scan_vulnerabilities
Scans code directories for security vulnerabilities using static analysis tools, with filters for severity, confidence, and git diff comparison.
Instructions
Scan a target directory for security vulnerabilities using a SAST tool.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target_path | Yes | The absolute path to the directory or file to scan. | |
| scanner_name | No | The scanner to use ('bandit', 'njsscan', 'bearer', 'semgrep'). Defaults to 'bearer'. | bearer |
| min_severity | No | Minimum severity to report (LOW, MEDIUM, HIGH, CRITICAL). | LOW |
| min_confidence | No | Minimum confidence to report (LOW, MEDIUM, HIGH). | LOW |
| git_diff_only | No | If true, only reports findings in files modified in git diff. | |
| limit | No | Maximum number of findings to return (for pagination). | |
| offset | No | Pagination offset. | |
| output_format | No | 'markdown' (human-readable, default) or 'json' (machine-readable list of findings for agents / CI). | markdown |
| use_cache | No | If true, reuse the last cached scan when the target's files are unchanged (incremental scan). Ignored when git_diff_only is set. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |