# PyCG: Practical Call Graph Generation in Python

arXiv: https://arxiv.org/abs/2103.00587 · HTML: https://mlsanity.com/paper/2103.00587/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Feb 2021.

## Built on by (most cited first, 17 of 17)

- [AutoCodeRover: Autonomous Program Improvement](https://mlsanity.com/paper/2404.05427/) (2024)
- [AutoPruner: Transformer-Based Call Graph Pruning](https://mlsanity.com/paper/2209.03230/) (2022)
- [Efficient Query-Based Attack against ML-Based Android Malware Detection under Zero Knowledge Setting](https://mlsanity.com/paper/2309.01866/) (2023)
- [Enhancing Differential Testing With LLMs For Testing Deep Learning Libraries](https://mlsanity.com/paper/2406.07944/) (2024)
- [Multi-Agent Taint Specification Extraction for Vulnerability Detection](https://mlsanity.com/paper/2601.10865/) (2026)
- [KGLiDS: A Platform for Semantic Abstraction, Linking, and Automation of Data Science](https://mlsanity.com/paper/2303.02204/) (2023)
- [An Empirical Study of Vulnerabilities in Python Packages and Their Detection](https://mlsanity.com/paper/2509.04260/) (2025)
- [An Execution-Verified Multi-Language Benchmark for Code Semantic Reasoning](https://mlsanity.com/paper/2605.11006/) (2026)
- [How Much Static Structure Do Code Agents Need? A Study of Deterministic Anchoring](https://mlsanity.com/paper/2606.26979/) (2026)
- [RepoRescue: An Empirical Study of LLM Agents on Whole-Repository Compatibility Rescue](https://mlsanity.com/paper/2607.01213/) (2026)
- [Effective and Efficient Context Retrieval via Partial Dependency Graph for Repository-Level Code Generation](https://mlsanity.com/paper/2608.01927/) (2026)
- [Topical: Learning Repository Embeddings from Source Code using Attention](https://mlsanity.com/paper/2208.09495/) (2022)
- [Understanding the Complexity and Its Impact on Testing in ML-Enabled Systems](https://mlsanity.com/paper/2301.03837/) (2023)
- [DepRadar: Agentic Coordination for Context Aware Defect Impact Analysis in Deep Learning Libraries](https://mlsanity.com/paper/2601.09440/) (2026)
- [M2K: Making the Model-Kernel Interface Explicit for Reliable CUDA Kernel Verification](https://mlsanity.com/paper/2603.24595/) (2026)
- [RepoAtlas: Guiding Coding Agents via Evolving Multimodal Repository Views](https://mlsanity.com/paper/2609.16936/) (2026)
- [Software World Models: From Consequence Prediction to Decision Value](https://mlsanity.com/paper/2610.04940/) (2026)

## Abstract (arXiv)

Call graphs play an important role in different contexts, such as profiling and vulnerability propagation analysis. Generating call graphs in an efficient manner can be a challenging task when it comes to high-level languages that are modular and incorporate dynamic features and higher-order functions. Despite the language's popularity, there have been very few tools aiming to generate call graphs for Python programs. Worse, these tools suffer from several effectiveness issues that limit their practicality in realistic programs. We propose a pragmatic, static approach for call graph generation in Python. We compute all assignment relations between program identifiers of functions, variables, classes, and modules through an inter-procedural analysis. Based on these assignment relations, we produce the resulting call graph by resolving all calls to potentially invoked functions. Notably, the underlying analysis is designed to be efficient and scalable, handling several Python features, such as modules, generators, function closures, and multiple inheritance. We have evaluated our prototype implementation, which we call PyCG, using two benchmarks: a micro-benchmark suite containing small Python programs and a set of macro-benchmarks with several popular real-world Python packages. Our results indicate that PyCG can efficiently handle thousands of lines of code in less than a second (0.38 seconds for 1k LoC on average). Further, it outperforms the state-of-the-art for Python in both precision and recall: PyCG achieves high rates of precision ~99.2%, and adequate recall ~69.9%. Finally, we demonstrate how PyCG can aid dependency impact analysis by showcasing a potential enhancement to GitHub's "security advisory" notification service using a real-world example.