entrygraph

entrygraph builds a queryable graph of your codebase. It indexes a repository into a local SQLite database, then answers questions about the code: what symbols and classes exist, what the entrypoints are (HTTP routes, GraphQL resolvers, CLI commands, main, tasks, lambdas), who calls what, and whether untrusted input can reach a dangerous function.

It works across Python, JavaScript/TypeScript, Go, Java, Ruby, C#, PHP, and Rust, using tree-sitter to parse and per-language rules to detect frameworks and entrypoints.

Install

pip install entrygraph      # or: uv pip install entrygraph

Requires Python 3.13+. This installs the entrygraph command.

Quick start

Index a repo, then query it:

cd ~/code/my-app
entrygraph index .
entrygraph entrypoints
entrygraph callers my_app.services.charge

The index lives in ~/.entrygraph/.entrygraph.db and holds every repo you index, keyed by path. Query commands automatically use the repo you're standing in; to query another repo, add --repo <name> (run entrygraph repos to see what's indexed). Add --json to any command for machine-readable output.

Commands

Command What it does
index <path|url> Build or update the graph. Incremental by default; --full rebuilds. A git URL is cloned first.
detect Languages (by byte share) and detected frameworks.
symbols Search symbols by name, qualified name, kind, or file.
entrypoints Every route, GraphQL resolver, command, main, task, and handler, with its framework and location.
callers / callees Who calls a symbol / what it calls (--depth N).
references Every call site targeting a symbol, with file:line.
paths Source → sink reachability (see below).
stats Counts for the current repo.
repos List the repositories in the database.
serve Web UI over the index.

Run entrygraph <command> --help for the flags on each.

Reachability (paths)

paths answers "can untrusted input reach a dangerous function?" — for example, can an HTTP request reach subprocess.run. It traces call paths from a source (where input enters) to a sink (a risky API), using a built-in catalog of both.

entrygraph paths --source-category http_input --sink-category command_exec

1 path  http_input → command_exec

[1] confirmed data flow → high-severity command_exec sink
  entrypoint POST /reports                flask http_route
  source     create_report               app/routes.py:12  query "cmd"
             cmd = request.args.get("cmd")
      ↓      run_report                  app/routes.py:20
  sink       subprocess.run              app/services.py:22
             subprocess.run(cmd, shell=True)
  confidence resolved — every call is exact/import

Read each finding top-down:

  • The headline tells you whether to act: confirmed data flow means input actually reaches the sink; reachable, but no data flow observed means the call path exists but the input doesn't provably flow through it. It's paired with the sink's severity and category.
  • entrypoint — the route or command the path is reachable through, when the source is one. This is the surface an attacker would actually hit.
  • source → sink — the call chain, each with its file:line and the literal line of code. Uncertain links are flagged (~ fuzzy (guess)); the rest are solidly resolved.
  • confidence — how much to trust the weakest link in the chain.

Paths are ordered best first (confirmed flows, then by severity and confidence). A finding is a lead to review, not proof of a bug.

Useful options:

  • --source / --sink name an exact symbol instead of a category (the language prefix is optional: --sink subprocess.run).
  • --list-categories prints the valid source and sink categories.
  • --confirmed-only keeps only paths with a confirmed flow.
  • --strict reports only high-confidence paths; otherwise the search widens automatically when it finds nothing.

Web UI

entrygraph serve

Browse symbols, entrypoints, the call graph, and reachability in the browser, and index repos from the UI. Runs locally with no auth by default; supports OIDC SSO for shared deployments. Everything is bundled — uvx entrygraph serve just works. (When developing from a source checkout, build the UI once with cd webapp && npm run build.)

Python API

Every CLI command is a thin wrapper over the CodeGraph class:

from entrygraph import CodeGraph

graph = CodeGraph.index("/path/to/repo")     # or CodeGraph.open("index.db")

graph.entrypoints(framework="flask")
graph.callers("app.services.charge")
graph.paths(source_category="http_input", sink_category="sql")
graph.reachable(source="app.routes.upload", sink="py:subprocess.run")  # -> bool

Results are plain frozen dataclasses, safe to hold and easy to serialize.

