trace_dataflow
Trace data flow paths from or to a variable to analyze data lineage, identify tainted data sources, or assess impact of changes.
Instructions
Trace data flow paths from or to a variable/expression.
Use this when you need to:
Forward trace: "Where does this value flow to?" (assignments, function calls, returns)
Backward trace: "Where does this value come from?" (sources, assignments)
Both: Full data lineage from sources to sinks
Direction options:
forward: Follow ASSIGNED_FROM, PASSES_ARGUMENT, FLOWS_INTO edges downstream
backward: Follow edges upstream to find data sources
both: Trace in both directions for complete context
Use cases:
Track tainted data: "Does user input reach database query?" (forward from input)
Find data sources: "What feeds this API response?" (backward from response)
Impact analysis: "If I change this variable, what breaks?" (forward trace)
Returns: List of nodes in the data flow chain with edge types and depth. Tip: Start with max_depth=5, increase if needed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | Variable or node ID to trace from | |
| file | No | File path | |
| direction | No | forward, backward, or both (default: forward) | |
| max_depth | No | Maximum trace depth (default: 10) | |
| limit | No | Max results (default: 10) | |
| detail | No | Level of detail: summary (counts only), normal (auto-compressed, default), full (every node) |