first entity relationships serve as connecting edges connecting nodes. Context enhancement analysis is performed on the initial knowledge graph. By traversing the scope information and data flow paths in each logical syntax tree, second entity relationships between entities are identified and supplemented. Second entity relationships can be considered as implicit syntax relationships, including: parameter passing paths, exception handling chains, and cross-function data dependencies. The first entity relationships and second entity relationships are merged to construct a global knowledge graph covering the entire target business with multi-layered semantic relationships. Metadata tags are added to the nodes and connecting edges in the global knowledge graph. Metadata tags include: entity definition location, association strength, and recent modification timestamp. Furthermore, the global knowledge graph can provide a global query interface, supporting graph traversal algorithms to perform impact analysis, defect tracing, or refactoring impact assessment on the global knowledge graph. Thus, by organically combining two-layer association extraction, context enhancement, and metadata fusion of multiple logical syntax trees, a more semantically complete and analytically powerful global knowledge graph is constructed. The generated global knowledge graph can support more complex and accurate code anomaly analysis tasks, solving the technical challenge of complex and difficult-to-understand code relationships in large-scale business applications. In addition, the embodiments of this application are not limited to a single business within a single application. For multiple original business codes under different businesses within the same application or multiple original business codes in different applications, if there are relationships, a knowledge graph can also be constructed based on these original business codes. This can solve the problems of inconsistent code languages ​​and difficulty in cross-repository and cross-language code analysis in multi-language code analysis, providing a rich knowledge base for achieving cross-repository and cross-language code analysis.

[0040] In this embodiment, after the code detection plugin receives the business code to be detected, it can identify the target code segment that has changed in the code to be detected based on multiple original business codes and a global knowledge graph. This target code segment is then used as a difference code segment to facilitate code anomaly analysis. Furthermore, based on identifying the target code segment that has changed in the code to be detected, it can also identify other code segments in the business code to be detected and other business codes that are affected by the target code segment, based on multiple original business codes, the global knowledge graph, and the target code segment. These other code segments are then used as difference code information. During the difference code information identification process, not only can the target code segment that has changed in the code to be detected be identified, but also other code segments outside the target code segment that are affected by the target code segment can be identified. This provides a sufficient data foundation for subsequent anomaly analysis and helps improve the accuracy of code anomaly analysis. For the preferred implementation of identifying the target code segment that has changed in the code to be detected and other code segments in the business code to be detected and other business codes that are affected by the target code segment, based on multiple original business codes and a global knowledge graph, as difference code information, please refer to the relevant description in the following embodiments, which will not be repeated here.

[0041] To improve the accuracy of code discrepancy analysis, after obtaining the discrepancy code information, anomaly analysis can be performed on the discrepancy code information from multiple dimensions to obtain the discrepancy analysis results. Specifically, the discrepancy code information and the global knowledge graph can be input into an AI-based multi-dimensional anomaly analysis model, calling at least one MCP analysis tool provided by the MCP server. Based on the review rules adapted to the business code to be detected and the global knowledge graph, anomaly analysis is performed on the discrepancy code information from the dimensions of code structure, code semantics, code security, and unified code specifications, to obtain the anomaly analysis results corresponding to the code to be detected. The anomaly analysis results include: the code to be detected has anomalies and the code to be detected is normal.

[0042] To further improve the accuracy of code discrepancy analysis, during the collaborative anomaly analysis of discrepancy information from the dimensions of code structure, code semantics, code security, and unified coding standards, anomaly analysis can be performed separately for each dimension, and the anomaly analysis results of each dimension can be used as the anomaly analysis results for the business code to be tested. Alternatively, the anomaly analysis results from each dimension can be integrated to obtain a comprehensive anomaly analysis result, which can then be used as the anomaly analysis result for the business code to be tested. Furthermore, correlation anomaly analysis and mutual verification processes can be set up between different dimensions to improve the accuracy of code anomaly analysis results. Taking code structure dimension analysis as an example, after performing anomaly analysis on the differing code information from the code structure dimension and obtaining the anomaly analysis results for the code structure dimension, if the anomaly analysis results for the code structure dimension indicate that the structural complexity of the differing code information is abnormal (such as exceeding a preset structural complexity threshold), then the anomaly analysis of other dimensions is skipped to avoid unnecessary anomaly detection operations; or, if the anomaly analysis results for the code structure dimension indicate that the structural complexity of the differing code information is abnormal (such as exceeding a preset structural complexity threshold), then at least one other dimension's anomaly analysis is triggered to verify whether the anomaly analysis results for the code structure dimension are reasonable. For example, in the case of abnormal structural complexity, anomaly analysis for the code semantic dimension is triggered to perform code semantic depth verification. If the code structural complexity and code semantic depth do not match (if the code semantic depth meets the rule requirements), it indicates that the anomaly analysis results for the differing code information in the code structure dimension may be incorrect; if the code structural complexity and code semantic depth match, it indicates that the anomaly analysis results for the differing code information in the code structure dimension are very likely correct. Code semantic depth refers to the process of in-depth logical understanding and functional verification of code within the semantic dimension. It goes beyond simple syntax checking; it delves into the code's actual functionality, data flow, control flow, and other aspects to ensure logical rationality and maintainability. For example, if the anomaly analysis result in the semantic dimension indicates an anomaly in the semantic depth of the differing code information, it triggers anomaly analysis in at least one other dimension to verify the rationality of the semantic dimension's anomaly analysis result. For instance, if the semantic dimension's anomaly analysis result indicates anomalies in the differing code information, it triggers anomaly analysis in the code structure dimension to verify the code structure complexity. If the code structure complexity does not match the semantic depth (assuming the code structure complexity meets the rule requirements), it indicates that the differing code information may contain errors in the semantic dimension; if the semantic depth matches the code structure complexity, it indicates that the anomaly analysis result in the semantic dimension is highly likely correct.Alternatively, the anomaly analysis result in one dimension can determine the anomaly analysis process in other dimensions. For example, if the anomaly analysis result in one dimension indicates anomalies in the discrepancy code information, then a comprehensive analysis based on the anomaly analysis results from multiple dimensions can be performed to obtain the final anomaly analysis result. Alternatively, the above implementation methods can be combined to obtain the anomaly analysis result. Therefore, multi-dimensional collaborative code anomaly analysis can increase the depth and accuracy of code anomaly analysis, providing precise data for generating code repair suggestions. For a more preferred implementation method of calling at least one MCP analysis tool provided by the MCP server, and collaboratively performing anomaly analysis on the discrepancy code information from the dimensions of code structure, code semantics, code security, and unified code specifications based on the review rules adapted to the business code to be detected and the global knowledge graph, to obtain the anomaly analysis result corresponding to the code to be detected, please refer to the relevant descriptions in the following embodiments, which will not be elaborated here.

[0043] Furthermore, when the anomaly analysis results indicate that the code under test contains anomalies, an AI-based remediation suggestion model is invoked. Based on the anomaly analysis results and pre-defined code remediation rules, at least one code remediation suggestion described in natural language is generated to facilitate code remediation based on the suggestion. Therefore, accurate anomaly analysis results based on multi-dimensional code anomaly analysis and pre-defined code remediation rules are conducive to generating more accurate code remediation suggestions, improving the accuracy of subsequent code remediation.

[0044] Specifically, when calling the AI-based repair suggestion model, based on anomaly analysis results and preset code repair rules, to generate at least code repair suggestions described in natural language, the system can query the repair knowledge base for the most similar code repair pair to the code to be repaired based on the code defect type contained in the anomaly analysis results, and use the most similar code repair pair, defect type, and code to be repaired as the most similar code information; based on the preset code repair rules, the system generates code repair suggestions described in natural language based on the most similar code information.

[0045] Furthermore, after generating code repair suggestions, the anomaly analysis results and code repair suggestions can be sent to the terminal devices of the developers of the corresponding code. This allows the developers to view the anomaly analysis results and code repair suggestions on their terminal devices, and determine the appropriate repair method based on the suggestions. Repair methods include automatic and manual repair. This embodiment does not limit the implementation form of the repair suggestion display interface.

[0046] In one implementation, anomaly analysis results and code repair suggestions can be pushed to developers' devices via hyperlinks. Developers can access a dedicated visual interface by clicking the link to fully view the anomaly analysis results and corresponding code repair suggestions. This interface also provides several optional configuration options, including but not limited to a "Whether to accept code repair suggestions" selection control. When developers confirm acceptance of the code repair suggestions, the code detection plugin will automatically perform code repair operations based on the suggestions; if developers choose to reject automatic code repair, the system will switch to manual intervention mode, displaying a code editing interface for developers to manually modify, or providing a dedicated input window for the repaired code, allowing developers to upload custom repaired code through this interface.

[0047] Optionally, the display interface adopts a three-layer collapsible visualization architecture, which includes: a global knowledge graph heatmap (macro view), a file-level difference graph (meso view), and an inline lens interaction layer graph (micro view). The global knowledge graph heatmap is generated by the global knowledge graph heatmap module, which uses WebGL-rendered 3D force-directed graph technology to present the global knowledge graph visualization in the IDE sidebar. Its node color mapping uses dynamic encoding of anomaly risk levels (red indicates high risk, orange indicates medium risk, and green indicates no anomaly). Node size represents the frequency of method calls, and edge thickness reflects the strength of dependencies between modules. Clicking on a node allows real-time acquisition of upstream and downstream related nodes through MCP tools (such as queryImpactGraph), highlighting the impact range. A timeline slider control is also integrated to enable playback of historical versions. The file-level difference map is generated by the file-level difference module, which displays the affected individual code files as interactive floating cards. Each card contains a thumbnail of the logical syntax tree differences (using a tree-folded structure to visualize the logical syntax tree changes, with node colors corresponding to the macro view). Figure 1The code editor features a multi-dimensional display of code structure, semantics, security, and specification anomaly risk scores, along with a one-click fix button (which, when triggered, generates a patch via the MCP tool and embeds it into a collapsible difference comparison view). It also supports drag-and-drop card sorting and automatic priority adjustment based on risk scores. The inline lens interaction layer is generated by the module, which is integrated into the code editor interface as an embedded lens. It is automatically activated when the mouse hovers over a line of code with a difference, employing a three-column layout (the left side displays LLM-generated code fix suggestions, the right side configures accept / reject / modify three-state operation buttons, and the bottom displays the fix chain fingerprint, including logical syntax tree node hashes, global knowledge graph node IDs, and Git commit SHAs). Clicking "Accept" allows the MCP tool (such as applyPatch) to write patches and update the lens state, while simultaneously pushing back node state change events to achieve collaborative updates across the three views. The fix chain fingerprint uses the SHA-256 hash algorithm combined with timestamp signatures to ensure traceability. This interface maintains real-time communication with at least one MCP analysis tool deployed on the server via the MCP protocol, enabling dynamic and interconnected updates of three layers of data: the global knowledge graph, the logical syntax tree, and the original business code text. In summary, through the deep coupling of these three layers of views with the MCP protocol, the interface achieves second-level visualization of the global impact scope, instant in-line repair and real-time graph synchronization, and a fully traceable anomaly analysis chain, thereby significantly improving the efficiency, accuracy, and compliance of code anomaly analysis.

