Switch/attach the active graph the whole server reasons over — point it at a different target (e.g. bnxt -> igb) mid-session with no restart. Takes a canonical graph JSON path and an optional overlay + profile; the graph loads once and every subsequent tool hits the in-memory copy.

Build a Lachesis graph from a source directory and attach it — the zero-config way to start on a repo that has no graph yet, no separate lachesis build step needed. Content-addressed: an unchanged tree returns instantly from cache; pass refresh=true to force a rebuild. On success the new graph is loaded, so the next tool call reasons over it. Toolchain: Python needs nothing extra; TypeScript/JavaScript need node on PATH and C needs clang — a missing one comes back as an actionable 'missing toolchain prerequisite' error, not a crash. Builds run in-process and can take minutes on a large tree (capped by timeout_seconds, default 300); a build longer than the MCP client's own request timeout may need a smaller subtree or an out-of-band lachesis build.

The subsystem's spine: the N highest-degree functions over the UNION call graph (direct CALLS + indirect function-pointer / ops-struct / runtime dispatch), ranked by fan_in + fan_out — no name knowledge needed. Each row carries node_id + handle (file:line), fan_in/fan_out/degree, and entry-point flags (exported | dispatch_target | callback). Language-agnostic cold-start: start here to find what a subsystem is built around, THEN callers/callees/read_body to traverse.

The codebase's SUBSYSTEMS: partitions the call graph into clusters that call each other more than the rest of the tree (label propagation), independent of the directory layout — the structure the code HAS, not how it was filed. Each community carries a label (its highest-degree member), size, cohesion, the files it spans, and its top members with node_id + handle. Reports the graph modularity and lifts out cross-cutting connector hubs. Partitions over precise compiler calls by default; set include_dispatch for C function-pointer trees. Use AFTER hubs to go from 'what is central' to 'what are the parts'.

Resolve a function/method/type/file name to its canonical node id(s) with file:line. Teleport to any symbol, fuzzy by default. Returns a real match total with paging (limit/offset), and de-prioritizes test/spec symbols. NOTE: on a cold graph prefer guards_top first — blind name-search has no ranking; use this once you know a name.

Who calls this symbol — direct + indirect dispatch (function-pointer / ops-struct / runtime), external stubs filtered. Each row tagged via: direct | indirect(may_invoke|context|fn-pointer). Set direct_only to get only resolved decl->decl CALLS. A jump move.

What this symbol calls — direct + indirect dispatch, in-repo only. Each row tagged via: direct | indirect(...); an indirect row with resolved:false is an unresolved function-pointer slot (the indirection is real, the target isn't pinned). Set direct_only for resolved decl->decl CALLS only. A jump move.

Read a function/method's real source (L3) — the 'open this and read it' move, so an agent never falls back to cat. Accepts a name or a node_id; returns the exact source span from byte offsets plus {node_id, name, file, start_line, end_line}, capped at max_chars (default 4000) with a truncated flag. If the file/offsets are unavailable it reconstructs a best-effort body from the function's L3 body nodes in line order.

L1 file graph: imports, declarations, intra-file calls, cross-file jump-stubs for one file (repo-relative path). Returns a {nodes,edges,manifest} graph.

Read-only. L0 folder graph rooted at a path prefix: folder -> file -> declarations. The coarsest orientation move — use it to see what lives under a directory before drilling in with open_file (one file's graph) or read_body (one function's source). Returns a {nodes, edges, manifest} graph.

Read-only. List the graph's explicit comprehension frontiers: unresolved calls, dynamic/reflective runtime behavior, and parser/compiler diagnostics. It separates proven-absent from couldn't-cross, so you never read a missing fact as 'none'. Call it to gauge how much of an answer is trustworthy; scope to one function or survey the whole graph.

Read-only. Report deterministic graph coverage by component: how many files and callable bodies are indexed, plus diagnostics and unmodeled frontiers. It measures what the graph contains, not per-client session activity — use it to decide whether an empty result means 'clean' or 'not analyzed'. All params optional.

