CodAIze Agent#2574

Merged

lshala merged 162 commits into

mainfrom

Mar 23, 2026

Contributor

lshala commented Feb 18, 2026 •

edited

Loading

This PR introduces an AI chat agent in the Codyze WebUI.

What's included:

The agent has access to the cpg-mcp server so it can call the MCP tools to query the CPG.
Multiple LLM providers, configured via application.conf (an example file is included):
- OpenAI-compatible endpoints: Ollama, vLLM, MLX
- Gemini
Agentic loop: configurable number of steps in which the LLM can call MCP tools
MCP tool result widgets

The AI features are optional so if cpg-mcp is not enabled or application.conf is missing, the console starts and the frontend shows a setup hint instead.

Next

The current approach of implementing a "custom" MCP client has overhead due to different provider APIs. We plan to replace most of that by using the Kotlin Koog framework -> Replace custom MCP client logic with Koog #2622
Replace the current file-based LLM configuration with a UI configuration

lshala and others added 30 commits

September 11, 2025 10:20


          Chat interface for AI assistant

bec0a45


          Format

2d42e1b


          Update dependency io.ktor.plugin to v3.3.0 (#2412)

715219c

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency com.charleskorn.kaml:kaml to v0.96.0 (#2430)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency @sveltejs/kit to v2.39.1 (#2429)

308495f

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update CODEOWNERS (#2425)

b8c202c

* Update CODEOWNERS

The Code owners are updated with specific responsibilities for passes.

* Add Second responsible to language frontends and remove the language specific pass responsibles


          Dokka v2 (#2413)

d9ac76f

* Change dokka config to new dsl

* Delete unused code

* Delete .kotlin/sessions directory

* Add V2Enabled mode to gradle.properties

* Delete tmp.json

* Remove set previous docs folder

---------

Co-authored-by: Konrad Weiss <konrad.weiss@aisec.fraunhofer.de>


          Update dependency eslint-plugin-svelte to v3.12.4 (#2433)

a5a1799

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency @sveltejs/kit to v2.42.2 (#2432)

c779ba6

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency com.vanniktech:gradle-maven-publish-plugin to v0.34…

69092df

….0 (#2397)

* Update dependency com.vanniktech:gradle-maven-publish-plugin to v0.34.0

* Fixed

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Christian Banse <christian.banse@aisec.fraunhofer.de>


          Moving group back to allprojects (#2435)

13b4c00


          Update dependency @eslint/compat to v1.4.0 (#2436)

bfd3eb3

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency @sveltejs/kit to v2.43.5 (#2437)

90a329b

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Abstract Value Analysis (#1759)

090520d

* create initial Size evaluator for modifiable lists

* move all collection dependant logic into collection class

* add support for static arrays

* implement narrowing and widening operations

* add narrowing and widening to loop analysis

* handle branches in analysis

* improve loops by preprocessing, better narrowing and valid starting ranges

* improve subtraction by handling 0 as lowest possible value

* mark branching nodes as nodes with an effect

* correctly identify nodes of deeper branch layers in a loop

* add documentation

* temporarily repurpose cpg-neo4j for debugging

* rework lattice intervals to support negative values

* rename target package to circumvent gitignore

* implement comparable for the LatticeInterval

* implement the IntervalState

* update the evaluator name in tests

* implement equals check for intervals

* add method stub for condition evaluation

* Spotless

* Squashed commit of the following:

commit 5c20b05
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 13:25:06 2024 +0200

    fix breaking merge changes

commit cc8eb48
Merge: 3e3c094 344ea58
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 13:08:46 2024 +0200

    Merge branch 'rh/abstract-value-analysis' into rh/abstract-value-analysis-worklist

