The author calls the catalog scan tools a convenience baseline for first-pass triage; the value is in the navigation and data-flow primitives the agent composes itself to answer whole-program questions. Two things to weigh before wiring it in: the project is v0.1.0 and research-grade, with the build pinned to CPG main-SNAPSHOT until Fraunhofer publishes a stable 11.x to Maven Central, and only Java and Python are turned on — other languages mean adding a dependency in build.gradle.kts and rebuilding.
Code-reason gives a coding agent real program-analysis primitives: data-flow reachability, call-graph traversal and evidence-chain construction. It parses the target codebase once into a code property graph, then answers queries against that graph, returning locations, paths, confidence and evidence rather than files to read. Where a traditional SAST tool produces a findings report for a human to triage, this exposes the analysis primitives so the agent drives its own investigation. Built on Fraunhofer AISEC's Code Property Graph and the Kotlin MCP SDK; Apache 2.0.
- One analysis pass per service, then unlimited cheap queries — reason_analyze_project builds the graph, every other tool reads it
- The places external input enters the codebase: HTTP handlers, CLI entries and framework hooks — reason_find_entry_points
- Call-graph traversal in both directions — who calls this function, and what this function calls — reason_find_callers, reason_find_callees
- Forward and backward reachability over the data-flow graph — reason_query_dataflow
- The complete source-to-sink path between any two points, with intermediate steps and code context — reason_trace_taint_path
- A catalog-driven first pass over SQL injection, XSS and command injection, the list of built-in checks behind it, and the description and remediation for any finding it returns — reason_scan_injections, reason_list_supported_checks, reason_get_finding_detail
- Compact structured answers instead of file dumps: a call-graph query returns the reachable methods as JSON
- Java and Python are supported; other CPG frontends (C/C++, Go, TypeScript, JVM, LLVM, Ruby) can be enabled by adding the matching cpg-language-* dependency
JDK 21, and no account or credentials of any kind. You build it yourself: ./gradlew installDist puts a launcher at build/install/code-reason/bin/code-reason, which your client runs with --stdio. The build pulls CPG artifacts from Maven Central and Sonatype Central Snapshots, and needs no sibling checkouts. Restart your client and the reason_* tools appear in its tool list.
Build from source — clone the repository and build it, then point your client at the binary