entrygraph

entrygraph builds a queryable graph of your codebase. It indexes a repository into a local SQLite database, then answers questions about the code: what symbols and classes exist, what the entrypoints are (HTTP routes, CLI commands, main, tasks, lambdas), who calls what, and whether untrusted input can reach a dangerous function.

It works across Python, JavaScript/TypeScript, Go, Java, Ruby, C#, PHP, and Rust, using tree-sitter to parse and per-language rules to detect frameworks and entrypoints.

Install

pip install entrygraph      # or: uv pip install entrygraph

Requires Python 3.13+. This installs the entrygraph command.

Quick start

Index a repo, then query it:

cd ~/code/my-app
entrygraph index .
entrygraph entrypoints
entrygraph callers my_app.services.charge

The index lives in ~/.entrygraph/.entrygraph.db and holds every repo you index, keyed by path. Query commands automatically use the repo you're standing in; to query another repo, add --repo <name> (run entrygraph repos to see what's indexed). Add --json to any command for machine-readable output.

Commands

Command What it does
index <path|url> Build or update the graph. Incremental by default; --full rebuilds. A git URL is cloned first.
detect Languages (by byte share) and detected frameworks.
symbols Search symbols by name, qualified name, kind, or file.
entrypoints Every route, command, main, task, and handler, with its framework and location.
callers / callees Who calls a symbol / what it calls (--depth N).
references Every call site targeting a symbol, with file:line.
paths Source → sink reachability (see below).
stats Counts for the current repo.
repos List the repositories in the database.
serve Web UI over the index.

Run entrygraph <command> --help for the flags on each.

Reachability (paths)

paths answers "can untrusted input reach a dangerous function?" — for example, can an HTTP request reach subprocess.run. It traces call paths from a source (where input enters) to a sink (a risky API), using a built-in catalog of both.

entrygraph paths --source-category http_input --sink-category command_exec

1 path  http_input → command_exec

[1] confirmed data flow → high-severity command_exec sink
  entrypoint POST /reports                flask http_route
  source     create_report               app/routes.py:12  query "cmd"
             cmd = request.args.get("cmd")
      ↓      run_report                  app/routes.py:20
  sink       subprocess.run              app/services.py:22
             subprocess.run(cmd, shell=True)
  confidence resolved — every call is exact/import

Read each finding top-down:

  • The headline tells you whether to act: confirmed data flow means input actually reaches the sink; reachable, but no data flow observed means the call path exists but the input doesn't provably flow through it. It's paired with the sink's severity and category.
  • entrypoint — the route or command the path is reachable through, when the source is one. This is the surface an attacker would actually hit.
  • source → sink — the call chain, each with its file:line and the literal line of code. Uncertain links are flagged (~ fuzzy (guess)); the rest are solidly resolved.
  • confidence — how much to trust the weakest link in the chain.

Paths are ordered best first (confirmed flows, then by severity and confidence). A finding is a lead to review, not proof of a bug.

Useful options:

  • --source / --sink name an exact symbol instead of a category (the language prefix is optional: --sink subprocess.run).
  • --list-categories prints the valid source and sink categories.
  • --confirmed-only keeps only paths with a confirmed flow.
  • --strict reports only high-confidence paths; otherwise the search widens automatically when it finds nothing.

Web UI

entrygraph serve

Browse symbols, entrypoints, the call graph, and reachability in the browser, and index repos from the UI. Runs locally with no auth by default; supports OIDC SSO for shared deployments. Everything is bundled — uvx entrygraph serve just works. (When developing from a source checkout, build the UI once with cd webapp && npm run build.)

Python API

Every CLI command is a thin wrapper over the CodeGraph class:

from entrygraph import CodeGraph

graph = CodeGraph.index("/path/to/repo")     # or CodeGraph.open("index.db")

graph.entrypoints(framework="flask")
graph.callers("app.services.charge")
graph.paths(source_category="http_input", sink_category="sql")
graph.reachable(source="app.routes.upload", sink="py:subprocess.run")  # -> bool

Results are plain frozen dataclasses, safe to hold and easy to serialize.

