code-pathfinder
Trace vulnerabilities across files using cross-file taint analysis and ASTs.
Build code graphs and trace data flows to find security vulnerabilities across files and functions.
Code Pathfinder is an open-source static analysis engine that parses code into Abstract Syntax Trees and constructs call graphs to detect source-to-sink vulnerabilities. It suits security teams and developers looking to catch complex cross-file bugs that simple pattern-matching tools miss.
What it is
The engine builds Variable Dependency Graphs per function and connects them through inter-procedural taint transfer summaries. It supports Python, Docker, and Docker Compose with 190 built-in rules downloaded automatically from a CDN.
Who it's for
It suits application security engineers and developers writing Python or Docker configurations who need deep static analysis without cloud lock-in. It does not suit teams working outside of Python and Docker or those needing zero-setup browser-only scanners.
Key features
Cross-File Taint Analysis
Tracks data flow from sources in one file to sinks in another across function boundaries.
MCP Server Integration
Exposes code graphs and security findings directly to AI coding assistants like Claude Code and Cursor.
Built-In Rule Registry
Automatically downloads rules for Python, Docker, and Docker Compose straight from a CDN.
Multiple Output Formats
Exports scan findings to text, JSON, SARIF for GitHub Code Scanning, or CSV.
Up and running in 3 steps
Our honest verdict
What's great
- Performs cross-file taint analysis that pattern-matching SAST tools miss entirely.
- Operates completely locally with no config files, API keys, or cloud accounts required.
- Includes an MCP server mode to give AI coding assistants deep context on code structure.
- Provides pre-built rulesets for Python applications, Dockerfiles, and Docker Compose.
Where it falls short
- Rule coverage is currently limited primarily to Python and Docker-related configurations.
- Requires managing and executing CLI commands or integrating local binaries into CI pipelines.
- Writing custom rules demands familiarity with the Python PathFinder SDK and AST dataflows.
Pricing & license
Code Pathfinder is free to use under its open-source license. The only cost is running the tool locally or within your own CI/CD infrastructure.
Open remote AI-training roles
767 open remote AI-training roles, updated November 14, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Do I need to manage local rule files?
No, rules download automatically from the CDN when you run a scan.
Can I write custom security checks?
Yes, you can write custom rules in Python using the PathFinder SDK.
Which AI assistants work with the MCP server?
Claude Code, Cursor, Cline, and other MCP-compatible coding assistants can connect to it.
