# Lachesis

Builds a compiler-grade property graph for C, Python and TypeScript, then answers questions about calls and data flow. Useful when you need to trace a value or check whether outside input reaches something risky.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: UnboundCompute
- License: AGPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/UnboundCompute/lachesis
- Updated: 2026-10-16
- HTML: https://affpapa.org/en/nevibecode/mcp/lachesis

## What it does

Lachesis parses your project the way a compiler would, not by matching text patterns. The result is a map of nodes and edges: functions, calls, and the routes values take. Ask it who calls a function, what that function calls, where a value came from, or where it ends up. A separate pass looks for entrypoints that reach a sensitive call with no guard in front of them. Treat each hit as a lead to investigate, not a verdict.

There are three ways in: the `lachesis` command, a Python library, and an MCP server for an agent. On the command line the work splits into passes — `lachesis build`, `lachesis enrich`, `lachesis analyze` — and `lachesis explain` dumps every piece of evidence for one location. The first scan of a repo is slow; after that the graph sits in the `~/.lachesis/cache` cache. You can also hand it a git URL, and the code is fetched to a temp folder and removed afterwards.

For MCP, run `lachesis mcp` from the folder where the graph was built, or with no argument and let the agent build its own. Install the package with `python -m pip install lachesis-cpg`, or point your client at `uvx` so nothing is installed up front. A Docker image ships with all three languages inside. Answers carry a confidence level: some edges are exact, some are an educated guess, and the server says which is which.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add lachesis -- uvx lachesis-cpg
```
uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>

### Codex

**Platform CLI**
```bash
codex mcp add lachesis -- uvx lachesis-cpg
```
uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "lachesis": {
            "command": "uvx",
            "args": [
                "lachesis-cpg"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "lachesis": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "lachesis-cpg"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add lachesis uvx lachesis-cpg
```
uvx runs the command named after the package; if the README names another one, use uvx --from lachesis-cpg <command>

## When to use it
- find who calls a function and what it calls in turn
- trace a value from its source to the place it lands
- check whether outside input reaches a database call
- pull every piece of evidence for one suspicious location
- catch double-free or use-after-free in C code

## Example prompts
- Run `lachesis mcp ./my-project` and show me the leads for this repo
- Who calls `handleWebhook`, and what guards sit on that path?
- Build the graph for `./my-project` and explain `tree.c:1487`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md