Analyzes C/C++ codebases by building Code Property Graphs, supporting CPGQL queries, call graph and data-flow analysis, program slicing, and vulnerability detection.
Builds Code Property Graphs from Git repositories, enabling CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting across the repository's code.
Analyzes JavaScript codebases by building Code Property Graphs, supporting CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting.
Analyzes Kotlin codebases by building Code Property Graphs, supporting CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting.
Analyzes PHP codebases by building Code Property Graphs, supporting CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting.
Analyzes Python codebases by building Code Property Graphs, supporting CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting.
Analyzes Ruby codebases by building Code Property Graphs, supporting CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting.
Analyzes Swift codebases by building Code Property Graphs, supporting CPGQL queries, data-flow and taint tracing, program slicing, and vulnerability hunting.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code Property Graphs (CPGs).
Point it at a Git repository, a local path, or even a pasted code snippet, and codebadger builds a CPG and exposes it over MCP — so an assistant can run CPGQL queries, trace data flow and taint, slice programs, and hunt for vulnerabilities across Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.
It's a general-purpose foundation for both program analysis (understanding code structure, call graphs, and data flow) and vulnerability analysis (taint tracking, bug hunting, and PoC development) — useful for academic research as well as industry security and engineering work. It's built to scale to large analysis batches with per-CPG worker pools, memory-aware scheduling, and a Postgres/Redis backend.
codebadger and its paper - Bridging Code Property Graphs and Language Models for Program Analysis - were accepted at the Software Vulnerability Management Workshop @ ICSE 2026. 🎉
Related MCP server: OpenCodeHub MCP Server
Everything a developer or security researcher needs lives in docs/:
Doc | What's in it |
Prerequisites and a 5-minute local setup. | |
Connecting MCP clients, the tool catalog, and a researcher workflow. | |
Recommended bounded tool sequence for agents. | |
Every MCP tool by category, with a description of what each does. | |
| |
Postgres/Redis, memory sizing, | |
System design and diagrams. | |
Threat model, trust boundaries, and production hardening. | |
Add your own detectors. | |
Dev setup, tests, and guidelines. | |
What's shipped and what's next. |
We'd love to hear about it - open a PR adding it to TROPHIES.md (CVE ID, project, one-line description, date).
@inproceedings{lekssays2026bridging,
title={Bridging Code Property Graphs and Language Models for Program Analysis},
author={Lekssays, Ahmed},
booktitle={Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management},
pages={33--40},
year={2026}
}This server cannot be deployed
Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
AI-native git hosting — repos, PRs, issues, CI gates, and AI code review over MCP (60 tools).