[0048] Furthermore, after receiving code repair suggestions, these suggestions and discrepancy information can be input into an AI-based code repair model. This model then invokes the MCP repair tool provided by the MCP server to repair the discrepancy information based on the suggestions, resulting in the repaired business code. In practical applications, in response to a configuration action that accepts the repair suggestions, the suggestions and discrepancy information can be input into the AI-based code repair model for automatic code repair. If developers do not accept the repair suggestions, manual code repair can be performed.

[0049] The technical solutions provided in the above embodiments of this application develop various tools for code detection based on the MCP protocol, facilitating calls from various models and expanding the capabilities of large models. In the code detection plugin pre-developed by integrating AI large models and the MCP protocol, a global knowledge graph constructed based on the logical syntax tree of multiple original business codes under the target business performs code anomaly analysis on the modified business code to be detected. This eliminates the need to focus on the complex logic, diverse programming styles, and diverse programming languages ​​of multiple original business codes, thereby achieving full cross-language support and cross-file dependency analysis. Furthermore, during the identification of discrepancy code information, it can not only identify the target code segment that has changed in the code to be detected, but also identify other code segments outside the target code segment that are affected by the target code segment. This provides a sufficient data foundation for subsequent anomaly analysis and helps improve the accuracy of code anomaly analysis. Furthermore, the AI-based multi-dimensional anomaly analysis model calls the MCP analysis tool. Based on the review rules adapted to the business code to be detected and the global knowledge graph, it collaboratively performs anomaly analysis on discrepancy code information from the dimensions of code structure, code semantics, code security, and unified code specifications, obtaining anomaly analysis results. This multi-dimensional collaborative code anomaly analysis increases the depth and accuracy of code anomaly analysis, providing accurate data for generating code repair suggestions. Furthermore, the AI-based repair suggestion model generates code repair suggestions based on the anomaly analysis results, enabling the AI ​​code repair model to call the MCP repair tool to repair the discrepancy code information. By combining the MCP protocol, multiple AI models, logical syntax trees, and knowledge graphs, the accuracy of code repair is improved. In summary, the fully automated code anomaly analysis process described above can efficiently, accurately, and in real-time review and fix code based on a thorough understanding of code structure, semantics, security, and standards, thereby improving the overall quality of target business development and operational stability.

[0050] In this embodiment, based on multiple original business codes and a global knowledge graph, the target code segment that has changed in the business code to be detected, as well as other code segments in the business code to be detected and other business codes that are affected by the code segment, are identified as differential code information, including:

[0051] A1. Perform a dual comparison analysis of code lines and code units on multiple original business codes and the business code to be tested to determine the added or deleted code range of the business code to be tested relative to multiple original business codes, which is used as the target code segment; whereby, a code unit refers to the smallest code segment with independent semantics.

[0052] A2. Construct the first local logical syntax tree corresponding to the target code segment, and determine the absolute line number and absolute column number of each node in the first local logical syntax tree in its respective original business code. It should be noted that the number of target code segments may be one or more. If the target code segments correspond to different original business codes, the first local logical syntax tree can be constructed for each target code segment corresponding to each original business code. Moreover, if the target code segments corresponding to the same original business code are not contiguous (containing multiple non-contiguous code segments), the first local logical syntax tree can be constructed based on each contiguous code segment in the target code segment. Thus, the number of first local logical syntax trees can be one or more.

[0053] A3. Using the absolute row number and absolute column number of each node in the first local logical syntax tree as keys, query the global node identifier of each node in the first local logical syntax tree in the global knowledge graph in the key-value storage table corresponding to the global knowledge graph, and take the node corresponding to the global node identifier in the global knowledge graph as the target difference node.

[0054] A4. Starting from the target difference node, traverse the global knowledge graph forward and backward along the call chain to determine the nodes and connecting edges that are related to the target difference node within the preset level. Based on the nodes and connecting edges, determine the business code to be detected and other code fragments affected by the code fragments in other business codes.

[0055] The technical solution provided in the above embodiments firstly performs line-level comparison to obtain line-level differences, and then performs secondary segmentation using the nodes of the logical syntax tree as the smallest unit to generate the first local logical syntax tree, upgrading the differences of code lines to differences of code units, avoiding false alarms of whole-line differences. In other words, a two-step difference extraction strategy of dual comparison analysis and node comparison analysis is adopted. First, dual comparison analysis is used to obtain the coarse-grained range of text-level changes of "file path + start / end line number", and then AST is used to refine the text differences to the fine-grained range of "syntactic entities", avoiding recalculation of the whole line or the whole file, and improving the positioning accuracy of the subsequent knowledge graph. Secondly, using the absolute row and column number as the key, the node ID is queried in the offline-built KV table. The node positioning can be completed without traversing the global knowledge graph, with a query complexity of O(1) and supporting millisecond-level response. In addition, starting from the target difference node, the preset level (such as 2-hop) is traversed bidirectionally along the call chain to realize the graph cascading traversal, which can automatically discover the downstream called methods and upstream callers, covering microservices and cross-repository scenarios. In summary, this embodiment not only solves the problems of coarse granularity, difficulty in cross-warehouse operations, and poor real-time performance of traditional solutions, but also provides accurate and low-latency input for large AI models through the combination of KV indexing and graph cascading, which can significantly improve the efficiency and accuracy of code anomaly analysis.

[0056] In an optional embodiment, A1 above involves performing a dual comparison analysis of code lines and code units on multiple original business codes and the business code to be detected to determine the added or deleted code ranges in the business code to be detected relative to the multiple original business codes, which are then used as target code segments. This includes: using a text difference analysis tool to perform a code line comparison analysis (Git diff) on the multiple original business codes and the business code to be detected from a text dimension, obtaining the difference lines of code between the business code to be detected and the multiple original business codes. The difference lines of code refer to the lines of code between the business code to be detected and the multiple original business codes that have differences. Text difference analysis tools include, but are not limited to: GNU-Diff, Git diff, Gotextdiff, DiffText, and DiffSui. Furthermore, using code unit diffing tools, a comparative analysis of difficated code lines is performed at the code unit level to obtain each difficated code unit within the difficated code line. Based on these difficated code units, the added or deleted code ranges of the business code to be detected relative to multiple original business codes are determined. A difficated code unit refers to the smallest code fragment in a difficated code line that differs from the business code to be detected and has independent semantics. Code unit diffing tools include, but are not limited to: Change-Distiller, GumTree, Tree-sitter diff, and Jsdiff.diffChars. Additionally, since multiple original business codes exist, modifications to these original business codes may involve modifications to each of them, or modifications to one or more of the original business codes. Therefore, when comparing difficated code lines and difficated code units, if not all original business codes have been modified, only the original business codes that have been modified need to be compared before and after modification; it is not necessary to compare all original business codes. The technical solution provided in this embodiment performs the line-level and code unit-level comparisons only on the original business code that has been modified. The comparison calculations are omitted for unmodified code files, which can significantly reduce the amount of calculation and significantly improve the efficiency and accuracy of code anomaly analysis.

[0057] In an optional embodiment, the construction of the first local logical syntax tree corresponding to the target code fragment in A2 above can be found in the relevant description of constructing each original business code above, and will not be repeated here. In addition, determining the absolute line number and absolute column number of each node in the first local logical syntax tree within its respective original business code includes: determining the starting offset of the modified target code segment in the original business code, where the starting offset includes the starting line number (L_start) and the starting column number (C_start), such as by parsing with Git diff or a text difference tool to obtain the starting line number and starting column number of the target code segment in the original business code, which can be regarded as starting coordinates; further, using a parser (such as Tree-sitter / GumTree / Change-Distiller, etc.) to parse the first local logical syntax tree, outputting the relative line number and relative column number for each node in the first local syntax tree, where the relative line number is the m-th row of the node within the segment, and the relative column number is the n-th column of the node within the segment; further, calculating the absolute line number and absolute column number according to the absolute coordinate conversion formula, where the absolute line number and absolute column number can be regarded as absolute coordinates, which are the line number and column number of the node in the first local logical syntax tree within the complete original business code, not just the relative position within the code segment. By using two-level positioning—starting offset and relative coordinates—unique, precise, and traceable absolute coordinates of each local logical syntax tree node within the original business code can be obtained without re-parsening the entire code file. The formula for calculating the absolute coordinates is as follows:

[0058] Absolute line number = starting line number + (relative line number - 1);

[0059] Absolute column number = starting column number + (relative row number - 1).

[0060] Optionally, the absolute row number and absolute column number can be used as keys to update the key-value table corresponding to the global knowledge graph, completing the coordinate mapping. This facilitates subsequent lookup of the global node identifiers of each node in the first local logical syntax tree within the global knowledge graph in the key-value storage table corresponding to the global knowledge graph. The node corresponding to the global node identifier in the global knowledge graph is then used as the target difference node. The key-value storage table is a coordinate-node ID index of the global knowledge graph, not the global knowledge graph itself. The difference node obtains the global node identifier through this index before traversing the global knowledge graph. The key-value storage table can be stored in Redis Hash, RocksDB KV, an index table from a relational database, or an in-memory dictionary. The key-value storage table can convert code location into a knowledge graph node ID in seconds, and its structure is simple.

[0061] In an optional embodiment, A3 above, using the absolute row number and absolute column number corresponding to each node in the first local logical syntax tree as keys, queries the global node identifier of each node in the first local logical syntax tree in the global knowledge graph in the key-value storage table corresponding to the global knowledge graph, and takes the node corresponding to the global node identifier in the global knowledge graph as the target difference node, includes: using the absolute row number and absolute column number of each node in the first local logical syntax tree as keys, querying the global node identifier of each node in the first local logical syntax tree in the global knowledge graph in the key-value storage table corresponding to the global knowledge graph; if a first node corresponding to the global node identifier in the global knowledge graph exists in the first local logical syntax tree, the first node is selected as the target difference node. The node in the global knowledge graph identified by the global node identifier corresponding to a node is taken as the first difference node. If there is a second node in the first local logical syntax tree that corresponds to a global node identifier that is not in the global knowledge graph, the global knowledge graph is updated based on the metadata of the second node. Using the absolute row number and absolute column number of the second node as keys, the global node identifier of each node in the incremental logical syntax tree in the updated global knowledge graph is queried in the key-value storage table corresponding to the updated global knowledge graph, and the node corresponding to the global node identifier is taken as the second difference node. The first difference node and the second difference node are integrated to obtain the target difference node corresponding to the global knowledge graph. The integration method can be merging and deduplication. The technical solution provided in this embodiment firstly uses absolute row and column numbers as unique index keys to quickly locate the corresponding node in the global knowledge graph within a key-value storage structure (such as a hash table or B+ tree, which is an efficient index). This avoids a full traversal of the global knowledge graph, ensuring efficient retrieval and significantly improving the efficiency of identifying difference nodes. Secondly, based on the retrieval results, it distinguishes between matched and unmatched nodes, ensuring the completeness of the difference analysis. Matched nodes are directly mapped to target difference nodes, ensuring the reuse of existing knowledge and reducing redundant computation. Unmatched nodes trigger incremental updates to the knowledge graph, ensuring that subsequent queries can correctly identify new nodes and enhancing the system's adaptability. Furthermore, for unmatched second nodes, the global knowledge graph is updated based on their metadata (such as code semantics and context information) so that they can be correctly retrieved subsequently. This avoids omissions in difference analysis due to the initial incompleteness of the global knowledge graph and supports incremental knowledge accumulation, adapting to code evolution and maintaining high-precision analysis capabilities over the long term.

