Bridging the Gap Using GPT-4 to Summarize and Explain Static Analysis Warnings at Scale

Static analysis tools such as SonarQube are widely adopted in industry to detect bugs, code smells, and security vulnerabilities. However, their effectiveness is often hindered by developer fatigue caused by large volumes of low-priority or cryptic warnings. We investigate how GPT-4, a Large Language Model (LLM), can assist in summarizing and remediating static analysis results. We propose a prompt-based pipeline that converts SonarQube output into rich, contextual guidance using LLMs. By analyzing over 2,700 real-world Java warnings from the Apache Commons Lang project, we compare GPT-4 responses across rule types and severity levels. Our study shows that GPT-4 consistently provides actionable advice that improves upon default tool outputs. We categorize the nature of the guidance, quantify verbosity and structure, and evaluate alignment with developer expectations. This work demonstrates the promise of human-AI collaboration in static analysis triage, extending earlier efforts on LLM-assisted software quality [3]–[6]. Our methodology and artifacts are publicly available to support reproducibility and further research.