For a field/property, list graph-evidenced initialization, modification, reads, checks, and value-flow events with owning functions.

Compare structurally similar callables by callees and control structure. Returns differences as facts only; it does not rank anomalies or issue verdicts.

Read-only. Explain a type from graph facts: its fields plus the methods that construct, mutate, consume, or destroy it, each role graph-derived. Use it to learn a struct/class's shape and how it is handled before reading call sites. Paginate fields with offset and methods with member_offset.

Read-only. Show every call, callback, and type reference crossing between two path components, in both directions, with confidence and file:line. Use it to audit the contract between two modules/dirs; cross_boundary_paths adds rarity ranking over the same crossings. Components are path prefixes (e.g. src/net vs src/crypto).

Resolve function-pointer, callback, ops-table, and runtime dispatch sites inside a function. Keeps unresolved sites visible and reports confidence.

Read-only. Map the codebase's architecture: deterministic file communities over the call + dependency graph, each with internal/boundary edge counts and its call-graph hubs (labels are graph-derived member names, never generated prose). A directory-independent 'what are the big pieces' view — use communities for function-level subsystems and hubs for the central functions. All params optional; paginate communities with offset and files with file_offset.

Read-only. Bounded forward call-and-branch trace from an entry point, following resolved indirect dispatch — the ordered structure of what runs, not generated narrative prose. Use it to see the control skeleton reachable from an entry; bound cost with max_depth/max_steps and page the branches/frontier. For pure centrality use hubs instead.

Read-only. Join a symbol to its Git history: the exact commits that touched it with author, date, and subject. Returns history facts only — no generated 'why' narrative. Use it to date a change or find who last touched a function; newest first, paged with limit/offset.

Find exact references to a symbol in test/spec files, including nearby assertion evidence. Reads the recorded source tree because tests are normally excluded from the production graph.

Read-only. Link a symbol to its documentation and source comments, preserving any standards URLs (RFCs, CVEs) and exact file:line evidence. Use it to recover the spec/standard a function implements; returns comment/doc references paged with limit/offset. Reads recorded source, so it works even where comments are outside the production graph.

Search code by behavior rather than spelling using an optional local embedding model. Search is offline-only and never downloads implicitly; install the concept-search extra and run lachesis concept-model download.

Return a minimal coherent factual set for a code question: relevant symbols, call relationships, conditions, tests, specs, and explicit unknowns. Uses identifier/graph relevance until concept_search embeddings are configured.

Return ranked leads from the whole taxonomy by default (lens=all): questions to investigate, never verdicts. Use lens=guard-diff for the entrypoint-to-effect guard view or lens=flow for native object-lifetime leads. Results are bounded and paged; the response includes coverage and whether the requested temporal work completed. Calls against one session are serialized; the native runtime is selected internally.

Infer wrapper semantics from graph evidence: allocator, deallocator, I/O, validator, and forwarding call roles. This is evidence with confidence, not a registry mutation.

Check whether recognized guards on an entry-to-effect call path dominate the effect. Returns proven, skippable, or undecided evidence and never emits a safety verdict.

Find a bounded call path from src to sink that avoids a named validator/guard. This is the inverse reachability move; absence of a path is not proof when the search is truncated.

Read-only. Trace the producers, mutators, checkers, and consumers of a value or field over a bounded local flow cone — who sets it, who guards it, who reads it. Use it to reconstruct an invariant around one value; returns role-tagged nodes with file:line, bounded by depth. Local, not interprocedural — use flow / sources_of to cross call seams.

Read-only. Compare two functions/paths side by side for graph-visible calls, control structure, conversions, and side-effect differences — e.g. an encode/decode or serialize/parse pair. Returns the differences as facts only, inferring no semantic verdict. Use sibling_compare for auto-discovered structural peers, this for a deliberate two-sided pairing.

