Lachesis MCP server

<!-- mcp-name: io.github.UnboundCompute/lachesis -->

Lachesis

Lachesis reads your code and builds a map of it. Then you can ask the map questions, like who calls this function, where does this value go, and can bad input reach a dangerous spot.

It works on C, Python, and TypeScript/JavaScript, all in one map.

What is this?

Search tools like grep tell you where a word shows up in your code. Lachesis is different. It follows the actual data. It can tell you where a value came from, where it goes next, and whether a request from the outside can reach something dangerous, like a database call with no login check in front of it.

To do this it reads your code the same way a compiler does, not by guessing with text patterns. So it doesn't miss a call just because a name was renamed or imported in a weird way.

You can use it three ways: as a command in your terminal, as a Python library, or as an MCP server that an AI agent can talk to.

Quick start

Install it, then point it at a folder:

python -m pip install lachesis-cpg
lachesis ./my-project

It builds the map, saves it, and prints the leads. A lead is a spot where outside input can reach something sensitive with no check in the way. Each lead is a question to look into, not a final answer.

✓ compiling (0.7s)
  2,677 nodes, 4,539 edges from typescript-compiler-api
  ✓ finding entrypoints that reach sensitive effects (0.1s)

2 leads (lens=all)
  1. [0.810] handleWebhook (http/webhook.ts:10, route) -> findById(documentId) [database]
     a caller that passes no recognized guard can read or write data
     through findById(documentId) starting from handleWebhook
  2. [0.810] handleWebhook (http/webhook.ts:10, route) -> findById(invoiceId) [database]
     this function branches on something, but no login-style check is seen here

You can also give it a git URL instead of a folder: lachesis https://github.com/owner/repo. It downloads the code to a temp folder, scans it, and cleans up after.

The first scan of a project is slow. After that the map is cached under ~/.lachesis/cache, so every run after is fast.

The three ways to use it

Terminal. One lachesis command. lachesis ./repo is the easy front door. If you want more control, the steps map to three passes:

lachesis build   ./my-project graph.kuzu     # step 1: read the code, build the map
lachesis enrich  graph.kuzu                   # step 2: work out the data flow
lachesis analyze graph.kuzu --summary         # step 3: print the leads
lachesis explain graph.kuzu tree.c:1487       # show all the evidence for one spot

Python library. Open the map once, then ask it as many questions as you want.

import lachesis

a = lachesis.Analysis.build("./my-project", "graph.kuzu", enrich=True)
leads = a.scan()
print(leads.summary())

print(a.explain_sink("tree.c", 1487))   # all the evidence for one spot

Runnable example scripts are in examples/.

Shortened. The full README is on GitHub.