LAMDA: Leveraging Large Language Models for Better API Misuse Detection via Multi-Agent Collaboration

Abstract

Modern software development heavily relies on reusing third-party and internal Application Programming Interfaces (APIs). However, API misuses occur frequently, leading to program crashes, security vulnerabilities, and other unexpected behaviors. To detect API misuse, many existing approaches mine API usage patterns from code repositories or documentation and flag code that violates these patterns as potential misuses. Despite their usefulness, such pattern-based methods often lack a deep understanding of the actual calling context, and the mined patterns are typically tied to specific APIs, limiting their generalizability and ultimately constraining their effectiveness in detecting API misuse. In this paper, we address API misuse detection from a new perspective by directly analyzing API-level contextual information and reasoning over it. To this end, we propose LAMDA, the first agent-based API misuse detector. LAMDA incorporates five customized modules that leverage large language models and specialized tools to generate multi-dimensional insights about API-level contexts, and it employs an iterative discussion mechanism to identify misuses more accurately. We compare LAMDA with state-of-the-art approaches on a newly collected dataset. Experimental results show that LAMDA achieves 68.34% precision, 76.81% recall, and 72.31% F1-score, significantly outperforming all baselines.