List crossings between two components with boundary tags and rarity ranking, preserving direction and confidence.

Read-only. Return the lightweight numeric evidence graph guards expose for a value (comparisons, bounds checks) — not a full interval solve: real value-range analysis stays unavailable until the numeric model ships, and the response names that frontier honestly. Scope with value and/or function; omit both for the capability report.

Read-only. Report what lifecycle evidence the graph holds for a value or function — Pass 3 alloc/release/deref/alias/generation events and its source-rooted coverage — plus the matcher leads that relate them. Give value or function to scope it; omit both for the capability report. Prefer field_history for one field's events and flow_pass for the composed interprocedural summary.

Read-only. For one function, report its exit paths (returns / error branches) and the resource-handling evidence on them, plus the honest frontier: complete transfer summaries remain a separate frontier from the lifecycle graph. Use it to see how a function leaves on its error paths; pair with guards and flow_pass for the interprocedural picture.

Read-only. Forward value-flow cone from a value/symbol: everything it can reach over VALUE_FLOWS_TO + POINTS_TO, bridging aliases through the heap. Use it to answer 'where does this value go?'; for the reverse (what feeds a sink) use sources_of, and for a yes/no witness between two points use reaches. Returns labeled nodes/edges; a missing path is over-approximation-safe, not proof of none.

Read-only. Does src reach sink through value flow? Returns the labeled witness path when it does, or an honest negative when it doesn't (a negative under truncation is not proof of no path). Use it to confirm one specific source->sink pair; use flow/sources_of to explore a whole cone. NOTE: it follows VALUE_FLOWS_TO/POINTS_TO, a different edge set than taint, so adjudicate taint witnesses from their own path.

Read-only reverse value-flow cone for a sink. Use this after a candidate or sink is selected to find values that may feed it; it returns labeled nodes and edges plus explicit truncation/frontier metadata. A missing path is not proof that no flow exists.

Read-only. Return the heap objects a value may point to through POINTS_TO edges — the alias set behind a pointer. Use it for pointer/alias follow-up, not for callers (callers) or value-flow (flow/reaches). Returns the pointed-to objects with path evidence plus explicit unknowns; a missing edge is over-approximation-safe, not proof the pointer is null.

Read-only. Return the values that alias this one — those sharing a heap object through POINTS_TO (the destructuring / alias set). Use it to find every name for the same object before reasoning about a mutation; complements points_to (objects a value points to) and flow (where a value goes). Response carries the alias set with path evidence.

Enumerate and rank every observable obligation site as leads. This is a pointer, not a safety check: leads are never suppressed because a size is constant, a guard seems nearby, or no input flow was witnessed. The result is bounded and paged with leads, total, and next_offset; call candidate_census for the full coverage roster. Calls against one session are serialized and the first cold bind can be expensive.

Return the complete neutral evidence capsule for one candidate id. It contains observations and bounded inferences, but no safe/unsafe verdict.

Report constructor metadata, exhaustive counts, and explicit analysis frontiers. Use this to distinguish an empty result from missing coverage.

One shot from a candidate (by id, or by the sink's file:line) to a judgeable picture: the obligation and where it lands, the guard the enclosing function does or does not place over it, the bounded reverse value-flow cone into the sink, and the enclosing function's source read inline -- the census->candidates->detail->sources_of->read_body chain composed into one result. Provenance and guard are evidence, not verdicts: an empty cone is 'nothing observed under this tier', not 'unreachable'. Pass candidate_id, or file and line.

Render a function's sink map as a pseudo-function: every catalogued sink (all families -- memory, os, file, ...) shown in place, each annotated with its size expression, destination-capacity status, and guard dominance (fall-through | guarded-region | none-observed), plus the branch/loop structure that scopes them, with everything else elided. A sink is not adjudicable alone -- the guard that dominates it decides it -- so co-locating each sink with its controlling branches and loops makes closure a local read. Every obligation on a line is shown, highest-rank first; operand provenance is a drill-down (candidate_detail / sources_of). Pass function (a name or node id) for the whole enclosing function, or candidate_id to focus its enclosing function.

