Skillget

codebadger

mcp
Security Audit
Fail
Health Pass
  • License — License: GPL-3.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 159 GitHub stars
Code Fail
  • rm -rf — Recursive force deletion command in cleanup.sh
  • fs.rmSync — Destructive file system operation in config.example.yaml
  • process.env — Environment variable access in config.example.yaml
  • network request — Outbound network request in config.example.yaml
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This tool is a containerized MCP server that performs deep static code analysis on local or remote codebases using Joern's Code Property Graph technology, supporting a wide variety of programming languages.

Security Assessment
Overall Risk: Medium. The server requires executing shell commands to manage Docker containers and run the underlying analysis engine. The automated scan flagged a recursive force deletion command (`rm -rf`) inside the provided `cleanup.sh` script, which poses a risk of accidental local data loss if executed carelessly. Additionally, the tool handles environment variables and makes outbound network requests, which is expected behavior since it must fetch external GitHub URLs and manage local Docker services. No hardcoded secrets or dangerous broad permissions were detected, but because the tool has built-in capabilities to read your local file system and execute custom queries, it should be treated with caution.

Quality Assessment
The project is healthy and actively maintained, with its most recent push occurring just today. It uses a standard GPL-3.0 license and has earned a solid baseline of community trust, currently sitting at 65 GitHub stars. The documentation is comprehensive and clearly details setup, cleanup, and integration steps for popular AI clients like GitHub Copilot and Claude Desktop.

Verdict
Use with caution: the tool itself is a legitimate static analyzer, but users should carefully inspect and understand the destructive file operations inside the `cleanup.sh` script before running it.
SUMMARY

🦡 codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code Property Graphs (CPGs).

README.md

🦡 codebadger

codebadger is a containerized Model Context Protocol (MCP) server that
gives AI agents and LLMs deep, queryable access to a codebase's structure and
data flow through Joern Code Property Graphs (CPGs).

Point it at a Git repository, a local path, or even a pasted code snippet, and
codebadger builds a CPG and exposes it over MCP — so an assistant can run CPGQL
queries, trace data flow and taint, slice programs, and hunt for vulnerabilities
across Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP,
Ruby, and Swift.

It's a general-purpose foundation for both program analysis (understanding
code structure, call graphs, and data flow) and vulnerability analysis
(taint tracking, bug hunting, and PoC development) — useful for academic
research as well as industry security and engineering work. It's built to
scale to large analysis batches with per-CPG worker pools, memory-aware
scheduling, and a Postgres/Redis backend.

News

codebadger and its paper - Bridging Code Property Graphs and Language Models for
Program Analysis - were accepted at the Software Vulnerability Management
Workshop @ ICSE 2026. 🎉

Documentation

Everything a developer or security researcher needs lives in docs/:

Doc What's in it
Installation Prerequisites and a 5-minute local setup.
Usage Connecting MCP clients, the tool catalog, and a researcher workflow.
LLM workflow guide Recommended bounded tool sequence for agents.
Available Tools Every MCP tool by category, with a description of what each does.
Configuration config.yaml / env reference, telemetry.
Deployment Postgres/Redis, memory sizing, shared vs pool, large batches.
Architecture System design and diagrams.
Security Threat model, trust boundaries, and production hardening.
Custom Tools Add your own detectors.
Contributing Dev setup, tests, and guidelines.
Roadmap What's shipped and what's next.

Found a vulnerability using codebadger?

We'd love to hear about it - open a PR adding it to TROPHIES.md
(CVE ID, project, one-line description, date).

Citation

@inproceedings{lekssays2026bridging,
  title={Bridging Code Property Graphs and Language Models for Program Analysis},
  author={Lekssays, Ahmed},
  booktitle={Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management},
  pages={33--40},
  year={2026}
}

Reviews (0)

No results found