A dynamic and static cooperative full-link intelligent analysis and verification method based on a large language model and an MCP protocol

Abstract

The application belongs to the cross field of network space security, software engineering and artificial intelligence, and discloses a kind of dynamic and static cooperative type vulnerability full-link intelligent analysis and verification method based on large language model and MCP protocol, comprising: S1: task initialization and context construction;S2: target code depth analysis and static stain pre-analysis;S3: Fuzzing Harness directional generation and iterative optimization based on stain path;S4: dynamic and static cooperative sandbox execution and dynamic stain tracking;S5: vulnerability accessibility determination and report output of multi-source data fusion.The application method adopts dynamic and static combination mechanism, and can automatically complete vulnerability analysis and verification for software target code, providing accurate technical support for vulnerability risk grading and repair priority sorting.

Description

Technical Field

[0001] This application belongs to the interdisciplinary field of cyberspace security, software engineering and artificial intelligence, and in particular relates to a dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and the MCP protocol. Background Technology

[0002] With the increasing prominence of software supply chain security risks, the number of vulnerability disclosures in open-source components and commercial software is growing exponentially. Vulnerability analysis and verification has become a core component of cybersecurity protection. Its core objective is to determine whether disclosed / discovered vulnerabilities in target software can be triggered in a real-world operating environment, clarifying whether the execution path of the vulnerable function is reachable and whether the vulnerability triggering conditions are met. This is the core basis for distinguishing between "theoretical risks" and "real threats" and for formulating vulnerability remediation strategies. Currently, mainstream vulnerability analysis and verification methods are mainly divided into two categories, both of which have significant technical limitations.

[0003] Static analysis and verification methods: Based on techniques such as Control Flow Graph (CFG), Data Flow Analysis, and Abstract Syntax Tree (AST), this method uses static code scanning to parse function call relationships and data flow paths to determine the reachability of vulnerability points. This method does not require running code and has high analysis efficiency, but it has core drawbacks: It is highly prone to false positives (false reachability) and false negatives (false unreachability) when dealing with complex indirect calls, runtime constraints, and multi-branch nested logic; it requires manually writing analysis rules adapted to different code scenarios, resulting in extremely high rule maintenance costs when dealing with codebases using multiple programming languages ​​and architectures; and it cannot simulate the dependency differences and system call constraints of real-world operating environments, leading to a significant disconnect between the analysis results and actual operating scenarios.

[0004] The manual-driven dynamic analysis and verification method involves security experts manually analyzing the call logic of vulnerable functions, writing fuzzing harnesses, setting up simulated runtime environments, and verifying whether the vulnerability can be triggered through fuzz testing. While this method offers high accuracy, it suffers from significant engineering bottlenecks: extremely low verification efficiency (manual processing of hundreds of vulnerabilities in large codebases can take weeks or even months, failing to meet the vulnerability incident response needs of large-scale software clusters); high dependence on individual expert experience (significant differences in harness writing and path coverage design capabilities among different personnel lead to inconsistent judgments); and the difficulty for manually written harnesses to fully cover function context dependencies, boundary conditions, and branch paths, resulting in inadequate verification and misjudgments.

[0005] In recent years, large language models have demonstrated powerful capabilities in code semantic understanding, automated generation, and logical reasoning. The emergence of intelligent agent technology has enabled atomic task scheduling, standardized tool invocation, and end-to-end context passing, providing a technological foundation for intelligent vulnerability analysis and verification. However, existing technologies still lack systematic solutions: most fuzzing solutions based on large models only reach the Harness single-point generation stage, failing to form a closed-loop process of "code parsing—generation—execution—judgment," thus unable to achieve end-to-end automated vulnerability reachability analysis. Furthermore, they struggle to deeply integrate static and dynamic methods to adapt to the vulnerability analysis and verification needs of complex scenarios. Summary of the Invention

[0006] The purpose of this application is to overcome the problems of existing technologies and disclose a dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on large language model and MCP protocol. Based on vulnerability analysis and verification technology, with LLM as the core inference engine, it realizes end-to-end automated verification of vulnerability reachability through automated generation of fuzzing harm and dynamic execution in sandbox.

[0007] The objective of this application is achieved through the following technical solution:

[0008] A dynamic-static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and the MCP protocol, comprising:

[0009] S1: Task initialization and context construction, receiving user input parameters, completing the basic information configuration of the verification task, defining dynamic and static collaborative analysis rules and initializing the analysis environment, establishing a standardized task context channel through the MCP protocol, and completing the basic foundation construction of the entire task chain;

[0010] S2: Deep analysis of target code and pre-analysis of static taints. It calls the code analysis tools and static taint analysis tools that are connected to the MCP protocol to complete the structural analysis of the target code, the extraction of vulnerability-related functions and call chains, and the definition of taint sources and taint convergence points, the analysis of taint propagation paths and the screening of reachable path sets. The structured code features and taint propagation link information are written into the task context through the MCP protocol.

[0011] S3: Fuzzing Harness Targeted Generation and Iterative Optimization Based on Tainted Paths. Based on the objective function information and static taint propagation path set in the MCP context, the code generation tool is called to dynamically generate Fuzzing Harness code containing a Mock environment, targeted payload generation logic, taint marking entry point, and exception handling mechanism. After compilation verification and logic optimization, the context is passed through the MCP protocol.

[0012] S4: Dynamic and static collaborative sandbox execution and dynamic taint tracking. Based on the MCP context, the optimized Harness code is obtained, and the sandbox execution tool and dynamic taint tracking tool are called to complete the fuzz test execution of Harness in an isolated environment. Full runtime data, including execution path, taint propagation trajectory, abnormal events, and crash information, is collected in real time. Based on the dynamic execution results, a feedback optimization closed loop is formed. The path blocking information and taint propagation breakpoints are sent back to the Harness generation stage through the MCP protocol to complete targeted optimization. Iterative execution continues until the termination condition is met.

[0013] S5: Vulnerability reachability determination and report output through multi-source data fusion. It integrates static taint analysis results, dynamic taint tracking data, and full fuzz test execution data from the MCP context, calls analysis tools to complete multi-dimensional logical reasoning and hierarchical determination of vulnerability reachability, generates a structured, fully traceable vulnerability analysis and verification report, and completes the closed loop of the entire analysis and verification process.

[0014] According to a preferred embodiment, in step S1, receiving user input parameters includes: target code library path, vulnerability analysis target, and task configuration parameters. The vulnerability analysis target includes: CVE number, vulnerable function address, risk call chain, and vulnerability principle description. The task configuration parameters include: sandbox environment specifications, fuzzing execution duration, path coverage threshold, target programming language and CPU architecture, and maximum number of iteration rounds.

