Pathfinder MCP server
{
"mcpServers": {
"codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
],
"env": {
"GITHUB_TOKEN": "ghp_..."
}
}
}
}{
"mcpServers": {
"codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
],
"env": {
"GITHUB_TOKEN": "ghp_..."
}
}
}
}{
"mcpServers": {
"codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
],
"env": {
"GITHUB_TOKEN": "ghp_..."
}
}
}
}{
"servers": {
"codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
],
"env": {
"GITHUB_TOKEN": "${input:github_token}"
}
}
},
"inputs": [
{
"id": "github_token",
"type": "promptString",
"description": "Github token",
"password": true
}
]
}{
"mcpServers": {
"codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
],
"env": {
"GITHUB_TOKEN": "ghp_..."
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall uvx codepathfinderversion 2.1.1
What it does
Code Pathfinder is a static analysis engine for Python and Docker that builds call graphs and performs cross-file dataflow analysis to detect vulnerabilities. It traces tainted data across function and file boundaries to find source-to-sink security issues, and exposes this analysis via MCP for AI coding assistants.
- Scan Python projects for SQL injection, RCE, SSRF, and other vulnerabilities that span multiple files and functions.
- Analyze Docker and Docker Compose files for security misconfigurations like root user, exposed secrets, and privileged mode.
- Query call graphs, trace data flows, and search code patterns from Claude, Cursor, or other AI assistants during code review.
Tools this server exposes
| Tool | Does |
|---|---|
| find_callers | Query which functions call a given function in the codebase. |
| find_callees | Query which functions are called by a given function. |
| trace_dataflow | Trace how data flows through the codebase across files and function boundaries. |
| search_pattern | Search for code patterns in the analyzed codebase. |
| run_security_rules | Execute security analysis rules against the codebase to detect vulnerabilities. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.