codebadger

Overview

CodeBadger is a professional-grade MCP server that implements static code analysis using Joern's Code Property Graph technology. It supports analysis across 12+ programming languages including Java, C/C++, JavaScript, Python, Go, and others. The server provides both core CPG operations and specialized vulnerability detection tools, making it valuable for security researchers and developers. Its containerized architecture ensures consistent deployment across environments.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• generate_cpg

  Generate a Code Property Graph (CPG) for a codebase.

  Try:Generate a CPG for the GitHub repository at https://github.com/example/projectTry:Create a CPG for the local codebase in /path/to/code
• get_cpg_status

  Check whether a CPG exists and retrieve status metadata.

  Try:What is the status of the CPG for my project?Try:Check if the code property graph is ready
• run_cpgql_query

  Execute a raw CPGQL query against a CPG and return structured results.

  Try:Find all methods that contain SQL queriesTry:Show all calls to the 'processData' function
• list_methods

  List methods/functions with optional regex/file filters.

  Try:List all methods in the authentication moduleTry:Show me all methods that start with 'parse'
• get_method_source

  Retrieve the source code for a named method.

  Try:Show me the source code for the 'login' methodTry:Get the implementation of the 'processRequest' function
• find_taint_sources

  Find likely external input points (taint sources).

  Try:Find all user input sources in the codebaseTry:Identify potential taint sources in the authentication module
• find_taint_sinks

  Locate dangerous sinks where tainted data can flow.

  Try:Find all SQL sinks in the applicationTry:Identify dangerous functions that could be vulnerable to tainted input
• find_taint_flows

  Detect dataflows from sources to sinks (taint analysis).

  Try:Find flows from user input to database functionsTry:Detect potential XSS vulnerabilities in the codebase
• find_null_pointer_deref

  Find likely null pointer dereferences.

  Try:Check for potential null pointer dereferences in the codeTry:Find unsafe dereferences of pointers in C code
• find_integer_overflow

  Detect integer overflow patterns.

  Try:Find potential integer overflow vulnerabilitiesTry:Check for unsafe arithmetic operations in the payment module
• find_format_string_vulns

  Detect format string vulnerabilities.

  Try:Find unsafe format string usage in C codeTry:Check for potential format string injection vulnerabilities
• get_codebase_summary

  Get high-level metrics about the codebase (files, methods, calls, language).

  Try:Give me a summary of this codebaseTry:Show me statistics about the project structure

Comparable tools

Installation

{
  "mcpServers": {
    "codebadger": {
      "url": "http://localhost:4242/mcp",
      "type": "http"
    }
  }
}

FAQ

What languages are supported by CodeBadger?

CodeBadger supports Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.

How do I customize vulnerability detection?

You can add custom detectors by creating Scala query templates in `src/tools/queries/your_query.scala` and registering Python tool functions in `src/tools/custom_tools.py`.

On Hacker News

Recent discussion from the developer community.

• Codebadger – MCP server for static code analysis with Joern▲ 1
  Story by codebadger · 2026-05-10

Compare codebadger with