UnboundCompute/lachesis

**Lachesis reads your code and builds a map of it. Then you can ask the map questions, like who calls this function, where does this value go, and can bad input reach a dangerous spot.**
It works on C, Python, and TypeScript/JavaScript, all in one map.
What is this?
Search tools like grep tell you *where a word shows up* in your code. Lachesis is
different. It follows the actual data. It can tell you where a value came from,
where it goes next, and whether a request from the outside can reach something
dangerous, like a database call with no login check in front of it.
To do this it reads your code the same way a compiler does, not by guessing with
text patterns. So it doesn't miss a call just because a name was renamed or
imported in a weird way.
You can use it three ways: as a command in your terminal, as a Python library, or
as an MCP server that an AI agent can talk to.
Quick start
Install it, then point it at a folder:
It builds the map, saves it, and prints the **leads**. A lead is a spot where
outside input can reach something sensitive with no check in the way. Each lead is
a question to look into, not a final answer.
You can also give it a git URL instead of a folder:
lachesis https://github.com/owner/repo. It downloads the code to a temp folder,
scans it, and cleans up after.
The first scan of a project is slow. After that the map is cached under
~/.lachesis/cache, so every run after is fast.
The three ways to use it
**Terminal.** One lachesis command. lachesis ./repo is the easy front door.
If you want more control, the steps map to three passes:
**Python library.** Open the map once, then ask it as many questions as you want.
Runnable example scripts are in examples/.
**MCP (for AI agents).** Start the server and an agent can build and query the map
on its own:
See MCP below for setup in Cursor, VS Code, Claude, and Docker.
What you can ask
Once the map is built, these are the moves. They work from the terminal, the
Python library, or as MCP tools an agent uses:
| You want to know | The tool |
|---|---|
| What is this part of the code built around? | hubs |
| Where is this name? | search |
| Who calls this? What does it call? | callers, callees |
| Show me the real source | read_body |
| What's in this file or folder? | open_file, open_folder |
| Where does this value go? What feeds this spot? | flow, sources_of |
| Does this input reach that spot? | reaches (gives a path, or a clear no) |
| What does this pointer point at? | points_to, aliases |
| Where does outside input reach something dangerous? | taint |
| Is this C object freed twice, or used after it's freed? | the C lifetime pass |
| Which entrypoints reach sensitive spots with no check? | scan (the leads) |
| All the evidence for one spot, in one call | explain |
Every answer comes with how sure it is. Some links are exact. Some are a safe
guess, and Lachesis tells you when it's guessing instead of hiding it. Read the
answers as evidence, not as a verdict.
MCP
Run lachesis mcp from the same place you built the map. You can hand it a
graph.kuzu path, but you don't have to. Start it with no argument and the agent
builds its own map when you point it at a repo.
**One click** (uses uvx, no install step):
 
Or set it up by hand. If the package is already installed:
Or let uvx fetch it on first run, no install:
Or run it in Docker, with all three languages already in the image: