pyflow

PyFlow is an alpha-stage program analysis framework for Python, designed as a research toolkit that combines program analysis infrastructure, experimental optimization passes, and security checking. It provides a wide range of intermediate representations (CFG, CDG, DDG, PDG, CPG, lowered data flow IR, and a shared store graph model) and supports multiple analysis techniques including call graph construction, IFDS, alias, IPA, CPA, shape, lifetime, and type analysis. The framework includes a modular optimization pipeline with passes such as simplification, method-call optimization, cloning, argument normalization, and load/store elimination. For security, it offers AST pattern matching, AST-based dataflow, CPG-based, and IFDS-backed security analysis engines. It also includes supply-chain analysis capabilities for local SBOM generation, distribution integrity auditing, and dependency metadata extraction. PyFlow ships with a CLI supporting commands for IR dumping, call graph generation, security analysis, alias analysis, concolic test-input generation, and supply-chain operations. It also provides LSP and MCP server modes for IDE integration and semantic queries. The project includes evaluation results on the PySASTBench microbenchmark, showing precision/recall metrics for its security engines. Installation requires Python 3.10+ and Graphviz for visualization. It can be installed from source via pip, with optional extras for development and PyCG-backed call graph algorithms. The project includes unit and integration test suites covering IR, frontend, API, and checker components.