codebadger

概述

CodeBadger是一个基于Joern代码属性图(CPG)技术的专业级MCP服务器，支持12种以上编程语言的静态代码分析，包括Java、C/C++、JavaScript、Python等。该服务器既提供核心CPG操作，又包含专门的漏洞检测工具，对安全研究人员和开发者都很有价值。其容器化架构确保了在不同环境中的一致部署。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• generate_cpg

  Generate a Code Property Graph (CPG) for a codebase.

  试试:Generate a CPG for the GitHub repository at https://github.com/example/project试试:Create a CPG for the local codebase in /path/to/code
• get_cpg_status

  Check whether a CPG exists and retrieve status metadata.

  试试:What is the status of the CPG for my project?试试:Check if the code property graph is ready
• run_cpgql_query

  Execute a raw CPGQL query against a CPG and return structured results.

  试试:Find all methods that contain SQL queries试试:Show all calls to the 'processData' function
• list_methods

  List methods/functions with optional regex/file filters.

  试试:List all methods in the authentication module试试:Show me all methods that start with 'parse'
• get_method_source

  Retrieve the source code for a named method.

  试试:Show me the source code for the 'login' method试试:Get the implementation of the 'processRequest' function
• find_taint_sources

  Find likely external input points (taint sources).

  试试:Find all user input sources in the codebase试试:Identify potential taint sources in the authentication module
• find_taint_sinks

  Locate dangerous sinks where tainted data can flow.

  试试:Find all SQL sinks in the application试试:Identify dangerous functions that could be vulnerable to tainted input
• find_taint_flows

  Detect dataflows from sources to sinks (taint analysis).

  试试:Find flows from user input to database functions试试:Detect potential XSS vulnerabilities in the codebase
• find_null_pointer_deref

  Find likely null pointer dereferences.

  试试:Check for potential null pointer dereferences in the code试试:Find unsafe dereferences of pointers in C code
• find_integer_overflow

  Detect integer overflow patterns.

  试试:Find potential integer overflow vulnerabilities试试:Check for unsafe arithmetic operations in the payment module
• find_format_string_vulns

  Detect format string vulnerabilities.

  试试:Find unsafe format string usage in C code试试:Check for potential format string injection vulnerabilities
• get_codebase_summary

  Get high-level metrics about the codebase (files, methods, calls, language).

  试试:Give me a summary of this codebase试试:Show me statistics about the project structure

可对比工具

安装

{
  "mcpServers": {
    "codebadger": {
      "url": "http://localhost:4242/mcp",
      "type": "http"
    }
  }
}

FAQ

CodeBadger支持哪些编程语言？

CodeBadger支持Java、C/C++、JavaScript、Python、Go、Kotlin、C#、Ghidra、Jimple、PHP、Ruby和Swift。

如何自定义漏洞检测？

您可以通过在`src/tools/queries/your_query.scala`中创建Scala查询模板，并在`src/tools/custom_tools.py`中注册Python工具函数来添加自定义检测器。

Hacker News 讨论

开发者社区最近的相关讨论。

• Codebadger – MCP server for static code analysis with Joern▲ 1
  帖子 by codebadger · 2026-05-10

codebadger 对比