Cycling through all six. Tap any point to stop.

Measured on six things

Compiler-precise code property graph for cross-language s...

Speed

Desktop Lighthouse 93 but mobile drops to 68 with a 4.2s LCP and 361ms TBT. The page is text-heavy with code blocks, so mobile users eat a slow first paint for a marketing page.

Screenshots

1 / 1

Lachesis

About this app

Lachesis is an open-source code property graph engine that parses C, Python, TypeScript, and JavaScript with real compilers, then builds a queryable graph with a full dataflow layer. Unlike traditional code-graph tools that stop at symbols and references, Lachesis captures value-flow, points-to, taint, and aliasing edges, alongside resolved and possible call edges. This allows it to answer security-critical questions like how data moves, who calls what, and what reaches a dangerous sink. The graph is served over MCP, enabling both humans and AI agents to reason over real source code with compiler fidelity. Standout features include one graph for four languages, confidence annotations on every edge, and security-shaped queries such as guard coverage, sibling comparison, and source-to-sink reachability. It runs locally with no account required and can be integrated into CI pipelines via GitHub Actions, emitting SARIF for inline annotations. Lachesis is AGPL-3.0 licensed, written in Py...

Key features

1Compiler-precise code property graph for C, Python, TypeScript, and JavaScript in a single queryable graph
2Full dataflow layer: value-flow, points-to, taint, and aliasing edges with confidence annotations on every edge
3MCP server exposes the graph to AI agents; GitHub Action integration emits SARIF for inline PR annotations

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Security researchers and analysts

Pain points

Traditional tools miss dataflow nuances; false negatives in vulnerability detection.

Primary needs

Deep, compiler-accurate analysis of data movement and taint propagation across languages.

Demographic

Software developers and engineers

Pain points

Manual code review is time-consuming; integrating security into CI without friction.

Primary needs

Automated, local-first security checks that fit into existing workflows and provide actionable findings.

Demographic

DevSecOps and AppSec teams

Pain points

Scaling security analysis across large codebases; reducing false positives in SAST.

Primary needs

A unified graph for multiple languages, CI integration, and precise, confidence-scored results.

Scout Review

Written by AI from measured evidence, scored out of 100.

Lachesis is an open-source code property graph engine that parses C, Python, TypeScript, and JavaScript with real compilers and builds a queryable graph with a full dataflow layer — value-flow, points-to, taint, aliasing, plus resolved and possible call edges. The pitch is sharp: most code-graph tools stop at symbols and references, so they can't answer whether a request parameter actually reaches a SQL call. Lachesis can, and it serves the graph over MCP so both humans and AI agents can query it. It runs locally with no account, integrates into CI via GitHub Actions with SARIF output, and is AGPL-3.0 licensed. The landing page is clean and technically credible but shows no product UI. Mobile performance is mediocre (Lighthouse 68, LCP 4.2s). Security headers are excellent (11/12). Accessibility is decent (89) with contrast and touch-target failures. Growth potential is solid: a real problem, a specific wedge, and a category with room — though the competition (Semgrep, CodeQL, Joern) is free or bundled.

Measure by measure

Usability

No signup, two clear install paths (full installer or headless pip), and a copy-paste quickstart. But there's no separate docs site, help center, or onboarding beyond the README and a 55-second video.

Design

Clean, dark, terminal-flavored landing page with disciplined typography, but it is a single marketing page with no product screenshots or UI previews. Branding is a wordmark and nothing more.

Speed

Desktop Lighthouse 93 but mobile drops to 68 with a 4.2s LCP and 361ms TBT. The page is text-heavy with code blocks, so mobile users eat a slow first paint for a marketing page.

Security

Strong header hygiene — HTTPS, HSTS, CSP, frame protection, 11/12 probe points, only Permissions-Policy missing. No SOC 2, ISO, or bug bounty published, but AGPL-3.0 with a public repo is a real transparency signal.

Accessibility

Lighthouse a11y 89/100 with two real failures: insufficient color contrast and undersized touch targets. No WCAG statement or multi-language support, but the site is responsive and keyboard-navigable.

Growth

Real, specific problem: dataflow-aware SAST that regex and symbol tools miss. Clear wedge — one graph, four languages, MCP for agents. Early-stage (domain ~0.6yr) but the idea has room.

Improvement areas

Landing page shows no product UI — add screenshots or a GIF of the graph explorer and query output
Mobile performance is weak (Lighthouse 68, LCP 4.2s); optimize render-blocking assets and code block loading
No dedicated docs site — query language reference and edge type glossary live only in the README

Design & Usability

Lachesis presents itself as a serious engineering tool and the landing page mostly matches that intent: dark palette, monospace code blocks, tight typography, and copy that respects the reader's intelligence. The problem is that it's a single page doing all the work — no screenshots of the graph explorer, no UI previews, no visual proof that the product exists beyond a terminal transcript. For a tool whose entire pitch is 'a graph you query, not a report you read,' showing zero of that graph is a strange own-goal. Usability is stronger: no account, no signup wall, two install paths (full installer or headless pip), and a copy-paste quickstart that gets you to a query in a handful of commands. The 55-second walkthrough video is a smart touch. What's missing is a real docs site — everything lives in the README and GitHub, which is fine for the target audience but leaves nothing for a curious evaluator who wants to understand the query language before committing to a clone.

