Code Pathfinder
PYPI · CODEPATHFINDER · 2 COMPONENTS · SCANNED SEP 20
Code intelligence MCP server: call graphs, type inference, and symbol search for Python/Go.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 147 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3707 tokens (~285/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
How do I install the Code Pathfinder MCP server?
Code Pathfinder runs locally as a PyPI package, launched with uvx codepathfinder. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · codepathfinder
claude mcp add dev-codepathfinder-pathfinder -- uvx codepathfinder
{
"mcpServers": {
"dev-codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
]
}
}
} {
"servers": {
"dev-codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
]
}
}
} codex mcp add dev-codepathfinder-pathfinder -- uvx codepathfinder
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-codepathfinder-pathfinder": {
"type": "local",
"command": [
"uvx",
"codepathfinder"
],
"enabled": true
}
}
} openclaw mcp add dev-codepathfinder-pathfinder --command uvx --arg codepathfinder
mcp_servers:
dev-codepathfinder-pathfinder:
command: "uvx"
args: ["codepathfinder"] {
"McpServers": {
"dev-codepathfinder-pathfinder": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"codepathfinder"
]
}
}
} assistant mcp add dev-codepathfinder-pathfinder -t stdio -c uvx -a codepathfinder
{
"mcpServers": {
"dev-codepathfinder-pathfinder": {
"command": "uvx",
"args": [
"codepathfinder"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −3
- Stability: pass → 0.80 functional
- 11 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/codepathfinder@2.1.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
find_compose_services ~271
Search docker-compose services with filtering. Supports configuration filters (has_privileged, has_volume, exposes_port). Returns: - service_name, file, line - Configuration (image, build, ports, volumes, environment, privileged, network_mode) Use when: Finding specific services, analyzing service configurations, or understanding multi-container architecture. Examples: - find_compose_services(has_privileged=true) - find privileged containers - find_compose_services(has_volume="/var/run/docker.sock") - find services with Docker socket - find_compose_services(exposes_port=8080) - find services on port 8080 - find_compose_services(service_name="db") - find database services - find_compose_services(file_path="docker-compose.yml") - get all services from specific file
| Name | Type | Req | Description |
|---|---|---|---|
| exposes_port | integer | – | Filter services exposing specific port |
| file_path | string | – | Filter by docker-compose.yml path |
| has_privileged | boolean | – | Filter by privileged mode (true=privileged containers only) |
| has_volume | string | – | Filter services with specific volume path (e.g., '/var/run/docker.sock') |
| limit | integer | – | Maximum results to return (default: 100) |
| service_name | string | – | Filter by service name (supports partial matching) |
No output schema declared.
No examples provided.
find_dockerfile_instructions ~361
Search Dockerfile instructions with semantic filtering. Supports instruction-specific filters (has_digest for FROM, user for USER, port for EXPOSE). Returns: - file, line, instruction, raw_content - Parsed details (base_image, tag, digest for FROM; user, group for USER; port, protocol for EXPOSE) Use when: Finding specific instructions, locating images, analyzing exposed ports, or understanding Dockerfile structure. Examples: - find_dockerfile_instructions(instruction_type="FROM", has_digest=false) - find unpinned base images - find_dockerfile_instructions(instruction_type="USER", user="appuser") - find specific user - find_dockerfile_instructions(instruction_type="EXPOSE", port=8080) - find services on port 8080 - find_dockerfile_instructions(instruction_type="FROM", base_image="python") - find Python-based images - find_dockerfile_instructions(file_path="api/Dockerfile") - get all instructions from specific Dockerfile
| Name | Type | Req | Description |
|---|---|---|---|
| base_image | string | – | Filter FROM instructions by base image name (e.g., 'python', 'alpine') |
| file_path | string | – | Filter by Dockerfile path (supports partial matching) |
| has_digest | boolean | – | Filter FROM instructions by digest pinning (true=pinned, false=unpinned) |
| instruction_type | string | – | Filter by instruction type (FROM, RUN, USER, EXPOSE, COPY, ADD, WORKDIR, etc.) |
| limit | integer | – | Maximum results to return (default: 100) |
| port | integer | – | Filter EXPOSE instructions by port number |
| user | string | – | Filter USER instructions by username |
No output schema declared.
