Local AI Vulnerability & Patch Assistant

Overview

Local AI Vulnerability & Patch Assistant is a Proof of Concept (PoC) inspired by enterprise vulnerability management tools such as Snyk and Mend. The project demonstrates how a Local Large Language Model (LLM) can be integrated into an offline vulnerability management workflow while ensuring that no application information leaves the local environment.

Instead of relying on cloud-based AI to identify vulnerabilities, the system uses a trusted local vulnerability database to detect known vulnerabilities based on installed software versions. The Local LLM is responsible only for generating clear, human-readable explanations of the detected vulnerabilities and recommended patches.

---

Motivation

Organizations often use vulnerability management platforms to identify vulnerable software and recommend security updates. However, many enterprise environments cannot send application or system information outside their network due to privacy and security requirements.

This project explores how a Local LLM can be combined with offline vulnerability intelligence to provide:

• Automatic detection of known vulnerabilities
• Patch recommendations
• Professional security explanations
• Complete offline processing

---

Features

• Read installed applications (hardcoded for the current PoC)
• Detect known vulnerabilities using a local vulnerability database
• Recommend patch versions for each detected vulnerability
• Recommend an overall version that resolves all detected vulnerabilities
• Generate structured data for Local LLM analysis
• Produce professional security explanations using a Local LLM
• Display results through a VS Code Hover Extension
• Fully offline architecture with no external API calls during vulnerability analysis

---

Project Workflow

systemApps.json
        │
        ▼
Read Installed Applications
        │
        ▼
Local Vulnerability Database
        │
        ▼
Automatic Vulnerability Detection
        │
        ▼
Patch Recommendation Engine
        │
        ▼
Generate patch_recommendations.json
        │
        ▼
Prompt Builder
        │
        ▼
Local LLM (Ollama)
        │
        ▼
Professional Security Report
        │
        ▼
VS Code Hover Extension

---

Project Structure

Local-AI-Vulnerability-Patch-Assistant/

│
├── data/
│   ├── systemApps.json
│   ├── vulnerability_database.json
│   └── patch_recommendations.json
│
├── src/
│   ├── scanner.py
│   ├── vulnerability_detector.py
│   ├── patch_engine.py
│   ├── prompt_builder.py
│   ├── ollama_client.py
│   ├── report_generator.py
│   └── main.py
│
├── prompts/
│   └── security_prompt.txt
│
├── extension/
│   ├── extension.js
│   └── hoverProvider.js
│
├── docs/
│
├── README.md
│
└── requirements.txt

---

How It Works

Step 1 – Read Installed Applications

The Proof of Concept reads installed applications from systemApps.json. This file contains the application name and installed version. In future versions, this can be replaced with automatic application discovery.

Step 2 – Detect Known Vulnerabilities

Each application's version is compared against a local vulnerability database created from trusted open-source vulnerability sources.

If a matching vulnerable version is found, the system retrieves:

• CVE ID
• Severity
• Vulnerability description
• Fixed version

Step 3 – Patch Recommendation

For every detected vulnerability, the Patch Recommendation Engine identifies the version that resolves that specific vulnerability.

The engine also determines an overall recommended version that resolves all detected vulnerabilities for the application.

The results are stored in patch_recommendations.json.

Step 4 – Local LLM Analysis

Only verified vulnerability and patch information is passed to the Local LLM.

The Local LLM generates:

• Security explanation
• Vulnerability summary
• Risk description
• Patch explanation
• Overall recommendation

Step 5 – Hover Extension

The generated report is displayed through a VS Code Hover Extension, allowing users to quickly view vulnerability and patch information directly within the editor.

---

Current Scope

This repository is currently a Proof of Concept.

Current implementation includes:

• Hardcoded application inventory
• Local vulnerability database
• Automatic vulnerability detection
• Patch recommendation engine
• Local LLM integration
• VS Code Hover Extension

---

Future Improvements

• Automatic application discovery
• Automatic synchronization of vulnerability databases
• Company-specific Retrieval-Augmented Generation (RAG)
• Support for additional operating systems
• Patch prioritization based on severity and exploitability
• Integration with enterprise patch-management systems
• Optional automated patch deployment after user approval

---

Technologies

• Python
• JSON
• Ollama
• Local Large Language Models
• VS Code Extension API
• JavaScript

---

References

This project is inspired by publicly available research and documentation on vulnerability management, Local LLMs, and enterprise security workflows.

Key areas of study include:

• Enterprise vulnerability management
• Patch management
• Local LLM deployment
• Vulnerability databases
• VS Code extension development

A detailed list of references will be included in the project documentation.