Code Pathfinder MCP Server

Open-source SAST engine that traces vulnerabilities across files and functions Website · Docs · Rule Registry · MCP Server · Blog. It runs locally over stdio via the published package.

People connecting developer tools tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Go.

VERIFIED ACTIVE

LAST COMMIT 2026-07-10 · ★ 140 · #49 OF 139 MAINTAINED DEVELOPER TOOLS · VERIFIED 2026-08-25

Apache-2.0 · Go servers · how we verify → /methodology

01 · Install Code Pathfinder

before you install - you'll need

The README does not document required environment variables for a basic install.

Claude Code

claude mcp add shivasurya-code-pathfinder -- uvx codepathfinder

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "shivasurya-code-pathfinder": {
      "command": "uvx",
      "args": [
        "codepathfinder"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions · container (OCI image) - can be sandboxed away from your filesystem

license Apache-2.0 - declared in the repository

pypi package codepathfinder - check the name against the project README before installing (PyPI has no namespace ownership)

registry vendor namespace dev.codepathfinder - domain-verified with the official MCP registry

03 · What Code Pathfinder can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v2.1.1 · 2026-04-25

sync server.json docker tag to v2.1.0 · with-statement + typed-parameter L3 resolution · bump version to 2.1.1 across all components

v2.1.0 · 2026-04-19

First class support for GoLang · v2.1.0 release support Go language data flow analysis, supports 21+ rules & new sdk docs. · Read more about in blog: Code Pathfinder now speaks Go · Bunch of Go language support PRs…

v2.0.2 · 2026-03-30

subscript taint propagation for dataflow analysis (GAP-012) · deep call chain resolution for VDG taint analysis (GAP-004) · remove dead hasAccess field and O(n²) post-processing loop · add Dockerfile.mcp for Docker MCP…

04 · Who maintains Code Pathfinder

Code Pathfinder is maintained by shivasurya. It's the only MCP server we track from this author; the repo dates to Nov 2023.

05 · Facts

repository: github.com/shivasurya/code-pathfinder
category: developer tools - ranked #49 of 139 actively-maintained developer tools servers as of 2026-08-25.
registry: dev.codepathfinder/pathfinder (active, first published 2026-02-28 · 4 versions)
packages: pypi:codepathfinder · oci:docker.io/shivasurya/code-pathfinder:v2.1.1

06 · Code Pathfinder FAQ

What is Code Pathfinder?

Open-source SAST engine that traces vulnerabilities across files and functions Website · Docs · Rule Registry · MCP Server · Blog. It runs locally over stdio via the published package.

Is Code Pathfinder still maintained?

Yes - as of 2026-08-25, its last commit was 2026-07-10. We re-verify nightly.

How do I install Code Pathfinder?

Run `uvx codepathfinder`. The README does not document required environment variables for a basic install. You can also paste the ready-made client config above.

Does Code Pathfinder run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Code Pathfinder

Alternatives to Code Pathfinder

Maintained developer tools servers if Code Pathfinder isn't the fit.

Pairs well with

Servers that cover what Code Pathfinder doesn't - only shown when the pairing reason fits the companion.

More developer tools MCP servers · Infrawise · Mergewarden · Sounio Compiler · Edict · Lumino MCP Server

More Go MCP servers · PCI DSS v4.0.1 Compliance Checker · Signadot MCP Server · SigNoz MCP Server · Ckb · Radar · see all