Best for
- Security teams that need local code-structure analysis and security scanning.
- Projects using Python, Dockerfiles, or Docker Compose.
- Development teams that want Claude Code, Cursor, or Cline to access call-graph and security analysis.
C
Code Pathfinder
Community
An MCP server for code intelligence and cross-file taint analysis for security teams.
GitHub source repository ↗
54FMRS · D
The supplied sources identify Code Pathfinder as an Apache-2.0 open-source security analysis MCP server, version 2.1.1, distributed through PyPI and OCI and using stdio transport. Its main capability is cross-file and cross-function dataflow and taint analysis. The sources do not provide concrete MCP tool identifiers, client configuration examples, or client authentication details.
Code Pathfinder is an open-source static analysis and security scanning engine that can also run as an MCP server. It builds abstract syntax trees, call graphs, and variable dependency graphs for Python projects, then performs cross-file and cross-function dataflow and taint analysis. The README describes caller and callee queries, dataflow tracing, structural search, and security-rule scanning. The manifest also describes call graphs, type inference, and symbol search for Python/Go; the README marks Python, Dockerfiles, and Docker Compose as stable, while Go is coming soon.
Tools
The tool list has not been reviewed yet.
Setup
Install codepathfinder from PyPI, or use the manifest's Docker image docker.io/shivasurya/code-pathfinder:v2.1.1. Start the stdio server with pathfinder serve --project .; --project selects the project root to index and defaults to the current directory. The README also documents Homebrew, pre-built binaries, and building from source. Rules are downloaded automatically from a CDN, and the README states that no API keys or cloud accounts are required.
Fit and risk
Not for
- Projects requiring proven stable Go analysis support; the README lists Go as coming soon.
- Use cases requiring only general language-server functionality without security or code-structure analysis.
- Integrations that require source-listed MCP tool identifiers or a client-specific configuration example.
Required permissions
- Needs to read and index source code and configuration files under the selected project root.
- When remote rulesets are used, it needs to download rules; the README says rules are fetched automatically from a CDN.
- No API keys or cloud accounts are required according to the README.
Risks and side effects
- Results depend on supported languages, selected rulesets, and code structure; the README marks only Python, Dockerfiles, and Docker Compose as stable.
- Providing a project to the analyzer allows it to process source code and configuration contents in that project.
- Automatic CDN rule downloads depend on external network availability.
Troubleshooting
- Verify that codepathfinder is installed and start the stdio server with pathfinder serve --project ..
- Verify that --project points to the intended project root and that the directory is readable.
- Check network connectivity for rule downloads and confirm that the selected ruleset name is valid.
- If coverage is unexpected, verify whether the target language is within the README's stated stable support.
Use cases
Query call graphs, symbols, and data flows during AI-assisted code review.
Trace user-controlled input across files into security-sensitive sinks such as SQL execution.
Run security rules for Python, Dockerfiles, and Docker Compose.
Create custom Python security rules using the dataflow analysis engine.
Supported clients
Claude CodePartial support
CursorPartial support
ClinePartial support