Code Pathfinder

What Code Pathfinder MCP server does

Code Pathfinder MCP server connects an AI coding assistant to a local project’s code graph and static-analysis engine. It can provide information about callers and callees, trace data flows, search for code patterns, and run security rules while the assistant reviews or changes code. The broader CLI also performs SAST scans and reports findings in text, JSON, SARIF, or CSV formats.

The engine is designed to find vulnerabilities that cross file and function boundaries. Examples in the project include tracking input received by an HTTP handler through helper functions and into a SQL execution call. Its bundled rules cover Python security issues such as SQL injection, remote-code execution, SSRF, path traversal, XSS, unsafe deserialization, cryptographic misuse, and JWT vulnerabilities. Docker and Docker Compose rules cover issues including root users, exposed secrets, privileged mode, socket exposure, and capability escalation.

How it works

Code Pathfinder MCP server starts against a project directory with the pathfinder serve --project . command. The analysis pipeline parses source with Tree-sitter, indexes functions, parameters, assignments, and call sites, and builds a cross-file call graph. It then creates variable dependency graphs for functions and connects them using inter-procedural taint summaries.

Security rules query those graph structures to identify source-to-sink paths. A source may be user-controlled input, while a sink may be a database operation or another security-sensitive operation. Sanitizers and propagation behavior can be defined in custom Python rules through the PathFinder SDK. The repository also supports selecting individual rules, rule bundles, or all rules for a language during CLI scans.

The README documents parsing for Python, Dockerfiles, and Docker Compose files. The current listing also describes code-intelligence features for Python and Go, including type inference and symbol search; consult the project’s current documentation for the exact language coverage of each MCP query.

Setup and configuration

Install the CLI with Homebrew using brew install shivasurya/tap/pathfinder, or install the Python package with pip install codepathfinder. Pre-built binaries are available through GitHub Releases, and a Docker image is provided for containerized scans. After installation, start the MCP process with:

pathfinder serve --project .

The project states that the server needs no API key, cloud account, or configuration file. Rules download automatically from a CDN when scans use bundled rules. The MCP client must be configured to launch the local pathfinder executable with the serve subcommand and the target project directory.

The README names Claude Code, Cursor, and Cline as supported AI assistants, along with other MCP-compatible assistants. It does not provide a client-specific configuration block in the supplied material.

Tools and capabilities

• Query callers and callees in the indexed code graph.
• Trace data flows across files and function boundaries.
• Search the project for code patterns.
• Run bundled security rules from the MCP session.
• Scan Python, Dockerfile, and Docker Compose projects through the CLI.
• Run custom Python rules that define sources, sinks, sanitizers, and propagation behavior.
• Export CLI findings as text, JSON, SARIF, or CSV.

Code Pathfinder MCP server is therefore most suitable when an agent needs structural and security analysis of a local repository rather than only text search or editor-level symbol information.