How it works

entrygraph walks the tree (skipping vendored and generated files), parses each file with tree-sitter, resolves references to their definitions with a confidence level, detects frameworks and entrypoints, and stores everything in SQLite. Re-indexing only reparses changed files. Reachability is a graph traversal over the stored call edges; the analyzed code is never executed.

Extending

Add custom sinks and sources with an entrygraph.toml in the repo root (same format as the built-in catalogs under data/sinks/). New frameworks and languages are added with small rule and tree-sitter query modules.

License

MIT

Project links

Data verified by PyPI on Jul 17, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.134)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for brettbergin from gravatar.com brettbergin

Credits

Author: Brett Bergin

GitHub Statistics

Data verified by PyPI on Jul 17, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.13

Provides Extra

dev

Tags

call-graph code-analysis entrypoints static-analysis tree-sitter

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

entrygraph-0.1.126.tar.gz (712.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

entrygraph-0.1.126-py3-none-any.whl (545.8 kB view details)

Uploaded Python 3

File details

Details for the file entrygraph-0.1.126.tar.gz.

File metadata

  • Download URL: entrygraph-0.1.126.tar.gz
  • Upload date:
  • Size: 712.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for entrygraph-0.1.126.tar.gz
Algorithm Hash digest
SHA256 f3754830a4c1d0970234e3cb25c72dbda0470ba4fc6b8f7ada710777f17973ed
MD5 e1ddfa8ee08b06f87a27e6b715371bda
BLAKE2b-256 70743672e57895e9029d132a09d6e2566d96ef7e062485a1bcf857b410bfc5a7

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.126.tar.gz:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file entrygraph-0.1.126-py3-none-any.whl.

File metadata

  • Download URL: entrygraph-0.1.126-py3-none-any.whl
  • Upload date:
  • Size: 545.8 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for entrygraph-0.1.126-py3-none-any.whl
Algorithm Hash digest
SHA256 30d3c6383ee8c736a80abe297b218e36143703fafc79cbfcea45d230f622fc62
MD5 d64cd50c3221f1b68f7ba5e52d0d3a90
BLAKE2b-256 62481e97e6f2f80d48167812eb7c17f2b893d0693725f2f6d5baa4cfae3f1456

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.126-py3-none-any.whl:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.134

2 files

0.1.133

2 files

0.1.132

2 files

0.1.131

2 files

0.1.130

2 files

0.1.129

2 files

0.1.128

2 files

0.1.127

2 files

This release

0.1.126 This release

2 files

0.1.125

2 files

0.1.124

2 files

0.1.123

2 files

0.1.122

2 files

0.1.121

2 files

0.1.120

2 files

0.1.119

2 files

0.1.118

2 files

0.1.117

2 files

0.1.116

2 files

0.1.115

2 files

0.1.114

2 files

0.1.113

2 files

0.1.112

2 files

0.1.111

2 files

0.1.110

2 files

0.1.109

2 files

0.1.108

2 files

0.1.107

2 files

0.1.106

2 files

0.1.105

2 files

0.1.104

2 files

0.1.103

2 files

0.1.102

2 files

0.1.101

2 files

0.1.100

2 files

0.1.99

2 files

0.1.98

2 files

0.1.97

2 files

0.1.96

2 files

0.1.95

2 files

0.1.94

2 files

0.1.93

2 files

0.1.92

2 files

0.1.91

2 files

0.1.90

2 files

0.1.89

2 files

0.1.88

2 files

0.1.87

2 files

0.1.86

2 files

0.1.85

2 files

0.1.84

2 files

0.1.83

2 files

0.1.82

2 files

0.1.81

2 files

0.1.80

2 files

0.1.79

2 files

0.1.78

2 files

0.1.77

2 files

0.1.76

2 files

0.1.75

2 files

0.1.74

2 files

0.1.73

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.25

2 files

0.1.24

2 files

0.1.23

2 files

0.1.22

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.17

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page