    # Conflicts:
    #	cpg-analysis/src/main/kotlin/de/fraunhofer/aisec/cpg/analysis/abstracteval/AbstractEvaluator.kt
    #	cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/helpers/EOGWorklist.kt

commit 3e3c094
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 13:04:45 2024 +0200

    remove redundant pushes to the worklist itself

commit 6d731f2
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 13:04:21 2024 +0200

    override methods to use custom functionality in IntervalStates

commit 1eb5a51
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 13:03:57 2024 +0200

    enhance analysis for simple value operations

commit 108f374
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 09:56:22 2024 +0200

    join intervals for multiple EOG (branch joins)

commit d4383b4
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 09:33:41 2024 +0200

    revert the change to the worklist pop to make it FIFO again

commit 46798c5
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Wed Oct 16 09:33:23 2024 +0200

    return a new altered state instead of directly modifying the current state

commit c634646
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 13:12:46 2024 +0200

    remove getInitialRange from the evaluator

commit f984a2c
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 13:11:58 2024 +0200

    remove the "getInitialRange" method for values and instead mark declarations as operations with effect

commit beb4d38
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 12:26:22 2024 +0200

    simplify evaluator to only use one worklist without special handling for loops and branches

commit 6ec77dc
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 12:25:04 2024 +0200

    add "until" to iteration, add state information to Worklist, fix pop order

commit 253debb
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 12:23:17 2024 +0200

    remove all modes from the IntervalState

commit 31ca4ac
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 12:17:45 2024 +0200

    remove boolean information about whether the operation had an impact

commit ccd839e
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 14 09:17:11 2024 +0200

    add three different state modes

commit e0e1a28
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 7 12:08:52 2024 +0200

    rewrite the handleBranch branch

commit 672f27f
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 7 11:45:10 2024 +0200

    rewrite the handleLoop branch

commit 33f3531
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 7 10:54:15 2024 +0200

    rewrite the applyEffect branch

commit ca88bb7
Author: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Date:   Mon Oct 7 10:20:39 2024 +0200

    rewrite evaluate function to use "iterateEOG"

* fix LatticeInterval.push to join with the previous value as it is already propagated from predecessors

* Fix Declaration to only effect matching integers

* correctly propagate widening only within loops

* added second evaluate call with more defined arguments

* support functions with side effects by creating a function-local evaluator

* moved side effect analysis to list instead of integer...

* add new 'assignMinus' expression and add the name as code when creating a reference

* cleanup

* add tests for the new Evaluator

* first implementation for other integer operations

* add prefix versions of the inc and dec operator

* Add test case for all implemented Integer operations

* add auto-generated hashcode function

* cleanup and documentation

* remove old code

* import cleanup

* automatically switch interval bounds if the lower bound is greater than the upper bound

* remove min and max comparisons after multiplication as the constructor now handles the order

* convert Bounded from data class to real class to remove constructor variables

* fix division to estimate x / ∞ = 0

* simplify division cases

* Fix invalid division cases

* make modulo calculation more concise

* beautify toString representation

* add first LatticeInterval tests

* fix meet of intervals when they do not overlap

* add equals operator for the Interval wrapper

* add tests for meet, widen, narrow and the wrapper

* fix meet test method

* change default of plusAssign and minusAssign to lose all information

* add tests for the Integer Value

* check name of array declaration

* move code block for function side effects further up

* add tests for array and mutable list

* remove unfinished code block in MutableList

* made spotless

* changed the name of the Value classes to prevent confusion with builtin classes