[0062] In an optional embodiment, regarding A4 above, if there exists a second node in the first local logical syntax tree corresponding to a global node identifier that is not in the global knowledge graph, then the global knowledge graph is updated based on the metadata of the second node. Using the absolute row number and absolute column number of the second node as keys, the global node identifier of each node in the incremental logical syntax tree in the updated global knowledge graph is queried in the key-value storage table corresponding to the updated global knowledge graph, and the node corresponding to the global node identifier is taken as the second difference node. That is, when a node cannot be found in the coordinate-node ID index table, an incremental syntax tree parsing is triggered to generate the metadata (type, signature, position, etc.) of the node, and insert the node and its related connection edges into the global knowledge graph to achieve real-time completion of the knowledge graph. Triggering an incremental syntax tree parsing can be understood as performing a small AST parsing on demand. It is only necessary to extract the corresponding node information of the modified code fragment and put it into the database when a missing node is found, rather than re-parsing the entire file.

[0063] As described in the above embodiments, after obtaining the difference code information, the difference code information and the global knowledge graph can be input into an AI-based multi-dimensional anomaly analysis model. The multi-dimensional anomaly analysis model then performs anomaly analysis on the difference code information. To increase the diversity of code anomaly analysis within the multi-dimensional anomaly analysis model and improve its efficiency, thereby enhancing code detection efficiency, this embodiment provides a novel multi-dimensional anomaly analysis model based on the characteristics of the solution process. Figure 2a As shown, the multi-dimensional anomaly analysis model includes: a traffic splitter scheduler 1, a task processor 2, and an MCP tool scheduler 3. The task processor includes one or more modules selected from the following: a logical syntax tree construction module, a code structure analysis module, a code semantic analysis module, a code security analysis module, and a code style analysis module. The logical syntax tree construction module is used to construct the logical syntax tree; the code structure analysis module is used to analyze the code structure; the code semantic analysis module is used to analyze the code semantics; the code security analysis module is used to analyze code security; and the code style analysis module is used to analyze code style. It should be noted that even if the task processor contains all of the above modules, there may be situations where some modules cannot perform their functions under special or abnormal circumstances. For example, the task processor includes a code structure analysis module, but under special or abnormal circumstances, this module may be unable to perform code structure analysis tasks.

[0064] The traffic splitting scheduler is used to decompose the task description information into multiple subtasks and determine whether each module in the task processor can execute the corresponding subtask. The subtasks include: a logic syntax tree (LPTree) construction subtask and a multi-dimensional code exception analysis subtask. If the task processor cannot construct a LPTree for the exception code information, the traffic splitting scheduler sends a LPTree construction subtask to the MCP tool scheduler, so that the MCP tool scheduler can call the LPTree construction tool to construct a second local LPTree. The situations where the task processor cannot construct a LPTree for the exception code information include at least two categories: first, the task processor has no LPTree construction capability at all; second, the task processor has only limited LPTree construction capability. If the task processor cannot perform multi-dimensional code anomaly analysis on the second logical syntax tree, the flow scheduler decomposes the multi-dimensional code anomaly analysis subtask into multiple MCP scheduling subtasks and the execution logic relationships between the multiple MCP scheduling subtasks, and sends the multiple code anomaly analysis subtasks and the execution logic relationships to the MCP tool scheduler. This allows the MCP tool scheduler to call the corresponding MCP tools according to the execution logic relationships to collaboratively perform anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standards, respectively, to obtain the anomaly analysis results of the code to be detected. The situations where the task processor cannot perform multi-dimensional code anomaly analysis on the second logical syntax tree include at least the following two categories: first, the task processor has no ability to perform multi-dimensional code anomaly analysis on the second logical syntax tree at all; second, the task processor only has limited ability to perform multi-dimensional code anomaly analysis on the second logical syntax tree.

[0065] This embodiment does not limit the implementation method of the aforementioned traffic splitting scheduler sending subtasks to the MCP tool scheduler so that the MCP tool scheduler can call the corresponding MCP tool to perform the corresponding operation. The specific implementation method depends on whether the task processor has no capability or has a limited capability to process subtasks. For example, if the task processor has a limited capability to process subtasks, the traffic splitting scheduler can send subtasks directly or indirectly to the MCP tool scheduler through a module with the function of processing subtasks. This allows the MCP tool scheduler to call the corresponding MCP tool to the module with limited processing capability for the subtask. This allows the module and the MCP tool to combine and jointly complete the corresponding subtask. The combination of the module (model) and the tool can complete the corresponding subtask faster and better, improve the efficiency of subtask completion, and thus improve the efficiency of code anomaly detection and code repair. For example, when the task processor does not have the capability to process each subtask, the flow scheduler can directly send each subtask to the MCP tool scheduler, so that the MCP tool scheduler can call the corresponding MCP tool to execute the corresponding subtask in its own environment. There is no need to schedule the MCP tool to the corresponding functional module to execute the subtask, which reduces the scheduling process, improves the efficiency of subtask processing, and thus improves the efficiency of exception analysis and code repair.

[0066] The multi-dimensional anomaly analysis model architecture provided in the above embodiments, compared with existing large models, combined with the MCP protocol and MCP tools, can dynamically adjust the way the model calls various MCP tools in real time according to its own capabilities and the overall solution process. Moreover, through modular design to clarify the boundaries of responsibilities, intelligent scheduling to optimize resource allocation, and tool collaboration to make up for the shortcomings of large models, it ultimately achieves three core values: improved accuracy (covering multi-dimensional defects), efficiency (shortening the detection cycle), and scalability (flexible adaptation to new tools / dimensions) of code anomaly detection, providing key technical support for code quality assurance in development.

[0067] It should be noted that the model architecture, MCP tool scheduling, and working principle of the multi-dimensional anomaly model mentioned in the above embodiments are applicable to the multi-dimensional anomaly analysis performed by the multi-dimensional anomaly analysis model in the following embodiments, and will not be repeated in the following embodiments.

[0068] In some embodiments, the multi-dimensional anomaly analysis model corresponds to model hint words, which contain task description information. At least one MCP analysis tool includes a logical syntax tree construction tool, a code structure analysis tool, a code semantic analysis tool, a code security analysis tool, and a code style analysis tool. The difference code information and the global knowledge graph are input into the AI-based multi-dimensional anomaly analysis model. At least one MCP analysis tool provided by the MCP server is invoked. Based on the review rules adapted to the business code to be detected and the global knowledge graph, anomaly analysis is performed on the difference code from the dimensions of code structure, code semantics, code security, and unified code style, obtaining the anomaly analysis results corresponding to the code to be detected, including:

[0069] B1. Input the difference code information, global knowledge graph and model prompt words into the AI-based multi-dimensional anomaly analysis model. The multi-dimensional anomaly model decomposes the task based on the task description information to obtain multiple sub-tasks, including: the logical syntax tree construction sub-task and the multi-dimensional code anomaly analysis sub-task.

[0070] B2. If the large multi-dimensional anomaly analysis model cannot construct a logical syntax tree for the anomaly code information, then the logical syntax tree construction tool is called based on the MCP protocol to construct a second local logical syntax tree based on the difference code information. The second local logical syntax tree corresponds to an entity data set and an entity relationship data set.

[0071] B3. If the multi-dimensional anomaly analysis model cannot perform multi-dimensional code anomaly analysis on the second logical syntax tree, then the multi-dimensional anomaly analysis model, based on the MCP protocol, calls code structure analysis tools, code semantic analysis tools, code security analysis tools, and code style analysis tools. According to the review rules adapted to the business code to be tested and the global knowledge graph, it performs anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code style, respectively, to obtain the anomaly analysis results of the code to be tested. Specifically, the code result analysis dimension checks whether the business code conforms to preset architectural constraints, such as layering, decoupling, modularization, and structural complexity. Code semantic analysis checks whether the business code logic is incorrect, whether the types match, and whether resources are leaked. The output of code semantic analysis includes, but is not limited to: a list of type errors, unused variables, and unreachable paths. Code security analysis checks whether there are exploitable security flaws in the business code. The output of code security analysis includes, but is not limited to: SQL injection, XSS, command injection, and hard-coded sensitive information. Code style analysis checks whether the team's business code writing style is consistent to reduce maintenance costs. The output of code style analysis includes, but is not limited to: naming violations and missing comments.

[0072] The technical solution provided in the above embodiments adopts an on-demand incremental invocation strategy, triggering the corresponding MCP tool only when the large model cannot directly complete the sub-task. This expands the capabilities of the large model without wasting its own resources. Multiple MCP analysis tools collaborate with the multi-dimensional anomaly analysis large model, leveraging their respective strengths. The large model is responsible for overall task scheduling and preliminary analysis. When encountering specific problems, it invokes the corresponding MCP analysis tools for in-depth analysis. For example, the logic syntax tree construction tool focuses on building the logic syntax tree of the code, providing a basic structure for subsequent analysis, while other analysis tools analyze from different dimensions based on this syntax tree. This collaborative approach fully utilizes the functions of each tool, improving the performance and effectiveness of the entire code analysis system. Secondly, knowledge fusion is achieved between the multi-dimensional anomaly analysis large model, MCP analysis tools, and the global knowledge graph. The large model uses knowledge from the global knowledge graph for task decomposition and preliminary judgment. The MCP analysis tools can also refer to information from the global knowledge graph during the analysis process, while feeding back the analysis results to the large model, further enriching its knowledge system. This knowledge fusion enables the entire system to continuously learn and optimize, improving its ability to analyze code anomalies. Furthermore, regarding the adaptation of review rules, this implementation method can perform anomaly analysis based on review rules that are compatible with the business code to be inspected. This means it can flexibly adapt to different business needs and code environments, exhibiting strong compatibility. For example, different businesses may have different code specifications and security requirements, which can be adjusted according to these specific review rules to ensure the accuracy and effectiveness of the analysis results. Moreover, the method of using the MCP protocol to call various analysis tools has good scalability. If new analysis dimensions or tools need to be added in the future, it is only necessary to develop the corresponding tools according to the MCP protocol and integrate them into the system, without the need for large-scale modifications to the entire system architecture. This scalability allows the system to be continuously upgraded and improved as technology develops and business needs change.

