Run deterministic static analysis (Semgrep) over repository files and return findings with exact line numbers plus the matched source snippet.

Use this to substantiate a suspected defect rather than guessing at it: the results are rule matches, so a hit is a fact. The snippet can be reused directly as existing_code when emitting a comment.

Scope paths to the file currently under review. OpenCodeReview only allows comments on the file being reviewed, so findings in other files cannot be reported even when the tool returns them.

An empty result is not a clean bill of health — it means no configured rule matched. The ruleset is broad but not exhaustive.

Run deterministic static analysis (Semgrep) restricted to the lines changed between two revisions, and return findings with exact line numbers plus the matched source snippet.

Prefer this over semgrep_scan when reviewing a pull request. OpenCodeReview reviews a diff and only permits comments on changed lines, so a finding on an untouched line cannot be reported — this tool does not return those at all, which keeps the result short and entirely actionable.

base and head are any git revisions (abc123, main, HEAD~1). Pass paths to narrow the scan to specific changed files.

Report whether deterministic analysis is available: the Semgrep binary in use, its version, the active ruleset, and the per-call limits. Call this once if a scan reports that it is unavailable.