Back to Home
Lekssays icon

codebadger

Verified Safe

by Lekssays

Overview

Static code analysis Model Context Protocol (MCP) server utilizing Joern's Code Property Graph (CPG) technology to provide structural and security analysis for various programming languages.

Installation

Run Command
python main.py &

Environment Variables

  • MCP_HOST
  • MCP_PORT
  • MCP_LOG_LEVEL
  • JOERN_BINARY_PATH
  • JOERN_MEMORY_LIMIT
  • JOERN_JAVA_OPTS
  • CPG_GENERATION_TIMEOUT
  • MAX_REPO_SIZE_MB
  • QUERY_TIMEOUT
  • QUERY_CACHE_ENABLED
  • QUERY_CACHE_TTL
  • WORKSPACE_ROOT
  • CLEANUP_ON_SHUTDOWN

Security Notes

The server's architecture promotes isolation by running the core Joern static analysis engine within a separate Docker container, communicating via `docker exec`. The `run_cpgql_query` tool, which allows arbitrary CPGQL execution, is protected by `validate_cpgql_query` that explicitly blocks dangerous commands (e.g., `System.exit`, `Runtime.getRuntime`, `java.io.File.delete`). User-provided local paths are validated with `resolve_host_path` to prevent path traversal and access to sensitive system directories. Potential risks include resource exhaustion from overly complex CPGQL queries (mitigated by timeouts) or vulnerabilities within the Joern engine itself. No hardcoded secrets or obvious malicious patterns were found in the Python codebase.

Similar Servers

Stats

Interest Score48
Security Score8
Cost ClassHigh
Avg Tokens5000
Stars23
Forks2
Last Update2025-11-23

Tags

Static AnalysisCPGJoernMCPCode SecurityVulnerability DetectionCoding Agents