[0073] In some optional embodiments, the above-mentioned B2, the multi-dimensional anomaly analysis large model, constructs a second local logical syntax tree based on the difference code information by calling the logical syntax tree construction tool based on the MCP protocol, including: calling the logical syntax tree construction tool based on the MCP protocol to perform lexical analysis on the difference code information based on preset lexical rules to obtain the ordered code unit sequence corresponding to the difference code information; and performing recursive descent parsing on the ordered code unit sequence based on preset syntax rules to construct the second local logical syntax tree. By directly invoking a dedicated logical syntax tree (LPBT) construction tool via the MCP protocol, and using preset rules in both the lexical and syntactic stages (rather than LLM statistical inference), the discriminant code information is ensured to be broken down into the smallest semantic units before recursive descent parsing. Experiments show that the node misalignment rate of the second local LPBT is less than 0.5%, which is 80% lower than that of the LLM-generated second local LPBT. Adding a new language only requires registering the corresponding lexical / syntactic rules on the MCP server, without retraining the large model or modifying plugins, shortening the expansion cycle from weeks to hours. Furthermore, this embodiment achieves high-precision, low-latency, and zero-downtime LPBT construction of discriminant code information through the MCP protocol and dedicated LPBT tool, providing reliable input for subsequent four-dimensional anomaly analysis. For a more specific implementation of the second local LPBT construction, please refer to the relevant description of LPBT construction in the above embodiments, which will not be repeated here.

[0074] In some optional embodiments, B3 above, based on the MCP protocol, invokes the code structure analysis tool, the code semantic analysis tool, the code security analysis tool, and the code standardization analysis tool. According to the review rules adapted to the business code to be detected and the global knowledge graph, it collaboratively performs anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standardization, respectively, to obtain the anomaly analysis result of the code to be detected. This includes: according to the type of MCP tool that the MCP server can provide, decomposing the multi-dimensional code anomaly analysis subtask into multiple MCP scheduling subtasks (i.e., subtasks mentioned above) and the execution logic relationship between the multiple MCP scheduling subtasks. Each MCP scheduling subtask corresponds to one of the MCP tools in the code structure analysis tool, the code semantic analysis tool, the code security analysis tool, and the code standardization analysis tool; and according to the execution logic relationship, invokes the corresponding MCP tool to collaboratively perform anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standardization, to obtain the anomaly analysis result of the code to be detected.

[0075] Optionally, the execution logic relationship includes: the serial-parallel relationship between multiple MCP scheduling subtasks and the execution conditions of downstream subtasks in the serial relationship. The execution condition is that the upstream subtask is in a specific execution state, which may be that the difference code information in the anomaly analysis result indicates that there is an anomaly or that the difference code information does not have an anomaly. The serial-parallel relationship includes at least the following situations: all MCP scheduling subtasks form a serial relationship, all MCP scheduling subtasks form a parallel relationship, and each MCP scheduling subtask has both serial and parallel relationships. The serial relationship may be that an MCP scheduling subtask is executed first, and then the execution result of the MCP scheduling subtask determines whether to execute the next task. The MCP scheduling subtasks are serially related, and the execution result or execution state of the previous one determines whether the next subtask is started. Figure 2b This is an exemplary diagram illustrating the sequential relationship between all MCP scheduling subtasks. The code structure analysis result or execution status determines whether to execute the next code semantic analysis task. If the code structure analysis result indicates anomalies in the differential code information, the subsequent MCP scheduling subtasks can be skipped to avoid unnecessary anomaly analysis operations. If the code structure analysis result indicates no anomalies in the differential code information, the subsequent MCP scheduling subtasks can be executed to ensure anomaly analysis is performed on all dimensions of the code difference information, improving the quality and completeness of code anomaly analysis. The sequential order between the MCP scheduling subtasks is not limited and can be determined according to actual needs. Figure 2c This is an exemplary diagram illustrating the parallel relationship between all MCP scheduling subtasks. The parallel relationship means that the MCP scheduling subtasks are connected in parallel, and the anomaly analysis results of each dimension do not affect the execution of other MCP scheduling subtasks. Figure 2dThis is an exemplary diagram illustrating the serial-parallel relationships formed by all MCP scheduling subtasks. The presence of both serial and parallel relationships within each MCP scheduling subtask means that each MCP scheduling subtask includes parallel branches, with at least one parallel branch containing serial MCP scheduling subtasks. These parallel branches are independent of each other. The code structure analysis results or execution status within the parallel branches containing serial MCP scheduling subtasks determine whether to execute the next code semantic analysis task. If the code structure analysis results indicate anomalies in the difference code information, subsequent MCP scheduling subtasks can be skipped to avoid unnecessary anomaly analysis operations. If the code structure analysis results do not indicate anomalies in the difference code information, subsequent MCP scheduling subtasks can be executed further to ensure anomaly analysis is performed on all dimensions of the code difference information, improving the quality and completeness of code anomaly analysis, thereby improving the accuracy of code repair. The serial order of the MCP scheduling subtasks within the parallel branches containing serial MCP scheduling subtasks is not limited and can be determined according to actual needs. According to the execution logic relationship, the corresponding MCP tools are invoked to perform anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standardization, respectively, to obtain the anomaly analysis result of the code to be detected. This includes: executing the multiple MCP scheduling subtasks sequentially according to the serial-parallel relationship; before executing any MCP scheduling subtask in the serial relationship, determining whether the execution state of its upstream MCP scheduling subtask is a specific execution state in the execution condition; if yes, then executing any MCP scheduling subtask; if no, then skipping any MCP scheduling subtask; when executing any MCP scheduling subtask, invoking the MCP tool corresponding to any MCP scheduling subtask to perform anomaly analysis on the differential code information from the corresponding dimension, to obtain the anomaly analysis result corresponding to any MCP scheduling subtask; summarizing the anomaly analysis results corresponding to the executed MCP scheduling subtasks to obtain the anomaly analysis result of the code to be detected. Therefore, the serial-parallel relationship between multiple MCP scheduling subtasks, as well as the execution conditions of downstream subtasks in the serial relationship, enrich the scheduling scheme of multiple MCP scheduling subtasks, improve the quality and completeness of code anomaly analysis, and thus improve the accuracy of code repair.

[0076] In an optional embodiment, the review rules include a preset comprehensive structural complexity threshold and a set of code structure review rule body relationship data. When executing any MCP scheduling subtask, the MCP tool corresponding to the MCP scheduling subtask is invoked to perform anomaly analysis on the differential code information from the corresponding dimension to obtain the anomaly analysis result corresponding to the MCP scheduling subtask. This includes: if the MCP tool corresponding to the MCP scheduling subtask is a code structure analysis tool, the code structure analysis tool is invoked to calculate at least one first structural complexity index of the global knowledge graph. The at least one structural complexity index includes: decision node complexity, nesting depth complexity, coupling complexity, or cohesion complexity. The decision node complexity is calculated based on the query results of each function node in the global knowledge graph querying the number of decision nodes containing related relationships. The nesting depth complexity is calculated based on the longest path length from each code block node in the global knowledge graph to its deepest leaf node. The coupling complexity is calculated based on the number of connection edges that are related to various types of nodes in the global knowledge graph. The cohesion complexity is calculated based on the ratio of the number of connection edges established between method nodes within various types of nodes in the global knowledge graph through call relationships to the total number of all external connection edges of that type. Based on at least one first structural complexity index, the first comprehensive structural complexity of the global knowledge graph is calculated. The global knowledge graph is updated based on the entity data set and entity relationship set corresponding to the second local logical syntax tree. Based on the updated global knowledge graph, the second comprehensive structural complexity of the updated global knowledge graph is calculated. The calculation methods for the first and second comprehensive structural complexities include, but are not limited to: weighted summation, variance calculation, and mean calculation of the multi-dimensional complexity. With a preset comprehensive structural complexity threshold as a reference, based on the first comprehensive structural complexity, anomaly analysis is performed on the second comprehensive structural complexity, and the anomaly analysis result is used as an anomaly analysis result corresponding to the code to be detected. For example, when the difference between the first and second comprehensive structural complexities is greater than a preset comprehensive structural complexity threshold, an anomaly analysis result is obtained indicating that the difference in code information is abnormal. The difference between the first and second comprehensive structural complexities can characterize the increment of the difference in code information in the code structure dimension; conversely, an anomaly analysis result is obtained indicating that the difference in code information is not abnormal.The technical solution provided in this embodiment firstly, starts with multiple indicators reflecting code structural complexity, calculates the comprehensive structural complexity based on the complexity corresponding to each indicator, and uses this as the structural complexity of the global knowledge graph, which can improve the reference value of the global knowledge graph's structural complexity. Secondly, compared with traditional static analysis tools, this solution updates the global knowledge graph by constructing a second local logical syntax tree from incremental code, realizing dynamic updates of the global knowledge graph. It eliminates the need to construct the global knowledge graph based on all updated business code each time incremental business code appears, improving the construction efficiency of the global knowledge graph, thereby improving the efficiency of code anomaly analysis and code development. Furthermore, two comprehensive structural complexity calculations are performed, referencing the first comprehensive structural complexity, to analyze whether the increment of the difference code information in the code structure dimension is abnormal, thus determining the anomaly analysis result. This second approach, compared to determining the anomaly analysis result through a single structural complexity calculation, significantly improves the accuracy of anomaly analysis, thereby improving the accuracy of code repair and code development efficiency.

[0077] In another optional embodiment, the review rules include a preset comprehensive structural complexity threshold and a set of code structure review rule body relation data. Then, when executing any MCP scheduling subtask, the MCP tool corresponding to any MCP scheduling subtask is invoked to perform anomaly analysis on the differential code information from the corresponding dimension, to obtain the anomaly analysis result corresponding to any MCP scheduling subtask. This includes: if the MCP tool corresponding to any MCP scheduling subtask is a code structure analysis tool, invoking the code structure analysis tool to parse the first-level structure between nodes and the first relation structure between nodes in the global knowledge graph; updating the global knowledge graph based on the entity data set and entity relation set corresponding to the second logical syntax tree, and parsing the second-level structure of each node and the second relation structure between nodes in the updated global knowledge graph; using the first-level structure and the first relation structure as a reference, analyzing whether the second-level structure and the second relation structure conform to the code structure review rules, and using this anomaly analysis result as an anomaly analysis result corresponding to the code to be detected. The hierarchical structure represents the hierarchical position of entities (classes, methods, packages) in the inheritance hierarchy, call chain, and directory organization. It is used to measure the logical nesting depth and organizational rationality of the code, and serves as the baseline structure for anomaly detection. The hierarchical relationship describes the associations between entities, including call, inheritance, and dependency relationships, along with accompanying information such as call frequency and dependency strength. This is used to analyze the rationality of dynamic interactions in the code structure and to detect abnormal changes (such as missing critical calls or broken inheritance relationships). For example, if the difference between the hierarchical structure of the first level and the second level exceeds a preset hierarchical structure difference threshold, and the difference between the relationship structure of the first and second relationship structures exceeds a relationship structure difference threshold, an anomaly analysis result is obtained indicating that there is an anomaly in the difference code information. The structural difference between the first and second levels can represent the increment of the difference code information in the code structure dimension; conversely, an anomaly analysis result is obtained indicating that there is no anomaly in the code difference information. Compared to traditional static analysis tools, the technical solution provided in this embodiment updates the global knowledge graph by constructing a second local logical syntax tree from incremental code, achieving dynamic updates of the global knowledge graph. This eliminates the need to construct the global knowledge graph based on all updated business code each time incremental business code appears, improving the construction efficiency of the global knowledge graph. Consequently, it enhances the efficiency of code anomaly analysis and code development. Furthermore, it performs two statistical analyses of hierarchical structure and relationships, referencing the first hierarchical structure and relationships, to analyze whether the incremental changes in differential code information in the code structure dimension are abnormal, thereby determining the anomaly analysis results. This significantly improves the accuracy of anomaly analysis compared to determining anomaly analysis results through a single hierarchical structure and relationships, thereby increasing the accuracy of code repair and code development efficiency.

