Code Pathfinder

Name: Code Pathfinder
Author: shivasurya

by shivasuryaversion 2.1.1i★ –iRuns on your computer

Registry namedev.codepathfinder/pathfinder

Install

Overview

Description from the maker (original English)

Code intelligence MCP server: call graphs, type inference, and symbol search for Python/Go.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Search & AI memory

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "pathfinder": {
      "command": "uvx",
      "args": [
        "codepathfinder",
        "serve",
        "--project",
        "."
      ]
    }
  }
}

Run this in your terminal

claude mcp add pathfinder -- uvx codepathfinder serve --project .

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "pathfinder": {
      "command": "uvx",
      "args": [
        "codepathfinder",
        "serve",
        "--project",
        "."
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "pathfinder": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "codepathfinder",
        "serve",
        "--project",
        "."
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain codepathfinder.dev (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Search & AI memoryi

More stars than 0% of the other 7249 servers in this category
Published to the registry more recently than 10% of the other 7249 servers in this category
Basic checks equal to or better than 100% of the other 7249 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Code Pathfinder safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (2.1.1) reached the registry 6 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv), Docker on your computer.

What can I use instead?

In the same category: Context7, Codebase Memory, Exa

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Context7

by upstash

Feeds AI the latest docs for libraries and frameworks before it answers, so code it writes does not use outdated, removed functions.

Computer or cloud★ 64,224MITUpdated today

Install

Codebase Memory

by DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

Runs on your computer★ 48,148MITUpdated 20 days ago

Install

Exa

by exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

Runs in the cloud★ 5,213MITUpdated last month

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Open-source SAST engine that traces vulnerabilities across files and functions

Website · Docs · Rule Registry · MCP Server · Blog

Quick Start

Install:

brew install shivasurya/tap/pathfinder

Scan a Python project (rules download automatically):

pathfinder scan --ruleset python/all --project .

Scan Dockerfiles:

pathfinder scan --ruleset docker/all --project .

No config files, no API keys, no cloud accounts. Results in your terminal in seconds.

What is Code Pathfinder?

Code Pathfinder is an open-source static analysis engine that builds a graph of your codebase and traces how data flows through it. It parses source code into Abstract Syntax Trees, constructs call graphs across files, and runs taint analysis to find source-to-sink vulnerabilities that span multiple files and function boundaries.

v2.0 introduces cross-file dataflow analysis: trace user input from an HTTP handler in one file through helper functions and into a SQL query in another file. This is the kind of analysis that pattern-matching tools miss entirely.

Cross-File Taint Analysis

Most open-source SAST tools operate on single files. Code Pathfinder v2.0 tracks tainted data across file boundaries:

app.py:5    user_input = request.get("query")     ← Source: user-controlled input

↓ calls db.py:12 cursor.execute(query) ← Sink: SQL execution

The engine builds a Variable Dependency Graph (VDG) per function, then connects them through inter-procedural taint transfer summaries. When user_input flows into a function parameter in another file, the taint propagates through the call graph to the sink.

How It Works

Source Code → Tree-sitter AST → Call Graph → Variable Dependency Graph → Taint Analysis → Findings

↓ Inter-procedural Taint Summaries (cross-file flows)

Parse: Tree-sitter builds ASTs for Python, Dockerfiles, and Docker Compose files
Index: Extract functions, call sites, parameters, and assignments into a queryable call graph
Analyze: Build VDGs per function, resolve inter-procedural flows, run taint analysis
Detect: Python-based security rules query the graph to find source-to-sink paths
Report: Output findings as text, JSON, SARIF (GitHub Code Scanning), or CSV

190 Security Rules, Ready to Use

Rules download from CDN automatically. No need to clone the repo or manage rule files.

Language	Bundles	Rules	Coverage
[Python](https://codepathfinder.dev/registry/python)	django, flask, aws_lambda, cryptography, jwt, lang, deserialization, pyramid	158	SQL injection, RCE, SSRF, path traversal, XSS, deserialization, crypto misuse, JWT vulnerabilities
[Docker](https://codepathfinder.dev/registry/docker)	security, best-practice, performance	37	Root user, exposed secrets, image pinning, multi-stage builds, layer optimization
[Docker Compose](https://codepathfinder.dev/registry/docker-compose)	security, networking	10	Privileged mode, socket exposure, capability escalation, network isolation

# Scan with a specific bundle

pathfinder scan --ruleset python/django --project .

Scan with multiple bundles

pathfinder scan --ruleset python/flask --ruleset python/jwt --project .

Scan a single rule

pathfinder scan --ruleset python/PYTHON-DJANGO-SEC-001 --project .

Scan all rules for a language

pathfinder scan --ruleset python/all --project .

Browse all rules with examples and test cases at the Rule Registry.

MCP Server for AI Coding Assistants

Code Pathfinder runs as an MCP server, giving Claude Code, Cursor, Cline, and other AI assistants access to call graphs, data flows, and security analysis. More context than LSP, focused on security and code structure.

pathfinder serve --project .

The MCP server exposes tools for querying the code graph: find callers/callees, trace data flows, search for patterns, and run security rules — all available to the AI assistant during code review or development.

Write Custom Rules

Security rules are Python scripts using the PathFinder SDK. Define sources, sinks, and sanitizers — the dataflow engine handles the analysis.

