entrygraph

entrygraph builds a queryable graph of your codebase. It indexes a repository into a local SQLite database, then answers questions about the code: what symbols and classes exist, what the entrypoints are (HTTP routes, GraphQL resolvers, CLI commands, main, tasks, lambdas), who calls what, and whether untrusted input can reach a dangerous function.

It works across Python, JavaScript/TypeScript, Go, Java, Ruby, C#, PHP, and Rust, using tree-sitter to parse and per-language rules to detect frameworks and entrypoints.

Install

pip install entrygraph      # or: uv pip install entrygraph

Requires Python 3.13+. This installs the entrygraph command.

Quick start

Index a repo, then query it:

cd ~/code/my-app
entrygraph index .
entrygraph entrypoints
entrygraph callers my_app.services.charge

The index lives in ~/.entrygraph/.entrygraph.db and holds every repo you index, keyed by path. Query commands automatically use the repo you're standing in; to query another repo, add --repo <name> (run entrygraph repos to see what's indexed). Add --json to any command for machine-readable output.

Commands

Command What it does
index <path|url> Build or update the graph. Incremental by default; --full rebuilds. A git URL is cloned first.
detect Languages (by byte share) and detected frameworks.
symbols Search symbols by name, qualified name, kind, or file.
entrypoints Every route, GraphQL resolver, command, main, task, and handler, with its framework and location.
callers / callees Who calls a symbol / what it calls (--depth N).
references Every call site targeting a symbol, with file:line.
paths Source → sink reachability (see below).
stats Counts for the current repo.
repos List the repositories in the database.
serve Web UI over the index.

Run entrygraph <command> --help for the flags on each.

Reachability (paths)

paths answers "can untrusted input reach a dangerous function?" — for example, can an HTTP request reach subprocess.run. It traces call paths from a source (where input enters) to a sink (a risky API), using a built-in catalog of both.

entrygraph paths --source-category http_input --sink-category command_exec

1 path  http_input → command_exec

[1] confirmed data flow → high-severity command_exec sink
  entrypoint POST /reports                flask http_route
  source     create_report               app/routes.py:12  query "cmd"
             cmd = request.args.get("cmd")
      ↓      run_report                  app/routes.py:20
  sink       subprocess.run              app/services.py:22
             subprocess.run(cmd, shell=True)
  confidence resolved — every call is exact/import

Read each finding top-down:

  • The headline tells you whether to act: confirmed data flow means input actually reaches the sink; reachable, but no data flow observed means the call path exists but the input doesn't provably flow through it. It's paired with the sink's severity and category.
  • entrypoint — the route or command the path is reachable through, when the source is one. This is the surface an attacker would actually hit.
  • source → sink — the call chain, each with its file:line and the literal line of code. Uncertain links are flagged (~ fuzzy (guess)); the rest are solidly resolved.
  • confidence — how much to trust the weakest link in the chain.

Paths are ordered best first (confirmed flows, then by severity and confidence). A finding is a lead to review, not proof of a bug.

Useful options:

  • --source / --sink name an exact symbol instead of a category (the language prefix is optional: --sink subprocess.run).
  • --list-categories prints the valid source and sink categories.
  • --confirmed-only keeps only paths with a confirmed flow.
  • --strict reports only high-confidence paths; otherwise the search widens automatically when it finds nothing.

Web UI

entrygraph serve

Browse symbols, entrypoints, the call graph, and reachability in the browser, and index repos from the UI. Runs locally with no auth by default; supports OIDC SSO for shared deployments. Everything is bundled — uvx entrygraph serve just works. (When developing from a source checkout, build the UI once with cd webapp && npm run build.)

Python API

Every CLI command is a thin wrapper over the CodeGraph class:

from entrygraph import CodeGraph

graph = CodeGraph.index("/path/to/repo")     # or CodeGraph.open("index.db")

graph.entrypoints(framework="flask")
graph.callers("app.services.charge")
graph.paths(source_category="http_input", sink_category="sql")
graph.reachable(source="app.routes.upload", sink="py:subprocess.run")  # -> bool

Results are plain frozen dataclasses, safe to hold and easy to serialize.

How it works

entrygraph walks the tree (skipping vendored and generated files), parses each file with tree-sitter, resolves references to their definitions with a confidence level, detects frameworks and entrypoints, and stores everything in SQLite. Re-indexing only reparses changed files. Reachability is a graph traversal over the stored call edges; the analyzed code is never executed.

Extending

Add custom sinks and sources with an entrygraph.toml in the repo root (same format as the built-in catalogs under data/sinks/). New frameworks and languages are added with small rule and tree-sitter query modules.

License

MIT

Project links

Data verified by PyPI on Jul 22, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.134)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for brettbergin from gravatar.com brettbergin

Credits

Author: Brett Bergin

GitHub Statistics

Data verified by PyPI on Jul 22, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.13

Provides Extra

dev

Tags

call-graph code-analysis entrypoints static-analysis tree-sitter

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

entrygraph-0.1.127.tar.gz (713.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

entrygraph-0.1.127-py3-none-any.whl (546.0 kB view details)

Uploaded Python 3

File details

Details for the file entrygraph-0.1.127.tar.gz.

File metadata

  • Download URL: entrygraph-0.1.127.tar.gz
  • Upload date:
  • Size: 713.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for entrygraph-0.1.127.tar.gz
Algorithm Hash digest
SHA256 b9e70a77a4535789dcbc2a7984930e2f7754bef9da767457bbf720a3a382a21c
MD5 51997f40b8d0dfc7325e392857d6774c
BLAKE2b-256 22627abfd47d0e5ae6f05fd089459551f1bf81ed4732ee6af2fc5398e6369e62

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.127.tar.gz:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file entrygraph-0.1.127-py3-none-any.whl.

File metadata

  • Download URL: entrygraph-0.1.127-py3-none-any.whl
  • Upload date:
  • Size: 546.0 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for entrygraph-0.1.127-py3-none-any.whl
Algorithm Hash digest
SHA256 62ad1153764c90e894a77a0a295918032d6f4430959b0b35648ef43db7243798
MD5 cb59f64b9cc4a408e7191d011669f4dc
BLAKE2b-256 9320f4ff4eeb611e25d62fa6c731b47cfd501f1c98189c6a6e381095138f3130

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.127-py3-none-any.whl:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.134

2 files

0.1.133

2 files

0.1.132

2 files

0.1.131

2 files

0.1.130

2 files

0.1.129

2 files

0.1.128

2 files

This release

0.1.127 This release

2 files

0.1.126

2 files

0.1.125

2 files

0.1.124

2 files

0.1.123

2 files

0.1.122

2 files

0.1.121

2 files

0.1.120

2 files

0.1.119

2 files

0.1.118

2 files

0.1.117

2 files

0.1.116

2 files

0.1.115

2 files

0.1.114

2 files

0.1.113

2 files

0.1.112

2 files

0.1.111

2 files

0.1.110

2 files

0.1.109

2 files

0.1.108

2 files

0.1.107

2 files

0.1.106

2 files

0.1.105

2 files

0.1.104

2 files

0.1.103

2 files

0.1.102

2 files

0.1.101

2 files

0.1.100

2 files

0.1.99

2 files

0.1.98

2 files

0.1.97

2 files

0.1.96

2 files

0.1.95

2 files

0.1.94

2 files

0.1.93

2 files

0.1.92

2 files

0.1.91

2 files

0.1.90

2 files

0.1.89

2 files

0.1.88

2 files

0.1.87

2 files

0.1.86

2 files

0.1.85

2 files

0.1.84

2 files

0.1.83

2 files

0.1.82

2 files

0.1.81

2 files

0.1.80

2 files

0.1.79

2 files

0.1.78

2 files

0.1.77

2 files

0.1.76

2 files

0.1.75

2 files

0.1.74

2 files

0.1.73

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.25

2 files

0.1.24

2 files

0.1.23

2 files

0.1.22

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.17

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page