SCOUT: LLM-Driven Vulnerability Detection via Interactive Repository Exploration

Abstract

Detecting software vulnerabilities requires understanding not only the target code but also its broader repository context. Existing LLM-based approaches either operate on isolated functions or rely on heavyweight program analysis such as Code Property Graphs, leaving them caught between insufficient context and information overload. We propose SCOUT (Structure-guided Code Observation and Understanding), an interactive agent-based framework that lets LLMs actively explore repository structures for vulnerability detection. SCOUT organizes the repository in two layers: a file-level structure graph for navigation and a function-level index for fine-grained retrieval within each file. Given a target function, SCOUT initializes a local subgraph centered on its containing file and allows the LLM to iteratively request additional context through a progressive subgraph expansion mechanism. We evaluate SCOUT on PrimeVul over C/C++ projects. On pair-wise discrimination, the metric PrimeVul’s authors introduced to test whether a model genuinely distinguishes vulnerable code from its patch, SCOUT reports the highest P-C (108/435) and VP-S (69) to date, alongside the highest accuracy (57.93%) and the lowest false positive rate (41.84%) among existing baselines, all without any training. To probe generality, we further report a same-backbone comparison against function-only and static-context prompting, and a backbone-sensitivity study across four LLMs. Our results suggest that effective vulnerability detection does not require complex program analysis representations, but rather an efficient navigation mechanism that lets LLMs acquire the right information at the right time. We acknowledge that the absolute level on this rigorously curated benchmark remains modest, and position SCOUT as a triage component rather than an unattended detector.