entrygraph

entrygraph builds a queryable graph of your codebase. It indexes a repository into a local SQLite database, then answers questions about the code: what symbols and classes exist, what the entrypoints are (HTTP routes, CLI commands, main, tasks, lambdas), who calls what, and whether untrusted input can reach a dangerous function.

It works across Python, JavaScript/TypeScript, Go, Java, Ruby, C#, PHP, and Rust, using tree-sitter to parse and per-language rules to detect frameworks and entrypoints.

Install

pip install entrygraph      # or: uv pip install entrygraph

Requires Python 3.13+. This installs the entrygraph command.

Quick start

Index a repo, then query it:

cd ~/code/my-app
entrygraph index .
entrygraph entrypoints
entrygraph callers my_app.services.charge

The index lives in ~/.entrygraph/.entrygraph.db and holds every repo you index, keyed by path. Query commands automatically use the repo you're standing in; to query another repo, add --repo <name> (run entrygraph repos to see what's indexed). Add --json to any command for machine-readable output.

Commands

Command What it does
index <path|url> Build or update the graph. Incremental by default; --full rebuilds. A git URL is cloned first.
detect Languages (by byte share) and detected frameworks.
symbols Search symbols by name, qualified name, kind, or file.
entrypoints Every route, command, main, task, and handler, with its framework and location.
callers / callees Who calls a symbol / what it calls (--depth N).
references Every call site targeting a symbol, with file:line.
paths Source → sink reachability (see below).
stats Counts for the current repo.
repos List the repositories in the database.
serve Web UI over the index.

Run entrygraph <command> --help for the flags on each.

Reachability (paths)

paths answers "can untrusted input reach a dangerous function?" — for example, can an HTTP request reach subprocess.run. It traces call paths from a source (where input enters) to a sink (a risky API), using a built-in catalog of both.

entrygraph paths --source-category http_input --sink-category command_exec

1 path(s)  category:http_input → category:command_exec

[1] severity high  confidence import
  source  create_report   app/routes.py:12  (http_input · explicit · query "cmd")
          cmd = request.args.get("cmd")
    ↓     run_report      app/routes.py:20  import
  sink    subprocess.run  app/services.py:22  ⚡ py.command-exec.subprocess  import
          subprocess.run(cmd, shell=True)
       flow: confirmed (1 hop)

Each path reports facts you can verify by opening the code:

  • severity — the sink's catalog severity (critical/high/medium/low).
  • confidence — how sure the resolver is of the weakest call in the chain. exact and import are solid; fuzzy and unresolved are guesses.
  • flow — confirmed if a source value actually reaches the sink, not observed if it provably doesn't.

Paths are ordered best first (confirmed flows, then by severity and confidence). A finding is a lead to review, not proof of a bug.

Useful options:

  • --source / --sink name an exact symbol instead of a category (the language prefix is optional: --sink subprocess.run).
  • --list-categories prints the valid source and sink categories.
  • --confirmed-only keeps only paths with a confirmed flow.
  • --strict reports only high-confidence paths; otherwise the search widens automatically when it finds nothing.

Web UI

entrygraph serve

Browse symbols, entrypoints, the call graph, and reachability in the browser, and index repos from the UI. Runs locally with no auth by default; supports OIDC SSO for shared deployments. Ships in the entrygraph[server] extra — build the UI once with cd webapp && npm run build.

Python API

Every CLI command is a thin wrapper over the CodeGraph class:

from entrygraph import CodeGraph

graph = CodeGraph.index("/path/to/repo")     # or CodeGraph.open("index.db")

graph.entrypoints(framework="flask")
graph.callers("app.services.charge")
graph.paths(source_category="http_input", sink_category="sql")
graph.reachable(source="app.routes.upload", sink="py:subprocess.run")  # -> bool

Results are plain frozen dataclasses, safe to hold and easy to serialize.

How it works

entrygraph walks the tree (skipping vendored and generated files), parses each file with tree-sitter, resolves references to their definitions with a confidence level, detects frameworks and entrypoints, and stores everything in SQLite. Re-indexing only reparses changed files. Reachability is a graph traversal over the stored call edges; the analyzed code is never executed.

Extending

Add custom sinks and sources with an entrygraph.toml in the repo root (same format as the built-in catalogs under data/sinks/). New frameworks and languages are added with small rule and tree-sitter query modules.

License

MIT

Project links

Data verified by PyPI on Jul 16, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.134)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for brettbergin from gravatar.com brettbergin

Credits

Author: Brett Bergin

GitHub Statistics

Data verified by PyPI on Jul 16, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.13

Provides Extra

dev server

Tags

call-graph code-analysis entrypoints static-analysis tree-sitter

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

entrygraph-0.1.124.tar.gz (425.7 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

entrygraph-0.1.124-py3-none-any.whl (258.2 kB view details)

Uploaded Python 3

File details

Details for the file entrygraph-0.1.124.tar.gz.

File metadata

  • Download URL: entrygraph-0.1.124.tar.gz
  • Upload date:
  • Size: 425.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for entrygraph-0.1.124.tar.gz
Algorithm Hash digest
SHA256 c03179c34f96ac768037108a1166c2d5768e2f6be4b7a5fd7bff8599cc5a884a
MD5 fc015d86bcd1af10ce45b5f743f5d0bf
BLAKE2b-256 f1d3486631f68890f972d0da21e314d060c81196cd18f88b75c499ea17b8692f

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.124.tar.gz:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file entrygraph-0.1.124-py3-none-any.whl.

File metadata

  • Download URL: entrygraph-0.1.124-py3-none-any.whl
  • Upload date:
  • Size: 258.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for entrygraph-0.1.124-py3-none-any.whl
Algorithm Hash digest
SHA256 df2dd622b39cfef19d1136d3e45b4ec3c81470468ce8f6c21acf7d6999e8c337
MD5 d3aa1a1d689d201c31886292cda0db13
BLAKE2b-256 3e6a3a68e4798c85016428d58282a64b5746047fceb54e493c0553903ea51c47

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.124-py3-none-any.whl:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.134

2 files

0.1.133

2 files

0.1.132

2 files

0.1.131

2 files

0.1.130

2 files

0.1.129

2 files

0.1.128

2 files

0.1.127

2 files

0.1.126

2 files

0.1.125

2 files

This release

0.1.124 This release

2 files

0.1.123

2 files

0.1.122

2 files

0.1.121

2 files

0.1.120

2 files

0.1.119

2 files

0.1.118

2 files

0.1.117

2 files

0.1.116

2 files

0.1.115

2 files

0.1.114

2 files

0.1.113

2 files

0.1.112

2 files

0.1.111

2 files

0.1.110

2 files

0.1.109

2 files

0.1.108

2 files

0.1.107

2 files

0.1.106

2 files

0.1.105

2 files

0.1.104

2 files

0.1.103

2 files

0.1.102

2 files

0.1.101

2 files

0.1.100

2 files

0.1.99

2 files

0.1.98

2 files

0.1.97

2 files

0.1.96

2 files

0.1.95

2 files

0.1.94

2 files

0.1.93

2 files

0.1.92

2 files

0.1.91

2 files

0.1.90

2 files

0.1.89

2 files

0.1.88

2 files

0.1.87

2 files

0.1.86

2 files

0.1.85

2 files

0.1.84

2 files

0.1.83

2 files

0.1.82

2 files

0.1.81

2 files

0.1.80

2 files

0.1.79

2 files

0.1.78

2 files

0.1.77

2 files

0.1.76

2 files

0.1.75

2 files

0.1.74

2 files

0.1.73

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.25

2 files

0.1.24

2 files

0.1.23

2 files

0.1.22

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.17

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page