CodeBadger

server: host: ${MCP_HOST:127.0.0.1} port: ${MCP_PORT:4242} log_level: ${MCP_LOG_LEVEL:INFO} joern: binary_path: ${JOERN_BINARY_PATH:joern} memory_limit: ${JOERN_MEMORY_LIMIT:4g} java_opts: ${JOERN_JAVA_OPTS:-Xmx4G -Xms2G -XX:+UseG1GC -Dfile.encoding=UTF-8} # For large projects # memory_limit: ${JOERN_MEMORY_LIMIT:16g} # java_opts: ${JOERN_JAVA_OPTS:-Xmx16G -Xms8G -XX:+UseG1GC -Dfile.encoding=UTF-8} sessions: ttl: ${SESSION_TTL:3600} idle_timeout: ${SESSION_IDLE_TIMEOUT:1800} max_concurrent: ${MAX_CONCURRENT_SESSIONS:50} cpg: generation_timeout: ${CPG_GENERATION_TIMEOUT:600} max_repo_size_mb: ${MAX_REPO_SIZE_MB:500} supported_languages: - java - c - cpp - javascript - python - go - kotlin - csharp - ghidra - jimple - php - ruby - swift exclusion_patterns: # Hidden files and directories (starting with .) - ".*/\\..*" - "\\..*" # Test and fuzzing directories (both root level and nested, with wildcards) - ".*/test.*" - "test.*" - ".*/fuzz.*" - "fuzz.*" - ".*/Testing.*" - "Testing.*" - ".*/spec.*" - "spec.*" - ".*/__tests__/.*" - "__tests__/.*" - ".*/e2e.*" - "e2e.*" - ".*/integration.*" - "integration.*" - ".*/unit.*" - "unit.*" - ".*/benchmark.*" - "benchmark.*" - ".*/perf.*" - "perf.*" # Documentation and examples (both root level and nested, with wildcards) - ".*/doc?/.*" - "doc?/.*" - ".*/documentation.*" - "documentation.*" - ".*/example.*" - "example.*" - ".*/sample.*" - "sample.*" - ".*/demo.*" - "demo.*" - ".*/tutorial.*" - "tutorial.*" - ".*/guide.*" - "guide.*" # Build and development artifacts - ".*/build.*/.*" - ".*_build/.*" - ".*/target/.*" - ".*/out/.*" - ".*/dist/.*" - ".*/bin/.*" - ".*/obj/.*" - ".*/Debug/.*" - ".*/Release/.*" - ".*/cmake/.*" - ".*/m4/.*" - ".*/autom4te.*/.*" - ".*/autotools/.*" # Version control and dependencies - ".*/\\.git/.*" - ".*/\\.svn/.*" - ".*/\\.hg/.*" - ".*/\\.deps/.*" - ".*/node_modules/.*" - ".*/vendor/.*" - ".*/third_party/.*" - ".*/extern/.*" - ".*/external/.*" - ".*/packages/.*" # Performance and profiling - ".*/benchmark.*/.*" - ".*/perf.*/.*" - ".*/profile.*/.*" - ".*/bench/.*" # Tools and scripts - ".*/tool.*/.*" - ".*/script.*/.*" - ".*/utils/.*" - ".*/util/.*" - ".*/helper.*/.*" - ".*/misc/.*" # Language-specific binding/wrapper directories - ".*/python/.*" - ".*/java/.*" - ".*/ruby/.*" - ".*/perl/.*" - ".*/php/.*" - ".*/csharp/.*" - ".*/dotnet/.*" - ".*/go/.*" # Generated and temporary files - ".*/generated/.*" - ".*/gen/.*" - ".*/temp/.*" - ".*/tmp/.*" - ".*/cache/.*" - ".*/\\.cache/.*" - ".*/log.*/.*" - ".*/logs/.*" - ".*/result.*/.*" - ".*/results/.*" - ".*/output/.*" # Configuration and metadata files (by extension) - ".*\\.md$" - ".*\\.txt$" - ".*\\.xml$" - ".*\\.json$" - ".*\\.yaml$" - ".*\\.yml$" - ".*\\.toml$" - ".*\\.ini$" - ".*\\.cfg$" - ".*\\.conf$" - ".*\\.properties$" - ".*\\.cmake$" - ".*Makefile.*" - ".*makefile.*" - ".*configure.*" - ".*\\.am$" - ".*\\.in$" - ".*\\.ac$" - ".*\\.log$" - ".*\\.cache$" - ".*\\.lock$" - ".*\\.tmp$" - ".*\\.bak$" - ".*\\.orig$" - ".*\\.swp$" - ".*~$" # IDE and editor files - ".*/\\.vscode/.*" - ".*/\\.idea/.*" - ".*/\\.eclipse/.*" - ".*\\.DS_Store$" - ".*Thumbs\\.db$" languages_with_exclusions: - c - cpp - java - javascript - python - go - kotlin - csharp - php - ruby - swift - jimple - ghidra taint_sources: c: - getenv - fgets - scanf - read - recv - accept - fopen - gets - getchar - fscanf - fread - recvfrom - recvmsg - getopt - getopt_long - getpass - getpwuid - getgrgid - gethostbyname - getaddrinfo - socket - listen - bind - connect cpp: - getenv - fgets - scanf - read - recv - accept - fopen - gets - getchar - fscanf - fread - recvfrom - recvmsg - cin - getline - getopt - getopt_long - getpass - getpwuid - getgrgid - gethostbyname - getaddrinfo - socket - listen - bind - connect java: - getParameter - getQueryString - getHeader - getCookie - getCookies - getRemoteAddr - getRemoteHost - getRemoteUser - getAuthType - getProtocol - getScheme - getServerName - getServerPort - getRequestURI - getRequestURL - getServletPath - getContextPath - getPathInfo - getPathTranslated - getReader - getInputStream - getPart - getParts - getLocales - getLocale - getAttribute - getAttributeNames - getInitParameter - getInitParameterNames - System.getenv - System.getProperty - Scanner.next - Scanner.nextLine - BufferedReader.readLine - Console.readLine - DataInputStream.readUTF - ObjectInputStream.readObject - Socket.getInputStream - ServerSocket.accept javascript: - req.body - req.query - req.params - req.headers - req.cookies - req.files - req.file - req.url - req.originalUrl - req.path - req.hostname - req.ip - req.ips - req.protocol - req.get - req.header - req.accepts - req.acceptsCharsets - req.acceptsEncodings - req.acceptsLanguages - process.env - process.argv - fs.readFile - fs.readFileSync - fs.createReadStream - http.get - https.get - axios.get - fetch - XMLHttpRequest - WebSocket - socket.on - prompt - readline python: - input - raw_input - sys.argv - os.environ - os.getenv - flask.request.args - flask.request.form - flask.request.values - flask.request.cookies - flask.request.headers - flask.request.json - flask.request.data - flask.request.files - django.request.GET - django.request.POST - django.request.COOKIES - django.request.META - django.request.FILES - django.request.body - django.request.path - django.request.path_info - django.request.method - django.request.resolver_match - django.request.content_type - django.request.content_params - bottle.request.args - bottle.request.forms - bottle.request.files - bottle.request.query - bottle.request.params - bottle.request.GET - bottle.request.POST - bottle.request.cookies - bottle.request.headers - bottle.request.json - bottle.request.body - pyramid.request.GET - pyramid.request.POST - pyramid.request.params - pyramid.request.body - pyramid.request.json - pyramid.request.cookies - pyramid.request.headers - aiohttp.request.match_info - aiohttp.request.query - aiohttp.request.post - aiohttp.request.json - aiohttp.request.content - aiohttp.request.text - aiohttp.request.read - tornado.request.query - tornado.request.body - tornado.request.files - tornado.request.cookies - tornado.request.headers - falcon.request.params - falcon.request.media - falcon.request.stream - falcon.request.headers - falcon.request.cookies - socket.recv - socket.recvfrom - socket.recvmsg - socket.recv_into - socket.recvfrom_into - socket.recvmsg_into go: - os.Args - os.Getenv - os.Environ - flag.String - flag.Int - flag.Bool - flag.Float64 - flag.Duration - flag.Var - flag.Parse - net/http.Request.FormValue - net/http.Request.PostFormValue - net/http.Request.Form - net/http.Request.PostForm - net/http.Request.MultipartForm - net/http.Request.Header - net/http.Request.Body - net/http.Request.URL.Query - net/http.Request.Cookies - net/http.Request.Cookie - net/http.Request.UserAgent - net/http.Request.Referer - io/ioutil.ReadAll - bufio.NewReader - bufio.NewScanner - fmt.Scan - fmt.Scanf - fmt.Scanln - fmt.Fscan - fmt.Fscanf - fmt.Fscanln csharp: - Console.ReadLine - Console.Read - System.Environment.GetEnvironmentVariable - System.Environment.GetCommandLineArgs - Request.QueryString - Request.Form - Request.Cookies - Request.Headers - Request.Params - Request.BinaryRead - Request.InputStream - Request.Url - Request.UserHostAddress - Request.UserHostName - Request.UserAgent - Request.ServerVariables - System.IO.File.ReadAllText - System.IO.File.ReadAllLines - System.IO.File.ReadAllBytes - System.IO.StreamReader.ReadLine - System.IO.StreamReader.ReadToEnd - System.Net.Sockets.Socket.Receive - System.Net.WebClient.DownloadString - System.Net.WebClient.DownloadData - System.Net.Http.HttpClient.GetStringAsync - System.Net.Http.HttpClient.GetByteArrayAsync - System.Net.Http.HttpClient.GetStreamAsync php: - $_GET - $_POST - $_COOKIE - $_REQUEST - $_FILES - $_SERVER - $_ENV - $HTTP_GET_VARS - $HTTP_POST_VARS - $HTTP_COOKIE_VARS - $HTTP_POST_FILES - $HTTP_SERVER_VARS - $HTTP_ENV_VARS - getenv - file_get_contents - fread - fgets - fgetc - file - readfile - socket_read - socket_recv - socket_recvfrom - socket_recvmsg - stream_get_contents - stream_get_line taint_sinks: c: - system - popen - execl - execv - execve - execlp - execvp - execvpe - execle - sprintf - fprintf - snprintf - vsprintf - vfprintf - vsnprintf - strcpy - strcat - gets - memcpy - memmove - memset - strncpy - strncat - strtok - strtok_r - realpath - syslog - open - openat - creat - fopen - freopen - fdopen - popen - tmpfile - mkstemp - mkdtemp - mktemp - remove - rename - link - symlink - unlink - mkdir - rmdir - chdir - fchdir - chroot - chmod - fchmod - chown - fchown - lchown - truncate - ftruncate - access - faccessat - stat - fstat - lstat - statat - utime - utimes - futimes - lutimes - futimens - utimensat - connect - bind - send - sendto - sendmsg - write - writev - pwrite - pwritev - printf - vprintf - dprintf - vdprintf - scanf - fscanf - sscanf - vscanf - vfscanf - vsscanf - malloc - calloc - realloc - free - alloca cpp: - system - popen - execl - execv - execve - execlp - execvp - execvpe - execle - sprintf - fprintf - snprintf - vsprintf - vfprintf - vsnprintf - strcpy - strcat - gets - memcpy - memmove - memset - strncpy - strncat - strtok - strtok_r - realpath - syslog - open - openat - creat - fopen - freopen - fdopen - popen - tmpfile - mkstemp - mkdtemp - mktemp - remove - rename - link - symlink - unlink - mkdir - rmdir - chdir - fchdir - chroot - chmod - fchmod - chown - fchown - lchown - truncate - ftruncate - access - faccessat - stat - fstat - lstat - statat - utime - utimes - futimes - lutimes - futimens - utimensat - connect - bind - send - sendto - sendmsg - write - writev - pwrite - pwritev - printf - vprintf - dprintf - vdprintf - scanf - fscanf - sscanf - vscanf - vfscanf - vsscanf - malloc - calloc - realloc - free - alloca - cin - cout - cerr - clog - wcin - wcout - wcerr - wclog java: - Runtime.exec - ProcessBuilder.start - System.load - System.loadLibrary - java.io.File - java.io.FileInputStream - java.io.FileOutputStream - java.io.FileReader - java.io.FileWriter - java.io.RandomAccessFile - java.net.Socket - java.net.ServerSocket - java.net.URL - java.net.URI - java.sql.Statement.executeQuery - java.sql.Statement.executeUpdate - java.sql.Statement.execute - java.sql.Connection.prepareStatement - java.sql.Connection.prepareCall - javax.persistence.EntityManager.createQuery - javax.persistence.EntityManager.createNativeQuery - org.hibernate.Session.createQuery - org.hibernate.Session.createSQLQuery - javax.servlet.http.HttpServletResponse.sendRedirect - javax.servlet.http.HttpServletResponse.addHeader - javax.servlet.http.HttpServletResponse.addCookie - javax.servlet.RequestDispatcher.forward - javax.servlet.RequestDispatcher.include - java.util.logging.Logger.info - java.util.logging.Logger.warning - java.util.logging.Logger.severe - java.util.logging.Logger.log - org.apache.log4j.Logger.info - org.apache.log4j.Logger.warn - org.apache.log4j.Logger.error - org.apache.log4j.Logger.fatal - org.slf4j.Logger.info - org.slf4j.Logger.warn - org.slf4j.Logger.error - org.slf4j.Logger.debug - org.slf4j.Logger.trace javascript: - eval - setTimeout - setInterval - Function - child_process.exec - child_process.execSync - child_process.spawn - child_process.spawnSync - child_process.execFile - child_process.execFileSync - fs.writeFile - fs.writeFileSync - fs.appendFile - fs.appendFileSync - fs.createWriteStream - fs.unlink - fs.unlinkSync - fs.rename - fs.renameSync - fs.chmod - fs.chmodSync - fs.chown - fs.chownSync - fs.rmdir - fs.rmdirSync - fs.mkdir - fs.mkdirSync - res.send - res.json - res.jsonp - res.render - res.redirect - res.write - res.end - res.sendFile - res.download - res.set - res.header - res.cookie - res.clearCookie - res.attachment - res.append - res.location - res.links - res.type - res.format - res.vary - res.status - res.sendStatus - document.write - document.writeln - document.body.innerHTML - element.innerHTML - element.outerHTML - element.insertAdjacentHTML - location.href - location.replace - location.assign - window.open python: - eval - exec - os.system - os.popen - os.spawn - os.execl - os.execle - os.execlp - os.execv - os.execve - os.execvp - os.execvpe - subprocess.call - subprocess.check_call - subprocess.check_output - subprocess.Popen - subprocess.run - pickle.load - pickle.loads - cPickle.load - cPickle.loads - yaml.load - yaml.full_load - sqlite3.execute - sqlite3.executemany - sqlite3.executescript - psycopg2.execute - psycopg2.executemany - MySQLdb.execute - MySQLdb.executemany - pymysql.execute - pymysql.executemany - cx_Oracle.execute - cx_Oracle.executemany - sqlalchemy.execute - django.db.connection.cursor().execute - flask.render_template - flask.render_template_string - jinja2.Template - jinja2.Environment - mako.template.Template - cheetah.template.Template - logging.info - logging.warning - logging.error - logging.critical - logging.exception - logging.log - open - file - io.open - codecs.open go: - os/exec.Command - os/exec.CommandContext - syscall.Exec - syscall.ForkExec - syscall.StartProcess - os.StartProcess - net/http.ResponseWriter.Write - fmt.Printf - fmt.Fprintf - fmt.Sprintf - fmt.Print - fmt.Fprint - fmt.Sprint - fmt.Println - fmt.Fprintln - fmt.Sprintln - log.Print - log.Printf - log.Println - log.Fatal - log.Fatalf - log.Fatalln - log.Panic - log.Panicf - log.Panicln - database/sql.DB.Query - database/sql.DB.QueryRow - database/sql.DB.Exec - database/sql.Tx.Query - database/sql.Tx.QueryRow - database/sql.Tx.Exec - html/template.New - html/template.ParseFiles - html/template.ParseGlob - text/template.New - text/template.ParseFiles - text/template.ParseGlob - os.Open - os.OpenFile - os.Create - io/ioutil.WriteFile csharp: - System.Diagnostics.Process.Start - System.Data.SqlClient.SqlCommand.ExecuteReader - System.Data.SqlClient.SqlCommand.ExecuteNonQuery - System.Data.SqlClient.SqlCommand.ExecuteScalar - System.Data.OleDb.OleDbCommand.ExecuteReader - System.Data.OleDb.OleDbCommand.ExecuteNonQuery - System.Data.OleDb.OleDbCommand.ExecuteScalar - System.Data.Odbc.OdbcCommand.ExecuteReader - System.Data.Odbc.OdbcCommand.ExecuteNonQuery - System.Data.Odbc.OdbcCommand.ExecuteScalar - System.Data.OracleClient.OracleCommand.ExecuteReader - System.Data.OracleClient.OracleCommand.ExecuteNonQuery - System.Data.OracleClient.OracleCommand.ExecuteScalar - Response.Write - Response.WriteFile - Response.TransmitFile - Response.BinaryWrite - Response.Redirect - System.IO.File.WriteAllText - System.IO.File.WriteAllLines - System.IO.File.WriteAllBytes - System.IO.File.AppendAllText - System.IO.File.AppendAllLines - System.IO.StreamWriter.Write - System.IO.StreamWriter.WriteLine - System.Console.Write - System.Console.WriteLine php: - exec - passthru - shell_exec - system - proc_open - popen - pcntl_exec - eval - assert - preg_replace - create_function - include - include_once - require - require_once - echo - print - printf - vprintf - file_put_contents - fwrite - fputs - fopen - unlink - rmdir - mkdir - rename - copy - move_uploaded_file - header - setcookie - setrawcookie - mysql_query - mysqli_query - mysqli::query - pg_query - pg_execute - mssql_query - sqlite_query - sqlite_exec - PDO::query - PDO::exec - PDO::prepare query: timeout: ${QUERY_TIMEOUT:30} cache_enabled: ${QUERY_CACHE_ENABLED:true} cache_ttl: ${QUERY_CACHE_TTL:300} storage: workspace_root: ${WORKSPACE_ROOT:/tmp/codebadger} cleanup_on_shutdown: ${CLEANUP_ON_SHUTDOWN:true}