Hybrid multi-engine scan: secrets regex, Python AST + advanced multi-hop taint, tree-sitter structural sinks, language grids, custom rules/plugins. Returns redacted issues, engines used, risk score, security_verdict.

Rough AWS/GCP monthly SKU catalog estimate from IaC text.

IaC misconfigs + budget gate on estimated monthly burn.

Parallel recursive repo scan with optional incremental cache.

Scan only files changed in a git range (PR/diff) or staged changes.

Dependency inventory + optional OSV CVE query.

Convert issues to SARIF 2.1.0 JSON.

Generate CycloneDX and/or SPDX SBOM JSON.

Template or LLM-assisted fix drafts for findings (never auto-applied).

Dockerfile / Kubernetes security heuristics.

Repo/diff scan + deps + fixes + SARIF + SBOM.

List loaded plugins and custom rule counts.

Report hybrid engine capabilities (tree-sitter langs, plugins, etc.).

Compute security score/grade from an issues list and optionally record history.

Return recent dashboard scan history from local SQLite.

Enterprise health, metrics, and non-secret config status.

Show active policy pack and gate thresholds for the caller tenant.

Run policy pack evaluation against a prior scan result object.

Generate a lightweight compliance evidence report for auditors.

List recent in-memory audit events (operator+).

Issue a short-lived JWT (admin). Requires GUARDRAIL_JWT_SECRET.

Reload enterprise YAML/JSON from disk (admin).

Inspect or update in-memory tenant quota counters (admin).