Code MCP Server

MCP server that gives coding agents program-analysis primitives — data flow, call graphs, taint analysis — so they reason from ground truth instead

Local serverstdioPython

What is the Code MCP Server?

MCP server that gives coding agents program-analysis primitives — data flow, call graphs, taint analysis — so they reason from ground truth instead of

What the server does

Coding agents are good at reading code, but they struggle with whole-program questions:

  • Does user-controlled input actually reach this SQL call, or does sanitization cut the flow off?
  • Who really invokes this function across the codebase?
  • What is the complete evidence chain from source to sink?

Credentials and setup notes

  • JDK 21 The build pulls CPG artifacts from Maven Central and Sonatype Central Snapshots (the latter for main-SNAPSHOT until CPG 11.x lands as a stable release on Central). No sibling checkouts required.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
GroupTool
Setupreason_analyze_project
Navigationreason_find_callees

How to install the Code MCP Server

{
  "mcpServers": {
    "code-reason": {
      "command": "/absolute/path/to/build/install/code-reason/bin/code-reason",
      "args": [
        "--stdio"
      ]
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

  • JDK 21 The build pulls CPG artifacts from Maven Central and Sonatype Central Snapshots (the latter for main-SNAPSHOT until CPG 11.x lands as a stable release on Central). No sibling checkouts required.

Example prompts to try

  • “Use Code to Group.”
  • “Use Code to Setup.”
  • “Use Code to Navigation.”

Frequently asked questions

MCP server that gives coding agents program-analysis primitives — data flow, call graphs, taint analysis — so they reason from ground truth instead of Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.