[0015] In step S1, the definition of dynamic and static collaborative analysis rules includes: based on vulnerability principles and target code characteristics, static taint analysis rules are automatically generated through LLM, including taint source definitions, taint convergence point definitions, and taint propagation rule definitions. Simultaneously, the granularity, instrumentation scope, and monitoring rules for dynamic taint tracing are configured. The taint source definitions include: defining user-controllable input, network interface input, external file input, and command-line parameters. The taint convergence point definitions include: defining vulnerability-sensitive operation functions, memory operation APIs, system call interfaces, and dangerous function execution points. The taint propagation rule definitions include: defining assignment operations, function parameter passing, pointer operations, and array copy propagation scenarios.

[0016] In step S1, the analysis environment initialization includes: calling the environment configuration tool interface through the MCP protocol to complete the target code library retrieval, dependency environment deployment, static / dynamic analysis tools, fuzzing engine and sandbox environment pre-verification; if the environment deployment is abnormal, an alarm log is generated and the process is terminated; after the verification is passed, the environment status information is written to the MCP context, and the target code deep analysis and static taint pre-analysis corresponding to step S2 are automatically triggered.

[0017] According to a preferred embodiment, step S2 includes:

[0018] Context reading: Read the target code library path, analysis target, environment information and taint analysis rules in the task context through the MCP protocol to determine the scope and core objectives of code analysis;

[0019] Tool Invocation and Code Analysis: Standardized code analysis tools are invoked via the MCP protocol to perform in-depth analysis of the target code based on abstract syntax trees, control flow graphs, function call graphs, and data flow graphs, automatically extracting core information: the prototype of the target function associated with the vulnerability, the upstream and downstream call chains of the function, sensitive API call points, input data flow paths, runtime dependencies and context constraints, branch judgment logic and conditional expressions;

[0020] Flow-sensitive static taint analysis: By calling the static taint analysis tool through the MCP protocol, based on predefined taint sources, sinks, and propagation rules, and employing context-sensitive, flow-sensitive, and field-sensitive cross-function taint analysis algorithms, a full taint propagation chain analysis is completed. The full taint propagation chain analysis includes: tracing the complete propagation path of taints from source nodes to sink nodes, identifying branch nodes, data dependencies, and constraints on the path, filtering out unreachable dead paths and invalid paths, and finally generating a set of taint reachable paths, clarifying the triggering conditions, dependencies, and branch constraints of each path.

[0021] Information structuring and context passing: The extracted code feature information, static taint analysis rules, taint reachable path set, and branch constraints are standardized to generate an objective function information table, call relationship graph, taint propagation link graph, and reachable path list. The corresponding information is incrementally written into the task context through the MCP protocol. The integrity of core information is verified synchronously. If there is missing objective function information or invalid taint path, supplementary analysis is triggered. After the information is complete, the startup of the fuzzing harness generation based on the taint path in step S3 is automatically triggered.

[0022] According to a preferred embodiment, step S3 includes:

[0023] Context reading: Read the target function prototype, call chain, data dependencies, runtime constraints, static taint reachable path set, and branch constraints in the task context through the MCP protocol to clarify the core requirements and targeted optimization objectives generated by Harness;

[0024] Targeted Harness Automated Generation: By calling an LLM-based code generation tool via the MCP protocol, and guided by a static taint reachable path set, Fuzzing Harness code is dynamically generated to adapt to the target function and taint propagation scenario.

[0025] Harness Iterative Optimization: Based on LLM, the generated Harness code undergoes syntax verification, compilation feasibility analysis, logical integrity verification, and path coverage optimization. If there are compilation errors, logical defects, or incomplete coverage of tainted paths, additional information and tainted path details of the target code are obtained through the MCP protocol to complete multiple rounds of iterative optimization until Harness code that can be compiled normally, has no logical defects, and fully covers the core tainted paths is generated.

[0026] Context passing: The final optimized Harness code, compilation configuration, payload generation rules, and taint marking configuration information are incrementally written into the task context via the MCP protocol, automatically triggering the start of the dynamic and static collaborative sandbox execution and dynamic taint tracking corresponding to step S4.

[0027] According to a preferred embodiment, in step S3, the targeted Harness automated generation content includes:

[0028] Target function call logic: Generate standardized function call entry points based on function prototypes, accurately adapt to input parameter types, quantities and calling conventions, and cover all function call chains in the taint reachable path set;

[0029] Mock environment: Automatically generates mock logic for external dependencies, global variables, system calls, upstream and downstream interfaces, and context constraints on taint propagation paths required for function execution, fully simulating the execution context of the real runtime environment and ensuring the executability of taint propagation paths;

[0030] Payload generation logic: Based on the taint source type and branch constraints on the path, an integrated structured fuzz test payload generation module is used to support dynamic generation of boundary values, outliers, malformed data, and directional inputs that meet the branch constraint conditions.

[0031] Tag entry logic: Built-in taint tagging interface adapted to dynamic taint tracking tools, automatically injecting taint tags into the input payload to ensure that the entire propagation trajectory of taint data can be fully tracked during dynamic execution;

[0032] Exception capture and monitoring logic: Built-in capture mechanisms for typical exceptions such as segmentation faults, memory out-of-bounds errors, null pointer references, use after free, and double free vulnerabilities, and synchronously integrated real-time monitoring and log output logic for execution path, register status, memory layout, and crash stack.

[0033] According to a preferred embodiment, step S4 includes:

[0034] Context reading: Read the Harness code, compilation configuration, task execution parameters, static taint reachable path set, and taint marking configuration in the task context via the MCP protocol to clarify execution requirements, monitoring rules, and termination conditions;

[0035] Sandbox environment initialization: The sandbox execution tool is invoked through the MCP protocol to build an isolated sandbox environment based on lightweight containerization or hardware-assisted virtualization methods. This completes the compilation of Harness code, deployment of dependency libraries, integration of the fuzzing engine and dynamic taint tracking tool, and configuration of resource isolation, network isolation, and system call restriction rules.

[0036] Dynamic execution and full-link data collection: Harness execution is started in an isolated sandbox. Based on compile-time instrumentation or runtime instrumentation, dynamic taint tracing is started simultaneously, and full runtime data is collected in real time, including: code execution path coverage information, branch hit status, function call sequence, full-link propagation trajectory of taint data, memory operation behavior, register state changes, and complete context of exception / crash events.

[0037] Feedback optimization through dynamic and static coordination: Real-time analysis of execution data to form a closed-loop optimization mechanism;

[0038] Context passing: The collected full runtime data, dynamic taint tracking logs, execution logs, crash files, path coverage reports, and iteration optimization records are structured and incrementally written into the task context via the MCP protocol, automatically triggering the start of the vulnerability reachability determination of the multi-source data fusion corresponding to S5.

[0039] According to a preferred embodiment, in step S4, the closed-loop optimization mechanism includes:

[0040] If dynamic taint tracking confirms that taint data has been completely propagated to the vulnerability aggregation point and a crash / anomaly matching the vulnerability principle is captured, execution will be terminated immediately and the task will be marked as "pending judgment".