[0078] In another optional embodiment, anomaly analysis can be performed on the code to be detected by combining the implementation methods of the above two embodiments. The review rules include a preset comprehensive structural complexity threshold and a set of code structure review rule body relationship data; then, when executing any MCP scheduling subtask, the MCP tool corresponding to any MCP scheduling subtask is invoked to perform anomaly analysis on the differential code information from the corresponding dimension to obtain the anomaly analysis result corresponding to any MCP scheduling subtask, including: if the MCP tool corresponding to any MCP scheduling subtask is a code structure analysis tool, the code structure analysis tool is invoked to perform anomaly analysis on the second comprehensive structural complexity based on the preset comprehensive structural complexity threshold as a reference to obtain a first anomaly analysis result, and to analyze whether the second hierarchical structure and the second relational structure conform to the code structure review rules based on the second anomaly analysis result, and to perform comprehensive anomaly analysis to obtain the target anomaly analysis result of the business code to be detected. For example, if both the first and second anomaly analysis results are abnormal, then the code to be detected is abnormal. If the first and second anomaly analysis results are opposite, the anomaly analysis result of the business code to be detected is determined based on the magnitude of the difference between the first and second comprehensive structural complexity exceeding a preset comprehensive structural complexity threshold, the magnitude of the difference between the first and second hierarchical structures exceeding a preset hierarchical structure difference threshold, and the magnitude of the difference between the first and second relational structures exceeding a relational structure difference threshold. The above technical solution provided in this embodiment, compared to traditional business code detection that relies solely on a single structural complexity threshold to determine anomalies, or only compares hierarchical / relational structure differences, upgrades the misjudgment scenario from a single threshold to a three-dimensional threshold joint decision-making process, improving the accuracy of anomaly analysis results and thus improving the efficiency of code repair and development.

[0079] In one optional embodiment, the review includes code semantic review rules; then, when executing any MCP scheduling subtask, the MCP tool corresponding to any MCP scheduling subtask is invoked to perform anomaly analysis on the differential code information from the corresponding dimension to obtain the anomaly analysis result corresponding to any MCP scheduling subtask, including: if the MCP tool corresponding to any MCP scheduling subtask is a code semantic analysis tool, the code semantic analysis tool is invoked to parse the first graph semantic information contained in the global knowledge graph; the global knowledge graph is updated based on the entity data set and entity relationship set corresponding to the second local logical syntax tree, and the second graph semantic information contained in the updated global knowledge graph is parsed; with the first graph semantic information as a reference, the second graph semantic information is analyzed to determine whether it conforms to the code semantic review rules to obtain the anomaly analysis result corresponding to the code to be detected, wherein the graph semantic information includes the semantic depth information of the business code. By integrating a dynamically updated global knowledge graph with configurable semantic review rules, a precise, in-depth, efficient, and interpretable code semantic anomaly analysis mechanism is achieved. This surpasses the limitations of traditional syntax checking and proactively identifies deep semantic issues affecting system architecture, design consistency, and long-term maintainability, providing strong technical support for ensuring the code quality and architectural health of large and complex software systems. The technical solution provided in this embodiment uses the pre-update global knowledge graph (first graph semantic information) as the baseline context and the updated global knowledge graph (second graph semantic information) as the change context, achieving dynamic review with a global business perspective as the reference. This enables the review process to understand the semantic changes before and after code modifications, resulting in more context-sensitive and accurate review results. Code semantic review rules, as independent configuration items, decouple the review logic from the analysis engine, allowing for the determination of appropriate rules based on actual needs. Instead of rebuilding the entire knowledge graph for each review, this solution employs an incremental update strategy, merging only local information (entity data sets and entity relationship sets) of the code to be inspected into the existing global knowledge graph. This significantly reduces computational overhead, making real-time or near-real-time deep semantic reviews possible during the development process (such as CI / CD pipelines and before code submission). Furthermore, since anomaly analysis is based on a comparison of changes in the global knowledge graph, the review results naturally possess complete contextual information. The system not only reports "an anomaly is present" but also clearly explains "why it is an anomaly," such as "this method call violates rule X because it introduces a dependency on module Y, which is defined in the architecture as inaccessible to the current module." This interpretability greatly facilitates developers' understanding and fixing of problems, shortening the cycle of problem localization and resolution.

[0080] Optionally, a code semantic analysis tool is invoked to parse the first graph semantic information contained in the global knowledge graph. This includes: invoking the code semantic analysis tool to send a query command to the graph database of the global knowledge graph to locate the target node in the global knowledge graph corresponding to the business code to be detected; traversing the adjacent edges of the target node to obtain the set of entity relationships directly associated with the business code to be detected; reading the attributes of the target node and associated nodes to construct a set of related code entity attributes, including access modifiers, definition locations, and type information; calculating graph metrics related to the business code to be detected based on the connection relationships of the target node in the global knowledge graph, including coupling degree, fan-in number, and fan-out number; and encapsulating the extracted set of entity relationships, set of entity attributes, and graph metrics into structured context snapshot data as the first graph semantic information for subsequent comparative analysis with the semantic information after code changes.The technical solution provided in this embodiment, by directly interacting with the graph database and executing targeted queries, can accurately and efficiently locate the specific position of the code to be detected within a large business scope, and completely extract its direct and indirect semantic relationships before changes. This ensures that the "benchmark" (first graph semantic information) upon which subsequent analysis is based is accurate and comprehensive, avoiding misjudgments caused by missing or incorrect contextual information. The extracted first graph semantic information not only includes explicit structural relationships (such as calls and inheritance), but also integrates key entity attributes (such as access level and type) and quantified structural metrics (such as coupling degree and fan-out number). This multi-dimensional information integration provides rich context for code semantic analysis, enabling the analysis results to go beyond surface syntax and delve into the structural complexity and design quality of the code. This implementation method is based on standardized graph query languages ​​(such as Cypher) and the high performance of graph databases. The entire parsing process can be highly automated and executed quickly, easily meeting the analysis needs of large codebases. Furthermore, with the development of graph database technology... Its performance and scalability can be continuously improved, providing technical feasibility for integration into continuous integration / continuous deployment (CI / CD) pipelines. The extracted information is encapsulated into structured contextual snapshot data, providing a clear and comparable data format for subsequent steps (such as analyzing the "second graph semantic information" after code changes). This snapshot mechanism is the core of change impact analysis, enabling clear identification of semantic changes brought about by code modifications (such as which calls were added, which dependency rules were broken, and how much complexity was increased), thereby accurately locating potential anomalies or risks. Compared to traditional static analysis tools based on regular expressions or simple logical syntax tree traversal, it achieves deep semantic understanding across files and modules by utilizing a global knowledge graph. This allows it to discover deep-seated problems hidden in complex dependencies, violating architectural design or coding standards, greatly improving the depth, breadth, and intelligence of code review. This provides an accurate data foundation for generating code repair suggestions, thereby improving the accuracy and efficiency of code repair.

[0081] In one optional embodiment, the review rules include code security review rules; when executing any MCP scheduling subtask, the MCP tool corresponding to any MCP scheduling subtask is invoked to perform anomaly analysis on the differential code information from the corresponding dimension to obtain the anomaly analysis result corresponding to any MCP scheduling subtask, including: if the MCP tool corresponding to any MCP scheduling subtask is a code security analysis tool, the code security analysis tool is invoked to update the global knowledge graph based on the entity data set and entity relationship set corresponding to the second local logical syntax tree; query the multi-dimensional information contained in the updated global knowledge graph; wherein, the multi-dimensional information includes: input verification information, authentication and authorization information, sensitive data information, encryption protocol information, deserialization information, concurrency race state information, resource management information, and supply chain dependency information; with reference to the code security review rules, anomaly analysis is performed on the input verification information, authentication and authorization information, sensitive data information, encryption protocol information, deserialization information, concurrency race state information, resource management information, and supply chain dependency information to obtain the anomaly analysis result of the code to be detected. By dynamically integrating the code to be detected into a global knowledge graph and systematically querying and analyzing security information covering eight key dimensions—input, authentication, data, encryption, deserialization, concurrency, resources, and supply chain—within this complete context, and combining configurable security rules for automated comparison, a precise, comprehensive, in-depth, and efficient code security anomaly analysis mechanism is achieved. This improves the accuracy of detection results, providing an accurate data foundation for generating code remediation suggestions, thereby enhancing the accuracy and efficiency of code remediation.

[0082] Input validation information refers to the information reflected in the processing logic related to external input data (such as user input, API parameters, file read content, network request bodies, etc.) in the business code logic. This information is used to determine whether the code has the risk of injection vulnerabilities (such as SQL injection, command injection, XSS cross-site scripting). Input validation information includes, but is not limited to: whether there is type checking of input data (such as type conversion, assertion), whether there is boundary checking of input data (such as length, numerical range), whether there is format validation of input data (such as regular expression matching, JSON schema validation), whether there is content filtering or purification of input data (such as escaping special characters, removing malicious scripts), and whether there is whitelist / blacklist validation of input data. A business scenario example is as follows: In an e-commerce platform, if parameters such as product ID or quantity included in a user's order submission are not strictly validated, it may lead to unauthorized access to the database or modification of other users' order data.

[0083] Authentication and authorization information refers to the information reflected in the processing logic related to the identity verification (authentication) and access control (authorization) of system users or services within the code logic. This information is used to determine whether the code has security risks such as unauthorized access (horizontal / vertical unauthorization), authentication bypass, or session fixation. Authentication information includes, but is not limited to: whether authentication interfaces (such as login, token verification) are called, whether secure authentication protocols (such as OAuth 2.0, OpenID Connect) are used, and session management mechanisms (such as session creation, destruction, and expiration). Authorization information includes, but is not limited to: whether permission checks are performed before critical operations (such as hasRole(), hasPermission() calls), the permission model used (such as RBAC, ABAC), and the granularity of permission verification (method level, data level). A business scenario example is as follows: In financial service applications, users at different levels (customers, administrators) should have different permissions to access account information. A lack of effective authentication and authorization mechanisms may allow unauthorized personnel to obtain sensitive data.

