SecureCodeGraph

A security-focused MCP (Model Context Protocol) server that indexes codebases from multiple sources into a SQLite-based graph database, enabling AI assistants to query code structure, dependencies, and cross-repository relationships.

Features

• Multi-source indexing — GitHub API, AWS CodeCommit, local filesystem, git clone
• Language parsing — Python, JavaScript/TypeScript, C# via tree-sitter (extensible)
• Graph queries — Traverse dependencies, find shortest paths, detect circular references
• Security-first design — Parameterized SQL, path validation, keyring credentials, HMAC auth
• MCP integration — 12 tools exposable to any MCP-compatible AI assistant
• Dual deployment — Single-user local or team/shared via Docker

Security

This project was built from scratch to address 10 specific security vulnerabilities identified in existing code graph tools:

#	Vulnerability	Resolution
1	Path traversal via symlinks	PathValidator with canonicalization and symlink checks
2	Subprocess command injection	Allowlisted commands, absolute paths, shell=False
3	Unvalidated bundle downloads	SHA-256 hash verification on all downloaded content
4	Plaintext credentials	OS keyring storage via keyring library
5	Query injection	100% parameterized SQL (zero string formatting)
6	Info disclosure via errors	Safe error handler maps exceptions to generic messages
7	File watcher race conditions	Eliminated — uses on-demand indexing instead
8	Supply chain via language packs	Pinned tree-sitter versions in pyproject.toml
9	Missing authentication	HMAC-SHA256 token auth with expiry and revocation
10	Container runs as root	Multi-stage Docker build with non-root scg user

Quick Start

Install

pip install -e .

Index a local codebase

secure-code-graph index --source-type local --location /path/to/your/code

Index from GitHub

export SCG_GITHUB_TOKEN=ghp_your_token_here
secure-code-graph index --source-type github --location owner/repo

Index from AWS CodeCommit

secure-code-graph index --source-type codecommit --location my-repo --branch main

Start the MCP server

# stdio mode (for AI assistant integration)
secure-code-graph server

# HTTP mode (for team/shared deployment)
secure-code-graph server --transport http --host 0.0.0.0 --port 8000

Query the graph

secure-code-graph query --node-type FUNCTION --language python
secure-code-graph stats
secure-code-graph validate

Docker

docker build -t secure-code-graph .
docker run -p 8000:8000 -v ./data:/data secure-code-graph

MCP Tools

When connected to an AI assistant, the following tools are available:

Tool	Description
graph_query_nodes	Search nodes by type, language, name, or repository
graph_query_edges	Search edges by type (CALLS, IMPORTS, INHERITS, etc.)
graph_traverse_path	Traverse the graph from a starting node
graph_analyze_dependencies	Analyze dependencies with circular detection
graph_search_code	Full-text search across indexed code
graph_index_source	Index a new code source into the graph
graph_import_codebase	Bulk import multiple code sources
graph_export_snapshot	Export graph data as JSON
graph_list_repositories	List all indexed repositories
system_health_check	Check system health and connectivity
graph_validate_integrity	Validate graph database integrity
graph_get_stats	Get graph statistics (nodes, edges, languages)

Adding a New Language

Create a new parser in src/secure_code_graph/parsers/:

from .base import LanguageParser, ExtractedDefinitions

class RubyParser(LanguageParser):
    @property
    def language_name(self) -> str:
        return "ruby"

    def extract_definitions(self, source_code: str, file_path: str) -> ExtractedDefinitions:
        # Parse with tree-sitter-ruby
        ...

    def extract_imports(self, source_code: str) -> list:
        ...

    def extract_calls(self, source_code: str) -> list:
        ...

Then register it in parsers/registry.py by adding the extension mapping and parser class.

Architecture

src/secure_code_graph/
├── security/          # Path validation, auth, credentials, input sanitization
├── graph/             # SQLite engine with WAL mode, schema, Pydantic models
├── parsers/           # Tree-sitter parsers (Python, JS, C#) + registry
├── sources/           # Source providers (local, git, GitHub API, CodeCommit)
├── indexer/           # Orchestrates source → parse → graph pipeline
├── tools/             # MCP tool implementations (query, analysis, index, export, admin)
├── server.py          # FastMCP server with 12 registered tools
└── __main__.py        # CLI with 6 commands

Configuration

All settings can be configured via environment variables with the SCG_ prefix:

Variable	Default	Description
SCG_DB_PATH	:memory:	SQLite database file path
SCG_AUTH_ENABLED	false	Enable HMAC-SHA256 authentication
SCG_LOG_LEVEL	INFO	Logging level
SCG_MAX_FILE_SIZE_BYTES	10485760	Max file size to index (10MB)
SCG_MAX_TRAVERSAL_DEPTH	50	Max graph traversal depth
SCG_GITHUB_TOKEN	—	GitHub API token (or use keyring)
SCG_SERVER_HOST	127.0.0.1	HTTP server host
SCG_SERVER_PORT	8000	HTTP server port

License

MIT