Code Pathfinder — Claude Code MCP server: call graphs and code search
Gives an AI assistant access to call graphs, data flows and security rules for Python and Go. Useful during code review and when reading unfamiliar code.
claude mcp add pathfinder -- uvx codepathfinderWhat Code Pathfinder does
The server starts with pathfinder serve --project . and exposes tools for working with the code graph: find callers and callees, trace data flows, search for patterns, run security rules. Under the hood sits a Tree-sitter static analysis engine. It builds ASTs, assembles a call graph across files, then runs taint analysis to follow data from one file into a dangerous spot in another. Pattern matching misses that kind of path.
Rules are Python scripts written against the PathFinder SDK. You declare sources, sinks and sanitizers, and the dataflow engine does the rest. Ready-made rulesets download from a CDN, so there is no repo to clone and no rule files to manage. Scanning also works without MCP: pathfinder scan --ruleset python/all --project ., with output as text, JSON, SARIF or CSV.
Running through uvx requires uv to be installed. Without it uvx codepathfinder fails and the server never comes up.
What it helps with
- trace user input leaking across files
- list every caller of a function
- run security rules over a Python project
- hand the assistant a call graph instead of guesses
- export findings as SARIF for GitHub Code Scanning
Example prompts for the agent
- Start the Code Pathfinder MCP server for this project and show the call graph around
handle_request - Find the path from
request.GET.getdown tocursor.execute - Run the Python security rules and list the findings
How to install Code Pathfinder
Platform CLI
claude mcp add pathfinder -- uvx codepathfinderuvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>
Platform CLI
codex mcp add code-pathfinder -- uvx codepathfinderuvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>
Config file
{
"mcpServers": {
"code-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>
Config file
{
"servers": {
"code-pathfinder": {
"type": "stdio",
"command": "uvx",
"args": [
"codepathfinder"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>
Platform CLI
gemini mcp add code-pathfinder uvx codepathfinderuvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Code Pathfinder
How do I install Code Pathfinder in Claude Code?
Add the server with claude mcp add pathfinder -- uvx codepathfinder. The assistant then sees the code graph tools.
What does Code Pathfinder do?
It builds call and variable dependency graphs from source, follows data flows across files, and runs security rules. Over MCP it hands all of that to an AI assistant.
What do I need to run the server?
uv installed, since the launch command goes through uvx codepathfinder. No API keys or cloud accounts.
