A
licenseB
qualityB
maintenanceA simple MCP (Multimodal Conversational Plugin) server based on Joern that provides code review and security analysis capabilities through natural language interfaces.
18
51
MIT
codebadger
by Elena73626
Provides CPG-based analysis for C/C++ codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Allows agents to point codebadger at Git repositories, build Joern Code Property Graphs, and run CPGQL queries for program analysis, data-flow/taint tracing, slicing, and vulnerability hunting.
Provides CPG-based analysis for JavaScript codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Provides CPG-based analysis for Kotlin codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Provides CPG-based analysis for PHP codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Provides CPG-based analysis for Python codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Provides CPG-based analysis for Ruby codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Provides CPG-based analysis for Swift codebases, enabling CPGQL queries, data-flow and taint tracking, program slicing, and vulnerability discovery.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codebadgerbuild a CPG from this repo and trace taint from user input to SQL"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
🦡 codebadger
codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code Property Graphs (CPGs).
Point it at a Git repository, a local path, or even a pasted code snippet, and codebadger builds a CPG and exposes it over MCP — so an assistant can run CPGQL queries, trace data flow and taint, slice programs, and hunt for vulnerabilities across Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.
It's a general-purpose foundation for both program analysis (understanding code structure, call graphs, and data flow) and vulnerability analysis (taint tracking, bug hunting, and PoC development) — useful for academic research as well as industry security and engineering work. It's built to scale to large analysis batches with per-CPG worker pools, memory-aware scheduling, and a Postgres/Redis backend.
News
codebadger and its paper - Bridging Code Property Graphs and Language Models for Program Analysis - were accepted at the Software Vulnerability Management Workshop @ ICSE 2026. 🎉
Related MCP server: hangang-code-graph
Documentation
Everything a developer or security researcher needs lives in docs/:
Doc | What's in it |
Prerequisites and a 5-minute local setup. | |
Connecting MCP clients, the tool catalog, and a researcher workflow. | |
Recommended bounded tool sequence for agents. | |
Every MCP tool by category, with a description of what each does. | |
| |
Postgres/Redis, memory sizing, | |
System design and diagrams. | |
Threat model, trust boundaries, and production hardening. | |
Add your own detectors. | |
Dev setup, tests, and guidelines. | |
What's shipped and what's next. |
Found a vulnerability using codebadger?
We'd love to hear about it - open a PR adding it to TROPHIES.md (CVE ID, project, one-line description, date).
Citation
@inproceedings{lekssays2026bridging,
title={Bridging Code Property Graphs and Language Models for Program Analysis},
author={Lekssays, Ahmed},
booktitle={Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management},
pages={33--40},
year={2026}
}This server cannot be deployed
Maintenance
ActivityActive
ResponsivenessResponsive
Related MCP Connectors
Repository knowledge graph MCP server for codebase understanding and debugging.
An MCP server that gives your AI access to the source code and docs of all public github repos
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceMCP server for indexing source code from repositories into a Neo4j graph database and enabling Graph RAG-based search and traversal of functions via natural language queries.-
- FlicenseNot gradedqualityAmaintenanceEnables AI agents and LLMs to build Joern Code Property Graphs from repositories, paths, or snippets and query them over MCP for CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting across many languages. It scales to large analysis batches with per-CPG worker pools, memory-aware scheduling, and a Postgres/Redis backend.-
- FlicenseNot gradedqualityAmaintenanceEnables AI agents and LLMs to build Joern Code Property Graphs from Git repos, local paths, or snippets and query them over MCP for CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting across many languages. It also supports large analysis batches with worker pools, memory-aware scheduling, and a Postgres/Redis backend.-