Here's a real rule from the repo (PYTHON-DJANGO-SEC-001) that detects SQL injection in Django:

from codepathfinder import calls, flows, QueryType

from codepathfinder.presets import PropagationPresets

class DBCursor(QueryType): fqns = ["sqlite3.Cursor", "psycopg2.extensions.cursor"] match_subclasses = True

@python_rule( id="PYTHON-DJANGO-SEC-001", name="Django SQL Injection via cursor.execute()", severity="CRITICAL", cwe="CWE-89", ) def detect_django_cursor_sqli(): return flows( from_sources=[ calls("request.GET.get"), calls("request.POST.get"), ], to_sinks=[ DBCursor.method("execute").tracks(0), calls("cursor.execute"), ], sanitized_by=[calls("escape"), calls("escape_string")], propagates_through=PropagationPresets.standard(), scope="global", # cross-file taint analysis )

# Run your custom rules

pathfinder scan --rules ./my_rules/ --project .

Explore all 190 rules in the rules/ directory or browse the Rule Registry. See the rule writing guide and dataflow documentation to write your own.

See the rule writing guide and dataflow documentation for more.

Installation

Homebrew (Recommended)

brew install shivasurya/tap/pathfinder

pip

Installs the CLI binary and Python SDK for writing rules.

pip install codepathfinder

Docker

docker pull shivasurya/code-pathfinder:stable-latest

docker run --rm -v "$(pwd):/src" \ shivasurya/code-pathfinder:stable-latest \ scan --ruleset python/all --project /src

Pre-Built Binaries

Download from GitHub Releases for Linux (amd64, arm64), macOS (Intel, Apple Silicon), and Windows (x64).

From Source

git clone https://github.com/shivasurya/code-pathfinder

cd code-pathfinder/sast-engine gradle buildGo ./build/go/pathfinder --help

Usage

# Scan with text output (default)

pathfinder scan --ruleset python/all --project .

JSON output

pathfinder scan --ruleset python/all --project . --output json --output-file results.json

SARIF output (GitHub Code Scanning)

pathfinder scan --ruleset python/all --project . --output sarif --output-file results.sarif

CSV output

pathfinder scan --ruleset python/all --project . --output csv --output-file results.csv

Fail CI on critical/high findings

pathfinder scan --ruleset python/all --project . --fail-on=critical,high

MCP server mode

pathfinder serve --project .

Verbose output with statistics

pathfinder scan --ruleset python/all --project . --verbose

GitHub Action

name: Code Pathfinder Security SAST Scan

on: pull_request:

permissions: security-events: write contents: read pull-requests: write

jobs: security-scan: runs-on: ubuntu-latest steps:

uses: actions/checkout@v6 with: fetch-depth: 0

name: Run Security Scan uses: shivasurya/code-pathfinder@v2.1.1 with: ruleset: python/all, docker/all, docker-compose/all verbose: true pr-comment: ${{ github.event_name == 'pull_request' }} pr-inline: ${{ github.event_name == 'pull_request' }} github-token: ${{ secrets.GITHUB_TOKEN }}

name: Upload SARIF uses: github/codeql-action/upload-sarif@v4 if: always() with: sarif_file: pathfinder-results.sarif

See the full example: .github/workflows/code-pathfinder-scan.yml

Action Inputs

Input	Description	Default
`rules`	Path to local Python rule files or directory	-
`ruleset`	Remote ruleset(s), comma-separated (e.g., `python/all`, `docker/security`)	-
`project`	Path to source code	`.`
`output`	Output format: `sarif`, `json`, or `csv`	`sarif`
`output-file`	Output file path	`pathfinder-results.sarif`
`fail-on`	Fail on severities (e.g., `critical,high`)	-
`verbose`	Enable verbose output	`false`
`debug`	Enable debug diagnostics with timestamps	`false`
`skip-tests`	Skip test files	`true`
`refresh-rules`	Force refresh cached rulesets	`false`
`disable-metrics`	Disable anonymous usage metrics	`false`
`python-version`	Python version to use	`3.12`
`pr-comment`	Post summary comment on pull request	`false`
`pr-inline`	Post inline review comments for critical/high findings	`false`
`github-token`	GitHub token (required when `pr-comment` or `pr-inline` is enabled)	-
`no-diff`	Disable diff-aware scanning (scan all files)	`false`

Either rules or ruleset is required.

Supported Languages

Language	Analysis	Status
Python	Cross-file dataflow, taint analysis, call graphs	Stable
Dockerfile	Instruction analysis, security patterns	Stable
Docker Compose	Configuration analysis, security patterns	Stable
Go	AST analysis, call graphs	Coming soon

Contributing

Contributions are welcome. Read the Contributing Guide for setup instructions, how to run tests locally, and the PR process.

Pushing an in-product announcement

In-product announcements (workshops, blog posts, security advisories) are managed via release/latest.json. Add an entry to announcements[], open a PR, and once it merges to main the publish workflow uploads the manifest to the CDN within ~60 seconds. See the version-update-check tech spec for the schema and version_range semantics.

All contributors must sign the Contributor License Agreement (CLA) before any pull request can be merged.

Report bugs or request features
[Ask questions or start a discussion](https://github.com/shivasurya/cod

Only the beginning is shown; read the rest in the repo

Code Pathfinder

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Search & AI memoryi

Common questions

Alternatives

Context7

Codebase Memory

Exa

README from the maker

Quick Start

What is Code Pathfinder?

Cross-File Taint Analysis

How It Works

190 Security Rules, Ready to Use

Scan with multiple bundles

Scan a single rule

Scan all rules for a language

MCP Server for AI Coding Assistants

Write Custom Rules

Installation

Homebrew (Recommended)

pip

Docker

Pre-Built Binaries

From Source

Usage

JSON output

SARIF output (GitHub Code Scanning)

CSV output

Fail CI on critical/high findings

MCP server mode

Verbose output with statistics

GitHub Action

Supported Languages

Contributing

Pushing an in-product announcement