NeuG-codescope

Code property graph (CPG) construction and LLM-based vulnerability audit tool for C / Java / Python / Rust, backed by the neug graph store. The importable package name is codegraph.

Installation

Requires Python >= 3.10.

# Full install (all language frontends + LLM loop dependencies)
pip install "neug-codescope[all]"

# Minimal install (neug + networkx + requests)
pip install neug-codescope

# Optional extras: c (libclang), java (tree-sitter + tree-sitter-java),
#                  rust (tree-sitter-rust), llm (openai)
pip install "neug-codescope[c,rust]"

If libclang cannot be located automatically, set the LIBCLANG_PATH environment variable (only needed by the C frontend). The Python frontend uses the standard library ast and needs no extra dependencies.

Usage

Every entry point is available both as a console script and via python -m:

Example (file_audit tool mode):

# Build the tier1 function-level summary graph
codescope-audit audit -i <project-dir> --out <output-dir> --build-only --skip-cpg

# Then drive step by step from the audited project's root directory
cd <project-dir>
codescope-audit overview --db-path <output-dir>/audit.neug
codescope-audit build "func:<relpath>:<name>" --db-path <output-dir>/audit.neug
codescope-audit query "MATCH (s:Symbol) RETURN s.node_id LIMIT 10" --db-path <output-dir>/audit.neug

For the full workflow (tier1/tier2 design, dataflow bug taxonomy, report formats), see SKILL.md in the source repository.

Development

pip install -e ".[all]"          # Editable install
python -m tests.smoke_test       # Smoke test (run from the project root)