# Code Pathfinder

Gives an AI assistant access to call graphs, data flows and security rules for Python and Go. Useful during code review and when reading unfamiliar code.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 143
- Author: shivasurya
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/shivasurya/code-pathfinder
- Updated: 2026-07-10
- HTML: https://affpapa.org/en/nevibecode/mcp/code-pathfinder

## What it does

The server starts with `pathfinder serve --project .` and exposes tools for working with the code graph: find callers and callees, trace data flows, search for patterns, run security rules. Under the hood sits a Tree-sitter static analysis engine. It builds ASTs, assembles a call graph across files, then runs taint analysis to follow data from one file into a dangerous spot in another. Pattern matching misses that kind of path.

Rules are Python scripts written against the PathFinder SDK. You declare sources, sinks and sanitizers, and the dataflow engine does the rest. Ready-made rulesets download from a CDN, so there is no repo to clone and no rule files to manage. Scanning also works without MCP: `pathfinder scan --ruleset python/all --project .`, with output as text, JSON, SARIF or CSV.

Running through `uvx` requires uv to be installed. Without it `uvx codepathfinder` fails and the server never comes up.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add pathfinder -- uvx codepathfinder
```
uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>

### Codex

**Platform CLI**
```bash
codex mcp add code-pathfinder -- uvx codepathfinder
```
uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "code-pathfinder": {
            "command": "uvx",
            "args": [
                "codepathfinder"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "code-pathfinder": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "codepathfinder"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add code-pathfinder uvx codepathfinder
```
uvx runs the command named after the package; if the README names another one, use uvx --from codepathfinder <command>

## When to use it
- trace user input leaking across files
- list every caller of a function
- run security rules over a Python project
- hand the assistant a call graph instead of guesses
- export findings as SARIF for GitHub Code Scanning

## Example prompts
- Start the Code Pathfinder MCP server for this project and show the call graph around `handle_request`
- Find the path from `request.GET.get` down to `cursor.execute`
- Run the Python security rules and list the findings

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md