Dataflow analysis identifies candidate paths from untrusted sources to sensitive sinks. It gives a professional security reviewer a prioritized inspection queue; exploitability is established by the separate security review.
Broad project audit
Start with a read-only deep-security audit of the configured project:
python -m src.cli audit --profile deep_security --skip-persistence
Add --format json --output <report.json> for a durable artifact. Confirm project and CPG
freshness before interpreting paths. --skip-persistence prevents audit/dashboard projection
updates; it does not reduce the analysis scope.
Targeted taint path
In an authorized security role/full MCP profile, use
codegraph_security_taint_analysis_run for a named method and one source/sink category. The
supported source categories are user_input, file_read, network, and env. Supported sink
categories are sql, command, file_write, xss, and buffer.
Agent-facing calls use the current project context. Do not pass a raw storage path. If the tool is not available in the active profile, request the correct role/profile instead of substituting a retired name.
Validate a finding
- Confirm the source is actually attacker-controlled in this execution context.
- Follow each call and assignment in the reported path.
- Check sanitization, validation, encoding, authorization, and trust-boundary transitions.
- Verify whether the sink is reachable with the reported data shape.
- Record the code revision, source/sink categories, evidence refs, and reviewer verdict.
An empty result means that the current graph, limits, and language support produced no path. The security review covers the remaining sources, sinks, and runtime boundaries.
Contract sources
src/mcp/tools/security_suite/security.py— targeted MCP tool and category contract;src/analysis/dataflow/taint/propagator.py— taint propagation;src/analysis/dataflow/taint/models.py— path model;src/cli/analysis_commands/audit_commands.py— broad audit integration.