CodeCrucible: A Reusable Blueprint for LLM-Driven SAST

Block has released CodeCrucible, an LLM-driven static application security testing tool, but the more durable contribution is the design blueprint behind it rather than the tool itself. The team frames LLM-driven SAST around four core decisions: compaction (fitting a codebase into the context window), identification (how vulnerabilities are surfaced), relevance screening (separating real findings from noise), and determinism (making nondeterministic output pipeline-safe).

Instead of the common architecture where a traditional engine like CodeQL or Semgrep nominates candidate findings for an LLM to merely validate, CodeCrucible feeds the whole repository into the model in a single pass, letting the LLM act as the primary analyzer with full cross-file context.

This runs counter to prevailing wisdom—exemplified by Snyk's CodeReduce paper—which aggressively compresses code before LLM review. The team argues that large context windows and code's high compressibility make whole-repo reasoning practical, with scaling issues addressed through engineering: token budgeting and late, semantically-aware chunking rather than upfront snippet restriction.

For engineers, the real takeaway is the reusable architecture—tradeoffs, failure modes, and reference implementation—rather than the specific tool, useful for teams building their own security tooling pipelines.