srinivasan-sundaresan95/orihime

Overview

A cross-repo code knowledge graph that serves as an MCP server for Java, Kotlin, JavaScript, and TypeScript. It performs taint analysis, builds call graphs, and generates OWASP security reports, claiming to use 95% fewer tokens than direct source code reading.

Best for

Best for
Developers needing efficient cross-repo vulnerability analysis and call graph visualization for Java, Kotlin, or JavaScript/TypeScript projects.

Use cases

• Analyze cross-repo code dependencies and call graphs
• Detect security vulnerabilities via taint analysis
• Generate OWASP-compliant security reports for multi-repo projects

How to use

Install

pip install -e .

Tools exposed

• serve-sse
• write-server
• install-skills
• ORIHIME_DB_PATH
• ORIHIME_SERVER_URL
• CALLS_REST
• UNRESOLVED_CALL
• CONTAINS_CLASS
• CONTAINS_METHOD
• DEPENDS_ON
• HAS_RELATION
• OBSERVED_AT
• find_callers

Tested with

Claude Desktop, Claude Code, Cursor

Notes

A cross-repo code knowledge graph that serves as an MCP server for Java, Kotlin, JavaScript, and TypeScript. It performs taint analysis, builds call graphs, and generates OWASP security reports, claiming to use 95% fewer tokens than direct source code reading.

0 stars on GitHub. Last updated 2026-05-15.

Use cases

• Analyze cross-repo code dependencies and call graphs
• Detect security vulnerabilities via taint analysis
• Generate OWASP-compliant security reports for multi-repo projects

Pros

• Dramatically reduces token consumption for LLM-based code analysis
• Covers multiple major languages (Java, Kotlin, JS/TS)
• Produces actionable OWASP security reports

Cons

• Zero GitHub stars indicates early stage or limited adoption
• Potential lack of community support and documentation
• Taint analysis accuracy may vary for complex codebases

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.