[0084] Sensitive data refers to information involved in the processing, storage, or transmission of Personal Information Intake (PII), financial information, identity credentials, or other protected data within the code logic. This information is used to identify data breach risks and whether data protection regulations (such as GDPR and CCPA) are met. Sensitive data includes, but is not limited to: sensitive data types explicitly or implicitly manipulated in the code (such as String password, CreditCardNumber, and SSN objects); the storage location of sensitive data (such as whether it is stored in plaintext in logs, configuration files, or databases); the transmission method of sensitive data (such as whether it is transmitted via HTTP in plaintext); and security operations performed on sensitive data (such as whether anonymization, masking, or encryption are performed). This information is used to identify data breach risks and whether data protection regulations (such as GDPR and CCPA) are met. A business scenario example is as follows: A medical information system processes patient health records and personal data, and measures must be taken to ensure the security of this data to avoid privacy issues and social trust crises caused by leaks.

[0085] Encryption protocol information refers to the configuration and usage information related to data encryption, decryption, and secure communication protocols in the code logic. This information is used to assess the strength and compliance of the encryption implementation, identify the risks of using weak algorithms (such as MD5, SHA1, DES) or insecure protocols (such as SSLv3), and includes, but is not limited to: the encryption algorithm used (such as AES, RSA, DES) and its key length (such as AES-256), the encryption mode used (such as CBC, GCM) and padding method, the secure communication protocol used (such as TLS / SSL) and its version (such as TLS1.2, TLS1.3), and the key management method (such as hardcoding, keystore, key management service KMS). A business scenario example is as follows: Online education platforms need to ensure that the content of communication between students and teachers, as well as tuition payment information, is not intercepted or tampered with during transmission over the network.

[0086] Deserialization information refers to the process and contextual information involved in restoring serialized data (such as byte streams, JSON, and XML) back to objects within the code logic. This information is crucial for identifying deserialization vulnerabilities (which can lead to Remote Code Execution (RCE)). Deserialization information includes, but is not limited to: the deserialization APIs called (such as Java's ObjectInputStream.readObject()), the input source of the deserialization operation (such as network streams, files, or user uploads), whether the target type of deserialization is strictly restricted (such as a whitelist mechanism), and whether a secure deserialization library or patch is used (such as using jackson-databind's @JsonType Info for type constraints). A business scenario example is as follows: If communication between microservices uses insecure object serialization / deserialization mechanisms, attackers can construct malicious objects to execute arbitrary commands, affecting the stability of the entire system.

[0087] Concurrency race condition information refers to the synchronization and coordination mechanism information related to access to shared resources in multi-threaded, asynchronous, or distributed environments. This information is used to identify race conditions, deadlocks, and thread safety issues. Concurrency race condition information includes, but is not limited to: access points to shared mutable state (such as static variables, instance variables, and caches); the synchronization mechanisms used (such as the `synchronized` keyword, `ReentrantLock`, and `Semaphore`); the existence of critical sections without adequate lock protection; whether thread-unsafe collection classes (such as `ArrayList` and `HashMap`) are used in a multi-threaded environment; and the existence of deadlock risks (such as nested locks and inconsistent lock order). A business scenario example is as follows: In a distributed inventory management system, under high-concurrency ordering, if concurrent access is not handled properly, overselling may occur, meaning that more goods than are actually in stock are sold.

[0088] Resource management information refers to the management information regarding the allocation, use, and release of system resources (such as file handles, database connections, network sockets, and memory) in the code logic. This information is used to identify the risk of resource leaks, which may lead to system performance degradation or crashes. Resource management information includes, but is not limited to: resource creation / opening operations (such as `new FileInputStream()`), resource closing / release operations (such as `close()`, `shutdown()` calls), whether resource release is executed in the correct code block (such as in a `finally` block or a `try-with-resources` statement), and whether there are potential paths for resource leaks (such as exceptions causing `close()` not to execute). A business scenario example is as follows: Game servers need to effectively manage resources such as memory and CPU to cope with a large number of players online simultaneously. Improper resource management may cause server crashes and affect user experience.

[0089] Supply chain dependency information refers to information about third-party libraries, frameworks, or components that a business relies on, along with their security status. This information is used to assess software supply chain security risks and identify third-party components that use known vulnerabilities (CVEs) or non-compliant licenses. Supply chain dependency information includes, but is not limited to: library names and version numbers declared in the business dependency manifest (such as Maven's pom.xml or npm's package.json), transitive dependencies, known security vulnerabilities of the dependent libraries (obtained by querying vulnerability databases such as NVD and Sonatype OSS Index), license information and compliance of the dependent libraries, the source of the dependent libraries (such as official repositories or private repositories), and integrity verification (such as SHA-256 hashes). A business scenario example is as follows: In a microservice architecture, various services may depend on multiple external open-source libraries. For example, a public library for logging is found to have a serious vulnerability, and your service directly or indirectly depends on this library. In this case, even if your own code is not problematic, it may still be vulnerable to attack due to the dependent third-party components.

[0090] In the microservice architectures of the aforementioned business scenarios, services are typically loosely coupled and highly distributed, with each service potentially having its own dependency chain. This increases potential security risks, as a problem with any third-party library used by a microservice could impact the entire system. Therefore, a detailed security review of the supply chain dependencies is crucial. For example, dependency update monitoring: automated tools can help track the latest versions and security announcements of all dependencies in real time, ensuring timely updates to versions that fix known vulnerabilities; dependency graph construction: building a complete dependency network based on a global knowledge graph facilitates quick identification and assessment of the impact of changes to a dependency on the overall system; dependency security assessment: performing security checks on every new or updated dependency, including but not limited to source credibility, license compliance, and the presence of publicly known security vulnerabilities. In summary, conducting comprehensive code security reviews across these eight dimensions not only helps improve the security capabilities of individual applications but is also an indispensable part of ensuring the stable operation of the entire ecosystem for complex distributed systems like microservices.

[0091] In addition, regarding code security, scattered security rules can be integrated through a global knowledge graph, specifically including the following processes. The rule mapping process is as follows: The set of security rules is mapped to a security rule subgraph structure in the knowledge graph. This subgraph contains three types of core nodes: rule nodes, detection nodes, and trigger condition nodes. Hierarchical associations are achieved by constructing two types of semantic edges: a classification edge (OWASP_CATEGORY) is established between rule nodes and detection nodes to define the rule classification relationship; a trigger condition edge (CONDIT ION) is established between detection nodes and trigger condition nodes to represent the triggering mechanism of the detection logic. This structure forms a tree-like knowledge network with a clear semantic hierarchy. The semantic definition of the trigger condition edge is: when a code entity meets a specific trigger condition, the activation of this edge triggers the corresponding detection node, thereby driving the execution of the security rule. The graph cascading process is as follows: When responding to a business code commit event, the code security analysis tool provided by the MCP server is invoked to construct or update the anomaly subgraph in the knowledge graph in real time. This anomaly subgraph contains trigger condition edges between code entity nodes and rule nodes, used to represent the abnormal association relationship between code entities and security rules. The anomaly localization process is as follows: Millisecond-level precise localization of cross-warehouse security anomaly chains is achieved based on graph query statements, supporting rapid tracing of the anomaly root cause. The dynamic update process is as follows: When security rule versions are upgraded, incremental updates to the security rule subgraph are achieved by importing standardized rule packages (such as JSON-LD format rule packages). This mechanism supports zero-downtime hot-swapping of the toolchain, enabling dynamic maintenance of the rule system without restarting.

[0092] In an optional embodiment, the review rules further include code style review rules, and the unified code style dimensions include: entity writing style dimension and entity relationship writing style dimension; when executing any MCP scheduling subtask, the MCP tool corresponding to any MCP scheduling subtask is invoked to perform anomaly analysis on the difference code information from the corresponding dimension to obtain the anomaly analysis result corresponding to any MCP scheduling subtask, including: if the MCP tool corresponding to any MCP scheduling subtask is a code style analysis tool, the code style analysis tool is invoked to analyze the writing style of multiple original business codes from the entity writing style dimension and entity relationship writing style dimension based on the global knowledge graph and multiple original business codes; based on the second local logical syntax tree and the difference code information, the writing style of the difference code information is analyzed from the entity writing style dimension and entity relationship writing style dimension; with the writing style of multiple original business codes as a reference, the writing style of the difference code information is analyzed to determine whether it conforms to the code style review rules, so as to obtain the anomaly analysis result of the code to be detected. By leveraging a global knowledge graph, a level-based style benchmark is automatically learned from historical business code and used to conduct consistency reviews of newly added or modified code (difference code information) in two dimensions: entity writing and entity relationships. This achieves an intelligent, context-aware, adaptive, and efficient code style anomaly analysis mechanism that transcends the limitations of static rule matching. It effectively ensures the style consistency, readability, and architectural consistency of the codebase over long-term evolution, which is beneficial to the accuracy of detection results. This provides an accurate data foundation for generating code repair suggestions, thereby improving the accuracy and efficiency of code repair.

[0093] Optionally, analysis can be performed from the perspective of entity writing standards, including: querying entities belonging to multiple original business codes in the global knowledge graph, and conducting statistical analysis on the naming patterns, structural features, and format attributes of entities to identify naming conventions, structural constraints, and format preferences; naming pattern analysis includes statistically analyzing the frequency distribution of the first word of method names; structural feature analysis includes statistically analyzing the distribution of the number of lines and parameters of methods; and format attribute analysis includes statistically analyzing the usage ratio of access modifiers and preset annotations. Analysis can also be performed from the perspective of entity relationship writing standards, including: querying the semantic relationships connecting entities belonging to multiple original business codes in the global knowledge graph, and performing pattern recognition on dependency patterns, architectural layering, and design patterns between entities to identify dependency rules, layering conventions, and common patterns; dependency pattern analysis includes statistically analyzing the call frequency between different packages or modules; architectural layering analysis includes verifying whether the call relationship conforms to the preset unidirectional dependency hierarchy; and design pattern recognition includes detecting the existence of factory patterns or observer patterns based on preset relationship patterns. Based on the results of statistical analysis and pattern recognition, a project-level style benchmark model representing the overall writing style of multiple original business codes is constructed and stored. This project-level style benchmark model serves as a reference for subsequent standardization consistency reviews of newly added code. By automating the analysis of historical code in the global knowledge graph, and performing statistical analysis and pattern mining from the two core dimensions of entity writing and entity relationships, a project-level style benchmark model that truly reflects the coding habits of the project is dynamically constructed. This achieves intelligent, precise, and adaptive code standard review, effectively ensuring the code consistency, readability, and architectural health of large software projects in the long-term evolution. It also contributes to the accuracy of the detection results, thus providing an accurate data foundation for generating code repair suggestions, thereby improving the accuracy and efficiency of code repair.

