scan_repo
Inventory the cryptography inside a local directory tree, file by file, returning each algorithm with its file, line, and quantum risk classification to show what a project actually uses.
Instructions
Inventory the cryptography inside one local directory tree, file by file.
Reads source, configuration (nginx.conf, sshd_config, .ini, .toml), CI pipelines,
Terraform and Kubernetes manifests under path. Returns each algorithm found with
its file and line, the mathematical family and standing of every post-quantum
scheme, and a coverage count.
Use this to answer what a specific project on this machine actually uses. Do not
use it to ask whether this server knows a given algorithm, or to explain how one is
classified without scanning anything -- list_algorithms answers that from the same
table and reads no files. It is also the wrong tool for a network endpoint, a
running host or a certificate store: it opens files on disk and nothing else.
Coverage is reported as a fraction with a base. files_scanned + unreadable_files + files_skipped_by_type == files_present. A file that could not be opened is listed,
never counted as scanned, because no findings in a file nobody read is not the same
as a file that is clean. Files skipped because this tool does not claim their type
are counted by extension, so the reader can judge the boundary rather than assume
past it.
Cost scales with the size of the tree, so a large monorepo takes proportionally longer; there is no cache and no partial mode.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory to scan, absolute or relative to the working directory: a checked-out repository, a service directory, a config tree. Vendored and build directories (.git, node_modules, vendor, dist, build, target) are excluded and do not count toward files_present. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||