inkdex
mlab's code index and vulnerability scanner. It indexes a whole codebase, follows how data moves through it, and reports what an attacker could reach.
inkdex indexes a codebase as a whole: its files, symbols, calls, routes, dependencies and the way data flows from where it enters (a request, a message, a file) to where it acts (a query, a command, a file write, a page). On top of that index, inkdex-vuln reports the vulnerabilities it finds, with their CWE, a severity, and how sure it is.
inkdex is in beta. Every run is recorded against your license; nothing is billed during the beta.
Two binaries
| Binary | What it does |
|---|---|
inkdex | Builds and keeps the index of a repository, and lets you explore it: symbols, callers, routes, data flows, dependencies, history. |
inkdex-vuln | Everything inkdex does, plus scan: the vulnerabilities of a repository, as text, JSON, SARIF or Markdown; finding to look at one in detail, ignore to triage, rules to list what it checks. |
Put both in the same directory on your PATH: inkdex vuln scan then runs inkdex-vuln scan, so you can type everything with inkdex.
inkdex-vuln scan . --update # index the repository, then scan it
inkdex routes --unauthenticated # entry points with no authentication found
inkdex sec flows --to 'sql.*' --unsanitized --traceHow it works, in short
- Index.
inkdex indexreads the repository (Python, TypeScript/JavaScript, Rust, Go, Elixir, Java), resolves calls across files, and records the security facts: sources, sinks, sanitizers, entry points, secrets, crypto. The index lives in.inkdex/inside the repository and is updated incrementally: only what changed is read again. - Scan.
inkdex-vuln scanturns those facts into findings: a request parameter reaching a SQL query unsanitized, a path built from user input and opened, a secret in the code, TLS verification turned off. - Review. Each finding has a verdict: proven when the index shows the whole path, verify when a human should look. Findings carry a fingerprint that stays the same when the code moves, so you can follow them across commits.
Your source code is analysed on your machine and never sent anywhere. See What inkdex sends to mlab.sh.