Javasinktracer MCP

🚀 JavaSinkTracer_MCP

JavaSinkTracer is a Java source code vulnerability auditing tool based on function-level taint analysis. It provides security analysis capabilities for AI assistants through the Model Context Protocol (MCP).

🚀 Quick Start

1. Install Dependencies

pip install -r requirements.txt

2. Configure Claude Desktop

Edit the configuration file and add the MCP server configuration:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "javasinktracer": {
      "command": "python",
      "args": [
        "/path/to/JavaSinkTracer/mcp_server.py"
      ],
      "description": "Java source code vulnerability auditing tool - based on function-level taint analysis"
    }
  }
}

Note: Replace /path/to/JavaSinkTracer with the actual project path.

3. Restart Claude Desktop

After the configuration is complete, restart Claude Desktop, and the MCP tool will be automatically loaded.

🎥 Video Demo

https://www.bilibili.com/video/BV1XrxDz1EvF

✨ Features

Vulnerability Scanning

Trace back from dangerous functions (Sink) to external entrances (Source) to automatically discover potential security vulnerability chains.

Call Graph Analysis

Build a complete function call relationship graph for Java projects, supporting cross-file and cross-class call tracing.

Intelligent Analysis

Based on function-level taint analysis, effectively avoid the chain-breaking problem of variable-level tracing in complex scenarios (threads, reflection, callbacks).

Code Extraction

Automatically extract the complete source code of each function in the vulnerability chain for in-depth analysis by humans or AI.

🛠️ Available Tools

💻 Usage Examples

Example 1: Comprehensive Vulnerability Scanning

Please help me scan the security vulnerabilities of the /path/to/java-project project.

The AI will automatically:

1. Build the call relationship graph.
2. Scan for all types of vulnerabilities.
3. Analyze and report the discovered issues.

Example 2: Targeted Detection

Check if there are SQL injection and command execution vulnerabilities in the project.

The AI will scan for specific types of vulnerabilities (SQLI, RCE).

Example 3: In-depth Analysis

Is this vulnerability chain a real vulnerability? Please analyze the source code of the call chain.

The AI will extract the complete call chain code and perform analysis.

🚨 Supported Vulnerability Types

• RCE - Remote Code Execution (CWE-78)
• SQLI - SQL Injection (CWE-89)
• XXE - XML External Entity Injection (CWE-611)
• SSRF - Server-Side Request Forgery (CWE-918)
• PATH_TRAVERSAL - Path Traversal (CWE-22)
• DESERIALIZE - Deserialization Vulnerability (CWE-502)
• XPATH_INJECTION - XPath Injection (CWE-643)
• TEMPLATE_INJECTION - Template Injection (CWE-94)
• JNDI_INJECTION - JNDI Injection (CWE-74)
• REFLECTION_INJECTION - Reflection Injection (CWE-470)
• LOG_INJECTION - Log Injection (CWE-117)
• CRYPTO_WEAKNESS - Cryptographic Algorithm Weakness (CWE-327)

🌟 Supported Frameworks

• Spring Boot / Spring MVC
• MyBatis / Hibernate / JPA
• Fastjson / Jackson / Gson
• OkHttp / Apache HttpClient
• Freemarker / Velocity / Thymeleaf
• Log4j / SLF4J

🔧 Technical Details

Function-Level Taint Analysis

Different from the "variable-level" taint analysis of traditional SAST tools, this tool uses "function-level" taint analysis:

• Advantages: Effectively avoid the chain-breaking problem in scenarios such as thread calls, listener callbacks, and reflection calls.
• Trade-offs: May produce false positives, which need to be further analyzed and confirmed by AI or humans.

Analysis Process

1. Parse the Java source code and build the AST.
2. Extract information about all classes and methods.
3. Build the function call relationship graph.
4. Trace back from the Sink point (dangerous function).
5. Identify the call chain reaching the Source point (external entrance).
6. Filter out functions without parameters (exclude uncontrollable variables).
7. Extract the source code of all functions in the call chain.

⚙️ Configuration Instructions

Rule File

The rule configuration file is located at Rules/rules.json, which contains:

• sink_rules: Rules for dangerous functions (e.g., Runtime.exec).
• source_rules: External input sources (e.g., HttpServletRequest.getParameter).
• sanitizer_rules: Sanitizing functions (e.g., StringEscapeUtils.escapeHtml).

Custom Rules

You can edit rules.json according to your actual needs to add new Sink, Source, or Sanitizer rules:

{
  "sink_rules": [
    {
      "sink_name": "CUSTOM_VULN",
      "sink_desc": "Custom vulnerability type",
      "severity_level": "High",
      "cwe": "CWE-XXX",
      "sinks": [
        "com.example.DangerousClass:dangerousMethod"
      ]
    }
  ]
}

⚡ Performance Optimization

Caching Mechanism

• Build the AST and call graph when analyzing the project for the first time.
• Automatically reuse the cache for subsequent calls, significantly improving the speed.
• Cache key: project_path:rules_path

Lightweight Mode

The find_vulnerabilities tool uses the lightweight mode by default:

• Only return the vulnerability chain information.
• Do not immediately extract the source code.
• Use analyze_vulnerability_chain to obtain the detailed code when needed.

❓ Frequently Asked Questions

The tool is not loaded?

1. Check if the path in the configuration file is correct.
2. Make sure all Python dependencies are installed.
3. Check the developer tool logs of Claude Desktop.

The analysis is slow?

• It takes time to build the AST for the first analysis of large projects.
• The speed will be significantly improved after using the cache.
• You can call build_callgraph first to warm up the cache.

There are false positives in the results?

• Function-level taint analysis may produce some false positives.
• Use analyze_vulnerability_chain to view the source code.
• Combine AI analysis or manual confirmation to verify the authenticity of the vulnerabilities.

🚧 Extended Development

Add a New MCP Tool

Edit mcp_server.py:

@app.list_tools()
async def list_tools() -> list[Tool]:
    return [
        Tool(
            name="your_tool",
            description="Tool description",
            inputSchema={...}
        )
    ]

@app.call_tool()
async def call_tool(name: str, arguments: Any):
    if name == "your_tool":
        # Implement your tool logic
        pass

📚 Related Resources

• Detailed Usage Guide: View MCP_GUIDE.md.
• Principle Explanation: View README.md.
• Optimization Log: View UPGRADE_SUMMARY.md.

🙏 Acknowledgments

The developer of JavaSinkTracer Tr0e

📄 License

This project is for learning and research purposes only. Do not use it for commercial or illegal purposes. The user shall bear all consequences arising from the use of this project.