Scan a target directory for security vulnerabilities using a SAST tool.

Ignore a specific vulnerability finding so it won't appear in future scans.

Remove a vulnerability from the ignore list so it appears in future scans again.

List all available SAST scanners, their status, and supported languages.

Returns information about each scanner including whether it is installed and ready to use, what languages it supports, and how to install it.

List all currently ignored vulnerability findings for a project.

Scan the entire git history for leaked secrets and credentials using Gitleaks.

Traditional SAST only scans the current state of files. This tool deeply analyzes the .git directory to find API keys, passwords, and tokens that were committed in the past but may still be valid.

Run an active dynamic scan (DAST) using OWASP ZAP.

Unlike SAST which only looks at code, this orchestrates spinning up the application via Docker Compose, waiting for it to be ready, and then running a ZAP dynamic baseline scan against the running instance.

Run a SAST scan and export results in SARIF 2.1.0 format for CI/CD integration.

SARIF is the industry standard format consumed by GitHub Code Scanning, GitLab SAST, Azure DevOps, and other CI/CD platforms.

Scan with ALL installed scanners in parallel, returning deduplicated results.

Automatically detects which scanners are installed, runs them concurrently, and deduplicates findings across scanners using content-based hashing. This is the recommended tool for comprehensive security scanning.

Scan a container image for vulnerabilities and secrets.

Pulls and analyzes a container image reference (e.g. nginx:1.25, ghcr.io/org/app@sha256:...) with Trivy or Grype, returning the same normalized findings as a source scan.

Run a scan and save the results as a named baseline for future comparison.

Compare current scan results against a saved baseline.

Shows new vulnerabilities, fixed vulnerabilities, and severity trends.

Run all scanners and evaluate findings against a CI security policy.

Returns an explicit PASS/FAIL verdict suitable for gating a pipeline. A threshold of -1 means "no limit" for that severity. When fail_on_new is set, the result also fails if any finding is new relative to the named baseline (created with save_baseline).

Run all scanners and export an SBOM / vulnerability report.

Produces the supply-chain artifact enterprises expect. In CycloneDX mode, if Syft is installed the component inventory is the full dependency list (not just vulnerable packages); otherwise components are derived from findings. SPDX mode emits an SPDX 2.3 document.

Run all scanners and render an executive security report (HTML or PDF).

Map findings to a compliance framework and report the posture.

Buckets all findings against OWASP Top 10, SANS CWE Top 25, PCI DSS, or CIS using each finding's CWE / OWASP metadata.

Upload a SARIF report to a DefectDojo engagement.

Requires the DEFECTDOJO_URL and DEFECTDOJO_API_KEY environment variables. Generate the SARIF file first with export_sarif(output_path=...).

Upload a SARIF report to GitHub Code Scanning.

Requires a GITHUB_TOKEN environment variable with security_events: write scope. Generate the SARIF file first with export_sarif(output_path=...).

Post a security summary comment on a GitHub PR or GitLab merge request.

Credentials come from environment variables only: GITHUB_TOKEN for GitHub, or GITLAB_TOKEN (+ optional GITLAB_URL) for GitLab.

Send a notification to the configured Slack incoming webhook.

Requires the SLACK_WEBHOOK_URL environment variable.

Send a notification to the configured Microsoft Teams incoming webhook.

Requires the TEAMS_WEBHOOK_URL environment variable.

Open a Jira issue for a security finding.

Requires the JIRA_URL, JIRA_EMAIL, and JIRA_API_TOKEN environment variables.

Build an LLM-ready prompt to fix a cached finding as a unified diff.

Recovers the finding (by hash) from the scan cache, extracts an expanded window of the vulnerable source, and returns a prompt engineered to make an LLM emit a strict unified diff. After generating the patch, apply it with apply_patch.

Apply an agent-generated unified diff to files under target_path.

Uses git apply, which refuses paths that escape the target directory. Run with check_only=True first to verify the patch applies cleanly before writing changes.

Apply a fix and prove it worked: scan → patch → re-scan → confirm gone.

The closed remediation loop. Recovers the finding by hash, dry-runs the patch, re-scans the affected file before and after applying it, and returns PASS only if the finding's hash disappears and no new finding of equal or higher severity is introduced. On failure (and when auto_rollback), the patch is reverted so the working tree is left clean.

Ingest an external SARIF file into the normalized finding pipeline.

Lets results from any SARIF-producing tool (Snyk, Veracode, CodeQL, a CI job, etc.) join the same dedup / baseline / dashboard flow as native scans. The findings are re-enriched with AST context and stable hashes on import.

Triage a finding: get an exploitability prompt, or record a VEX decision.