When Claude Code puts on a hacker hat and verifies its findings

What it does

RAPTOR is an autonomous security research framework that chains static analysis, binary analysis, and LLM reasoning into a single workflow against a codebase or binary. It orchestrates tools like Semgrep, CodeQL, AFL++, and an optional Z3 SMT solver through Claude Code to map attack surfaces, find vulnerabilities, validate them, and—if they survive scrutiny—generate proof-of-concept exploits and patches. The whole process is organised inside named project workspaces that persist findings across multiple runs.

The interesting bit

The framework treats vulnerability discovery as a funnel, not a light switch. Before any LLM writes a line of exploit code, RAPTOR uses Z3 to check whether CodeQL dataflow paths are actually satisfiable, dropping unreachable ghosts immediately. Survivors then face a staged validation gauntlet (Stages A through D) that asks whether a finding is real, reachable, and practical. It also supports multi-model correlation and a configurable cost ceiling, so you can pair a cheap triage model with an expensive code generator without surprises.

Key highlights

• Multi-stage validation pipeline (/validate) filters static-analysis noise through stages A–D before dispatching findings to exploit or patch generation.
• Optional Z3 SMT integration pre-screens CodeQL path constraints for satisfiability, producing concrete candidate inputs for the LLM and discarding dead paths.
• Semgrep runs fully offline using cached registry packs shipped in the repository; CodeQL works offline after its initial setup download.
• Supports multiple LLM providers and model roles—analysis, code, consensus, aggregate, fallback—with deterministic cross-model correlation and a per-run budget cap.
• Named project workspaces (/project) organise runs and track findings over time, with cross-finding analysis to surface shared root causes and attack chains.

Caveats

• The authors explicitly describe the project as “not polished software” that is “held together with enthusiasm and duct tape.”
• Exploit generation (/exploit) and patch writing (/patch) are marked Beta; web application scanning (/web) is an Alpha stub.
• CodeQL carries its own license that does not permit commercial use, which may complicate enterprise deployment.

Verdict

Security researchers and red teams who want an opinionated, automated assistant for vulnerability triage and validation should take a look. Teams seeking polished, production-grade DevSecOps tooling should probably wait—or open a PR.