# trailofbits/buttercup

Buttercup finds and patches software vulnerabilities

Repository: https://github.com/trailofbits/buttercup
Canonical: https://ross.abutalabs.com/products/buttercup
Language: Python
License: AGPL-3.0
License Family: copyleft
Last push: 2026-08-24T04:10:20+00:00

## Health v2 (maintenance only)
Score: 56/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 10, longevity 42
- inputs: {"age_days": 597, "days_push": 9, "days_rel": 384, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1683, forks 183 (observed 2026-08-28T04:05:21.820326+00:00)

## What it is
Buttercup is a Cyber Reasoning System (CRS) developed by Trail of Bits for the DARPA AI Cyber Challenge that automatically finds and patches software vulnerabilities in open-source C and Java repositories. It combines AI/ML-assisted fuzzing built on OSS-Fuzz with a multi-agent LLM-driven patcher to discover, analyze, and repair security bugs.

## Use cases
- automatically find vulnerabilities in open-source C or Java projects
- generate patches for discovered security bugs using LLM agents
- run AI-assisted fuzzing campaigns on OSS-Fuzz compatible codebases
- participate in or replicate DARPA AI Cyber Challenge style autonomous vulnerability discovery
- audit code repositories for exploitable memory or logic bugs

## When to choose
- you need autonomous end-to-end vulnerability discovery and patching for OSS-Fuzz compatible C or Java projects
- you have Linux x86_64 hardware and budget for third-party LLM API costs
- you want to experiment with multi-agent AI-driven security repair pipelines

## When to avoid
- you need a lightweight scanner without heavy LLM API costs or Docker infrastructure
- your target project is not OSS-Fuzz compatible or lacks fuzzing harnesses
- you require Windows or full ARM64 support

## Facets
- artifact type: application
- maturity: active
- function: security, vulnerability-scanning, machine-learning, llm-inference, agent-framework, testing
- domain: security, developer-tools, artificial-intelligence
- platform: python
- tags: cyber-reasoning-system, fuzzing, automated-patching, vulnerability-discovery, aixcc, oss-fuzz, llm-agents, automation, linux, macos, docker

## Member repositories
- trailofbits/buttercup (main) score 56

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:21.820326+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:41:20.638631+00:00, confidence not recorded.
  - readme: https://github.com/trailofbits/buttercup (fetched 2026-08-28T04:05:21.820326+00:00, sha d36d33a1826e)
- Data as of 2026-08-30T08:39:29.467469+00:00.