Code Reason
About
MCP server that gives coding agents program-analysis primitives — data flow, call graphs, taint analysis — so they reason from ground truth instead of grep-and-guess. (same as the GitHub About — keeps your messaging consistent across the web).
Details
- Author
- ph0smet
- Downloads
- 218
- Categories
- Developer Tools, Other
Jump to
- Provides 9 MCP tools for program analysis
- Built on Fraunhofer AISEC’s Code Property Graph for Java and Python
- One analyze pass, unlimited subsequent queries
- Compact JSON evidence chains with intermediate steps and code context
- ~30–40% fewer agent tokens on multi-step security reviews
- Works with any MCP-compatible coding agent
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Code ReasonCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Add code-reason as an MCP server to your coding agent (tested with Claude Code). First call reason_analyze_project to build the CPG, then use any of the other 9 tools — such as reason_find_entry_points, reason_query_dataflow, or reason_trace_taint_path — for unlimited in-memory queries against the same analysis.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"code reason": {
"code-reason": {
"command": "/absolute/path/to/build/install/code-reason/bin/code-reason",
"args": [
"--stdio"
]
}
}
}
}McpServers
{
"code-reason": {
"command": "/absolute/path/to/build/install/code-reason/bin/code-reason",
"args": [
"--stdio"
]
}
}Program analysis for your coding agents.
Instead of grep-and-guess, provide your agents program analysis capabilities with code-reason.
code-reasonis an MCP server that gives coding agents real program-analysis primitives like data-flow reachability, call-graph traversal, and evidence-chain construction, so they verify code behavior from ground truth instead of speculation.
Coding agents are good at reading code, but they struggle with whole-program questions:
- Does user-controlled input actually reach this SQL call, or does sanitization cut the flow off?
- Who really invokes this function across the codebase?
- What is the complete evidence chain from source to sink?
Without a code-analysis tool, the agent answers these bymanual grep-based tracing.It can read code, but it can't actually trace data flow, walk a control graph, or verify that user input reaches a sink. Ask any modern coding agent how it traces taint without a tool, and the answer is some variant of"I read files and follow string matches."
That works for simple cases. The cracks show on anything non-trivial: aliased variables, inter-procedural flow, sanitization checks, framework-injected inputs. The agent still produces an answer, often with high confidence, but it's reading 6+ files to confirm a single chain, burning context on speculation, and silently missing flows it never thought to grep for. For security-sensitive work, a confident wrong answer is more dangerous than no answer at all, and that's exactly what grep-based tracing produces at scale.
code-reason closes the gap. The agent stays in charge ofwhat's interesting; code-reason answerswhat's actually true, backed by a code property graph parsed once and queried cheaply. The result: more deterministic, more token-efficient, faster agents, and agentic security workflows you can actually trust.
Where traditional SAST tools produce findings reports for humans to triage, code-reason exposes the underlying analysis primitives for an agent to drive its own investigation.
Built onFraunhofer AISEC's Code Property Graphfor multi-language data-flow, control-flow, and taint analysis, and theKotlin MCP SDKto expose those capabilities as agent-callable tools.
From dogfood sessions on real Java and Python codebases:
- 30-40% fewer agent tokenson multi-step security reviews, mostly from call-graph queries that would otherwise take 5-10 grep iterations to confirm by hand.
- Compact structured answers, not file dumps.A call-graph query returns reachable methods in JSON; the grep-and-read equivalent forces the agent to read 6+ files to confirm one chain.
- One analysis pass per service, unlimited queries.reason_analyze_projectbuilds the CPG once; every otherreason_tool queries it cheaply.
- Real evidence chains.reason_trace_taint_pathreturns the full source-to-sink path with intermediate steps and code context, not "looks like SQLi maybe."
code-reason sits between the coding agent and a code property graph. The agent drives; code-reason answers.
Coding agent (Claude Code, Cursor, ...) │ MCP over stdio ▼ code-reason server │ ▼ Fraunhofer CPG (Java + Python frontends) │ ▼ Target codebase
-
Analyze.The agent callsreason_analyze_project. CPG parses the target codebase into a multi-graph: abstract syntax, control flow, data flow, and evaluation order, all in one queryable structure.