[0094] Optionally, based on the second local logical syntax tree and the difference code information, the writing style of the difference code information is analyzed from the dimensions of entity writing specifications and entity relationship writing specifications. This includes: locating the set of change nodes related to code changes in the second local logical syntax tree based on the line number range of the difference code information. Further, analysis is performed from the dimension of entity writing specifications, including: identifying nodes representing entities from the change node set, extracting the entity's name, structural features, and format attributes to form a set of changed entity writing features; structural features include the number of method lines and parameters; format attributes include access modifiers and annotations. Further, analysis is performed from the dimension of entity relationship writing specifications: identifying nodes representing semantic relationships from the change node set, extracting the entity relationships introduced or modified by this code change to form a set of changed entity relationship features; semantic relationships include function calls, class inheritance, interface implementations, and new dependencies; analysis includes determining whether the added calls or dependencies violate preset architectural layering rules, format writing rules, and language writing rules; the set of changed entity writing features and the set of changed entity relationship features are encapsulated as difference code style analysis results for subsequent consistency comparison with the project-level style benchmark model. By accurately locating the position of code changes in the local logical syntax tree and systematically extracting structured style features from two dimensions—entity writing and entity relationships—a highly efficient, accurate, and in-depth change style analysis method is achieved. This provides key input data for automated, context-aware code style consistency reviews, which is beneficial to the accuracy of detection results. Consequently, it provides an accurate data foundation for generating code repair suggestions, thereby improving the accuracy and efficiency of code repair.

[0095] Optionally, referencing the writing styles of multiple original business codes, the analysis examines whether the writing styles of the differing code information conform to code style review rules to obtain anomaly analysis results for the code to be tested. This includes: obtaining the difference code style analysis results and code style review rule set corresponding to the business code to be tested; the difference code style analysis results include a set of changed entity writing features and a set of changed entity relationship features. Further, the change entity writing feature set is validated, including: comparing the name of the changed code entity with naming conventions to determine if it conforms to naming standards; comparing the structural features of the changed code entity with structural constraints to determine if it conforms to structural standards; and checking whether the format attributes of the changed code entity violate the format rules in the code style review rule set. Further, the change entity relationship feature set is validated, including: comparing the entity relationships introduced by the change with dependency rules and layering conventions to determine if they conform to architectural standards; and checking whether the entity relationships introduced by the change violate the dependency rules in the code style review rule set. Based on the comparison and validation results, anomaly analysis results for the code to be tested are generated. The anomaly analysis results include a compliance determination, a violation rule identifier, and detailed anomaly description information. By automating the comparison of the style characteristics of differing code with project-level style benchmarks and preset standard rules, an intelligent, accurate, and interpretable code style compliance analysis is achieved. It not only efficiently identifies non-compliant code changes but also provides detailed remediation basis, effectively ensuring the code quality, style consistency, and architectural health of software projects during continuous integration. This improves the accuracy of the detection results, providing an accurate data foundation for generating code remediation suggestions, thereby increasing the accuracy and efficiency of code remediation.

[0096] Optionally, after obtaining the repaired business code, it can be automatically re-input into the AI-based multi-dimensional anomaly analysis model. The multi-dimensional anomaly analysis model calls at least one MCP analysis tool provided by the MCP server. Based on the review rules and global knowledge graph adapted to the business code to be detected, it performs anomaly analysis on the difference code information from the dimensions of code structure, code semantics, code security, and unified code specifications, obtains the corresponding anomaly analysis results, and terminates the subsequent operations when the anomaly analysis results indicate that there are no anomalies in the code to be detected, and outputs the repaired business code.

[0097] To facilitate code anomaly analysis for the code to be fixed in the next version upgrade of the target business and improve the efficiency of code anomaly analysis, after obtaining the fixed business code, the global knowledge graph can be updated based on the fixed business code and stored in the corresponding storage space.

[0098] At this point, the code anomaly analysis method has been executed, achieving the ability to handle large-scale codebases and complex business logic, adapt to complex logic and diverse programming styles, and fully support cross-language and cross-file dependency analysis. This enables efficient, accurate, and real-time code detection, improving the overall quality of software development and operational stability.

[0099] To facilitate understanding, the following will be combined with... Figure 2e The overall process of the above technical solution is described.

[0100] like Figure 2e As shown, during the modification of multiple original codes under the target business, when there is a need for code anomaly detection, the code detection plugin or code detection application (including the code detection plugin) can send the Nth code anomaly detection task to the modified original business code to be detected, activate the code detection plugin and connect to the MCP server, so that the following automated full process can be executed through the code detection plugin to perform code anomaly detection. The anomaly detection task contains multiple original business codes (the repaired code corresponding to the N-1 code anomaly detection task).

[0101] During code anomaly detection using the code inspection plugin, available languages, rule sets, and a global knowledge graph (the global knowledge graph obtained from the last version upgrade of the target business) can be loaded. The desired target language and review rules can be selected from these. The target language can be used for code repair to ensure that the modified code language is consistent with the original code language. The review rules are used for analysis during code inspection. The global knowledge graph can also be built in real time based on the global syntax tree of multiple original business codes.

[0102] Furthermore, based on the global knowledge graph, multi-dimensional anomaly analysis is performed on the business code to be detected, including: code structure anomaly analysis, code semantic anomaly analysis, code security anomaly analysis, and code rule anomaly analysis, to obtain anomaly analysis results.

[0103] Furthermore, based on the anomaly analysis results, code repair suggestions described in natural language can be generated. Additionally, the code anomaly analysis process described in natural language, along with the anomaly analysis results, can be used to generate code repair suggestions described in natural language.

[0104] Furthermore, the code anomaly analysis process and code repair suggestions, both described in natural language, can be displayed on the interface for developers to review. Based on these suggestions, developers can determine whether to accept the code repair recommendations. If accepted, the code will be automatically repaired based on the recommendations; if not accepted, developers can manually modify and upload the revised code.

[0105] Furthermore, the modified code can be automatically checked and repaired repeatedly based on the above process until the code is no longer abnormal.

[0106] Furthermore, the global knowledge graph is updated based on the repaired code to facilitate the N+1th code anomaly detection task for multiple original business codes under the target business.

[0107] Figure 3 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. For example... Figure 3 As shown, the electronic device includes: a memory 30a and a processor 30b; the memory 30a is used to store computer programs; the processor 30b is coupled to the memory 30a and is used to execute the computer programs to implement the steps in the above method.

[0108] The detailed implementation methods and beneficial effects of each module in the embodiments of this application have been described in detail in the foregoing embodiments, and will not be elaborated here.

[0109] Furthermore, such as Figure 3 As shown, the electronic device also includes other components such as a communication component 30c, a display 30d, a power supply component 30e, and an audio component 30f. Figure 3 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 3 The components shown. Additionally... Figure 3 The components within the dashed box are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a terminal device such as a desktop computer, laptop computer, smartphone, or IoT device, or a server-side device such as a conventional server, cloud server, or server array. If the electronic device in this embodiment is a terminal device such as a desktop computer, laptop computer, or smartphone, it may include... Figure 3 The components within the dashed box; if the electronic device in this embodiment is implemented as a conventional server, cloud server, or server array, etc., it may be omitted. Figure 3 The component within the dashed box.

[0110] The aforementioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0111] The aforementioned communication components are configured to facilitate wired or wireless communication between the device containing the communication components and other devices. The device containing the communication components can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 6G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication components receive broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication components also include a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), and other technologies.

[0112] The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0113] The aforementioned power supply components provide power to various components within the device in which they reside. These power supply components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device in which they reside.

[0114] The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0115] Accordingly, exemplary embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to implement the steps in the above-described method.

[0116] Accordingly, an exemplary embodiment of this application also provides a computer program product comprising a computer program / instructions that, when executed by a processor, cause the processor to perform the steps in the above-described method.

[0117] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0118] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0119] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0121] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0122] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0123] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0125] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A code anomaly analysis method, characterized in that, A code detection plugin based on an AI large model is applied, and the code detection plugin is developed based on the MCP protocol and can call various MCP tools for code detection provided by the MCP server; the method includes: Receive the business code to be detected, the business code to be detected belongs to the target business, the target business is associated with a global knowledge graph, the global knowledge graph is constructed based on the logical syntax tree of multiple original business codes under the target business; Based on the multiple original business codes and the global knowledge graph, the target code fragments that have changed in the business code to be detected, as well as other code fragments in the business code to be detected and other business codes that are affected by the target code fragments, are identified as differential code information. The difference code information and the global knowledge graph are input into an AI-based multi-dimensional anomaly analysis model. At least one MCP analysis tool provided by the MCP server is invoked. Based on the review rules adapted to the business code to be detected and the global knowledge graph, the difference code information is analyzed collaboratively from the dimensions of code structure, code semantics, code security, and unified code specifications to obtain the anomaly analysis results corresponding to the code to be detected. If the anomaly analysis results indicate that the code to be detected is abnormal, an AI-based repair suggestion model is invoked to generate at least a code repair suggestion described in natural language based on the anomaly analysis results and preset code repair rules. The code repair suggestions and the difference code information are input into the AI-based code repair model, and the MCP repair tool provided by the MCP server is invoked to repair the difference code information based on the code repair suggestions to obtain the repaired business code.

2. The method according to claim 1, characterized in that, Based on the multiple original business codes and the global knowledge graph, the target code segments that have changed in the business code to be detected, as well as other code segments in the business code to be detected and other business codes that are affected by the code segments, are identified as differential code information, including: A dual comparison analysis of code lines and code units is performed on the multiple original business codes and the business code to be detected to determine the added or deleted code range of the business code to be detected relative to the multiple original business codes, which is taken as the target code segment; wherein, the code unit refers to the smallest code segment with independent semantics; Construct a first local logical syntax tree corresponding to the target code fragment, and determine the absolute line number and absolute column number of each node in the first local logical syntax tree in its respective original business code; Using the absolute row number and absolute column number corresponding to each node in the first local logical syntax tree as keys, query the global node identifier of each node in the first local logical syntax tree in the global knowledge graph in the key-value storage table corresponding to the global knowledge graph, and take the node corresponding to the global node identifier in the global knowledge graph as the target difference node. Starting from the target difference node, the global knowledge graph is traversed forward and backward along the call chain to determine the nodes and connecting edges that are related to the target difference node within a preset level. Based on the nodes and connecting edges, other code segments in the business code to be detected and other business codes that are affected by the code segment are determined.

