codebadger MCPサーバー
コミット 2026年8月31日Lets an AI client build Joern Code Property Graphs from repositories and run CPGQL queries to trace data flow and find vulnerabilities.
別名 qcri/codebadger
- スター
- 181
- ツール
- —
- ダウンロード数（30日間）
- —
- 最新バージョン
- —
- 最終コミット
- 2026年8月31日
- ライセンス
- GPL-3.0
codebadger MCPとは
codebadgerはMCPサーバーです。 Lets an AI client build Joern Code Property Graphs from repositories and run CPGQL queries to trace data flow and find vulnerabilities.
プロジェクトのREADMEから生成された概要
自動チェック
実行日 2026年11月15日完全なレポート →まだ検証されていません。サーバーには80点のスコア、重大な問題がないこと、および検証に必要な十分なデータが必要です。 チェックの仕組み · 点数を上げるための改善点
- ソースリポジトリがリンクされており、アクセス可能qcri/codebadger is public and reachablegithub.com/qcri/codebadger ↗合格
- パッケージがこのリポジトリをソースとして指定未チェック
- ビルドの来歴 (Sigstore 証明)未チェック
- オープンソースライセンス (OSI)GPL-3.0spdx.org/licenses/GPL-3.0.html ↗合格
- 過去1年以内にコミットまたはリリースありLast commit or release 2026-08-31github.com/qcri/codebadger ↗合格
- OpenSSF Scorecard未チェック
- パッケージ名が有名なパッケージに酷似していない未チェック
- パッケージおよびその依存関係に重大な勧告なし未チェック
- モデルへの隠れた指示がない0 tool descriptions and the README read; no override phrases, credential paths or hidden characters合格
- 破壊的なツールがラベル付けされている未チェック
- リモートエンドポイントが MCP ハンドシェイクに応答未チェック
README
GitHubで見る🦡 codebadger
codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code Property Graphs (CPGs).
Point it at a Git repository, a local path, or even a pasted code snippet, and codebadger builds a CPG and exposes it over MCP — so an assistant can run CPGQL queries, trace data flow and taint, slice programs, and hunt for vulnerabilities across Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.
It's a general-purpose foundation for both program analysis (understanding code structure, call graphs, and data flow) and vulnerability analysis (taint tracking, bug hunting, and PoC development) — useful for academic research as well as industry security and engineering work. It's built to scale to large analysis batches with per-CPG worker pools, memory-aware scheduling, and a Postgres/Redis backend.
News
codebadger and its paper - Bridging Code Property Graphs and Language Models for Program Analysis - were accepted at the Software Vulnerability Management Workshop @ ICSE 2026. 🎉
Documentation
Everything a developer or security researcher needs lives in docs/:
| Doc | What's in it |
|---|---|
| Installation | Prerequisites and a 5-minute local setup. |
| Usage | Connecting MCP clients, the tool catalog, and a researcher workflow. |
| LLM workflow guide | Recommended bounded tool sequence for agents. |
| Available Tools | Every MCP tool by category, with a description of what each does. |
| Configuration | config.yaml / env reference, telemetry. |
| Deployment | Postgres/Redis, memory sizing, shared vs pool, large batches. |
| Architecture | System design and diagrams. |
| Security | Threat model, trust boundaries, and production hardening. |
| Custom Tools | Add your own detectors. |
| Contributing | Dev setup, tests, and guidelines. |
| Roadmap | What's shipped and what's next. |
Found a vulnerability using codebadger?
We'd love to hear about it - open a PR adding it to TROPHIES.md (CVE ID, project, one-line description, date).
Citation
@inproceedings{lekssays2026bridging,
title={Bridging Code Property Graphs and Language Models for Program Analysis},
author={Lekssays, Ahmed},
booktitle={Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management},
pages={33--40},
year={2026}
}
codebadger MCPのよくある質問
What languages does codebadger support for code analysis?
It analyzes Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift code through Joern CPGs.
What can an AI agent do with codebadger tools?
Agents can run CPGQL queries, trace data flow and taint, slice programs, and search for vulnerabilities.
What inputs can codebadger build a CPG from?
It can take a Git repository, a local path, or a pasted code snippet as input to build a CPG.
Does codebadger support large analysis batches?
Yes, it uses per-CPG worker pools, memory-aware scheduling, and a Postgres/Redis backend to scale.
Where is codebadger documented?
Installation, usage, tools, configuration, deployment, and other guides are in the docs/ directory.