How it works

entrygraph walks the tree (skipping vendored and generated files), parses each file with tree-sitter, resolves references to their definitions with a confidence level, detects frameworks and entrypoints, and stores everything in SQLite. Re-indexing only reparses changed files. Reachability is a graph traversal over the stored call edges; the analyzed code is never executed.

Extending

Add custom sinks and sources with an entrygraph.toml in the repo root (same format as the built-in catalogs under data/sinks/). New frameworks and languages are added with small rule and tree-sitter query modules.

License

MIT

Project links

Data verified by PyPI on Jul 22, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.134)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for brettbergin from gravatar.com brettbergin

Credits

Author: Brett Bergin

GitHub Statistics

Data verified by PyPI on Jul 22, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License

Requires

Python >=3.13

Provides Extra

dev

Tags

call-graph code-analysis entrypoints static-analysis tree-sitter

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

entrygraph-0.1.128.tar.gz (716.5 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

entrygraph-0.1.128-py3-none-any.whl (550.1 kB view details)

Uploaded Python 3

File details

Details for the file entrygraph-0.1.128.tar.gz.

File metadata

  • Download URL: entrygraph-0.1.128.tar.gz
  • Upload date:
  • Size: 716.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for entrygraph-0.1.128.tar.gz
Algorithm Hash digest
SHA256 23e3ad3e63872a4ff5c03a4a01f0e53650458ed7240704eb9d14507e47c64eb0
MD5 400ceb31a2b0a7e2ddc6bfd24c198064
BLAKE2b-256 02c8b58754dc06c6c15d981536567f974bd83db1a2fc68bb46b68f347938a41a

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.128.tar.gz:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file entrygraph-0.1.128-py3-none-any.whl.

File metadata

  • Download URL: entrygraph-0.1.128-py3-none-any.whl
  • Upload date:
  • Size: 550.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for entrygraph-0.1.128-py3-none-any.whl
Algorithm Hash digest
SHA256 f71c9cc68e01ceb23b615785c820c241ce8dcbcb03ebfa400b58ed0e915ab45a
MD5 3098946d3d31cf7bf923809f483171ee
BLAKE2b-256 639c711691e76e22ca8d72b78fa2940a0602077cabbfbea034c4b4692325c6e2

See more details on using hashes here.

Provenance

The following attestation bundles were made for entrygraph-0.1.128-py3-none-any.whl:

Publisher: release.yml on brettbergin/entrygraph

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.134

2 files

0.1.133

2 files

0.1.132

2 files

0.1.131

2 files

0.1.130

2 files

0.1.129

2 files

This release

0.1.128 This release

2 files

0.1.127

2 files

0.1.126

2 files

0.1.125

2 files

0.1.124

2 files

0.1.123

2 files

0.1.122

2 files

0.1.121

2 files

0.1.120

2 files

0.1.119

2 files

0.1.118

2 files

0.1.117

2 files

0.1.116

2 files

0.1.115

2 files

0.1.114

2 files

0.1.113

2 files

0.1.112

2 files

0.1.111

2 files

0.1.110

2 files

0.1.109

2 files

0.1.108

2 files

0.1.107

2 files

0.1.106

2 files

0.1.105

2 files

0.1.104

2 files

0.1.103

2 files

0.1.102

2 files

0.1.101

2 files

0.1.100

2 files

0.1.99

2 files

0.1.98

2 files

0.1.97

2 files

0.1.96

2 files

0.1.95

2 files

0.1.94

2 files

0.1.93

2 files

0.1.92

2 files

0.1.91

2 files

0.1.90

2 files

0.1.89

2 files

0.1.88

2 files

0.1.87

2 files

0.1.86

2 files

0.1.85

2 files

0.1.84

2 files

0.1.83

2 files

0.1.82

2 files

0.1.81

2 files

0.1.80

2 files

0.1.79

2 files

0.1.78

2 files

0.1.77

2 files

0.1.76

2 files

0.1.75

2 files

0.1.74

2 files

0.1.73

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.25

2 files

0.1.24

2 files

0.1.23

2 files

0.1.22

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.17

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page