remediate_and_verify
Apply a code patch, re-scan to confirm the vulnerability is resolved, and automatically rollback if verification fails, ensuring no new high-severity issues are introduced.
Instructions
Apply a fix and prove it worked: scan → patch → re-scan → confirm gone.
The closed remediation loop. Recovers the finding by hash, dry-runs the
patch, re-scans the affected file before and after applying it, and returns
PASS only if the finding's hash disappears and no new finding of equal
or higher severity is introduced. On failure (and when auto_rollback),
the patch is reverted so the working tree is left clean.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target_path | Yes | Root of the scanned project (with a `.sast-mcp-cache`). | |
| finding_hash | Yes | Hash of the finding to fix (from earlier scan output). | |
| patch | Yes | The unified diff to apply (e.g. produced via generate_fix_prompt). | |
| scanner_name | No | Scanner to re-scan with. Defaults to the finding's originating scanner, falling back to all scanners. | |
| auto_rollback | No | Revert the patch if verification fails (default True). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |