Code Pathfinder MCP Server
by shivasuryaStatic Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP
Code Pathfinder is an open-source mcp server by shivasurya, written mainly in Go, with 143 GitHub stars and the Apache-2.0 license. Its code was last updated Jul 10, 2026.
Scan summary: scanned Nov 5, 2026 at commit 460d0d3. Seen able to run shell commands, read environment and secrets, connect to the internet. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
460d0d3 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit1810 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Passed. This check ran and found nothing it flags.Manifestserver.jsonpassPassed. This check ran and found nothing it flags.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (67)
- highHigh. Something risky that needs a close look before you install.dropper issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dropper issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dropper issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dropper issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
extension/secureflow/packages/secureflow-cli/lib/git.js:15 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Turns off TLS certificate checking, allowing traffic interception.
python-sdk/codepathfinder/python_rule_meta.py:605 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Turns off TLS certificate checking, allowing traffic interception.
python-sdk/codepathfinder/python_rule_meta.py:1733 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Turns off TLS certificate checking, allowing traffic interception.
python-sdk/codepathfinder/python_rule_meta.py:2915 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Turns off TLS certificate checking, allowing traffic interception.
python-sdk/codepathfinder/python_rule_meta.py:2924 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Turns off TLS certificate checking, allowing traffic interception.
rules/python/lang/PYTHON-LANG-SEC-053/rule.py:15 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Turns off TLS certificate checking, allowing traffic interception.
rules/python/lang/PYTHON-LANG-SEC-053/rule.py:19 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.13: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.0.3: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.5: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.28.1: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.devalue@5.6.4: 8 known vulnerabilitiesGHSA-4q55-j62x-fr9h, GHSA-77vg-94rm-hx3p, GHSA-9rgm-9g3h-6x36, GHSA-hx4r-w6wj-j8fg, GHSA-j22f-vq7h-c4qm +3 more
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.0: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.1: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.11: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.8: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.3.6: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
extension/secureflow/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.2.1: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
extension/secureflow/packages/secureflow-cli/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.google.golang.org/grpc@1.80.0: 100 known vulnerabilitiesGO-2026-6061, GO-2026-6348, GO-2026-6441, GO-2026-6443, GO-2026-6061 +95 more
rules/golang/GO-CRYPTO-001/tests/go.mod - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
extension/secureflow/src/test/suite/settings-manager.test.ts:35 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt
rules/golang/GO-JWT-002/tests/positive/vulnerable.go:19 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
rules/golang/GO-SEC-004/tests/positive/vulnerable.go:14 - lowLow. Minor, or common in normal tools. Shown for information.@humanfs/node@0.16.7: 1 known vulnerabilityGHSA-p498-v437-472g
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/core@2.6.0: 1 known vulnerabilityGHSA-8988-4f7v-96qf
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/core@2.6.1: 1 known vulnerabilityGHSA-8988-4f7v-96qf
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/instrumentation-knex@0.57.0: 1 known vulnerabilityGHSA-qqmp-wf37-98f9
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/instrumentation-mongoose@0.59.0: 1 known vulnerabilityGHSA-qqmp-wf37-98f9
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/instrumentation-mysql@0.59.0: 1 known vulnerabilityGHSA-qqmp-wf37-98f9
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/instrumentation-mysql2@0.59.0: 1 known vulnerabilityGHSA-qqmp-wf37-98f9
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/instrumentation-pg@0.65.0: 1 known vulnerabilityGHSA-qqmp-wf37-98f9
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/instrumentation-tedious@0.32.0: 1 known vulnerabilityGHSA-qqmp-wf37-98f9
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.10.12: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@10.5.0: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@13.0.6: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.5: 1 known vulnerabilityGHSA-g3hv-75wg-m249
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@9.0.9: 1 known vulnerabilityGHSA-g3hv-75wg-m249
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.1: 2 known vulnerabilitiesGHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.serialize-javascript@7.0.5: 1 known vulnerabilityGHSA-m5mm-p8h7-m29v
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.svelte@5.55.1: 4 known vulnerabilitiesGHSA-9rmh-mm8f-r9h6, GHSA-f3cj-j4f6-wq85, GHSA-pr6f-5x2q-rwfp, GHSA-rcqx-6q8c-2c42
extension/secureflow/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.github.com/jackc/pgx/v5@5.9.1: 25 known vulnerabilitiesGO-2026-5004, GO-2026-5004, GO-2026-5004, GO-2026-5004, GO-2026-5004 +20 more
rules/golang/GO-CRYPTO-001/tests/go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/quic-go/quic-go@0.59.0: 33 known vulnerabilitiesGO-2026-5676, GO-2026-5676, GO-2026-5676, GO-2026-5676, GO-2026-5676 +28 more
rules/golang/GO-CRYPTO-001/tests/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.52.0: 345 known vulnerabilitiesGO-2026-4918, GO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028 +340 more
rules/golang/GO-CRYPTO-001/tests/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/sys@0.43.0: 23 known vulnerabilitiesGO-2026-5024, GO-2026-5024, GO-2026-5024, GO-2026-5024, GO-2026-5024 +18 more
rules/golang/GO-CRYPTO-001/tests/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.36.0: 46 known vulnerabilitiesGO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629, GO-2026-5970 +41 more
rules/golang/GO-CRYPTO-001/tests/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.20.0: 4 known vulnerabilitiesGO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629
rules/golang/GO-GORM-SQLI-001/tests/negative/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.51.0: 150 known vulnerabilitiesGO-2026-4918, GO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028 +145 more
rules/golang/GO-GORM-SQLI-001/tests/positive/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/sys@0.41.0: 10 known vulnerabilitiesGO-2026-5024, GO-2026-5024, GO-2026-5024, GO-2026-5024, GO-2026-5024 +5 more
rules/golang/GO-GORM-SQLI-001/tests/positive/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.34.0: 20 known vulnerabilitiesGO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629, GO-2026-5970 +15 more
rules/golang/GO-GORM-SQLI-001/tests/positive/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.49.0: 30 known vulnerabilitiesGO-2026-4918, GO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028 +25 more
rules/golang/GO-NET-002/tests/negative/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/sys@0.40.0: 2 known vulnerabilitiesGO-2026-5024, GO-2026-5024
rules/golang/GO-NET-002/tests/negative/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.33.0: 4 known vulnerabilitiesGO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629
rules/golang/GO-NET-002/tests/negative/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.29.0: 2 known vulnerabilitiesGO-2026-5970, GO-2026-6629
rules/golang/GO-SQLI-002/tests/negative/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/mod@0.36.0: 2 known vulnerabilitiesGO-2026-6179, GO-2026-6180
sast-engine/tools/validate_go_resolution/go.mod - lowLow. Minor, or common in normal tools. Shown for information.Reads environment variables not listed in the manifest_ENV_OVERRIDE, TYPESHED_PATH
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Code Pathfinder alternatives
View more →Similar mcp servers in Research & Analysis, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Code Pathfinder (this page) shivasurya | 143 | Apache-2.0 | Jul 10, 2026 | Scanned, no flagged issues |
| Worldmonitor koala73 | 90k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| GPT Researcher assafelovic | 30k | Apache-2.0 | Oct 10, 2026 | Scanned, no flagged issues |
| Auto Claude Code Research In Sleep wanshuiyin | 18k | MIT | Nov 1, 2026 | Scanned, no flagged issues |
| Deep Research u14app | 4.7k | MIT | Jun 18, 2026 | Scanned, no flagged issues |
| MCP Server Chart antvis | 4.4k | MIT | Aug 27, 2026 | Scanned, no flagged issues |