Create a project
create_projectCreate a Trent project for security scanning. Its first scan starts automatically unless trigger_analysis is false, or a source is still syncing in (sources or source_scopes); then start it with trigger_analysis, which syncs any source that has not landed.
Supply at least one source: github_repo, website_url, or documents. For
documents, call prepare_file_upload, run upload_command, and pass s3_url.
Do not bundle source code into documents; connect its repository through
github_repo and the Trent GitHub App. For a quick plan review before
creating a project, use security_advisor.
The scan runs in the background and takes up to 1 hour. Read job_id, then
poll get_scan_status, with a first look around 10 minutes in. Relay any
returned 'Trent dashboard: <url>' line verbatim.
A matching repository or website returns reason='confirmation_needed'
with existing_project_details. Show the match and ask the user, then call
again with dedup_policy='reuse' or 'force_new'. A first call with
'force_new' requires the user's existing request for a new project.
If GitHub access prevents the scan starting, reason is
'github_app_install_required'. Send the user to the returned Trent GitHub
App install URL, then retry with trigger_analysis.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "create_project"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Project name. Trent generates one when omitted. | |
| sources | No | Connected sources to attach, exactly as find_related_sources returned them. Pass the ones the user chose; they attach in this call, and the reply names each one and the app page where it is detached. | |
| documents | No | Documents to attach, each {s3_url, repo_slug?}: design docs, architecture specs and feature plans, or SARIF, Semgrep and Snyk findings from the customer's scanners. Call prepare_file_upload with the document_type, run upload_command, then pass the returned s3_url. Trent uses the uploaded name and type. Do not bundle source code into documents; connect it through github_repo. A project holds up to 50 design documents, counting connected sources that will become one; external findings are outside that count. For a quick interactive plan review, use security_advisor. | |
| ticketing | No | Whether Trent files tickets for this new project's tasks when the Trent workspace files tickets. Default true; update_project(ticketing=...) changes it later. Ignored when this call reuses an existing project. | |
| compliance | No | Compliance frameworks to analyze. Defaults to ['THREAT_MODEL']. | |
| github_repo | No | GitHub repository to scan: 'owner/repo', 'https://github.com/owner/repo', or a GitHub URL ending in .git. Add '@branch', such as 'acme/app@release', to select a branch. Omit it for the default branch. The branch stays fixed after creation; create a second project for another branch. Pass GitHub URLs here. github_repo and website_url can be supplied together. For several repositories, use github_repos. | |
| website_url | No | Live website to crawl and scan, such as 'https://myapp.com'. Pass GitHub URLs in github_repo. Both inputs can be supplied together. Trent stores website logins through the app. If the user supplies a login, explain that route and wait for their request before creating a project with public-page access. Do not put credentials in the URL, discard them silently, or invent a login parameter; this tool cannot accept them. | |
| dedup_policy | No | Project deduplication policy. 'auto' (default): check for existing match and ask. 'force_new': always create a new project. 'reuse': reuse an existing matching project. | auto |
| github_repos | No | GitHub repositories for a project with several repositories, such as a frontend and backend or microservices. Trent models data flows across them. Each accepts the github_repo formats: 'owner/repo', 'owner/repo@branch', URL, or URL.git. Choose github_repos or github_repo. A project holds up to 10 repositories. | |
| source_scopes | No | Whole scopes to attach, as find_related_sources returned under scopes: a Linear team or project, or a Notion database or page and its subpages. A project holds up to 50 design documents, counting connected sources that will become one; external findings are outside that count. A request exceeding that limit is refused before project creation. Scope sources sync in the background; scanning waits for them to attach. | |
| trigger_analysis | No | Whether to trigger the initial security analysis after creation. Default is True. Requires GitHub App to be installed for code access. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| error | No | True when the call itself failed. False for successful calls, including a scan still running, an already approved plan, or a repository classified as non-agentic. The reason field describes these workflow states. | |
| job_id | No | Triggered analysis job identifier. | |
| reason | No | A stable snake_case code from the allowed set. Present on every error and on successful calls that carry a workflow state. | |
| message | No | Exactly one sentence written for the user. Never raw exception text or a backend error string, which may expose private details. | |
| metadata | No | Caller metadata, such as 'expiration_warning'. Substantive results have their own fields. Never includes exception or backend error text, which may expose private details. | |
| compliance | No | Compliance frameworks configured for the project. | |
| next_steps | No | Suggested follow-up actions for the caller. | |
| project_id | No | Created or reused Trent project identifier. | |
| repository | No | The first GitHub repository attached to the project; repositories lists them all. | |
| website_url | No | Website URL attached to the project. | |
| project_name | No | Created or reused Trent project name. | |
| repositories | No | Every GitHub repository attached to the project, each with the branch it scans. | |
| scopes_refused | No | Scopes whose attachment the server refused, each with its reason. | |
| pending_sources | No | Sources still staged on the project. The app labels them 'not finished connecting'. The server refuses scans while any remain. | |
| scopes_attached | No | Scopes attached in this call, each with its scope_id and how many sources it added. | |
| sources_refused | No | Connected sources whose attachment the server refused, each with its reason. | |
| sources_attached | No | Connected sources attached in this call. | |
| matching_projects | No | Every existing project holding the requested sources, each with its repositories and the branch each one scans, when confirmation is required. | |
| analysis_triggered | No | Whether an analysis was started automatically. | |
| documents_uploaded | No | Documents attached to the project, each with the name it was uploaded under, its s3_url, and for a findings file the repo_slug it applies to. | |
| is_existing_project | No | Whether an existing project was reused. | |
| retry_after_seconds | No | With reason rate_limited, how many seconds Trent asks the caller to wait. | |
| existing_project_details | No | The project dedup_policy='reuse' would reuse, when confirmation is required. |