No examples provided.
find_module ~141
Search for Python modules by name. Returns module information including file path and symbol counts. Returns: module_fqn, file_path, functions_count (number of functions/methods in the module), and match_type (exact/partial). Use when: Finding module locations, understanding module structure, or navigating between modules. Examples: - find_module("myapp.auth") - find the auth module - find_module("utils") - find all modules named utils - find_module("models.user") - find user module in models package
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Module name to find. Can be FQN ('myapp.auth') or short name ('auth') |
No output schema declared.
No examples provided.
find_symbol ~684
Search and filter symbols by name and/or type. Supports Python, Go, and Java. Supports partial matching. Results are paginated. Symbol Types Available: - Python Functions: function_definition, method, constructor, property, special_method - Python Classes: class_definition, interface (Protocol/ABC), enum, dataclass - Python Variables: module_variable, constant (UPPERCASE), class_field, parameter - Go Functions: function_declaration, init_function, method, func_literal - Go Types: struct_definition, interface, type_alias - Go Variables: package_variable, constant, variable_assignment Returns: For ALL symbols: fqn, file, line, type, symbol_kind (LSP integer), symbol_kind_name (human-readable). For functions/methods: return_type, parameters, decorators. For classes: superclass, interfaces. For fields: inferred_type, confidence, assigned_in. For parameters: inferred_type (type annotation), parent_fqn (containing function). LSP Symbol Kinds: Function(12), Method(6), Constructor(9), Property(7), Operator(25), Class(5), Interface(11), Enum(10), Struct(23), Variable(13), Constant(14), Field(8). Filtering: At least ONE of name/type/types/module must be provided. Filters can be combined (e.g., name="get" + type="method" + module="core.utils"). Use when: Looking for symbols by name; filtering by type; exploring codebase structure; finding definitions; analyzing symbol types; drilling down into specific modules. Examples: - find_symbol(name="login") - finds all symbols named login - find_symbol(type="method") - lists all methods - find_symbol(types=["interface","enum"]) - lists all interfaces and enums - find_symbol(name="get", type="method") - finds methods named "get" - find_symbol(name="User", type="class_definition") - finds User class only - find_symbol(module="core.settings") - finds all symbols in core.settings module - find_symbol(type="constant", module="core.settings.base") - finds constants in specific module - find_symbol(module="data_manager", type="method")…
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Pagination cursor from previous response |
| limit | integer | – | Max results to return (default: 50, max: 500) |
| module | string | – | Filter by module. Optional. Matches symbols whose FQN starts with the module path (e.g., 'core.settings', 'data_manager.models'). Works with all symbol types |
| name | string | – | Symbol name to find. Optional. Can be: short name ('login'), partial name ('auth'), or FQN ('myapp.auth.login') |
| type | string | – | Filter by single symbol type. Optional. One of: function_definition, method, constructor, property, special_method, class_definition, interface, enum, dataclass, module_variable, constant, class_fiel… |
| types | array | – | Filter by multiple symbol types. Optional. Array of type strings. Alternative to 'type' parameter |
No output schema declared.
No examples provided.
get_call_details ~179
Get detailed information about a SPECIFIC call from one function to another. Most detailed view of a single call site. Returns: Full call site info including caller FQN, target, exact location (file, line, column), arguments passed, and resolution details (resolved status, failure reason if unresolved, type inference info). Use when: Investigating a specific function call, understanding how arguments are passed, debugging why a call wasn't resolved, or analyzing type inference. Examples: - get_call_details("handle_request", "authenticate") - how does handle_request call authenticate? - get_call_details("save_user", "execute") - examine the database call in save_user
| Name | Type | Req | Description |
|---|---|---|---|
| callee | string | yes | The function being called (short name, will match partially) |
| caller | string | yes | The function making the call (short name or FQN) |
No output schema declared.
