🦡 codebadger

A containerized Model Context Protocol (MCP) server providing static code analysis using Joern's Code Property Graph (CPG) technology with support for Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.

Prerequisites

Before you begin, make sure you have:

• Docker and Docker Compose installed

• Python 3.10+ (Python 3.13 recommended)

• pip (Python package manager)

To verify your setup:

Quick Start

1. Install Python Dependencies

2. Start the Docker Services (Joern)

This starts:

• Joern Server: Static code analysis engine (runs CPG generation and queries)

Verify services are running:

3. Start the MCP Server

The MCP server will be available at http://localhost:4242.

4. Stop All Services

Cleanup Script

Use the provided cleanup script to reset your environment:

This will:

• Stop and remove Docker containers

• Kill orphaned Joern/MCP processes

• Clear Python cache (__pycache__, .pytest_cache)

• Optionally clear the playground directory (CPGs and cached codebases)

Integrations

GitHub Copilot Integration

Edit the MCP configuration file for VS Code (GitHub Copilot):

Path:

Example configuration:

Claude Code Integration

To integrate codebadger into Claude Desktop, edit:

Path:

Add the following:

Available Tools

Core Tools (hash-based)

• generate_cpg: Generate a CPG for a codebase (from local path or GitHub URL)

• get_cpg_status: Get status and existence of a CPG by codebase_hash

• run_cpgql_query: Execute CPGQL queries (synchronous)

Code Browsing Tools

• get_codebase_summary: Get codebase overview

• list_files: List source files

• list_methods: Discover methods/functions

• get_method_source: Retrieve method source code

• list_calls: Find function call relationships

• get_call_graph: Build call graphs

• list_parameters: Get parameter information

• find_literals: Search for hardcoded values

• get_code_snippet: Retrieve code snippets

• find_taint_sources: Locate external input points

• find_taint_sinks: Locate dangerous sinks

• find_taint_flows: Find dataflow paths

• find_argument_flows: Find expression reuse

• check_method_reachability: Check call graph connections

• list_taint_paths: List detailed taint paths

• get_program_slice: Build program slices

Contributing & Tests

Thanks for contributing! Here's a quick guide to get started with running tests and contributing code.

Prerequisites

• Python 3.10+ (3.13 is used in CI)

• Docker and Docker Compose (for integration tests)

Local Development Setup

1. Create a virtual environment and install dependencies

2. Start Docker services (for integration tests)

3. Run unit tests

4. Run integration tests (requires Docker Compose running)

5. Run all tests

6. Cleanup after testing

Code Contributions

Please follow these guidelines when contributing:

1. Follow repository conventions

2. Write tests for behavioral changes

3. Ensure all tests pass before submitting PR

4. Include a clear changelog in your PR description

5. Update documentation if needed

Configuration

The MCP server can be configured via environment variables or config.yaml.

Environment Variables

Key settings (optional - defaults shown):

Config File

Create a config.yaml from config.example.yaml:

Then customize as needed.