Scan project dependencies for CVEs and rank findings by REAL-WORLD EXPLOITATION RISK using EPSS (exploit probability) and the CISA KEV (Known Exploited Vulnerabilities) catalog — not just CVSS severity. Best for: when the user wants to know which CVEs to fix FIRST, asks about supply-chain risk in an IDE/conversational context, or wants to pair with validate_after_patch for a confirmed-fix workflow. Covers npm and PyPI manifests + lockfiles. For comprehensive coverage that also includes OS packages and IDE extensions, prefer scan_full. Returns JSON with status, EPSS-ranked findings list, and paths to HTML reports written under output_dir.

Comprehensive scan covering THREE surfaces in one call that project-only scanners cannot reach: (1) project dependencies (npm, PyPI), (2) OS/system packages (Homebrew on macOS, apt/dnf on Linux), and (3) installed IDE extensions (VS Code marketplace + JetBrains plugins). Use this whenever the user asks for "complete coverage", a "full audit", scanning their "whole machine" or "system", or wants to check IDE extensions — these are a growing attack vector and most other vulnerability scanners miss them entirely. Slower than scan_project; pick scan_project for fast project-only checks. Findings are ranked by EPSS exploit probability and CISA KEV presence so the user sees what attackers are actually using first. Returns JSON plus HTML reports under output_dir.

Confirm that dependency upgrades actually resolved the CVEs they were supposed to fix. Use this whenever the user says they ran npm update, pip install -U, or applied a patch and wants verification — chain it with two scan_project calls (before/after) or pass two saved scan JSON results. This is unique to TridentChain; most other supply-chain scanners only report findings without a verifiable post-patch loop. Returns resolved_count, remaining_count, new_count, and validation_passed (true only when new findings == 0 and at least one was resolved).