Codesteward/Taint Analysis

Can user input reach a
dangerous operation?

Traces how untrusted input propagates through your codebase to dangerous operations — SQL sinks, shell commands, file I/O — and writes findings as queryable TAINT_FLOW edges into the Codesteward graph. Three levels of depth. CWE-tagged findings.

PythonTypeScriptJavaGoCWE-tagged findings
Read the Docs GitHub
Taint Graph
sanitize()safereq.bodyparseInput()validate()buildQuery()db.exec()!
HIGHCWE-89
SQL Injection — unsanitized input reaches db.exec() via 4-hop path
req.body → parseInput() → validate() → buildQuery() → db.exec()
THE PROBLEM

Code review misses taint paths

Injection vulnerabilities — SQL injection, command injection, path traversal — all share the same root cause: user-controlled input reaches a dangerous operation without sanitization. A reviewer sees the endpoint and the sink, but not the multi-hop call chain connecting them across dozens of files.

A sanitizer in the same function is not enough. If a sanitizer exists on one branch and the tainted value arrives on a different branch, the check is useless. This is the class of bug that path-sensitive analysis catches.
HOW IT WORKS

Three levels of depth

Each level builds on the previous. Run all three for maximum accuracy, or stop early for a fast first pass.

01

Call graph traversal

Follows the CALLS graph to find multi-hop paths from HTTP input sources to dangerous sinks. Fast, language-agnostic, runs entirely as graph queries.

02

Intra-procedural propagation

Inspects source code of functions on the path to verify tainted values actually reach the sink through variable assignments and transformations. Removes false positives.

03

Path-sensitive CFG analysis

Builds a control flow graph and tracks taint along individual execution branches. Catches vulnerabilities where a sanitizer exists but on a different branch than the tainted value.

OUTCOMES

Find what static analysis and code review miss

Injection prevention

SQL injection, command injection, path traversal — caught before they ship.

CWE-tagged findings

Every finding maps to a CWE identifier for compliance reporting and remediation priority.

Graph-native results

Findings are written as TAINT_FLOW edges — queryable alongside call chains, auth guards, and blast radius.

Framework-aware

Built-in catalogs for FastAPI, Flask, Django, Express, NestJS, Spring MVC, Gin, and Echo.

QUICK START

Run after graph_rebuild

Taint analysis builds on the structural graph. Build the graph first, then run the analyzer. 

# 1. Build the graph first
codesteward-mcp graph_rebuild --repo-path /path/to/repo

# 2. Run taint analysis
codesteward-taint \
  --repo-id  my-repo \
  --repo-path /path/to/repo \
  --frameworks fastapi \
  --level 3
Full CLI reference, custom catalogs, and framework configuration in the documentation

Catch injection vulnerabilities before they ship.

See the documentation for CLI flags, custom catalogs, and integration with the graph.

Read the Docs View on GitHub