trailmark

name

trailmark

description

Builds and queries multi-language source code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, and entry point enumeration. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, or building a code graph for audit prioritization. Supports 16 languages including Solidity, Cairo, Circom, Rust, Go, Python, C/C++, TypeScript.

Trailmark

Parses source code into a directed graph of functions, classes, calls, and semantic metadata for security analysis. Static only. One language per graph: in polyglot repos, build the full graph per component with the right --language (FFI boundaries are where bugs cluster — don't sample).

Mutation testing triage belongs to the genotoxic skill, which calls trailmark internally. Run engine.preanalysis() before handing off to genotoxic or diagramming-code.

Installation

If uv run trailmark fails: uv pip install trailmark. Do not fall back to manual code reading as a substitute; if installation fails, report the error.

Quick Start

uv run trailmark analyze --summary {targetDir}          # Python (default)
uv run trailmark analyze --language rust {targetDir}
uv run trailmark analyze --complexity 10 {targetDir}    # complexity hotspots

Programmatic API

from trailmark.query.api import QueryEngine

engine = QueryEngine.from_directory("{targetDir}", language="rust")  # default "python"

engine.callers_of("function_name")
engine.callees_of()
engine.paths_between(, )
engine.complexity_hotspots(threshold=)
engine.attack_surface()
engine.summary()
engine.to_json()

result = engine.preanalysis()


engine.subgraph_names()
engine.subgraph()
engine.subgraph()
engine.subgraph()
engine.subgraph()

 trailmark.models  AnnotationKind
engine.annotate(, AnnotationKind.ASSUMPTION,
                , source=)
engine.annotations_of()
engine.annotations_of(, kind=AnnotationKind.BLAST_RADIUS)