Scan Kotlin/JVM code for security issues using a 216-rule analyzer.

Point this at a file or directory. It returns every security finding the analyzer reports — rule id, message, location, and severity — so the agent can fix issues while writing, not after.

Args: path: File or directory to scan (absolute, or relative to the project).

Security-review a unified diff: flag issues the change introduces.

Paste a unified diff (e.g. the output of git diff) after editing Kotlin code. Only findings on lines the diff adds are returned, so the agent sees exactly what its change is responsible for — a self-check before committing.

Args: diff: A unified diff whose file paths are relative to the current project directory.

Get the secure way to do a risky Kotlin/JVM task, before writing it.

Ask "how do I do X securely" and get vetted before/after snippets and the reason — so the agent writes the safe version the first time.

Args: task: What you want to do, e.g. "create a session cookie", "store a JWT secret", "configure CORS", "read the current user in reactive code". framework: Optional stack to narrow results, e.g. "spring-webflux", "ktor", "vertx". Leave empty to search all frameworks.