Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Code Pathfinder

PYPI · CODEPATHFINDER · 2 COMPONENTS · SCANNED SEP 20

Code intelligence MCP server: call graphs, type inference, and symbol search for Python/Go.

0 this week 78 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 147 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability64
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3707 tokens (~285/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
  • Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
  • Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the Code Pathfinder MCP server?

Code Pathfinder runs locally as a PyPI package, launched with uvx codepathfinder. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · codepathfinder

# add to Claude Code
claude mcp add dev-codepathfinder-pathfinder -- uvx codepathfinder
// .cursor/mcp.json
{
  "mcpServers": {
    "dev-codepathfinder-pathfinder": {
      "command": "uvx",
      "args": [
        "codepathfinder"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "dev-codepathfinder-pathfinder": {
      "command": "uvx",
      "args": [
        "codepathfinder"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add dev-codepathfinder-pathfinder -- uvx codepathfinder
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-codepathfinder-pathfinder": {
      "type": "local",
      "command": [
        "uvx",
        "codepathfinder"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add dev-codepathfinder-pathfinder --command uvx --arg codepathfinder
# ~/.hermes/config.yaml
mcp_servers:
  dev-codepathfinder-pathfinder:
    command: "uvx"
    args: ["codepathfinder"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "dev-codepathfinder-pathfinder": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "codepathfinder"
      ]
    }
  }
}
# add to Vellum
assistant mcp add dev-codepathfinder-pathfinder -t stdio -c uvx -a codepathfinder
// mcp.json
{
  "mcpServers": {
    "dev-codepathfinder-pathfinder": {
      "command": "uvx",
      "args": [
        "codepathfinder"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 18 Sept 26 0
    • Stability: 0.97 → pass security
  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 11 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/codepathfinder@2.1.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted setuptools.build_meta

Background: Why install scripts are a supply-chain risk →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 13 exposed · ~3,707 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
find_compose_services ~271

Search docker-compose services with filtering. Supports configuration filters (has_privileged, has_volume, exposes_port). Returns: - service_name, file, line - Configuration (image, build, ports, volumes, environment, privileged, network_mode) Use when: Finding specific services, analyzing service configurations, or understanding multi-container architecture. Examples: - find_compose_services(has_privileged=true) - find privileged containers - find_compose_services(has_volume="/var/run/docker.sock") - find services with Docker socket - find_compose_services(exposes_port=8080) - find services on port 8080 - find_compose_services(service_name="db") - find database services - find_compose_services(file_path="docker-compose.yml") - get all services from specific file

NameTypeReqDescription
exposes_portintegerFilter services exposing specific port
file_pathstringFilter by docker-compose.yml path
has_privilegedbooleanFilter by privileged mode (true=privileged containers only)
has_volumestringFilter services with specific volume path (e.g., '/var/run/docker.sock')
limitintegerMaximum results to return (default: 100)
service_namestringFilter by service name (supports partial matching)

No output schema declared.

No examples provided.

find_dockerfile_instructions ~361

Search Dockerfile instructions with semantic filtering. Supports instruction-specific filters (has_digest for FROM, user for USER, port for EXPOSE). Returns: - file, line, instruction, raw_content - Parsed details (base_image, tag, digest for FROM; user, group for USER; port, protocol for EXPOSE) Use when: Finding specific instructions, locating images, analyzing exposed ports, or understanding Dockerfile structure. Examples: - find_dockerfile_instructions(instruction_type="FROM", has_digest=false) - find unpinned base images - find_dockerfile_instructions(instruction_type="USER", user="appuser") - find specific user - find_dockerfile_instructions(instruction_type="EXPOSE", port=8080) - find services on port 8080 - find_dockerfile_instructions(instruction_type="FROM", base_image="python") - find Python-based images - find_dockerfile_instructions(file_path="api/Dockerfile") - get all instructions from specific Dockerfile

NameTypeReqDescription
base_imagestringFilter FROM instructions by base image name (e.g., 'python', 'alpine')
file_pathstringFilter by Dockerfile path (supports partial matching)
has_digestbooleanFilter FROM instructions by digest pinning (true=pinned, false=unpinned)
instruction_typestringFilter by instruction type (FROM, RUN, USER, EXPOSE, COPY, ADD, WORKDIR, etc.)
limitintegerMaximum results to return (default: 100)
portintegerFilter EXPOSE instructions by port number
userstringFilter USER instructions by username

No output schema declared.

No examples provided.

find_module ~141

Search for Python modules by name. Returns module information including file path and symbol counts. Returns: module_fqn, file_path, functions_count (number of functions/methods in the module), and match_type (exact/partial). Use when: Finding module locations, understanding module structure, or navigating between modules. Examples: - find_module("myapp.auth") - find the auth module - find_module("utils") - find all modules named utils - find_module("models.user") - find user module in models package

NameTypeReqDescription
namestringyesModule name to find. Can be FQN ('myapp.auth') or short name ('auth')

No output schema declared.

No examples provided.

find_symbol ~684

Search and filter symbols by name and/or type. Supports Python, Go, and Java. Supports partial matching. Results are paginated. Symbol Types Available: - Python Functions: function_definition, method, constructor, property, special_method - Python Classes: class_definition, interface (Protocol/ABC), enum, dataclass - Python Variables: module_variable, constant (UPPERCASE), class_field, parameter - Go Functions: function_declaration, init_function, method, func_literal - Go Types: struct_definition, interface, type_alias - Go Variables: package_variable, constant, variable_assignment Returns: For ALL symbols: fqn, file, line, type, symbol_kind (LSP integer), symbol_kind_name (human-readable). For functions/methods: return_type, parameters, decorators. For classes: superclass, interfaces. For fields: inferred_type, confidence, assigned_in. For parameters: inferred_type (type annotation), parent_fqn (containing function). LSP Symbol Kinds: Function(12), Method(6), Constructor(9), Property(7), Operator(25), Class(5), Interface(11), Enum(10), Struct(23), Variable(13), Constant(14), Field(8). Filtering: At least ONE of name/type/types/module must be provided. Filters can be combined (e.g., name="get" + type="method" + module="core.utils"). Use when: Looking for symbols by name; filtering by type; exploring codebase structure; finding definitions; analyzing symbol types; drilling down into specific modules. Examples: - find_symbol(name="login") - finds all symbols named login - find_symbol(type="method") - lists all methods - find_symbol(types=["interface","enum"]) - lists all interfaces and enums - find_symbol(name="get", type="method") - finds methods named "get" - find_symbol(name="User", type="class_definition") - finds User class only - find_symbol(module="core.settings") - finds all symbols in core.settings module - find_symbol(type="constant", module="core.settings.base") - finds constants in specific module - find_symbol(module="data_manager", type="method")…

NameTypeReqDescription
cursorstringPagination cursor from previous response
limitintegerMax results to return (default: 50, max: 500)
modulestringFilter by module. Optional. Matches symbols whose FQN starts with the module path (e.g., 'core.settings', 'data_manager.models'). Works with all symbol types
namestringSymbol name to find. Optional. Can be: short name ('login'), partial name ('auth'), or FQN ('myapp.auth.login')
typestringFilter by single symbol type. Optional. One of: function_definition, method, constructor, property, special_method, class_definition, interface, enum, dataclass, module_variable, constant, class_fiel…
typesarrayFilter by multiple symbol types. Optional. Array of type strings. Alternative to 'type' parameter

No output schema declared.

No examples provided.

get_call_details ~179

Get detailed information about a SPECIFIC call from one function to another. Most detailed view of a single call site. Returns: Full call site info including caller FQN, target, exact location (file, line, column), arguments passed, and resolution details (resolved status, failure reason if unresolved, type inference info). Use when: Investigating a specific function call, understanding how arguments are passed, debugging why a call wasn't resolved, or analyzing type inference. Examples: - get_call_details("handle_request", "authenticate") - how does handle_request call authenticate? - get_call_details("save_user", "execute") - examine the database call in save_user

NameTypeReqDescription
calleestringyesThe function being called (short name, will match partially)
callerstringyesThe function making the call (short name or FQN)

No output schema declared.