* Some renaming and extended test

* formatting

* Do not stop on target node and change int to long

* Template for eventually using new iteration

* Fix comment

* Minor cosmetic changes

* Move code to correct location

* Several updates, missing widening and narrowing for integer tests

* Some fixes

* Fix integer tests

* Some idea on integrating widening and narrowing

* Try to integrate widening

* Integrate widening and fix comparisons

* Try to include conditions

* Fix

* Also handle negated condition

* Redesign of list size evaluation

* Small cleanup

* Rework array value

* Small cleanup

* Fix list removeall

* Size evaluation for sets

* test set size evaluator

* Improvements and more tests for sets

* Integration into value evaluator system and query API

* Revert unnecessary changes in EOGWorklist.kt

* Split division by 0 and other test

* Try to fix problematic integer lookup - no success

* somewhat fix problem with equal but non-identical Integer objects used as keys

* Fix min and max operations

* Add more operators, implement shl

* right shifting

* bitwise and and or

* trigger build

* define some of the exceptional cases to avoid exceptions

* Several fixes in tests and in minus

* throw less exceptions and catch them

* Fix asserts

* Less unsupported operators

* Some cleanup

* Fix test

* Remove commented out code

---------

Co-authored-by: Robert Haimerl <robert.haimerl@aisec.fraunhofer.de>
Co-authored-by: KuechA <31155350+KuechA@users.noreply.github.com>
Co-authored-by: Alexander Kuechler <alexander.kuechler@aisec.fraunhofer.de>


          Update dependency @sveltejs/kit to v2.44.0 (#2441)

b8ff709

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency com.charleskorn.kaml:kaml to v0.97.0 (#2442)

0d39b4c

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Timeout for CDG and CFSensitiveDFG pass (#2417)

* Timeout for CDG and CFSensitiveDFG pass

* Make the timeout an argument of iterateEOG

* remove existing dfg edges only on success

* apply strategy usage to to timeoutless invocation

* updating call due to having non positional argument

* Returning a non null time to solve the issue because apparently we are able to

* Adding Test. Fixing coding issue that actually reran the iteration without timeout if the iteration timeouted

* Add nullness conditional checks

* Fixing coding issue that actually reran the iteration without timeout if the iteration timeouted

* Spotless

---------

Co-authored-by: Konrad Weiss <konrad.weiss@aisec.fraunhofer.de>


          Only put AST nodes in fields/methods/... in RecordDeclaration t…

ddda6cd

…hat are part of the AST (#2403)

* Added API to return methods of a Type

* Added members, fields and methods

* Add `declaringScope` to `Declaration`.

* Extended unit test

* Rename fields/methods/... in `RecordDeclaration` to `innerFields`, ...

This should make it clear that it only contains those that are directly embedded into the AST structure.

* Do not add Go's method to innerMethod AST property anymore

* Fixed Go tests by using the correct Type API

* Do not add outside methods in C++ to record inner methods

* Trying to get rid of addXXX functions

* Fixed test

* Removed INNER_


          Make MCP configurable (#2444)

1630de2

* Make MCP configurable

* Readme++


          Changing function signature of parse to accept the file content ins…

3e4d65c

…tead of a file (#1706)

* Changing function signature of `parse` to accept the file content instead of a file

This PR changes the way `parse` works (in a backwards compatible way). Instead of parsing a `File`, we parse the file contents (and a path). The reasoning behind this is that almost all language frontends currently need to read the file contents and we can harmonize this. This will also allow us to provide more common statistics about the parsing context in the future.

* Fixed spotless

* fixing uri handling due to it being nullable now

* Fixing parameter order

* Addign a Converter for the newly introduced TranslationStats

---------

Co-authored-by: Konrad Weiss <konrad.weiss@aisec.fraunhofer.de>


          Transition to integration tests for MCP (#2445)

e5fb3ee

* Move unit tests depending on Python language frontend to integration test

* Add missing dependency for Python language frontend in integration tests

* Remove test condition for available Python language frontend

---------

Co-authored-by: Christian Banse <christian.banse@aisec.fraunhofer.de>


          Update dependency com.charleskorn.kaml:kaml to v0.98.0 (#2448)

dd0c077

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency @sveltejs/kit to v2.46.4 (#2447)

00a0f18

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Fixing comment matching on multiple nested namespaces with no location (

71b7dd6

#2446)

* Merging namespace skip if it has no location with ast tree exploration if nodes have no location to better match

* moving iterative search into getEnclosingChild

* Add condidate search to enclosing node search and neares node search in comment matcher

* Move back testfile

* Some refactoring

* Nesting the comment test file into several folders to implicitly create namespaces


          Update dependency globals to v16.4.0 (#2451)

