entrygraph

entrygraph builds a queryable graph of your codebase. It indexes a repository into a local SQLite database, then answers questions about the code: what symbols and classes exist, what the entrypoints are (HTTP routes, GraphQL resolvers, CLI commands, main, tasks, lambdas), who calls what, and whether untrusted input can reach a dangerous function.

It works across Python, JavaScript/TypeScript, Go, Java, Ruby, C#, PHP, and Rust, using tree-sitter to parse and per-language rules to detect frameworks and entrypoints.

Install

pip install entrygraph      # or: uv pip install entrygraph

Requires Python 3.13+. This installs the entrygraph command.

Quick start

Index a repo, then query it:

cd ~/code/my-app
entrygraph index .
entrygraph entrypoints
entrygraph callers my_app.services.charge

The index lives in ~/.entrygraph/.entrygraph.db and holds every repo you index, keyed by path. Query commands automatically use the repo you're standing in; to query another repo, add --repo <name> (run entrygraph repos to see what's indexed). Add --json to any command for machine-readable output.

Commands

Command What it does
index <path|url> Build or update the graph. Incremental by default; --full rebuilds. A git URL is cloned first.
detect Languages (by byte share) and detected frameworks.
symbols Search symbols by name, qualified name, kind, or file.
entrypoints Every route, GraphQL resolver, command, main, task, and handler, with its framework and location.
callers / callees Who calls a symbol / what it calls (--depth N).
references Every call site targeting a symbol, with file:line.
paths Source → sink reachability (see below).
stats Counts for the current repo.
repos List the repositories in the database, with each one's refresh status.
reindex --stale Refresh repos whose data predates the current analyzer (see Upgrading).
serve Web UI over the index.

Run entrygraph <command> --help for the flags on each.

Upgrading

The index is a cache, but upgrading entrygraph does not make you rebuild it. A structural schema change is migrated in place, preserving your data. When a release improves the analyzer itself — teaching it a new framework, say — every repo you've already indexed keeps serving its existing results and is simply marked refreshing until re-scanned; nothing goes offline and no repo is wiped. Refresh them on your own schedule with entrygraph reindex --stale, or let entrygraph serve do it automatically in the background (EG_HEAL_INTERVAL_S: 0 sweeps once at startup, the default; >0 also re-sweeps on that interval; -1 disables).

Reachability (paths)

paths answers "can untrusted input reach a dangerous function?" — for example, can an HTTP request reach subprocess.run. It traces call paths from a source (where input enters) to a sink (a risky API), using a built-in catalog of both.

entrygraph paths --source-category http_input --sink-category command_exec

1 path  http_input → command_exec

[1] confirmed data flow → high-severity command_exec sink
  entrypoint POST /reports                flask http_route
  source     create_report               app/routes.py:12  query "cmd"
             cmd = request.args.get("cmd")
      ↓      run_report                  app/routes.py:20
  sink       subprocess.run              app/services.py:22
             subprocess.run(cmd, shell=True)
  confidence resolved — every call is exact/import

Read each finding top-down:

  • The headline tells you whether to act: confirmed data flow means input actually reaches the sink; reachable, but no data flow observed means the call path exists but the input doesn't provably flow through it. It's paired with the sink's severity and category.
  • entrypoint — the route or command the path is reachable through, when the source is one. This is the surface an attacker would actually hit.
  • source → sink — the call chain, each with its file:line and the literal line of code. Uncertain links are flagged (~ fuzzy (guess)); the rest are solidly resolved.
  • confidence — how much to trust the weakest link in the chain.

Paths are ordered best first (confirmed flows, then by severity and confidence). A finding is a lead to review, not proof of a bug.

Useful options:

  • --source / --sink name an exact symbol instead of a category (the language prefix is optional: --sink subprocess.run).
  • --list-categories prints the valid source and sink categories.
  • --confirmed-only keeps only paths with a confirmed flow.
  • --strict reports only high-confidence paths; otherwise the search widens automatically when it finds nothing.

Web UI

entrygraph serve

Browse symbols, entrypoints, the call graph, and reachability in the browser, and index repos from the UI. Runs locally with no auth by default; supports OIDC SSO for shared deployments. Everything is bundled — uvx entrygraph serve just works. (When developing from a source checkout, build the UI once with cd webapp && npm run build.)

Python API

Every CLI command is a thin wrapper over the CodeGraph class:

from entrygraph import CodeGraph

graph = CodeGraph.index("/path/to/repo")     # or CodeGraph.open("index.db")

graph.entrypoints(framework="flask")
graph.callers("app.services.charge")
graph.paths(source_category="http_input", sink_category="sql")
graph.reachable(source="app.routes.upload", sink="py:subprocess.run")  # -> bool

Results are plain frozen dataclasses, safe to hold and easy to serialize.

How it works

entrygraph walks the tree (skipping vendored and generated files), parses each file with tree-sitter, resolves references to their definitions with a confidence level, detects frameworks and entrypoints, and stores everything in SQLite. Re-indexing only reparses changed files. Reachability is a graph traversal over the stored call edges; the analyzed code is never executed.

Extending

Add custom sinks and sources with an entrygraph.toml in the repo root (same format as the built-in catalogs under data/sinks/). New frameworks and languages are added with small rule and tree-sitter query modules.

License

MIT

Project links

Data verified by PyPI on Jul 23, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for brettbergin from gravatar.com brettbergin

Credits

Author: Brett Bergin

GitHub Statistics

Data verified by PyPI on Jul 23, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.13

Provides Extra

dev

Tags

call-graph code-analysis entrypoints static-analysis tree-sitter

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

entrygraph-0.1.134.tar.gz (757.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

entrygraph-0.1.134-py3-none-any.whl (579.1 kB view details)

Uploaded Python 3

File details

Details for the file entrygraph-0.1.134.tar.gz.

File metadata

  • Download URL: entrygraph-0.1.134.tar.gz
  • Upload date:
  • Size: 757.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for entrygraph-0.1.134.tar.gz
Algorithm Hash digest
SHA256 1ea5fed142eecec86d847b4d871338511772d3b2a795eb898bceb14996398451
MD5 f6c3e5f67f23918bfaa7b270926e126c
BLAKE2b-256 7abfcece4d13c47476a59114ef99080fbfa05c4edb295a196836f598cf5ee0a2

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.134.tar.gz:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file entrygraph-0.1.134-py3-none-any.whl.

File metadata

  • Download URL: entrygraph-0.1.134-py3-none-any.whl
  • Upload date:
  • Size: 579.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for entrygraph-0.1.134-py3-none-any.whl
Algorithm Hash digest
SHA256 a7022964b7d30093ed8c4fd97e512f20140263ee26705e45a441ee3e2643c9ca
MD5 308c5d8a339b8eb4f04c621c327447c9
BLAKE2b-256 e59866ffee64f17d9e6d0527d90319912bf723784b09d53d85885425f8df4fa4

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.134-py3-none-any.whl:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.1.134 This release

2 files

0.1.133

2 files

0.1.132

2 files

0.1.131

2 files

0.1.130

2 files

0.1.129

2 files

0.1.128

2 files

0.1.127

2 files

0.1.126

2 files

0.1.125

2 files

0.1.124

2 files

0.1.123

2 files

0.1.122

2 files

0.1.121

2 files

0.1.120

2 files

0.1.119

2 files

0.1.118

2 files

0.1.117

2 files

0.1.116

2 files

0.1.115

2 files

0.1.114

2 files

0.1.113

2 files

0.1.112

2 files

0.1.111

2 files

0.1.110

2 files

0.1.109

2 files

0.1.108

2 files

0.1.107

2 files

0.1.106

2 files

0.1.105

2 files

0.1.104

2 files

0.1.103

2 files

0.1.102

2 files

0.1.101

2 files

0.1.100

2 files

0.1.99

2 files

0.1.98

2 files

0.1.97

2 files

0.1.96

2 files

0.1.95

2 files

0.1.94

2 files

0.1.93

2 files

0.1.92

2 files

0.1.91

2 files

0.1.90

2 files

0.1.89

2 files

0.1.88

2 files

0.1.87

2 files

0.1.86

2 files

0.1.85

2 files

0.1.84

2 files

0.1.83

2 files

0.1.82

2 files

0.1.81

2 files

0.1.80

2 files

0.1.79

2 files

0.1.78

2 files

0.1.77

2 files

0.1.76

2 files

0.1.75

2 files

0.1.74

2 files

0.1.73

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.25

2 files

0.1.24

2 files

0.1.23

2 files

0.1.22

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.17

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page