No examples provided.

get_callees ~536

Find all functions CALLED BY a given function (forward call graph / outgoing edges). Answer: "What does this function depend on?" Results are paginated. Returns: Source function info, list of callees with target name, call line, resolution status (resolved/unresolved), and type inference info if available. Includes pagination info. IMPORTANT - Function Parameter Requirements: - Must be a FUNCTION or METHOD name, NOT a module path - Use find_symbol first to get the exact FQN of the function you want to analyze - Short names work ("process_payment") if the function name is unique - Full FQNs are preferred ("myapp.payment.process_payment") to avoid ambiguity - Method names should include class ("Payment.process" or "myapp.models.Payment.process") - Test files are NOT indexed - only production code is queryable What WORKS: ✓ "myapp.payment.process_payment" - function FQN ✓ "Payment.process" - method with class name ✓ "process_payment" - short function name (if unique in codebase) ✓ "myapp.models.Task.update_status" - full method FQN What DOESN'T work: ✗ "myapp.payment" - this is a module, not a function ✗ "test_process_payment" - test files are not indexed ✗ Module-level code that isn't wrapped in a function Type Inference in Results: - Callees resolved via cross-file import resolution include "type_inference" metadata - Shows inferred_type (e.g., "django.db.models.JSONField") for method calls on imported classes - Confidence score (0.0-1.0) indicates resolution certainty - High confidence (>0.9) means the call was resolved using import analysis Use when: Understanding function dependencies, analyzing what a function does, tracing data flow FROM a function, finding unresolved external calls, or analyzing cross-file method calls. Examples: - get_callees("process_payment") - what functions does payment processing call? - get_callees("myapp.payment.process_payment") - dependencies with full FQN - get_callees("User.save") - what does the User.save method call? - get…

NameTypeReqDescription
cursorstringPagination cursor from previous response
functionstringyesFunction to find callees for. Use short name ('process') or FQN ('myapp.payment.process')
limitintegerMax results to return (default: 50, max: 500)

No output schema declared.

No examples provided.

get_callers ~408

Find all functions that CALL a given function (reverse call graph / incoming edges). Answer: "Who uses this function?" Results are paginated. Returns: Target function info and list of callers with their FQN, file, line number, and the specific call site location. Includes pagination info. IMPORTANT - Function Parameter Requirements: - Must be a FUNCTION or METHOD name, NOT a module path - Use find_symbol first to get the exact FQN of functions - Short names work ("sanitize_input") if unique in the codebase - Full FQNs are preferred ("myapp.utils.sanitize_input") to avoid ambiguity - Method names should include class ("MyClass.save" or "myapp.models.MyClass.save") - Test files are NOT indexed - only production code is queryable What WORKS: ✓ "myapp.auth.login" - function FQN ✓ "User.save" - method with class name ✓ "sanitize_input" - short function name (if unique) ✓ "myapp.models.Project.get_all_tasks" - full method FQN What DOESN'T work: ✗ "myapp.auth" - this is a module, not a function ✗ "test_login" - test files are not indexed ✗ Module-level code without a function wrapper Use when: Understanding function usage, impact analysis before refactoring, finding entry points, or tracing how data flows INTO a function. Examples: - get_callers("sanitize_input") - who calls the sanitize function? - get_callers("myapp.auth.login") - who calls the login function? - get_callers("User.save") - who calls the User.save method?

NameTypeReqDescription
cursorstringPagination cursor from previous response
functionstringyesFunction to find callers for. Use short name ('login') or FQN ('myapp.auth.login')
limitintegerMax results to return (default: 50, max: 500)

No output schema declared.

No examples provided.

get_docker_dependencies ~452

Retrieves dependency information for Docker entities (compose services or Dockerfile stages). Use cases: - Map docker-compose service dependencies (depends_on relationships) - Analyze multi-stage Dockerfile build dependencies (COPY --from) - Traverse upstream/downstream dependency chains Examples: - get_docker_dependencies(type="compose", name="web") - find all dependencies for "web" service - get_docker_dependencies(type="dockerfile", name="builder", file_path="Dockerfile") - find stage dependencies - get_docker_dependencies(type="compose", name="api", direction="upstream", max_depth=2) - upstream only, 2 levels Parameters: - type: Entity type - "compose" for docker-compose services or "dockerfile" for Dockerfile stages (required) - name: Entity name - service name (for compose) or stage name/alias (for dockerfile) (required) - file_path: Filter to specific file path (optional) - direction: Traversal direction - "upstream" (dependencies), "downstream" (dependents), or "both" (default: "both") - max_depth: Maximum traversal depth (default: 10) Returns: - target: Target entity name - type: Entity type (compose or dockerfile) - file: Source file path - line: Line number - direction: Traversal direction used - max_depth: Maximum depth used - upstream: Array of dependencies (entities this depends on) - downstream: Array of dependents (entities that depend on this) - dependency_chain: Simple chain string (e.g., "db → api → web")