4fcf453

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency @sveltejs/kit to v2.47.2 (#2450)

e798ad5

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency vite to v6.4.1 [SECURITY] (#2453)

bdef6b6

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency com.charleskorn.kaml:kaml to v0.102.0 (#2457)

2ba6f1c

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Update dependency @sveltejs/kit to v2.48.1 (#2456)

bee0018

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>


          Expose host and port config in codyze API (#2458)

a4b6bd9

lshala added 2 commits

March 13, 2026 12:20


          More logs

a4683d2


          Exclude shadowJar, shadowDistZip, and shadowDistTar in ci build

03154d6

lshala commented

View reviewed changes

.github/workflows/build.yml

lshala added 5 commits

March 13, 2026 14:25


          Add missing mcp integration tests

0aeaf97


          Add tests for ChatClient

80cd8f4


          Replace println's

75697fc


          Add MCP application tests

9c0c220


          Merge ChatService and ChatClient

9c7cba6

lshala marked this pull request as ready for review

March 16, 2026 09:03


          Rename test

a57e72d

KuechA reviewed

View reviewed changes

cpg-mcp/src/integrationTest/kotlin/mcp/tools/ApplyConceptsTest.kt

cpg-mcp/src/integrationTest/kotlin/mcp/tools/CpgAnalyzeToolTest.kt

cpg-mcp/src/integrationTest/kotlin/mcp/tools/CpgAnalyzeToolTest.kt

cpg-mcp/src/integrationTest/kotlin/mcp/tools/CpgDfgBackwardToolTest.kt Outdated

cpg-mcp/src/main/kotlin/de/fraunhofer/aisec/cpg/mcp/mcpserver/tools/utils/Serializable.kt Outdated

cpg-mcp/src/test/kotlin/de/fraunhofer/aisec/cpg/mcp/JsonSchemaGeneratorTest.kt Outdated

codyze-console/src/main/kotlin/de/fraunhofer/aisec/codyze/console/ai/clients/GeminiClient.kt Outdated

codyze-console/src/main/kotlin/de/fraunhofer/aisec/codyze/console/ai/McpServerHelper.kt

codyze-console/src/main/resources/application.conf.example

codyze-console/src/main/kotlin/de/fraunhofer/aisec/codyze/console/Router.kt Outdated


          Merge branch 'main' into codyze-goes-ai

33cb9a4

This was referenced Mar 17, 2026

MCP Server: Replace the cpg_llm_analyze tool with a suggest_concepts MCP prompt. #2631

Merged

MCP Server: Add CpgDfgBackwardTool #2632

Merged

lshala added 9 commits

March 17, 2026 16:32


          Refactor data flow widget

161b606


          Replace schema of getNode tool

167112d


          Fix docstrings, host propagation and imports

76b2554


          Merge branch 'main' into codyze-goes-ai

a1d33fe


          Rename mcp models from '*summary' back to '*info'

95d87f8


          Fix JsonSchemaGeneratorTest by adding descriptions

4bbe249


          Readme

d3ef161


          Fix test ListCommandsTest in mcp module

8587cd0


          Revert unintended changes

5a3b37f

KuechA approved these changes

View reviewed changes

cpg-mcp/src/integrationTest/kotlin/mcp/tools/ApplyConceptsTest.kt


          Merge branch 'main' into codyze-goes-ai

b3ea3a6

lshala added this pull request to the merge queue

Merged via the queue into main with commit 78918bb

2 of 4 checks passed

lshala deleted the codyze-goes-ai branch

March 23, 2026 08:39

lshala mentioned this pull request

Document CI workflow #2646

Merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

KuechA KuechA approved these changes

fwendland Awaiting requested review from fwendland fwendland is a code owner

oxisto Awaiting requested review from oxisto oxisto is a code owner

maximiliankaul Awaiting requested review from maximiliankaul

konradweiss Awaiting requested review from konradweiss konradweiss is a code owner

Labels

None yet