Lachesis — Claude Code MCP server: code graph and taint leads
Builds a compiler-grade property graph for C, Python and TypeScript, then answers questions about calls and data flow. Useful when you need to trace a value or check whether outside input reaches something risky.
claude mcp add lachesis -- uvx lachesis-cpgWhat Lachesis does
Lachesis parses your project the way a compiler would, not by matching text patterns. The result is a map of nodes and edges: functions, calls, and the routes values take. Ask it who calls a function, what that function calls, where a value came from, or where it ends up. A separate pass looks for entrypoints that reach a sensitive call with no guard in front of them. Treat each hit as a lead to investigate, not a verdict.
There are three ways in: the lachesis command, a Python library, and an MCP server for an agent. On the command line the work splits into passes — lachesis build, lachesis enrich, lachesis analyze — and lachesis explain dumps every piece of evidence for one location. The first scan of a repo is slow; after that the graph sits in the ~/.lachesis/cache cache. You can also hand it a git URL, and the code is fetched to a temp folder and removed afterwards.
For MCP, run lachesis mcp from the folder where the graph was built, or with no argument and let the agent build its own. Install the package with python -m pip install lachesis-cpg, or point your client at uvx so nothing is installed up front. A Docker image ships with all three languages inside. Answers carry a confidence level: some edges are exact, some are an educated guess, and the server says which is which.
What it helps with
- find who calls a function and what it calls in turn
- trace a value from its source to the place it lands
- check whether outside input reaches a database call
- pull every piece of evidence for one suspicious location
- catch double-free or use-after-free in C code
Example prompts for the agent
- Run
lachesis mcp ./my-projectand show me the leads for this repo - Who calls
handleWebhook, and what guards sit on that path? - Build the graph for
./my-projectand explaintree.c:1487
How to install Lachesis
Platform CLI
claude mcp add lachesis -- uvx lachesis-cpguvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>
Platform CLI
codex mcp add lachesis -- uvx lachesis-cpguvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>
Config file
{
"mcpServers": {
"lachesis": {
"command": "uvx",
"args": [
"lachesis-cpg"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>
Config file
{
"servers": {
"lachesis": {
"type": "stdio",
"command": "uvx",
"args": [
"lachesis-cpg"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>
Platform CLI
gemini mcp add lachesis uvx lachesis-cpguvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Lachesis
How do I install Lachesis in Claude Code?
Run claude mcp add lachesis -- uvx lachesis-cpg. That registers the server in your Claude config, and the agent starts it on demand.
What does Lachesis do?
It builds a code property graph for C, Python and TypeScript/JavaScript and answers questions over it: calls, value flow, pointers, reachability of sensitive spots. It runs as a terminal command, a Python library, or an MCP server.
Do I need to install the package first?
Not if your config uses uvx — it pulls lachesis-cpg on the first run. For terminal use, install it with python -m pip install lachesis-cpg.