[0041] If dynamic taint tracking finds that taint propagation is blocked in a preset branch or that the core taint path is not covered, the blocking location, branch condition expression, current payload information, and path coverage gap are automatically sent back to the Harness generation stage via the MCP protocol. The LLM optimizes the payload generation logic and Mock environment based on the branch constraints, regenerates the targeted Harness, and performs iterative verification until the taint reaches the convergence point, the coverage meets the threshold, or the maximum number of iterations is reached.

[0042] If an abnormal sandbox environment occurs or Harness execution crashes due to a non-target vulnerability, the system will automatically retry or send back the abnormal information via the MCP protocol, triggering compatibility optimization in the Harness generation process.

[0043] According to a preferred embodiment, step S5 includes:

[0044] Context reading: Read the context data of the entire task process through the MCP protocol, including the static analysis results of the target code, the set of static taint reachable paths, Harness code, full data of dynamic taint tracing, fuzz test execution logs, exception and crash information, and iteration optimization records;

[0045] Multi-source data fusion and in-depth analysis: By calling data fusion and analysis tools through the MCP protocol, multi-dimensional data from static analysis and dynamic execution are fused to complete in-depth correlation analysis: the matching degree between static taint propagation paths and dynamic execution paths, the complete propagation of taint data from source to convergence point, the fulfillment of vulnerability triggering conditions, the correlation between abnormal / crash events and vulnerability principles, whether input data flows to vulnerability-sensitive operation points, the core reasons for path blocking and the possibility of breakthrough;

[0046] Reachability classification: Based on the logical reasoning capabilities of LLM and combined with multi-dimensional analysis results, the vulnerability reachability is accurately classified and determined, and four standardized classification results are output to confirm reachability, conditional reachability, potential reachability and unreachability.

[0047] Results storage and report generation: The judgment results, full-link evidence data, and static / dynamic analysis original files are written into a relational database; at the same time, a standardized vulnerability reachability verification report is automatically generated. The report module includes: basic task information, target code and vulnerability overview, description of the dynamic and static collaborative analysis process, reachability judgment conclusion, vulnerability triggering conditions, complete taint propagation path, execution path diagram, evidence attachments, remediation priority suggestions, and remediation solution reference.

[0048] Task closure: The core information of the report and the final judgment result are written into the task context through the MCP protocol, the task execution status is updated to "completed", and the whole process verification task ends.

[0049] According to a preferred embodiment, in step S5:

[0050] Confirmed reachability: Static taint analysis shows a complete propagation path, dynamic taint tracing confirms that taint data has been propagated completely from the source node to the vulnerability aggregation point, and a stable crash / abnormal event that perfectly matches the vulnerability principle has been captured, clearly marking the vulnerability triggering conditions, complete execution path, taint propagation link and impact scope;

[0051] Conditions are met: Static taint analysis shows that there is an effective propagation path, and dynamic taint tracking confirms that the taint can reach the vulnerability convergence point, but specific runtime conditions, environment configuration, permission requirements or input combinations must be met to trigger the vulnerability. The preconditions and scenario constraints for triggering are marked.

[0052] Potential reach: Static taint analysis reveals potential propagation paths, and the vulnerable function can be hit during dynamic execution, but the taint has not been fully propagated to the vulnerability-sensitive operation point. There is a possibility of triggering under specific boundary conditions or special inputs. Core risk points are marked and supplementary verification suggestions are provided.

[0053] Unreachable: Static taint analysis shows no effective taint propagation path, or dynamic execution has insurmountable branch blockages, unmet compilation conditions, missing runtime dependencies, permission constraints, or other core limitations, clearly indicating the root cause of unreachability.

[0054] According to a preferred embodiment, in step S5, the relational database supports multi-dimensional queries, including queries by CVE number, vulnerability level, reachability status, target component, and scope of impact.

[0055] The aforementioned main solution and its various further alternative solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed in this application. Those skilled in the art, after understanding the solution of this application, will realize that there are many combinations based on the prior art and common general knowledge, all of which are technical solutions to be protected in this application, and will not be exhaustively listed here.

[0056] This application constructs an LLM-driven intelligent agent for vulnerability analysis and verification, achieving an end-to-end automated closed loop for vulnerability analysis and verification based on atomic agent skills and the MCP protocol. This addresses the core pain points of existing technologies and offers the following significant benefits and advantages compared to traditional methods:

[0057] 1. Based on "atomic agent skills + MCP standardized protocol", the entire process of vulnerability analysis and verification is automated and collaborative, which greatly reduces the cost of manual intervention. At the same time, through standardized context passing and tool calling specifications, the problems of fragmentation and insufficient collaborative capabilities of existing technical processes are solved, and the consistency and reproducibility of verification results are significantly improved.

[0058] 2. Based on LLM-driven automated fuzzing harness generation technology, it can dynamically generate adapted test code based on the semantic and structural features of the target function, automatically complete the construction of the mock environment, payload logic design and exception handling mechanism setup, solving the pain points of traditional manual harness writing such as low efficiency, poor adaptability and insufficient path coverage; at the same time, it supports multiple rounds of iterative optimization, which greatly improves the executability and branch path coverage of harness, and the verification sufficiency is significantly better than manual solutions.

[0059] 3. A multi-dimensional reachability determination system integrating static taint propagation paths, dynamic taint tracking results, and full execution data from fuzz testing enables precise hierarchical determination of vulnerability reachability, solving the one-sided problem of traditional methods that only use "whether it crashes" as the determination criterion. At the same time, the security risks of the verification process are completely avoided by using an isolated sandbox environment. Execution data and determination evidence are collected throughout the entire process, achieving full traceability of the "analysis-generation-execution-determination" process. The determination accuracy is significantly better than existing mainstream methods. Attached Figure Description

[0060] Figure 1 This is a schematic diagram of the principle framework of the dynamic and static collaborative full-link intelligent analysis and verification method for vulnerabilities based on the large language model and MCP protocol in this application.

[0061] Figure 2 This is a schematic diagram of the underlying standardized communication process based on MCP. Detailed Implementation

[0062] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0063] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance. Additionally, this application should point out that unless otherwise specified, the structures, connections, positional relationships, power source relationships, etc., involved in this application are all things that a person skilled in the art could discover without inventive effort based on prior art.

[0064] Example 1

[0065] refer to Figure 1 As shown in the figure, this embodiment discloses a dynamic and static collaborative full-link intelligent analysis and verification method for vulnerabilities based on a large language model and the MCP protocol. The dynamic and static collaborative full-link intelligent analysis and verification method for vulnerabilities includes the following steps.

[0066] Step S1: Task initialization and context construction. Receive user input parameters, complete the basic information configuration of the verification task, define dynamic and static collaborative analysis rules and initialize the analysis environment. Establish a standardized task context channel through the MCP protocol to complete the basic foundation construction of the entire task chain.

