Security advisor review
security_advisorConsult a principal security engineer on a security topic.
Send specific code, a plan, a config, or a security question. For a full
codebase scan, use create_project and trigger_analysis. Choose one input:
content for small inline text, or content_document for a large design
document uploaded with prepare_file_upload. The upload keeps the file out
of the context window. Supplying both inputs is refused.
Use this selective consultation when feedback can still change a decision
about authentication, authorization, secrets, sensitive data, new network
exposure, cryptography, infrastructure, IAM, or filesystem or command
execution. Send the relevant plan or diff. Reserve calls for those
decisions, and respect a user's request to skip consultation.
The tool answers immediately from the content sent. Report it as an
advisory review of that content, with CRITICAL, HIGH, MEDIUM, or LOW
severity labels. Trent's full assessment requires a scan.
Each call starts a new conversation unless you pass thread_id. The
thread_id and resumed fields describe continuation.
A reply with detected_repository and onboarding_hint identifies a local
repository awaiting a Trent project. Say existing project findings were
unavailable to this review, and offer create_project.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "security_advisor"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| content | No | Plan, code, config, or other content to review for security. | |
| context | No | Security context, such as 'API behind Gateway auth, intentionally public endpoint'. | |
| question | No | Security question to answer, such as 'Is this auth flow secure?'. | |
| thread_id | No | Pass the thread_id from an earlier security_advisor call to continue with its full context. Use it to iterate on reviewed content, answer the advisor's question, or follow up on its findings. Omit it for a new topic. An unusable id starts a fresh conversation, reported in resumed. | |
| project_name | No | Trent project name for relevant existing findings. Defaults to a match from the git remote. | |
| content_document | No | Name of an uploaded design document to review. Use this for a large file to keep it out of the context window. Call prepare_file_upload with document_type='design_doc', transfer the file with upload_command, then pass document_name here. Choose this or content. | |
| content_document_version | No | Version of the uploaded document, returned as document_version by prepare_file_upload. Defaults to the latest. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| error | No | True when the call itself failed. False for successful calls, including a scan still running, an already approved plan, or a repository classified as non-agentic. The reason field describes these workflow states. | |
| reason | No | A stable snake_case code from the allowed set. Present on every error and on successful calls that carry a workflow state. | |
| review | No | Security review content returned by Trent. | |
| message | No | Exactly one sentence written for the user. Never raw exception text or a backend error string, which may expose private details. | |
| resumed | No | True when the supplied thread_id continued the conversation. False for a fresh conversation, including one started after an unusable thread_id. | |
| metadata | No | Caller metadata, such as 'expiration_warning'. Substantive results have their own fields. Never includes exception or backend error text, which may expose private details. | |
| thread_id | No | This conversation's id. Pass it back as the thread_id argument to continue this same conversation on a later call. | |
| next_steps | No | Recommended next actions, in order. | |
| onboarding_hint | No | Guidance for onboarding the detected repository into Trent. | |
| detected_repository | No | Repository auto-detected from the local git remote. | |
| retry_after_seconds | No | With reason rate_limited, how many seconds Trent asks the caller to wait. |