# Java Sink Tracer

> Use this tool when you need to identify potential Java security vulnerabilities, such as SQL injection or XSS, through automated sink tracing and code analysis. It solves problems in security audits, code reviews, and vulnerability assessments by tracing data flow through parsed Java code. The Java Sink Tracer takes in Java code and outputs identified security sinks and vulnerabilities, making it a valuable asset in Java development environments.

Canonical page: https://skillsregistry.net/skills/zacarx-java-sink-tracer  
JSON: https://api.skillsregistry.net/v1/skills/zacarx-java-sink-tracer

## Description

Built by Zacarx, this server provides Java security vulnerability analysis capabilities through automated sink tracing and code extraction. It integrates javalang for Java AST parsing and includes configurable vulnerability detection rules for identifying potential security sinks like SQL injection points, XSS vulnerabilities, and other common Java security issues by tracing data flow through parsed Java code. The server is valuable for security audits, code reviews, and automated vulnerability assessment workflows in Java development environments.

## Trust

- **Trust score (0–1):** 0.64
- **Verification tier:** scanned
- **Last scanned:** 2026-09-01

## Facts

- **Version:** 1.0.0
- **Skill type:** atomic
- **Execution layer:** mcp-remote
- **Runtime environment:** api
- **Category:** database
- **Updated:** 2026-09-01

## Source

- **Source listing:** [PulseMCP](https://www.pulsemcp.com/servers/zacarx-java-sink-tracer)
- **Repository:** <https://github.com/zacarx/javasinktracer_mcp>

## Use it

Resolve this record through the SkillsRegistry MCP server (no auth, read-only):

```
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp
```

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_skill",
    "arguments": {
      "slug": "zacarx-java-sink-tracer"
    }
  }
}
```

REST: `GET https://api.skillsregistry.net/v1/skills/zacarx-java-sink-tracer` · pull for local use: `GET https://api.skillsregistry.net/v1/skills/zacarx-java-sink-tracer/pull`

---
SkillsRegistry indexes agent skills from public registries and GitHub. Skills we have analysed are scanned with Circle-IR and scored on six dimensions; each listing states its scan coverage. More: https://skillsregistry.net/llms.txt