[0067] Preferably, the user input parameters include: target code library path, vulnerability analysis target, and task configuration parameters. The vulnerability analysis target includes: CVE number, vulnerable function address, risk call chain, and vulnerability principle description. The task configuration parameters include: sandbox environment specifications, fuzzing execution duration, path coverage threshold, target programming language and CPU architecture, and maximum iteration rounds.

[0068] Preferably, the definition of dynamic and static collaborative analysis rules includes: based on vulnerability principles and target code characteristics, static taint analysis rules are automatically generated through LLM, including taint source definition, taint convergence point definition, and taint propagation rule definition, while configuring the granularity of dynamic taint tracking, instrumentation range, and monitoring rules.

[0069] The definitions of taint sources include: defining user-controlled input, network interface input, external file input, and command-line parameters; the definitions of taint convergence points include: defining vulnerability-sensitive operation functions, memory operation APIs, system call interfaces, and dangerous function execution points; and the definitions of taint propagation rules include: defining propagation scenarios such as assignment operations, function parameter passing, pointer operations, and array copying.

[0070] Preferably, the analysis environment initialization includes: calling the environment configuration tool interface through the MCP protocol to complete the pre-verification of the target code library retrieval, dependency environment deployment, static / dynamic analysis tools, fuzzing engine and sandbox environment; if the environment deployment is abnormal, an alarm log is generated and the process is terminated; after the verification is passed, the environment status information is written to the MCP context, and the in-depth analysis of the target code and the pre-analysis of static taints corresponding to step S2 are automatically triggered.

[0071] Preferably, step S1 further includes context initialization: generating a unique task ID based on LLM, constructing a task context structure that conforms to the MCP protocol standard, completing the structured writing of target modules, analysis parameters, dynamic and static analysis rules, and execution thresholds, and synchronously initializing the task execution status to "pending execution".

[0072] Step S2: In-depth analysis of target code and pre-analysis of static taints. The code analysis tool and static taint analysis tool connected to the MCP protocol are called to complete the structural analysis of the target code, the extraction of vulnerability-related functions and call chains, the definition of taint sources and taint convergence points, the analysis of taint propagation paths and the screening of reachable path sets, and the structured code features and taint propagation link information are written into the task context through the MCP protocol.

[0073] Preferably, the execution logic of step S2 includes:

[0074] Context reading: The target code library path, analysis target, environment information and taint analysis rules in the task context are read through the MCP protocol to determine the scope and core objectives of code analysis.

[0075] Tool Invocation and Code Analysis: Standardized code analysis tools are invoked via the MCP protocol to perform in-depth analysis of target code based on Abstract Syntax Tree (AST), Control Flow Graph (CFG), Function Call Graph (CG), and Data Flow Graph (DFG), automatically extracting core information: the prototype of the target function associated with the vulnerability, the upstream and downstream call chains of the function, sensitive API call points, input data flow paths, runtime dependencies and context constraints, branch judgment logic and conditional expressions.

[0076] Flow-sensitive static taint analysis: By calling the static taint analysis tool through the MCP protocol, based on predefined taint sources, sinks, and propagation rules, and employing context-sensitive, flow-sensitive, and field-sensitive cross-function taint analysis algorithms, a full taint propagation chain analysis is completed. The full taint propagation chain analysis includes: tracing the complete propagation path of taints from source nodes to sink nodes, identifying branch nodes, data dependencies, and constraints on the path, filtering unreachable dead paths and invalid paths, and finally generating a set of taint reachable paths, clarifying the triggering conditions, dependencies, and branch constraints of each path.

[0077] Information structuring and context passing: The extracted code feature information, static taint analysis rules, taint reachable path set, and branch constraints are standardized to generate an objective function information table, call relationship graph, taint propagation link graph, and reachable path list. The corresponding information is incrementally written into the task context through the MCP protocol. The integrity of core information is verified synchronously. If there is missing objective function information or invalid taint path, supplementary analysis is triggered. After the information is complete, the startup of the fuzzing harness generation based on the taint path in step S3 is automatically triggered.

[0078] Step S3: Targeted generation and iterative optimization of tainted paths for fuzzing harness. Based on the objective function information and static tainted propagation path set in the MCP context, the code generation tool is called to dynamically generate fuzzing harness code that includes a mock environment, targeted payload generation logic, tainted marking entry point, and exception handling mechanism. After compilation verification and logic optimization, the context is passed through the MCP protocol.

[0079] Preferably, the execution logic of step S3 includes:

[0080] Context reading: The objective function prototype, call chain, data dependencies, runtime constraints, static taint reachable path set, and branch constraints in the task context are read through the MCP protocol to clarify the core requirements and targeted optimization goals generated by Harness.

[0081] Targeted Harness Automated Generation: By calling an LLM-based code generation tool via the MCP protocol, and guided by a static taint reachable path set, Fuzzing Harness code is dynamically generated to adapt to the objective function and taint propagation scenario.

[0082] Harness Iterative Optimization: Based on LLM, the generated Harness code undergoes syntax verification, compilation feasibility analysis, logical integrity verification, and path coverage optimization. If compilation errors, logical defects, or incomplete taint path coverage exist, additional information and taint path details of the target code are obtained through the MCP protocol to complete multiple rounds of iterative optimization until Harness code that can be compiled normally, has no logical defects, and fully covers the core taint paths is generated.

[0083] Context passing: The final optimized Harness code, compilation configuration, payload generation rules, and taint marking configuration information are incrementally written into the task context via the MCP protocol, automatically triggering the start of the dynamic and static collaborative sandbox execution and dynamic taint tracking corresponding to step S4.

[0084] Furthermore, the content generated automatically by targeted Harness includes:

[0085] Target function call logic: Generates standardized function call entry points based on function prototypes, accurately adapts to input parameter types, quantities, and calling conventions, and covers all function call chains in the tainted reachable path set.

[0086] Mock environment: Automatically generates mock logic for external dependencies, global variables, system calls, upstream and downstream interfaces, and context constraints on taint propagation paths required for function execution, fully simulating the execution context of the real runtime environment and ensuring the executability of taint propagation paths.

[0087] Payload generation logic: Based on taint source type and branch constraints on the path, an integrated structured fuzzing payload generation module is used to dynamically generate payloads from boundary values, outliers, malformed data, and directed inputs that meet branch constraints. It focuses on the preset critical path of taint propagation, solving the blindness problem of traditional fuzzing and maximizing the branch coverage of taint propagation paths.

[0088] Tag entry logic: Built-in taint tagging interface adapted to dynamic taint tracking tools, automatically injecting taint tags into the input payload, ensuring that the entire propagation trajectory of taint data can be fully tracked during dynamic execution.

[0089] Exception capture and monitoring logic: Built-in capture mechanisms for typical exceptions such as segmentation faults, memory out-of-bounds errors, null pointer references, use after free (UAF), and double-free vulnerabilities, and synchronously integrated real-time monitoring and log output logic for execution path, register status, memory layout, and crash stack.

