Code Reason
Program analysis for your coding agents.
Instead of grep-and-guess, provide your agents program analysis capabilities with code-reason.
code-reason is an MCP server that gives coding agents real program-analysis primitives — data-flow reachability, call-graph traversal, evidence-chain construction — so they verify code behavior from ground truth instead of speculation.
What is code-reason?
An MCP server that gives coding agents real program-analysis capabilities —
data-flow reachability, call-graph traversal, evidence-chain construction,
and source/sink taint analysis. Built on Fraunhofer AISEC's Code Property
Graph (CPG) for Java and Python codebases.
The problem it solves
Without a code-analysis tool, a coding agent answers whole-program questions
by manual grep-based tracing. That works for trivial cases and breaks
silently on anything non-trivial — aliased variables, inter-procedural flow,
sanitization checks. The agent still produces an answer, often confidently,
and a confident wrong answer is the dangerous kind for security work.
code-reason gives the agent ground-truth primitives instead of speculation.
The agent decides what's interesting; code-reason answers what's actually
true.
What you get
- 9 MCP tools — analyze, find entry points, find callers/callees, query data flow, trace taint paths, catalog-driven injection scan, plus supporting tools for evidence retrieval
- One analyze pass, unlimited queries —
reason_analyze_projectbuilds
the CPG once; every subsequent tool is a cheap in-memory query - Compact structured answers — JSON evidence chains with intermediate
steps and code context, not "looks like SQLi maybe" - ~30-40% fewer agent tokens on multi-step security reviews, validated on real Java codebases
- MCP-native — tested with Claude Code; works with any MCP-compatible coding agent
Example session
- Agent calls
reason_analyze_projecton the target codebase - Agent calls
reason_find_entry_pointsto enumerate where external input enters - For each suspicious entry, agent traces downstream with
reason_query_dataflowandreason_find_callees - When a flow reaches a sensitive call, agent calls
reason_trace_taint_pathfor the full source-to-sink evidence chain - Agent reasons from the structured result and decides what to investigate
next
The catalog-driven reason_scan_injections is available as a quick
first-pass for SQLi / XSS / command injection, but the headline value is
the agent composing its own investigation from the primitives.
Server Config
{
"mcpServers": {
"code-reason": {
"command": "/absolute/path/to/build/install/code-reason/bin/code-reason",
"args": [
"--stdio"
]
}
}
}Recommend Servers
View Alltest