SAF: An AI-Agent-Ready and Browser-Accessible Static Analysis Framework for LLVM IR

Abstract

Static program analysis finds bugs before software ships, and modern checkers for C/C++ depend on whole-program infrastructure: pointer analysis, value-flow tracking, taint analysis, and IFDS-based data flow on top of LLVM. Today’s LLVM-IR frameworks fall short. SVF, Phasar, and Lotus expose their analyses through C++ APIs that require subclassing, recompilation, and pinned LLVM builds; onboarding takes months. CodeQL replaces the C++ API with a domain-specific query language. None is designed for the AI coding agents that increasingly drive software-engineering work. We present the Static Analyzer Factory (SAF), an LLVM-IR analysis framework that combines a Rust kernel exposed to Python through PyO3 zero-copy bindings, a WebAssembly and Pyodide browser playground that runs the same SDK with no install, a declarative YAML language for function specifications that the built-in checkers consume at runtime, and two shipped coding-agent skills installable in Claude Code and Codex. As an illustrative case, SAF’s bundled memory-safety checkers were themselves authored end-to-end through this workflow using Claude Code on the Opus 4.6 model. On the NIST Juliet C/C++ benchmark, these checkers achieve the best F1 on three of four memory-safety CWEs, each measured against whichever of SVF and Lotus ships a corresponding checker. Code: https://github.com/Static-Analyzer-Factory/static-analyzer-factory. Documentation and browser playground: https://static-analyzer-factory.github.io/static-analyzer-factory/. Demo video: https://youtu.be/Cj58VvNCrlw.