No examples provided.
get_callees ~536
Find all functions CALLED BY a given function (forward call graph / outgoing edges). Answer: "What does this function depend on?" Results are paginated. Returns: Source function info, list of callees with target name, call line, resolution status (resolved/unresolved), and type inference info if available. Includes pagination info. IMPORTANT - Function Parameter Requirements: - Must be a FUNCTION or METHOD name, NOT a module path - Use find_symbol first to get the exact FQN of the function you want to analyze - Short names work ("process_payment") if the function name is unique - Full FQNs are preferred ("myapp.payment.process_payment") to avoid ambiguity - Method names should include class ("Payment.process" or "myapp.models.Payment.process") - Test files are NOT indexed - only production code is queryable What WORKS: ✓ "myapp.payment.process_payment" - function FQN ✓ "Payment.process" - method with class name ✓ "process_payment" - short function name (if unique in codebase) ✓ "myapp.models.Task.update_status" - full method FQN What DOESN'T work: ✗ "myapp.payment" - this is a module, not a function ✗ "test_process_payment" - test files are not indexed ✗ Module-level code that isn't wrapped in a function Type Inference in Results: - Callees resolved via cross-file import resolution include "type_inference" metadata - Shows inferred_type (e.g., "django.db.models.JSONField") for method calls on imported classes - Confidence score (0.0-1.0) indicates resolution certainty - High confidence (>0.9) means the call was resolved using import analysis Use when: Understanding function dependencies, analyzing what a function does, tracing data flow FROM a function, finding unresolved external calls, or analyzing cross-file method calls. Examples: - get_callees("process_payment") - what functions does payment processing call? - get_callees("myapp.payment.process_payment") - dependencies with full FQN - get_callees("User.save") - what does the User.save method call? - get…
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Pagination cursor from previous response |
| function | string | yes | Function to find callees for. Use short name ('process') or FQN ('myapp.payment.process') |
| limit | integer | – | Max results to return (default: 50, max: 500) |
No output schema declared.
No examples provided.
get_callers ~408
Find all functions that CALL a given function (reverse call graph / incoming edges). Answer: "Who uses this function?" Results are paginated. Returns: Target function info and list of callers with their FQN, file, line number, and the specific call site location. Includes pagination info. IMPORTANT - Function Parameter Requirements: - Must be a FUNCTION or METHOD name, NOT a module path - Use find_symbol first to get the exact FQN of functions - Short names work ("sanitize_input") if unique in the codebase - Full FQNs are preferred ("myapp.utils.sanitize_input") to avoid ambiguity - Method names should include class ("MyClass.save" or "myapp.models.MyClass.save") - Test files are NOT indexed - only production code is queryable What WORKS: ✓ "myapp.auth.login" - function FQN ✓ "User.save" - method with class name ✓ "sanitize_input" - short function name (if unique) ✓ "myapp.models.Project.get_all_tasks" - full method FQN What DOESN'T work: ✗ "myapp.auth" - this is a module, not a function ✗ "test_login" - test files are not indexed ✗ Module-level code without a function wrapper Use when: Understanding function usage, impact analysis before refactoring, finding entry points, or tracing how data flows INTO a function. Examples: - get_callers("sanitize_input") - who calls the sanitize function? - get_callers("myapp.auth.login") - who calls the login function? - get_callers("User.save") - who calls the User.save method?
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Pagination cursor from previous response |
| function | string | yes | Function to find callers for. Use short name ('login') or FQN ('myapp.auth.login') |
| limit | integer | – | Max results to return (default: 50, max: 500) |
No output schema declared.
No examples provided.
get_docker_dependencies ~452
Retrieves dependency information for Docker entities (compose services or Dockerfile stages). Use cases: - Map docker-compose service dependencies (depends_on relationships) - Analyze multi-stage Dockerfile build dependencies (COPY --from) - Traverse upstream/downstream dependency chains Examples: - get_docker_dependencies(type="compose", name="web") - find all dependencies for "web" service - get_docker_dependencies(type="dockerfile", name="builder", file_path="Dockerfile") - find stage dependencies - get_docker_dependencies(type="compose", name="api", direction="upstream", max_depth=2) - upstream only, 2 levels Parameters: - type: Entity type - "compose" for docker-compose services or "dockerfile" for Dockerfile stages (required) - name: Entity name - service name (for compose) or stage name/alias (for dockerfile) (required) - file_path: Filter to specific file path (optional) - direction: Traversal direction - "upstream" (dependencies), "downstream" (dependents), or "both" (default: "both") - max_depth: Maximum traversal depth (default: 10) Returns: - target: Target entity name - type: Entity type (compose or dockerfile) - file: Source file path - line: Line number - direction: Traversal direction used - max_depth: Maximum depth used - upstream: Array of dependencies (entities this depends on) - downstream: Array of dependents (entities that depend on this) - dependency_chain: Simple chain string (e.g., "db → api → web")
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | Traversal direction: "upstream", "downstream", or "both" (default: "both") |
| file_path | string | – | Optional: Filter to specific file path |
| max_depth | integer | – | Maximum traversal depth (default: 10) |
| name | string | yes | Entity name: service name (for compose) or stage name/alias (for dockerfile) |
| type | string | yes | Entity type: "compose" for docker-compose services or "dockerfile" for Dockerfile stages |
No output schema declared.
