reason_analyze_projectLABSCO SUMMARY
The vulnerability scanner is the least interesting thing in here.
The author calls the catalog scan tools a convenience baseline for first-pass triage; the value is in the navigation and data-flow primitives the agent composes itself to answer whole-program questions. Two things to weigh before wiring it in: the project is v0.1.0 and research-grade, with the build pinned to CPG main-SNAPSHOT until Fraunhofer publishes a stable 11.x to Maven Central, and only Java and Python are turned on — other languages mean adding a dependency in build.gradle.kts and rebuilding.
What it is
code-reason gives a coding agent real program-analysis primitives: data-flow reachability, call-graph traversal and evidence-chain construction. It parses the target codebase once into a code property graph, then answers queries against that graph, returning locations, paths, confidence and evidence rather than files to read. Where a traditional SAST tool produces a findings report for a human to triage, this exposes the analysis primitives so the agent drives its own investigation. Built on Fraunhofer AISEC's Code Property Graph and the Kotlin MCP SDK; Apache 2.0.
What you get
- One analysis pass per service, then unlimited cheap queries — reason_analyze_project builds the graph, every other tool reads it
- The places external input enters the codebase: HTTP handlers, CLI entries and framework hooks — reason_find_entry_points
- Call-graph traversal in both directions — who calls this function, and what this function calls — reason_find_callers, reason_find_callees
- Forward and backward reachability over the data-flow graph — reason_query_dataflow
- The complete source-to-sink path between any two points, with intermediate steps and code context — reason_trace_taint_path
- A catalog-driven first pass over SQL injection, XSS and command injection, the list of built-in checks behind it, and the description and remediation for any finding it returns — reason_scan_injections, reason_list_supported_checks, reason_get_finding_detail
- Compact structured answers instead of file dumps: a call-graph query returns the reachable methods as JSON
- Java and Python are supported; other CPG frontends (C/C++, Go, TypeScript, JVM, LLVM, Ruby) can be enabled by adding the matching cpg-language-* dependency
Requirements
JDK 21, and no account or credentials of any kind. You build it yourself: ./gradlew installDist puts a launcher at build/install/code-reason/bin/code-reason, which your client runs with --stdio. The build pulls CPG artifacts from Maven Central and Sonatype Central Snapshots, and needs no sibling checkouts. Restart your client and the reason_* tools appear in its tool list.
Setup effort
Build from source — git clone https://github.com/ph0smet/code-reason.git
USE CASES
01
Does user-controlled input actually reach this SQL call, or does sanitization cut it off?
Build the graph once, check reachability over the data flow, then pull the full path with its intermediate steps as evidence either way.
02
I'm about to change this function and need to know who depends on it
Ask the call graph directly instead of trusting a string match across the repository.
03
Work out what a request handler touches downstream
Walk out through the callees and follow the data forward to see where it lands.
04
Get oriented in a service I've never opened before
Enumerate the entry points where external input arrives, then trace outward from the ones that look exposed.
05
Give me a first pass on this codebase before I spend real review time
Run the built-in injection catalog to surface candidate flows, check what the catalog actually covers, and read the detail behind each finding.
06
Write up a finding a reviewer will accept without re-deriving it
Confirm the candidate flow with a full source-to-sink chain and attach the remediation guidance that comes with it.
9 tools
Listed in project docs. Your client may show a different list.
reason_find_entry_pointsreason_find_callersreason_find_calleesreason_query_dataflowreason_trace_taint_pathreason_scan_injectionsreason_list_supported_checksreason_get_finding_detailBEFORE YOU INSTALL
What to know first
Tools you get
9 tools named in the project's documentation.
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone and build this one yourself, so the path in the block is the one thing the author cannot fill in for you — replace it with wherever your copy ended up.
Server setup
TERMINAL
git clone https://github.com/ph0smet/code-reason.git
cd code-reason
./gradlew installDistMCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"code-reason": {
"command": "/absolute/path/to/build/install/code-reason/bin/code-reason",
"args": [
"--stdio"
]
}
}
}
