PatchLabs

Three tools revolve around the check lifecycle: start_check initiates a lab check with ownership proof, run_check queues a check for a monitored app, and get_check retrieves status. The distinction (anonymous/full-lab vs. workspace-monitored vs. retrieval) is explained but still easy to misselect, while headers_check and rls_check are cleanly distinct.

All names are snake_case and mostly verb_noun (get_check, list_apps, run_check, start_check), but headers_check and rls_check are noun-first and drop the verb, creating a minor stylistic split within an otherwise readable set.

Six tools is well-scoped for a security-check service: two targeted scanners, two initiation paths, one retrieval, and one listing. Every tool maps to a distinct user workflow with no filler.

The surface covers scanning and check initiation but has lifecycle gaps: list_apps exists with no register/create_app or remove_app, there is no way to list or cancel checks beyond fetching by id, and 'fix' is only returned as text with no remediation tool. Agents can work around most of this but will hit dead ends when onboarding a new monitored app.