Speed & Security

Speed is a tale of two devices. Desktop Lighthouse lands at 93, which is genuinely good for a text-heavy technical page. Mobile collapses to 68 with a 4.2s LCP and 361ms TBT — the page is dense with code blocks and long copy, and mobile users pay for it. There's no published benchmark for the graph engine itself, though the site claims the embedded columnar database 'opens in well under a second,' which is plausible for an embedded store but unverified here. Security is the strongest dimension: the HTTP probe returns 11/12 checklist points with HTTPS enforced, HSTS, CSP, frame protection, X-Content-Type-Options, Referrer-Policy, SPF and DMARC all present. Only Permissions-Policy is missing. There's no SOC 2, ISO 27001, pen-test report, or bug bounty program — normal for an early-stage open-source project, and the AGPL-3.0 public repo is a meaningful transparency substitute. Nothing here suggests a security incident or broken TLS.

Accessibility & Growth

Accessibility lands at 89/100 on Lighthouse with two concrete failures: insufficient color contrast and touch targets that are too small or too tightly spaced. On a page whose primary call-to-action is copying terminal commands, undersized touch targets are a real annoyance for mobile users, and the contrast failure is the kind of thing that's easy to fix and embarrassing to ship. There's no accessibility statement, no WCAG conformance claim, and no multi-language support — all normal for a project this young, but worth noting. Growth is the more interesting question. The problem Lachesis names is real and specific: traditional code-graph tools stop at symbols and references, which means they can't answer 'does this request parameter reach that SQL call.' The wedge — full dataflow edges (value-flow, points-to, taint, aliasing) across four languages in one graph, served over MCP so AI agents can reason over real source — is genuinely differentiated against Semgrep (pattern-based), CodeQL (build-step heavy, steep curve), and Joern (C/C++/Java focused). The MCP angle is timely. The limit is that the target buyer already has free or cheap tools, and 'compiler-accurate' is a hard sell to teams who've learned to live with false positives.

Conclusion

Lachesis is the kind of tool that earns respect slowly. It doesn't try to be a platform, doesn't gate features behind a signup, and doesn't pretend its graph is magic — it just parses with real compilers and follows the value. For security researchers and AppSec teams tired of SAST tools that flag every string concatenation and miss the actual taint path, that's a meaningful difference. The MCP integration is the smartest bet here: as AI agents get better at reasoning over code, a graph they can actually query with confidence annotations becomes more valuable, not less. The risks are real — Semgrep is free and fast, CodeQL is bundled with GitHub, and Joern owns the CPG niche in academia. But Lachesis's bet on dataflow fidelity plus agent-readability is a coherent one. Fix the mobile LCP, add a screenshot or two, publish a docs site, and this becomes easy to recommend. Right now it's a strong idea with a thin storefront.

Suggestions for improvement

Add real screenshots or a short GIF of the graph explorer and query output — the landing page currently shows zero product UI
Fix mobile performance: 4.2s LCP and 361ms TBT are dragging the mobile Lighthouse score to 68; lazy-load code blocks and trim render-blocking assets
Ship a proper docs site separate from the README — query language reference, edge type glossary, and worked examples
Address the two Lighthouse a11y failures: bump contrast on secondary text and enlarge touch targets on the quickstart code blocks

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	Lachesis	Semgrep	CodeQL	Joern
Analysis approach	Compiler-precise code property graph with full dataflow (value-flow, points-to, taint, aliasing)	Lightweight syntax-aware pattern matching; no full dataflow graph	Semantic code analysis via database queries; requires build step	Code property graph queries; strong on C/C++ and Java
Language support	C, Python, TypeScript, JavaScript in one unified graph	30+ languages via pattern-based rules	Many languages including C/C++, Java, Python, JS, Go, Ruby	Primarily C/C++ and Java; limited other languages
AI agent integration	Native MCP server exposes the graph to LLM agents	No native MCP; CLI and API only	No native MCP; CLI and GitHub integration	No native MCP; interactive shell and scripting
CI integration	GitHub Action emits SARIF for inline PR annotations; runs locally with no API key	Mature CI integrations, Semgrep AppSec Platform, SARIF output	Native GitHub Actions integration; SARIF upload to code scanning	Scriptable; CI integration requires custom setup
Licensing and cost	AGPL-3.0, fully open source, no account required	Open source (LGPL) core; paid Semgrep AppSec Platform tiers	Free for public repos; paid GitHub Advanced Security for private	Apache 2.0 open source, free

Semgrep

A fast, open-source static analysis tool that finds bugs and enforces standards. It uses a lightweight syntax-aware approach rather than full dataflow graphs.

CodeQL

GitHub's semantic code analysis engine that queries code as data. It supports multiple languages but requires a build step and has a steeper learning curve.

Joern

An open-source code analysis platform for querying code property graphs. It focuses on C/C++ and Java, with limited support for other languages.

Comparing options? See Lachesis alternatives, scored side by side

View all Development & Engineering