code-pathfinder

Overview

Code Pathfinder is an open-source static analysis engine that traces data flows across files and functions. The MCP server exposes tools for querying the code graph, finding callers/callees, tracing data flows, and running security rules—making these powerful analysis capabilities available to AI assistants during code review or development. It supports Python, Docker, and Docker Compose analysis with 190+ security rules that can be automatically downloaded.

Try asking AI

After installing, here are 3 things you can ask your AI assistant:

• find_callers

  Find callers of a specific function in the codebase

  Try:Show me all functions that call authenticate_userTry:Find callers of the process_data function
• find_callees

  Find functions called by a specific function

  Try:What functions does authenticate_user call?Try:Show me all callees of the main function
• trace_dataflow

  Trace data flow between source and sink points

  Try:Trace how user input flows from request to database queryTry:Show the data flow between login input and password check
• search_patterns

  Search for specific code patterns across the codebase

  Try:Find all SQL queries constructed with string concatenationTry:Show me all instances of eval() usage
• run_security_rule

  Run a specific security rule on the codebase

  Try:Run the SQL injection detection ruleTry:Check for XSS vulnerabilities in the code
• analyze_project

  Perform complete security analysis of the project

  Try:Analyze the codebase for security vulnerabilitiesTry:Run a full security scan on this project
• get_code_graph

  Retrieve the call graph representation of the code

  Try:Show me the call graph for the authentication moduleTry:Get the function dependency graph for the main module
• query_taint_flows

  Query for tainted data flows across the codebase

  Try:Find all tainted flows from user inputs to file operationsTry:Show me paths where unsanitized user input reaches SQL queries
• list_rules

  List available security rules for the codebase

  Try:Show all available security rulesTry:List Python security rules
• get_function_info

  Get detailed information about a specific function

  Try:Get details about the process_user_data functionTry:Show information for the authenticate function
• find_vulnerabilities

  Find vulnerabilities based on predefined security rules

  Try:Find all critical vulnerabilities in the codeTry:Show me high severity security issues
• get_project_summary

  Get a summary of the project structure and analysis

  Try:Provide a summary of this codebaseTry:Show project structure and metrics

Note: Tool names inferred from the MCP server description which mentions tools for 'querying the code graph: find callers/callees, trace data flows, search for patterns, and run security rules'. The specific tool names were constructed based on t

Comparable tools

Installation

brew install shivasurya/tap/pathfinder

pathfinder serve --project .

{
  "mcpServers": {
    "code-pathfinder": {
      "command": "pathfinder",
      "args": ["serve", "--project", "."]
    }
  }
}

On Hacker News

Recent discussion from the developer community.

• Show HN: Open-Source CodeQL Alternative▲ 3
  Story by shivasurya · 2024-11-23

Compare code-pathfinder with