[0090] Step S4: Dynamic and static collaborative sandbox execution and dynamic taint tracing. Based on the MCP context, the optimized Harness code is obtained. The sandbox execution tool and the dynamic taint tracing tool are called to complete the fuzz test execution of Harness in an isolated environment. Full runtime data, including execution path, taint propagation trajectory, abnormal events, and crash information, is collected in real time. A feedback optimization closed loop is formed based on the dynamic execution results. The path blocking information and taint propagation breakpoints are sent back to the Harness generation stage through the MCP protocol to complete targeted optimization. Iterative execution continues until the termination condition is met.

[0091] Preferably, the execution logic of step S4 includes:

[0092] Context reading: Read the Harness code, compilation configuration, task execution parameters, static taint reachable path set, and taint marking configuration in the task context via the MCP protocol to clarify execution requirements, monitoring rules, and termination conditions.

[0093] Sandbox environment initialization: The sandbox execution tool is invoked via the MCP protocol to build an isolated sandbox environment based on lightweight containerization or hardware-assisted virtualization methods. This completes the compilation of Harness code, deployment of dependent libraries, integration of fuzzing engines (such as libFuzzer and AFL++) and dynamic taint tracking tools, and configuration of resource isolation, network isolation, and system call restriction rules.

[0094] Dynamic execution and full-link data collection: Harness execution is started in an isolated sandbox. Based on compile-time instrumentation or runtime instrumentation, dynamic taint tracing is started simultaneously to collect full runtime data in real time, including: code execution path coverage information, branch hit status, function call sequence, full-link propagation trajectory of taint data, memory operation behavior, register state changes, and complete context of exception / crash events (crash stack, trigger payload, crash address, memory dump file).

[0095] Feedback optimization through dynamic and static synergy: Real-time analysis of execution data to form a closed-loop optimization mechanism.

[0096] Context passing: The collected full runtime data, dynamic taint tracking logs, execution logs, crash files, path coverage reports, and iteration optimization records are structured and incrementally written into the task context via the MCP protocol, automatically triggering the start of the vulnerability reachability determination of the multi-source data fusion corresponding to S5.

[0097] Furthermore, the closed-loop optimization mechanism includes:

[0098] If dynamic taint tracking confirms that taint data has been completely propagated to the vulnerability aggregation point and a crash / anomaly matching the vulnerability principle is captured, execution will be terminated immediately and the task will be marked as "pending judgment".

[0099] If dynamic taint tracking finds that taint propagation is blocked in a preset key branch or that the core taint path is not covered, the blocking location, branch condition expression, current payload information, and path coverage gap are automatically sent back to the Harness generation stage via the MCP protocol. The LLM optimizes the payload generation logic and Mock environment based on the branch constraints, regenerates the targeted Harness, and performs iterative verification until the taint reaches the convergence point, the coverage meets the threshold, or the maximum number of iterations is reached.

[0100] If an abnormal sandbox environment occurs or Harness execution crashes due to a non-target vulnerability, the system will automatically retry or send back the abnormal information via the MCP protocol, triggering compatibility optimization in the Harness generation process.

[0101] Step S5: Vulnerability reachability determination and report output based on multi-source data fusion. This involves fusing static taint analysis results, dynamic taint tracking data, and full fuzz test execution data from the MCP context. The analysis tool is then invoked to complete multi-dimensional logical reasoning and hierarchical determination of vulnerability reachability, generating a structured, end-to-end traceable vulnerability analysis and verification report, thus completing the closed loop of the entire analysis and verification process.

[0102] Preferably, the execution logic of step S5 includes:

[0103] Context reading: Reads the context data of the entire task process through the MCP protocol, including the static analysis results of the target code, the set of static taint reachable paths, Harness code, full data of dynamic taint tracing, fuzz test execution logs, exception and crash information, and iteration optimization records.

[0104] Multi-source data fusion and in-depth analysis: By calling data fusion analysis tools through the MCP protocol, multi-dimensional data from static analysis and dynamic execution are integrated to complete in-depth correlation analysis: the matching degree between static taint propagation paths and dynamic execution paths, the complete propagation of taint data from source to convergence point, the fulfillment of vulnerability triggering conditions, the correlation between abnormal / crash events and vulnerability principles, whether input data flows to vulnerability-sensitive operation points, the core reasons for path blocking and the possibility of breakthrough.

[0105] Reachability classification: Based on the logical reasoning capabilities of LLM, combined with multi-dimensional analysis results, the vulnerability reachability is accurately classified and determined, and four standardized classification results are output, confirming reachability, conditional reachability, potential reachability, and unreachability.

[0106] Results storage and report generation: The judgment results, full-link evidence data, and static / dynamic analysis original files are written into a relational database; at the same time, a standardized vulnerability reachability verification report is automatically generated. The report module includes: basic task information, target code and vulnerability overview, description of the dynamic and static collaborative analysis process, reachability judgment conclusion, vulnerability triggering conditions, complete taint propagation path, execution path graph, evidence attachments, remediation priority suggestions, and remediation solution reference.

[0107] Task closure: The core information of the report and the final judgment result are written into the task context through the MCP protocol, the task execution status is updated to "completed", and the whole process verification task ends.

[0108] Furthermore, it was confirmed that: static taint analysis showed a complete propagation path, dynamic taint tracing confirmed that taint data propagated completely from the source node to the vulnerability convergence point, and stable crash / abnormal events that perfectly matched the vulnerability principle were captured, clearly marking the vulnerability triggering conditions, complete execution path, taint propagation link and impact scope.

[0109] Conditions are met: Static taint analysis shows an effective propagation path, and dynamic taint tracing confirms that the taint can reach the vulnerability convergence point, but specific runtime conditions, environment configurations, permission requirements, or input combinations must be met to trigger the vulnerability. The preconditions and scenario constraints for triggering are marked.

[0110] Potential reach: Static taint analysis reveals potential propagation paths. During dynamic execution, the vulnerable function can be hit, but the taint has not been fully propagated to the vulnerability-sensitive operation point. There is a possibility of triggering under specific boundary conditions or special inputs. Core risk points are marked and supplementary verification suggestions are provided.

[0111] Unreachable: Static taint analysis shows no effective taint propagation path, or dynamic execution has insurmountable branch blockages, unmet compilation conditions, missing runtime dependencies, permission constraints, or other core limitations, clearly indicating the root cause of unreachability.

[0112] Preferably, in step S5, the relational database supports multi-dimensional queries, including queries by CVE number, vulnerability level, reachability status, target component, and scope of impact.