No examples provided.
get_dockerfile_details ~155
Get complete breakdown of a Dockerfile with all instructions and multi-stage analysis. Returns: - file, total_instructions - instructions: Array of parsed instructions with details - multi_stage: is_multi_stage, base_image, stages (array of stage aliases) - summary: has_user_instruction, has_healthcheck, unpinned_images Use when: Understanding complete Dockerfile structure, analyzing multi-stage builds, or reviewing all instructions. Examples: - get_dockerfile_details(file_path="/app/Dockerfile") - get complete Dockerfile breakdown - get_dockerfile_details(file_path="Dockerfile") - analyze Dockerfile in current context
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Path to Dockerfile (required) |
No output schema declared.
No examples provided.
get_index_info ~209
Get comprehensive statistics about the indexed codebase (Python, Go, Java). Use this FIRST to understand the project scope before making other queries. Returns: - Project info: project_path, python_version, indexed_at, build_time_seconds - Overall stats: total_symbols, call_edges, modules, files, taint_summaries, class_fields - symbols_by_type: Breakdown by all 13 Python types (function_definition, method, constructor, property, special_method, class_definition, interface, enum, dataclass, module_variable, constant, class_field, parameter) - symbols_by_lsp_kind: Breakdown by LSP Symbol Kind (Function, Method, Constructor, Property, Operator, Class, Interface, Enum, Struct, Variable, Constant, Field) - top_modules: Top 10 modules by function count - health: Index health indicators (average functions per module, etc.) Use when: Starting analysis, understanding project size and structure, verifying index quality, or exploring symbol distribution.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_modules ~80
List all Python modules in the indexed project. Returns comprehensive module information. Returns: Array of modules with module_fqn, file_path, and functions_count for each. Includes total_modules count. Use when: Exploring project structure, getting an overview of all modules, or discovering what modules exist. Examples: - list_modules() - get all modules in the project
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
resolve_import ~147
Resolve a Python import path to its actual file location in the project. Returns: Import resolution with file_path, module_fqn, match_type (exact/short_name/partial/ambiguous), and alternatives if multiple matches exist. Use when: Finding where a module is defined, understanding import structure, or locating source files for external references. Examples: - resolve_import("myapp.auth.users") - find the users module - resolve_import("utils") - find modules named utils (may return multiple) - resolve_import("database") - locate database module
| Name | Type | Req | Description |
|---|---|---|---|
| import | string | yes | Import path to resolve. Can be FQN ('myapp.auth.users') or short name ('users') |
No output schema declared.
No examples provided.
status ~84
Returns the current server state: indexing phase, progress, and readiness. Use when: Checking whether the index is ready before making queries, or diagnosing slow startup. Returns: state (uninitialized/indexing/ready/failed), progress details, stats (when ready), and optional update-check fields (latest_version, update_message, announcement) when a newer version or operator announcement is available.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the Code Pathfinder MCP server?
Code Pathfinder is an MCP server listed in the public MCP registry as dev.codepathfinder/pathfinder. Code intelligence MCP server: call graphs, type inference, and symbol search for Python/Go. This page covers its PyPI package (codepathfinder).
Is the Code Pathfinder MCP server safe to use?
Code Pathfinder scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Code Pathfinder MCP server expose?
Code Pathfinder exposes 13 tools: get_index_info, find_symbol, find_module, list_modules, get_callers, and 8 more. Their descriptions and schemas cost roughly 3,707 tokens of context every time the server is loaded.
Is the Code Pathfinder MCP server still maintained?
Code Pathfinder is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Code Pathfinder MCP server under?
Code Pathfinder declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.