NameTypeReqDescription
directionstringTraversal direction: "upstream", "downstream", or "both" (default: "both")
file_pathstringOptional: Filter to specific file path
max_depthintegerMaximum traversal depth (default: 10)
namestringyesEntity name: service name (for compose) or stage name/alias (for dockerfile)
typestringyesEntity type: "compose" for docker-compose services or "dockerfile" for Dockerfile stages

No output schema declared.

No examples provided.

get_dockerfile_details ~155

Get complete breakdown of a Dockerfile with all instructions and multi-stage analysis. Returns: - file, total_instructions - instructions: Array of parsed instructions with details - multi_stage: is_multi_stage, base_image, stages (array of stage aliases) - summary: has_user_instruction, has_healthcheck, unpinned_images Use when: Understanding complete Dockerfile structure, analyzing multi-stage builds, or reviewing all instructions. Examples: - get_dockerfile_details(file_path="/app/Dockerfile") - get complete Dockerfile breakdown - get_dockerfile_details(file_path="Dockerfile") - analyze Dockerfile in current context

NameTypeReqDescription
file_pathstringyesPath to Dockerfile (required)

No output schema declared.

No examples provided.

get_index_info ~209

Get comprehensive statistics about the indexed codebase (Python, Go, Java). Use this FIRST to understand the project scope before making other queries. Returns: - Project info: project_path, python_version, indexed_at, build_time_seconds - Overall stats: total_symbols, call_edges, modules, files, taint_summaries, class_fields - symbols_by_type: Breakdown by all 13 Python types (function_definition, method, constructor, property, special_method, class_definition, interface, enum, dataclass, module_variable, constant, class_field, parameter) - symbols_by_lsp_kind: Breakdown by LSP Symbol Kind (Function, Method, Constructor, Property, Operator, Class, Interface, Enum, Struct, Variable, Constant, Field) - top_modules: Top 10 modules by function count - health: Index health indicators (average functions per module, etc.) Use when: Starting analysis, understanding project size and structure, verifying index quality, or exploring symbol distribution.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_modules ~80

List all Python modules in the indexed project. Returns comprehensive module information. Returns: Array of modules with module_fqn, file_path, and functions_count for each. Includes total_modules count. Use when: Exploring project structure, getting an overview of all modules, or discovering what modules exist. Examples: - list_modules() - get all modules in the project

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

resolve_import ~147

Resolve a Python import path to its actual file location in the project. Returns: Import resolution with file_path, module_fqn, match_type (exact/short_name/partial/ambiguous), and alternatives if multiple matches exist. Use when: Finding where a module is defined, understanding import structure, or locating source files for external references. Examples: - resolve_import("myapp.auth.users") - find the users module - resolve_import("utils") - find modules named utils (may return multiple) - resolve_import("database") - locate database module

NameTypeReqDescription
importstringyesImport path to resolve. Can be FQN ('myapp.auth.users') or short name ('users')

No output schema declared.

No examples provided.

status ~84

Returns the current server state: indexing phase, progress, and readiness. Use when: Checking whether the index is ready before making queries, or diagnosing slow startup. Returns: state (uninitialized/indexing/ready/failed), progress details, stats (when ready), and optional update-check fields (latest_version, update_message, announcement) when a newer version or operator announcement is available.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Common questions

What is the Code Pathfinder MCP server?

Code Pathfinder is an MCP server listed in the public MCP registry as dev.codepathfinder/pathfinder. Code intelligence MCP server: call graphs, type inference, and symbol search for Python/Go. This page covers its PyPI package (codepathfinder).

Is the Code Pathfinder MCP server safe to use?

Code Pathfinder scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Code Pathfinder MCP server expose?

Code Pathfinder exposes 13 tools: get_index_info, find_symbol, find_module, list_modules, get_callers, and 8 more. Their descriptions and schemas cost roughly 3,707 tokens of context every time the server is loaded.

Is the Code Pathfinder MCP server still maintained?

Code Pathfinder is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Code Pathfinder MCP server under?

Code Pathfinder declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.