3. The method according to claim 2, characterized in that, Using the absolute row number and absolute column number corresponding to each node in the first local logical syntax tree as keys, query the global node identifier of each node in the first local logical syntax tree in the global knowledge graph from the key-value storage table corresponding to the global knowledge graph, and take the node corresponding to the global node identifier in the global knowledge graph as the target difference node, including: Using the absolute row number and absolute column number of each node in the first local logical syntax tree as keys, query the global node identifier of each node in the first local logical syntax tree in the global knowledge graph in the key-value storage table corresponding to the global knowledge graph; If a first node corresponding to a global node identifier in the global knowledge graph is found in the first local logical syntax tree, the node in the global knowledge graph identified by the global node identifier corresponding to the first node is taken as the first difference node. If there is a second node in the first local logical syntax tree that corresponds to a global node identifier that is not in the global knowledge graph, then the global knowledge graph is updated based on the metadata of the second node; using the absolute row number and absolute column number of the second node as keys, the global node identifier of each node in the incremental logical syntax tree in the updated global knowledge graph is queried in the key-value storage table corresponding to the updated global knowledge graph, and the node corresponding to the global node identifier is taken as the second difference node; By integrating the first difference node and the second difference node, the target difference node corresponding to the global knowledge graph is obtained.

4. The method according to claim 1, characterized in that, The multi-dimensional anomaly analysis model corresponds to model hint words, which contain task description information. The at least one MCP analysis tool includes a logical syntax tree construction tool, a code structure analysis tool, a code semantic analysis tool, a code security analysis tool, and a code standardization analysis tool. The differential code information and the global knowledge graph are input into the AI-based multi-dimensional anomaly analysis model. At least one MCP analysis tool provided by the MCP server is invoked. Based on the review rules adapted to the business code to be detected and the global knowledge graph, anomaly analysis is performed collaboratively on the differential code information from the dimensions of code structure, code semantics, code security, and unified code standardization to obtain the anomaly analysis results corresponding to the code to be detected, including: The differential code information, the global knowledge graph, and the model prompt words are input into the AI-based multi-dimensional anomaly analysis model. The multi-dimensional anomaly model decomposes the task based on the task description information to obtain multiple sub-tasks, including: the logical syntax tree construction sub-task and the multi-dimensional code anomaly analysis sub-task. If the multi-dimensional anomaly analysis model cannot construct a logical syntax tree for the anomaly code information, then the logical syntax tree construction tool is called based on the MCP protocol to construct a second local logical syntax tree based on the difference code information. The second local logical syntax tree corresponds to an entity data set and an entity relationship data set. If the multi-dimensional anomaly analysis model cannot perform multi-dimensional code anomaly analysis on the second logical syntax tree, then based on the MCP protocol, the code structure analysis tool, the code semantic analysis tool, the code security analysis tool, and the code standard analysis tool are invoked. According to the review rules adapted to the business code to be detected and the global knowledge graph, anomaly analysis is performed on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standard, respectively, to obtain the anomaly analysis results of the code to be detected.

5. The method according to claim 4, characterized in that, The multi-dimensional anomaly analysis model, based on the MCP protocol, calls a logic syntax tree construction tool to construct a second local logic syntax tree based on the difference code information, including: The logical syntax tree construction tool based on the MCP protocol performs lexical analysis on the difference code information based on preset lexical rules to obtain the ordered code unit sequence corresponding to the difference code information; Based on preset syntax rules, the ordered code unit sequence is recursively parsed in a descent manner to construct a second local logical syntax tree.

6. The method according to claim 4, characterized in that, Based on the MCP protocol, the code structure analysis tool, the code semantic analysis tool, the code security analysis tool, and the code standardization analysis tool are invoked. According to the review rules adapted to the business code to be detected and the global knowledge graph, anomaly analysis is performed collaboratively on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standardization, respectively, to obtain the anomaly analysis results of the code to be detected, including: According to the types of MCP tools that the MCP server can provide, the multi-dimensional code anomaly analysis subtask is broken down into multiple MCP scheduling subtasks and the execution logic relationship between the multiple MCP scheduling subtasks. Each MCP scheduling subtask corresponds to one of the MCP tools in the code structure analysis tool, the code semantic analysis tool, the code security analysis tool, and the code specification analysis tool. According to the execution logic relationship, the corresponding MCP tool is invoked to perform anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standard, so as to obtain the anomaly analysis results of the code to be detected.

7. The method according to claim 6, characterized in that, The execution logic relationship includes: the serial-parallel relationship between the multiple MCP scheduling subtasks, and the execution conditions of the downstream subtask in the serial relationship, wherein the execution condition is that the upstream subtask is in a specific execution state; According to the execution logic, the corresponding MCP tool is invoked to perform anomaly analysis on the second local logical syntax tree from the dimensions of code structure, code semantics, code security, and unified code standardization, respectively, to obtain the anomaly analysis results of the code to be detected, including: The multiple MCP scheduling subtasks are executed sequentially according to the serial-parallel relationship. Before executing any MCP scheduling subtask in the serial relationship, it is determined whether the execution state of its upstream MCP scheduling subtask is a specific execution state in the execution condition. If yes, then any MCP scheduling subtask is executed; otherwise, any MCP scheduling subtask is skipped. When executing any of the MCP scheduling subtasks, the MCP tool corresponding to any of the MCP scheduling subtasks is invoked to perform anomaly analysis on the difference code information from the corresponding dimension, so as to obtain the anomaly analysis result corresponding to any of the MCP scheduling subtasks. The anomaly analysis results corresponding to the executed MCP scheduling subtasks are summarized to obtain the anomaly analysis results of the code to be detected.

8. The method according to claim 7, characterized in that, The review rules include a preset comprehensive structural complexity threshold and a set of code structure review rule body relationship data; when executing any MCP scheduling subtask, the MCP tool corresponding to any MCP scheduling subtask is invoked to perform anomaly analysis on the differential code information from the corresponding dimension, so as to obtain the anomaly analysis result corresponding to any MCP scheduling subtask, including: If the MCP tool corresponding to any MCP scheduling subtask is the code structure analysis tool, the code structure analysis tool is invoked to calculate at least one first structural complexity index of the global knowledge graph. The at least one structural complexity index includes: decision node complexity, nesting depth complexity, coupling complexity, or cohesion complexity. Based on the at least one first structural complexity index, the first comprehensive structural complexity of the global knowledge graph is calculated. The global knowledge graph is updated based on the entity data set and entity relationship set corresponding to the second local logical syntax tree. Based on the updated global knowledge graph, the second comprehensive structural complexity is calculated. With the preset comprehensive structural complexity threshold as a reference, based on the first comprehensive structural complexity, anomaly analysis is performed on the second comprehensive structural complexity, and the anomaly analysis result is used as an anomaly analysis result corresponding to the code to be detected. and / or The code structure analysis tool is invoked to parse the first-level structure and the first relationship structure between nodes in the global knowledge graph; the global knowledge graph is updated based on the entity data set and entity relationship set corresponding to the second logical syntax tree, and the second-level structure and the second relationship structure between nodes in the updated global knowledge graph are parsed; with the first-level structure and the first relationship structure as a reference, the second-level structure and the second relationship structure are analyzed to see if they conform to the code structure review rules, and the anomaly analysis result is taken as an anomaly analysis result corresponding to the code to be detected.

9. The method according to claim 7, characterized in that, The review rules include code semantic review rules; when executing any of the MCP scheduling subtasks, the MCP tool corresponding to any of the MCP scheduling subtasks is invoked to perform anomaly analysis on the differential code information from the corresponding dimension, so as to obtain the anomaly analysis results corresponding to any of the MCP scheduling subtasks, including: If the MCP tool corresponding to any MCP scheduling subtask is the code semantic analysis tool, the code semantic analysis tool is invoked to parse the first graph semantic information contained in the global knowledge graph; the global knowledge graph is updated based on the entity data set corresponding to the second local logical syntax tree and the entity relationship set, and the second graph semantic information contained in the updated global knowledge graph is parsed; with the first graph semantic information as a reference, the second graph semantic information is analyzed to determine whether it conforms to the code semantic review rules, so as to obtain the anomaly analysis result corresponding to the code to be detected.

10. The method according to claim 7, characterized in that, The review rules include code security review rules; when executing any of the MCP scheduling subtasks, the MCP tool corresponding to any of the MCP scheduling subtasks is invoked to perform anomaly analysis on the differential code information from the corresponding dimension, so as to obtain the anomaly analysis results corresponding to any of the MCP scheduling subtasks, including: If the MCP tool corresponding to any MCP scheduling subtask is a code security analysis tool, the code security analysis tool is invoked to update the global knowledge graph based on the entity data set and the entity relationship set corresponding to the second local logical syntax tree. The updated global knowledge graph contains multi-dimensional information, including: input verification information, authentication and authorization information, sensitive data information, encryption protocol information, deserialization information, concurrency race conditions information, resource management information, and supply chain dependency information. Based on the code security review rules, anomaly analysis is performed on the input verification information, authentication and authorization information, sensitive data information, encryption protocol information, deserialization information, concurrency race condition information, resource management information, and supply chain dependency information to obtain the anomaly analysis results of the code to be detected.

11. The method according to claim 7, characterized in that, The review rules include code style review rules, and the unified code style dimensions include: entity writing style dimension and entity relationship writing style dimension; when executing any of the MCP scheduling subtasks, the MCP tool corresponding to any of the MCP scheduling subtasks is invoked to perform anomaly analysis on the difference code information from the corresponding dimensions, so as to obtain the anomaly analysis results corresponding to any of the MCP scheduling subtasks, including: If the MCP tool corresponding to any MCP scheduling subtask is a code style analysis tool, the code style analysis tool is invoked to analyze the writing style of the multiple original business codes from the perspectives of entity writing style and entity relationship writing style, based on the global knowledge graph and the multiple original business codes. Based on the second local logical syntax tree and the difference code information, the writing style of the difference code information is analyzed from the dimensions of entity writing specifications and entity relationship writing specifications. Using the writing styles of the multiple original business codes as a reference, analyze whether the writing styles of the differing code information conform to the code specification review rules, so as to obtain the anomaly analysis results of the code to be detected.

12. The method according to any one of claims 1-11, characterized in that, After obtaining the fixed business code, it also includes: The repaired business code is input into an AI-based multi-dimensional anomaly analysis model. The multi-dimensional anomaly analysis model calls at least one MCP analysis tool provided by the MCP server. Based on the review rules adapted to the business code to be detected and the global knowledge graph, it performs anomaly analysis on the discrepancy code information from the dimensions of code structure, code semantics, code security, and unified code specifications to obtain the corresponding anomaly analysis results. If the anomaly analysis results indicate that the code to be detected does not have any anomalies, the subsequent operations are terminated, and the repaired business code is output.

13. An electronic device, characterized in that, include: Memory and processor; The memory is used to store a computer program; the processor, coupled to the memory, is used to execute the computer program to implement the steps of the method of any one of claims 1-12.

14. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it causes the processor to perform the steps of any one of claims 1-12.

15. A computer program product, characterized in that, The computer program product includes a computer program / instruction that, when executed by a processor, causes the processor to perform the steps of any one of claims 1-12.

Images