Warm this graph's sidecars once (the 2nd pass), so later flow_pass / leads / candidates / explain answer fast instead of paying the cost cold. Folds the dataflow tier over the whole graph and binds the catalog, and persists both beside the store (.dataflow.pb / .bind.pb) -- the difference between a >120s cold census and an instant one. Idempotent: a store already enriched is a no-op that just reports what is on disk. An unevaluated temporal family is reported as 'not evaluated', never 'clean'. No arguments.

Run the interprocedural flow pass (the 3rd pass) over the whole graph and return its per-function SUMMARY census -- the layer beneath the skeletons. For each function: its taxonomy, whether it is a taint source, the ordered sink-flow signatures (which value reaches which sink, guarded or not, and the callee it flows through), and the pointer lifetime signatures (alloc->use->free->escape). This is the composed, interprocedural summary the shape matcher runs on -- one call materializes and caches the pass. The response returns counts and a bounded lead page, never the whole semantic graph. Use function to scope to one function; paginate with offset/limit.

Query the flow pass's LEADS in memory -- the shape-matcher findings the 3rd pass already computed and cached, not a fresh cold run. This is the warm counterpart to re-deriving leads by hand every question: the pass is materialized once (via flow_pass), then this filters the held result. No arg: a by-pattern summary plus the honesty fields (whether the run timed out, which functions were truncated) -- an empty result over a partial run is never 'clean'. pattern filters to one bug shape; function to one enclosing function; at locates by source position file, file:line, or file:lo-hi (a lead carries only its function + line, so the file is resolved through the symbol index; a basename or path suffix is enough). Leads are leads, not verdicts -- adjudicate with sources_of/reaches. Calls against one session are serialized; results are bounded and paged.

Interprocedural flow skeletons: compose per-function summaries into linear, nesting-aware {control|sink|lifecycle} streams STITCHED across call seams -- the cross-function flow a single-function skeleton cannot show -- then match shape patterns over them. Two skeleton kinds: REACH (a value's guard-nesting down the call chain to a sink; feeds the guarded-vs-unguarded size differential) and TYPESTATE (a pointer's ordered alloc/use/free/escape; feeds double-free / use-after-free / leak). Returns shape-matcher LEADS (not verdicts -- adjudicate with sources_of/reaches). No arg: every lead, source-rooted first. The response is bounded to a lead page and reports graph counts, never the whole graph. Pass function to scope to one entry and kind to filter reach|typestate.

Taint witnesses from the Atropos catalog: where untrusted input actually reaches a dangerous sink through value flow. Folds the Atropos taint models (sources / sinks / summaries) onto this graph's exact nodes and runs propagation, returning each source->sink reach with the catalog model id, CWE, and file:line for both ends. atropos_connected rows are the ones a catalog fact drove (e.g. request -> urlopen SSRF); the rest are the engine's own generic-role reaches. Costs one whole-graph value-flow build on first call per graph (cached after). A no-op with a clear reason if the Atropos catalog is not checked out. Each witness carries source_id/sink_id, the exact graph node ids of the bound endpoints, plus path -- the ordered source->sink hops taint actually walked ({id,label,at} each). Adjudicate a witness from its path (read source at each hop); do NOT re-derive it with reaches, which follows a different edge set (VALUE_FLOWS_TO/POINTS_TO) and can return 0 hops for a pair taint reached over REACHING_DEF/summary edges. unwitnessed lists bound sinks/sources that took part in no reach -- feed those ids straight to sources_of/flow/reaches to trace why (on a C graph they mark where value-flow gaps sever the chain); no name resolution needed since the endpoint is often an external callee the name index can't seed.