{"repo":"shivasurya/code-pathfinder","free":true,"listed":false,"github":"https://github.com/shivasurya/code-pathfinder","clone":"git clone https://github.com/shivasurya/code-pathfinder.git","description":"Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP","language":"Go","stars":140,"topics":["sast","security","security-tools","structural-search","application-security","code-scanning","ai-agents","ai-sast","static-analysis","static-code-analysis"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"Open-source SAST engine that traces vulnerabilities across files and functions Website · Docs · Rule Registry · MCP Server · Blog --- Quick Start Install: Scan a Python project (rules download automatically): Scan Dockerfiles: No config files, no API keys, no cloud accounts. Results in your terminal in seconds. --- What is Code Pathfinder? Code Pathfinder is an open-source static analysis engine that builds a graph of your codebase and traces how data flows through it. It parses source code into Abstract Syntax Trees, constructs call graphs across files, and runs taint analysis to find source-to-sink vulnerabilities that span multiple files and function boundaries. v2.0 introduces cross-file dataflow analysis : trace user input from an HTTP handler in one file through helper functions and into a SQL query in another file. This is the kind of analysis that pattern-matching tools miss entirely. Cross-File Taint Analysis Most open-source SAST tools operate on single files. Code Pathfinder v2.0 tracks tainted data across file boundaries: The engine builds a Variable Dependency Graph (VDG) per function, then connects them through inter-procedural taint transfer summaries. When user input flows into a function parameter in another file, the taint propagates through the call graph to the sink. How It Works 1. Parse : Tree-sitter builds ASTs for Python, Dockerfiles, and Docker Compose files 2. Index : Extract functions, call sites, parameters, and assignments into a queryable call gr","default_branch":null,"files":null,"tree":[],"storefront":"/r/shivasurya","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/shivasurya/code-pathfinder/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}