Code Reason

Name: Code Reason
Author: ph0smet

@ph0smet

About Code Reason

MCP server that gives coding agents program-analysis primitives — data flow, call graphs, taint analysis — so they reason from ground truth instead of grep-and-guess."

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "code-reason": {
      "command": "/absolute/path/to/build/install/code-reason/bin/code-reason",
      "args": [
        "--stdio"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Code Reason?

Code Reason is an MCP server that gives coding agents real program-analysis capabilities — data-flow reachability, call-graph traversal, evidence-chain construction, and source/sink taint analysis. It is built on Fraunhofer AISEC's Code Property Graph for Java and Python codebases and is designed for any MCP-compatible coding agent.

How to use Code Reason?

Add code-reason as an MCP server to your coding agent (tested with Claude Code). First call reason_analyze_project to build the CPG, then use any of the other 9 tools — such as reason_find_entry_points, reason_query_dataflow, or reason_trace_taint_path — for unlimited in-memory queries against the same analysis.

Key features of Code Reason

Provides 9 MCP tools for program analysis
Built on Fraunhofer AISEC’s Code Property Graph for Java and Python
One analyze pass, unlimited subsequent queries
Compact JSON evidence chains with intermediate steps and code context
~30–40% fewer agent tokens on multi-step security reviews
Works with any MCP-compatible coding agent

Use cases of Code Reason

Multi-step security reviews of Java or Python codebases
Detecting SQLi, XSS, and command injection via catalog-driven scanning
Tracing taint paths from input sources to sensitive sinks
Understanding call-graph relationships and data flow across functions
Replacing manual grep-based speculation with ground-truth analysis

FAQ from Code Reason

What problem does Code Reason solve?

Without a code-analysis tool, coding agents answer whole-program questions by manual grep-based tracing, which breaks silently on aliased variables, inter-procedural flow, or sanitization checks. Code Reason gives the agent ground-truth primitives instead of speculation.

What languages does Code Reason support?

Code Reason supports Java and Python codebases, using Fraunhofer AISEC’s Code Property Graph.

How many analysis tools does Code Reason provide?

Code Reason provides 9 MCP tools, including tools for analysis, entry point discovery, callers/callees, data-flow querying, taint path tracing, and catalog-driven injection scanning.