UnboundCompute/lachesis

Overview

Lachesis is a compiler-precise code property graph for C, Python, and TypeScript, exposed as a navigable interface over the Model Context Protocol (MCP). It enables data-flow and taint-flow analysis with source-to-sink witnesses, points-to information, and guard/sink structure for security reasoning over source code.

Best for

Best for
Security researchers and developers analyzing cross-language codebases for taint flow and vulnerability paths.

Use cases

• Trace taint flow from user inputs to dangerous sinks across C, Python, or TypeScript code
• Query code property graphs via MCP to identify security-relevant data dependencies
• Analyze points-to and guard structures to reason about vulnerability reachability

How to use

Install

python -m pip install lachesis-cpg

Tools exposed

• hubs
• search
• callers
• callees
• read_body
• open_file
• open_folder
• flow
• sources_of
• reaches
• points_to
• aliases
• taint
• scan
• explain

Tested with

Cursor, VS Code, Claude

Example client config

{"mcpServers":{"lachesis":{"command":"lachesis","args":["mcp"]}}}

Notes

Lachesis is a compiler-precise code property graph for C, Python, and TypeScript, exposed as a navigable interface over the Model Context Protocol (MCP). It enables data-flow and taint-flow analysis with source-to-sink witnesses, points-to information, and guard/sink structure for security reasoning over source code.

3 stars on GitHub. Last updated 2026-09-07. Licensed AGPL-3.0.

Use cases

• Trace taint flow from user inputs to dangerous sinks across C, Python, or TypeScript code
• Query code property graphs via MCP to identify security-relevant data dependencies
• Analyze points-to and guard structures to reason about vulnerability reachability

Pros

• Compiler-precise analysis provides high-fidelity code property information
• Supports multiple languages (C, Python, TypeScript) in one graph
• Offers concrete source-to-sink witnesses for taint-flow findings

Cons

• Very low community adoption (3 stars) suggests early-stage maturity
• Requires an MCP-compatible environment to navigate the graph
• Compiler-level precision may incur significant computational overhead

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.