[0113] Example 2

[0114] Building upon Example 1, this example also discloses a dynamic and static collaborative intelligent vulnerability analysis and verification system based on a large language model and the MCP protocol. This system adopts a layered architecture of "atomic skills + MCP standardized protocol," using LLM as the core inference engine. It achieves atomic task processing throughout the entire vulnerability analysis and verification process through five core agent skills, corresponding to the five steps in Example 1. Context passing and tool calls between all agent skills are standardized and integrated through the MCP protocol.

[0115] The intelligent agent architecture of this system uses the MCP protocol as the sole communication and data foundation. The five core agent skills are all independent atomic execution units with no direct point-to-point communication. Context passing, tool invocation, and process scheduling between all skills are uniformly implemented through the three-layer architecture of the MCP protocol, forming a decoupled architecture of "unified MCP management and independent execution of agent skills". This ensures context consistency, tool invocation standardization, and multi-skill collaboration capabilities throughout the entire process.

[0116] To address the collaborative interaction needs of intelligent agent vulnerability analysis and verification scenarios, an enhanced Model Context Protocol (EMP) is developed, extending and strengthening the underlying communication capabilities of the standard MCP to form an enhanced MCP adapted to vulnerability analysis and verification systems. This enhanced MCP is the core communication and context management protocol for intelligent agents, serving as the core carrier for achieving atomic collaboration of multiple skills, standardized tool integration, and lossless end-to-end context transmission. It adopts a three-layer decoupled modular architecture, consisting of a collaborative scheduling layer, a context management layer, and an interface adaptation layer. These three layers are logically decoupled and interconnected through a standardized bus, providing unified service capabilities for all agent skills, such as... Figure 2 As shown.

[0117] The interface adaptation layer forms the underlying foundation of the protocol, designing a unified and standardized calling interface. On one hand, it provides a seamless tool invocation entry point for the five core Agent skills; on the other hand, it provides a plug-in registration interface for external tools (code analysis tools, code generation tools, etc.), uniformly defining request / response data formats, dynamic parameter injection specifications, and exception retry and degradation mechanisms, and supporting feedback on tool invocation results. Each Agent skill can independently invoke tools through this layer's interface without needing to adapt to the tool's native protocol, fundamentally solving the industry pain point of high complexity in tool integration.

[0118] The context management layer serves as the core data foundation of the protocol, constructing a globally unique task context data model and designing a three-level index structure of "Task ID - Skill ID - Data Type". It provides standardized context read / write, incremental update, and status backtracking interfaces for each Agent skill. The core storage fields cover all information such as basic task information, static analysis results, taint propagation paths, Harness code, dynamic execution data, and task execution status, enabling lossless context transfer between Skills and completely solving the context gap problem in multi-skill collaboration.

[0119] The collaborative scheduling layer serves as the decision-making hub of the protocol, with a built-in Agent skill collaborative rule engine. It defines standardized scheduling logic for serial execution, conditional jump, and iterative rollback, and provides interfaces for task status monitoring, trigger-based skill activation, and abnormal process control. It can automatically complete the process scheduling of multiple skills based on the task execution status, support multi-round iterative optimization combining static and dynamic approaches, and realize the automated closed loop of complex verification processes.

[0120] Specifically, each Agent skill corresponds to an independent atomic task, possessing independent reasoning logic and execution boundaries. It can complete tool invocation, context reading and writing, and upstream and downstream collaboration through the MCP protocol, deeply integrating dynamic and static analysis logic. The specific design is as follows:

[0121] 1. Task initialization skills

[0122] The core is positioned as the entry unit of the intelligent agent, responsible for the parameter parsing of the verification task, the definition of dynamic and static analysis rules and the initialization of the analysis environment. The corresponding atomic task is "task parameter standardization, dynamic and static analysis rule configuration and analysis environment pre-verification". The specific implementation process is executed according to the logic of step S1.

[0123] 2. Target code recognition skills

[0124] The core is positioned as the static parsing unit of the intelligent agent, which is responsible for the semantic structure analysis of the target code, the extraction of vulnerability-related features, and the pre-analysis of taint propagation paths. The corresponding atomic tasks are "deep analysis of target code, extraction of vulnerability-related functions and call chains, analysis of static taint propagation paths and screening of reachable path sets". The specific implementation process is executed according to the logic of step S2.

[0125] 3. Fuzzing Harness (Generates Skill)

[0126] The core is positioned as the test code generation unit for intelligent agents. It is responsible for the automated generation and iterative optimization of fuzzing harness based on static taint paths with high coverage, strong directionality and executable performance. The corresponding atomic task is "harness generation, logic optimization and validity verification that adapts the objective function and taint path". The specific implementation process is executed according to the logic of step S3.

[0127] 4. Sandbox execution and dynamic taint tracking skills

[0128] The core is positioned as the dynamic execution and feedback unit of the agent, responsible for Harness's isolated environment execution, dynamic taint tracking, runtime full data collection and dynamic-static collaborative feedback optimization. The corresponding atomic task is "Harness isolated execution, dynamic taint full-link tracking, runtime data collection and iterative optimization feedback". The specific implementation process is executed according to step S4 logic.

[0129] 5. Accessibility determination skills for dynamic and static data integration vulnerabilities

[0130] The core is positioned as the decision output unit of the intelligent agent, responsible for the fusion of multi-source data based on static analysis and dynamic execution, to complete the multi-dimensional logical reasoning and hierarchical judgment of vulnerability accessibility. The corresponding atomic tasks are "multi-source data fusion analysis, intelligent hierarchical reasoning of accessibility, and automatic generation of verification report". The specific implementation process is executed according to step S4 logic.

[0131] This application constructs an LLM-driven intelligent agent for vulnerability analysis and verification, achieving an end-to-end automated closed loop for vulnerability analysis and verification based on atomic agent skills and the MCP protocol. This addresses the core pain points of existing technologies and offers the following significant benefits and advantages compared to traditional methods:

[0132] 1. Based on the intelligent agent architecture of "atomic agent skills + MCP standardized protocol", the entire process of vulnerability analysis and verification is automated and collaborative, which greatly reduces the cost of manual intervention. At the same time, through standardized context passing and tool calling specifications, the problems of fragmentation and insufficient collaborative capabilities of existing technical processes are solved, and the consistency and reproducibility of verification results are significantly improved.

[0133] 2. Based on LLM-driven automated fuzzing harness generation technology, it can dynamically generate adapted test code based on the semantic and structural features of the target function, automatically complete the construction of the mock environment, payload logic design and exception handling mechanism setup, solving the pain points of traditional manual harness writing such as low efficiency, poor adaptability and insufficient path coverage; at the same time, it supports multiple rounds of iterative optimization, which greatly improves the executability and branch path coverage of harness, and the verification sufficiency is significantly better than manual solutions.

[0134] 3. A multi-dimensional reachability determination system integrating static taint propagation paths, dynamic taint tracking results, and full execution data from fuzz testing enables precise hierarchical determination of vulnerability reachability, solving the one-sided problem of traditional methods that only use "whether it crashes" as the determination criterion. At the same time, the security risks of the verification process are completely avoided by using an isolated sandbox environment. Execution data and determination evidence are collected throughout the entire process, achieving full traceability of the "analysis-generation-execution-determination" process. The determination accuracy is significantly better than existing mainstream methods.

