submit_findings
Record missing control evidence found while scanning a codebase against threat model controls. Persist structured findings to track gaps through review and updates.
Instructions
Record negative findings (gaps discovered while scanning a codebase against a model's controls). Mutating: persists new finding records against the model.
Use after a gap-discovery scan (see get_scan_prompt) to log where expected control evidence was NOT found. Findings are the negative counterpart to assertions (positive proof via submit_assertions): a finding says "I looked here for this and it was missing." Once submitted, drive a finding through its lifecycle with update_finding and review them with list_findings.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| model_id | Yes | ID of the threat model. | |
| findings_json | Yes | JSON string of an **array** of finding objects. Each object should carry: - ``control_id`` (str): the control the gap relates to. - ``title`` (str): short summary of the gap. - ``description`` (str): what is missing and why it matters. - ``severity`` (str): finding severity (e.g., "low"/"medium"/"high"/"critical"). - ``checked_locations`` (list): files/paths inspected. - ``checked_patterns`` (list): patterns/signals searched for. - ``expected_evidence`` (str): what implemented evidence would have looked like. Must parse as a JSON array; a single object or malformed JSON is rejected. | |
| server_version | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||