Query.The agent calls one or morereason_tools, each of which translates to a focused graph operation: taint propagation, call-graph traversal, data-flow reachability, evidence-chain construction.
Reason.Each tool returns a structured result (locations, paths, confidence, evidence). The agent combines those results with its own contextual reasoning and decides what to ask next.
The agent provides theintentand high-level reasoning; code-reason providesground-truth answersagainst the actual graph. No grep-and-guess, no oversized context dumps.
code-reason exposes nine MCP tools, grouped by purpose:
The marquee value is thenavigationanddata flowprimitives; the agent composes them to answer whole-program questions on its own. Thecatalog scantools are a convenience baseline for quick first-pass triage; the agent's own reasoning over the primitives is what makes the difference on real codebases.
The build pulls CPG artifacts from Maven Central and Sonatype Central Snapshots (the latter formain-SNAPSHOTuntil CPG 11.x lands as a stable release on Central). No sibling checkouts required.
The launcher lands atbuild/install/code-reason/bin/code-reason.
Integration tests run the full pipeline against small Java and Python fixtures.
Add code-reason to your.mcp.json(project-scoped) or~/.claude/.mcp.json(global):
{ "mcpServers": { "code-reason": { "command": "/absolute/path/to/build/install/code-reason/bin/code-reason", "args": ["--stdio"] } } }
Restart Claude Code; thereason_tools will appear in its tool list.
A typical agent-driven session, with primitives composing into evidence:
- Agent callsreason_analyze_projectto build the CPG.
- Agent callsreason_find_entry_pointsto enumerate where external input enters the codebase.
- For a suspicious entry point, agent usesreason_find_calleesandreason_query_dataflowto map the downstream reach.
- When the data reaches a sensitive call, agent callsreason_trace_taint_pathfor the full source-to-sink evidence chain.
- Agent reasons about exploitability from the structured result and decides what to investigate next.
For quick first-pass triage, the agent can also callreason_scan_injectionsto surface candidate flows from the built-in catalog, then verify each one withreason_trace_taint_path.
Additional CPG frontends (C/C++, Go, TypeScript, JVM, LLVM, Ruby) can be enabled by adding the correspondingcpg-language-dependency inbuild.gradle.kts.
code-reason is v0.1.0: early, research-grade. CI runs on every push and pull request. The build is currently pinned to CPGmain-SNAPSHOT; this will move to a stable11.xrelease once Fraunhofer publishes one to Maven Central.
Built onFraunhofer AISEC's Code Property Graph.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
A stateful LSP runtime for AI agents: warm language server sessions with 50+ tools for go-to-definition, find-references, diagnostics, rename, and more across 30+ languages.
An MCP service that equips your workspace with a complete set of AI-accessible development tools for reading, editing, executing, and managing code.
Visual Studio extension with 20 Roslyn-powered MCP tools for AI assistants. Semantic code navigation, symbol search, inheritance, call graphs, safe rename, build/test.
Multi-language code-graph MCP server with 18 tools (find_symbol, callers, callees, blast_radius, dataflow_trace) for AI assistants — local-first, no API key required, ~3× fewer tokens than Claude+grep at the same correctness.
A tool for safely executing local Python code without requiring external data files.
AI-to-AI code review platform — Claude, Codex, and Gemini cross-check each other via MCP, REST API, and CLI for consensus-based results.
Persistent code index using Tree-sitter for fast, precise code search. Replaces grep with ~50 token responses instead of 2000+.
AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.
Orchestrates a dual-AI engineering loop where a Primary AI plans and implements, while a Review AI validates and reviews, with continuous feedback for optimal code quality. Supports custom AI pairing (Claude, Codex, Gemini, etc.)
AmazingMCP — MCP Server for .NET / C# Codebases
An MCP server that gives AI agents deep understanding of C# codebases via Roslyn — type search, dependency graphs, usage analysis, and architecture overviews, all from a live in-memory compilation.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