[0135] 4. Adopting a loosely coupled, modular architecture design, Agent skills can be flexibly combined to adapt to different verification scenarios. The MCP protocol supports the rapid access and expansion of tools. It can adapt to the vulnerability accessibility verification needs of different programming languages, CPU architectures, and software types (desktop software, embedded firmware, cloud-native components) without reconstructing the core architecture, and has extremely strong scenario adaptability and engineering feasibility.

[0136] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and the MCP protocol, characterized in that, The dynamic-static collaborative full-link intelligent analysis and verification method for vulnerabilities includes: S1: Task initialization and context construction, receiving user input parameters, completing the basic information configuration of the verification task, defining dynamic and static collaborative analysis rules and initializing the analysis environment, establishing a standardized task context channel through the MCP protocol, and completing the basic foundation construction of the entire task chain; S2: Deep analysis of target code and pre-analysis of static taints. It calls the code analysis tools and static taint analysis tools that are connected to the MCP protocol to complete the structural analysis of the target code, the extraction of vulnerability-related functions and call chains, and the definition of taint sources and taint convergence points, the analysis of taint propagation paths and the screening of reachable path sets. The structured code features and taint propagation link information are written into the task context through the MCP protocol. S3: Fuzzing Harness Targeted Generation and Iterative Optimization Based on Tainted Paths. Based on the objective function information and static taint propagation path set in the MCP context, the code generation tool is called to dynamically generate Fuzzing Harness code containing a Mock environment, targeted payload generation logic, taint marking entry point, and exception handling mechanism. After compilation verification and logic optimization, the context is passed through the MCP protocol. S4: Dynamic and static collaborative sandbox execution and dynamic taint tracking. Based on the MCP context, the optimized Harness code is obtained, and the sandbox execution tool and dynamic taint tracking tool are called to complete the fuzz test execution of Harness in an isolated environment. Full runtime data, including execution path, taint propagation trajectory, abnormal events, and crash information, is collected in real time. Based on the dynamic execution results, a feedback optimization closed loop is formed. The path blocking information and taint propagation breakpoints are sent back to the Harness generation stage through the MCP protocol to complete targeted optimization. Iterative execution continues until the termination condition is met. S5: Vulnerability reachability determination and report output through multi-source data fusion. It integrates static taint analysis results, dynamic taint tracking data, and full fuzz test execution data from the MCP context, calls analysis tools to complete multi-dimensional logical reasoning and hierarchical determination of vulnerability reachability, generates a structured, fully traceable vulnerability analysis and verification report, and completes the closed loop of the entire analysis and verification process.

2. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 1, characterized in that, In step S1, the user input parameters received include: target code library path, vulnerability analysis target, and task configuration parameters. The vulnerability analysis target includes: CVE number, vulnerable function address, risk call chain, and vulnerability principle description. The task configuration parameters include: sandbox environment specifications, fuzzing execution duration, path coverage threshold, target programming language and CPU architecture, and maximum number of iteration rounds. In step S1, the definition of dynamic and static collaborative analysis rules includes: based on vulnerability principles and target code characteristics, static taint analysis rules are automatically generated through LLM, including taint source definitions, taint convergence point definitions, and taint propagation rule definitions. Simultaneously, the granularity, instrumentation scope, and monitoring rules for dynamic taint tracing are configured. The taint source definitions include: defining user-controllable input, network interface input, external file input, and command-line parameters. The taint convergence point definitions include: defining vulnerability-sensitive operation functions, memory operation APIs, system call interfaces, and dangerous function execution points. The taint propagation rule definitions include: defining assignment operations, function parameter passing, pointer operations, and array copy propagation scenarios. In step S1, the analysis environment initialization includes: calling the environment configuration tool interface through the MCP protocol to complete the target code library retrieval, dependency environment deployment, static / dynamic analysis tools, fuzzing engine and sandbox environment pre-verification; if the environment deployment is abnormal, an alarm log is generated and the process is terminated; after the verification is passed, the environment status information is written to the MCP context, and the target code deep analysis and static taint pre-analysis corresponding to step S2 are automatically triggered.

3. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 2, characterized in that, Step S2 includes: Context reading: Read the target code library path, analysis target, environment information and taint analysis rules in the task context through the MCP protocol to determine the scope and core objectives of code analysis; Tool Invocation and Code Analysis: Standardized code analysis tools are invoked via the MCP protocol to perform in-depth analysis of the target code based on abstract syntax trees, control flow graphs, function call graphs, and data flow graphs, automatically extracting core information: the prototype of the target function associated with the vulnerability, the upstream and downstream call chains of the function, sensitive API call points, input data flow paths, runtime dependencies and context constraints, branch judgment logic and conditional expressions; Flow-sensitive static taint analysis: By calling the static taint analysis tool through the MCP protocol, based on predefined taint sources, sinks, and propagation rules, and employing context-sensitive, flow-sensitive, and field-sensitive cross-function taint analysis algorithms, a full taint propagation chain analysis is completed. The full taint propagation chain analysis includes: tracing the complete propagation path of taints from source nodes to sink nodes, identifying branch nodes, data dependencies, and constraints on the path, filtering out unreachable dead paths and invalid paths, and finally generating a set of taint reachable paths, clarifying the triggering conditions, dependencies, and branch constraints of each path. Information structuring and context passing: The extracted code feature information, static taint analysis rules, taint reachable path set, and branch constraints are standardized to generate an objective function information table, call relationship graph, taint propagation link graph, and reachable path list. The corresponding information is incrementally written into the task context through the MCP protocol. The integrity of core information is verified synchronously. If there is missing objective function information or invalid taint path, supplementary analysis is triggered. After the information is complete, the startup of the fuzzing harness generation based on the taint path in step S3 is automatically triggered.

4. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 2, characterized in that, Step S3 includes: Context reading: Read the target function prototype, call chain, data dependencies, runtime constraints, static taint reachable path set, and branch constraints in the task context through the MCP protocol to clarify the core requirements and targeted optimization objectives generated by Harness; Targeted Harness Automated Generation: By calling an LLM-based code generation tool via the MCP protocol, and guided by a static taint reachable path set, FuzzingHarness code is dynamically generated to adapt to the target function and taint propagation scenario; Harness Iterative Optimization: Based on LLM, the generated Harness code undergoes syntax verification, compilation feasibility analysis, logical integrity verification, and path coverage optimization. If there are compilation errors, logical defects, or incomplete coverage of tainted paths, additional information and tainted path details of the target code are obtained through the MCP protocol to complete multiple rounds of iterative optimization until Harness code that can be compiled normally, has no logical defects, and fully covers the core tainted paths is generated. Context passing: The final optimized Harness code, compilation configuration, payload generation rules, and taint marking configuration information are incrementally written into the task context via the MCP protocol, automatically triggering the start of the dynamic and static collaborative sandbox execution and dynamic taint tracking corresponding to step S4.

5. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 4, characterized in that, In step S3, the content automatically generated by the targeted Harness includes: Target function call logic: Generate standardized function call entry points based on function prototypes, accurately adapt to input parameter types, quantities and calling conventions, and cover all function call chains in the taint reachable path set; Mock environment: Automatically generates mock logic for external dependencies, global variables, system calls, upstream and downstream interfaces, and context constraints on taint propagation paths required for function execution, fully simulating the execution context of the real runtime environment and ensuring the executability of taint propagation paths; Payload generation logic: Based on the taint source type and branch constraints on the path, an integrated structured fuzz test payload generation module is used to support dynamic generation of boundary values, outliers, malformed data, and directional inputs that meet the branch constraint conditions. Tag entry logic: Built-in taint tagging interface adapted to dynamic taint tracking tools, automatically injecting taint tags into the input payload to ensure that the entire propagation trajectory of taint data can be fully tracked during dynamic execution; Exception capture and monitoring logic: Built-in capture mechanisms for typical exceptions such as segmentation faults, memory out-of-bounds errors, null pointer references, use after free, and double free vulnerabilities, and synchronously integrated real-time monitoring and log output logic for execution path, register status, memory layout, and crash stack.

6. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 4, characterized in that, Step S4 includes: Context reading: Read the Harness code, compilation configuration, task execution parameters, static taint reachable path set, and taint marking configuration in the task context via the MCP protocol to clarify execution requirements, monitoring rules, and termination conditions; Sandbox environment initialization: The sandbox execution tool is invoked through the MCP protocol to build an isolated sandbox environment based on lightweight containerization or hardware-assisted virtualization methods. This completes the compilation of Harness code, deployment of dependency libraries, integration of the fuzzing engine and dynamic taint tracking tool, and configuration of resource isolation, network isolation, and system call restriction rules. Dynamic execution and full-link data collection: Harness execution is started in an isolated sandbox. Based on compile-time instrumentation or runtime instrumentation, dynamic taint tracing is started simultaneously, and full runtime data is collected in real time, including: code execution path coverage information, branch hit status, function call sequence, full-link propagation trajectory of taint data, memory operation behavior, register state changes, and complete context of exception / crash events. Feedback optimization through dynamic and static coordination: Real-time analysis of execution data to form a closed-loop optimization mechanism; Context passing: The collected full runtime data, dynamic taint tracking logs, execution logs, crash files, path coverage reports, and iteration optimization records are structured and incrementally written into the task context via the MCP protocol, automatically triggering the start of the vulnerability reachability determination of the multi-source data fusion corresponding to S5.

7. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 6, characterized in that, In step S4, the closed-loop optimization mechanism includes: If dynamic taint tracking confirms that taint data has been completely propagated to the vulnerability aggregation point and a crash / anomaly matching the vulnerability principle is captured, execution will be terminated immediately and the task will be marked as "pending judgment". If dynamic taint tracking finds that taint propagation is blocked in a preset branch or that the core taint path is not covered, the blocking location, branch condition expression, current payload information, and path coverage gap are automatically sent back to the Harness generation stage via the MCP protocol. The LLM optimizes the payload generation logic and Mock environment based on the branch constraints, regenerates the targeted Harness, and performs iterative verification until the taint reaches the convergence point, the coverage meets the threshold, or the maximum number of iterations is reached. If an abnormal sandbox environment occurs or Harness execution crashes due to a non-target vulnerability, the system will automatically retry or send back the abnormal information via the MCP protocol, triggering compatibility optimization in the Harness generation process.

8. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 6, characterized in that, Step S5 includes: Context reading: Read the context data of the entire task process through the MCP protocol, including the static analysis results of the target code, the set of static taint reachable paths, Harness code, full data of dynamic taint tracing, fuzz test execution logs, exception and crash information, and iteration optimization records; Multi-source data fusion and in-depth analysis: By calling data fusion and analysis tools through the MCP protocol, multi-dimensional data from static analysis and dynamic execution are fused to complete in-depth correlation analysis: the matching degree between static taint propagation paths and dynamic execution paths, the complete propagation of taint data from source to convergence point, the fulfillment of vulnerability triggering conditions, the correlation between abnormal / crash events and vulnerability principles, whether input data flows to vulnerability-sensitive operation points, the core reasons for path blocking and the possibility of breakthrough; Reachability classification: Based on the logical reasoning capabilities of LLM and combined with multi-dimensional analysis results, the vulnerability reachability is accurately classified and determined, and four standardized classification results are output to confirm reachability, conditional reachability, potential reachability and unreachability. Results storage and report generation: The judgment results, full-link evidence data, and static / dynamic analysis original files are written into a relational database; at the same time, a standardized vulnerability reachability verification report is automatically generated. The report module includes: basic task information, target code and vulnerability overview, description of the dynamic and static collaborative analysis process, reachability judgment conclusion, vulnerability triggering conditions, complete taint propagation path, execution path diagram, evidence attachments, remediation priority suggestions, and remediation solution reference. Task closure: The core information of the report and the final judgment result are written into the task context through the MCP protocol, the task execution status is updated to "completed", and the whole process verification task ends.

9. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 8, characterized in that, In step S5: Confirmed reachability: Static taint analysis shows a complete propagation path, dynamic taint tracing confirms that taint data has been propagated completely from the source node to the vulnerability aggregation point, and a stable crash / abnormal event that perfectly matches the vulnerability principle has been captured, clearly marking the vulnerability triggering conditions, complete execution path, taint propagation link and impact scope; Conditions are met: Static taint analysis shows an effective propagation path, and dynamic taint tracking confirms that the taint can reach the vulnerability convergence point, but the vulnerability can only be triggered if preset runtime conditions, environment configuration, permission requirements or input combinations are met. The preconditions and scenario constraints for triggering are marked. Potential reach: Static taint analysis reveals potential propagation paths. During dynamic execution, the vulnerable function can be hit, but the taint has not been fully propagated to the vulnerability-sensitive operation point. There is a possibility of triggering under preset boundary conditions or preset inputs. Core risk points are marked and supplementary verification suggestions are provided. Unreachable: Static taint analysis shows no effective taint propagation path, or dynamic execution has insurmountable branch blockages, unmet compilation conditions, missing runtime dependencies, or permission constraints, clearly indicating the root cause of unreachability.

10. The dynamic and static collaborative intelligent analysis and verification method for the entire vulnerability chain based on a large language model and MCP protocol as described in claim 8, characterized in that, In step S5, the relational database supports multi-dimensional queries, including queries by CVE number, vulnerability level, reachability status, target component, and scope of impact.

Images