Skip to main content
Glama
Sign In
CodeInspectus

CodeInspectus

by Synvoya
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Scan code for security issues

codeinspectus_scan
Read-onlyIdempotent

Run a full offline security scan of a repository path to detect secrets, vulnerabilities, misconfigurations, and AI-code risks, returning CWE-keyed findings with fix recommendations.

Instructions

Run a full local security scan of a path: managed engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Also returns the V3 repository-trust contract with deterministic V3.1 source-integrity evidence for bidi controls, hidden/default-ignorable characters, Unicode tag and variation-selector payloads, and bounded mixed-script confusables. V3.2 additionally audits explicit AI attribution in source/git/media metadata and validates supported local C2PA assets with the official optional Content Authenticity Initiative library. Remote manifests and revocation endpoints are never fetched. Statistical-watermark detection remains explicitly unavailable. Licence findings are off by default (informational, not fixable); pass include_licenses: true to add them. Lists declared coverage gaps (coverage_gaps, stable ids) that make coverage partial and informational coverage_notes; accept_gaps accepts named gap ids for CI while they stay listed. Fully offline — zero network egress at scan time. Never writes to your code or repo.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "path": "<path>"
    },
    "name": "codeinspectus_scan"
  }
}

Input Schema

NameRequiredDescriptionDefault
pathYesAbsolute path to the repository or directory to scan.
scannersNoLimit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all except license, which needs include_licenses or an explicit license entry.
accept_gapsNoCoverage gap ids to accept for CI (e.g. php-sast, deno-lock). Coverage still reads partial and the gaps stay listed; CI passes coverage only when every other cause is absent.
max_findingsNoCap the number of findings returned to protect agent context (default: 200).
include_licensesNoInclude Trivy licence findings (default: false; they are informational and not fixable). Listing license in scanners also requests them. A rescan follows the prior scan's setting.
include_complianceNoInclude the per-framework compliance overview in the result (default: true).
severity_thresholdNoOnly return findings at or above this severity (default: info — all).

Output Schema

NameRequiredDescriptionDefault
targetYes
offlineYes
scan_idYes
summaryYes
findingsYes
warningsYes
git_scopeNo
truncatedYes
disclaimerYes
git_safetyYes
started_atYes
duration_msYes
engines_runYes
scan_configNo
engine_setupNo
accepted_gapsNo
coverage_gapsNo
pack_coverageYes
trivy_db_dateNo
coverage_notesNo
engine_detailsYes
repository_rootNo
secret_coverageNo
synvoya_checkedNo
history_revisionNo
repository_trustYes
secret_suppressionNo
compliance_overviewNo
dependency_coverageNo
trivy_db_provenanceNo
component_signaturesNo
detected_technologiesYes
security_control_evidenceNo
total_findings_before_limitYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed18 schema fields changedv4.0.0
    • addedInput schema / properties / accept_gaps
      Added value: +{
+  "description": "Coverage gap ids to accept for CI (e.g. php-sast, deno-lock). Coverage still reads partial and the gaps stay listed; CI passes coverage only when every other cause is absent.",
+  "items": {
+    "enum": [
+      "php-sast",
+      "ruby-sast",
+      "java-sast",
+      "kotlin-sast",
+      "go-sast",
+      "csharp-sast",
+      "rust-sast",
+      "swift-sast",
+      "c-sast",
+      "cpp-sast",
+      "scala-sast",
+      "dart-sast",
+      "vue-sast",
+      "svelte-sast",
+      "astro-sast",
+      "objc-sast",
+      "elixir-sast",
+      "erlang-sast",
+      "lua-sast",
+      "perl-sast",
+      "groovy-sast",
+      "clojure-sast",
+      "haskell-sast",
+      "ocaml-sast",
+      "r-sast",
+      "julia-sast",
+      "zig-sast",
+      "solidity-sast",
+      "vb-sast",
+      "sast-parse-errors",
+      "third-party-bundles",
+      "native-parse-errors",
+      "oversized-files",
+      "native-token-budget",
+      "express-routes-unresolved",
+      "nextjs-routes-unresolved",
+      "symlinked-paths",
+      "wordpress-plugins",
+      "actions-unchecked",
+      "dev-deps-unscanned",
+      "deno-lock",
+      "bun-lockb",
+      "no-lockfile-npm",
+      "no-lockfile-composer",
+      "npm-shrinkwrap-unread",
+      "vendored-js"
+    ],
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedInput schema / properties / include_licenses
      Added value: +{
+  "description": "Include Trivy licence findings (default: false; they are informational and not fixable). Listing license in scanners also requests them. A rescan follows the prior scan's setting.",
+  "type": "boolean"
+}
    • changedInput schema / properties / scanners / description
      Previous value: -"Limit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all."New value: +"Limit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all except license, which needs include_licenses or an explicit license entry."
    • addedOutput schema / properties / accepted_gaps
      Added value: +{
+  "items": {
+    "enum": [
+      "php-sast",
+      "ruby-sast",
+      "java-sast",
+      "kotlin-sast",
+      "go-sast",
+      "csharp-sast",
+      "rust-sast",
+      "swift-sast",
+      "c-sast",
+      "cpp-sast",
+      "scala-sast",
+      "dart-sast",
+      "vue-sast",
+      "svelte-sast",
+      "astro-sast",
+      "objc-sast",
+      "elixir-sast",
+      "erlang-sast",
+      "lua-sast",
+      "perl-sast",
+      "groovy-sast",
+      "clojure-sast",
+      "haskell-sast",
+      "ocaml-sast",
+      "r-sast",
+      "julia-sast",
+      "zig-sast",
+      "solidity-sast",
+      "vb-sast",
+      "sast-parse-errors",
+      "third-party-bundles",
+      "native-parse-errors",
+      "oversized-files",
+      "native-token-budget",
+      "express-routes-unresolved",
+      "nextjs-routes-unresolved",
+      "symlinked-paths",
+      "wordpress-plugins",
+      "actions-unchecked",
+      "dev-deps-unscanned",
+      "deno-lock",
+      "bun-lockb",
+      "no-lockfile-npm",
+      "no-lockfile-composer",
+      "npm-shrinkwrap-unread",
+      "vendored-js"
+    ],
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / coverage_gaps
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "examples": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "files": {
+        "minimum": 0,
+        "type": "integer"
+      },
+      "id": {
+        "enum": [
+          "php-sast",
+          "ruby-sast",
+          "java-sast",
+          "kotlin-sast",
+          "go-sast",
+          "csharp-sast",
+          "rust-sast",
+          "swift-sast",
+          "c-sast",
+          "cpp-sast",
+          "scala-sast",
+          "dart-sast",
+          "vue-sast",
+          "svelte-sast",
+          "astro-sast",
+          "objc-sast",
+          "elixir-sast",
+          "erlang-sast",
+          "lua-sast",
+          "perl-sast",
+          "groovy-sast",
+          "clojure-sast",
+          "haskell-sast",
+          "ocaml-sast",
+          "r-sast",
+          "julia-sast",
+          "zig-sast",
+          "solidity-sast",
+          "vb-sast",
+          "sast-parse-errors",
+          "third-party-bundles",
+          "native-parse-errors",
+          "oversized-files",
+          "native-token-budget",
+          "express-routes-unresolved",
+          "nextjs-routes-unresolved",
+          "symlinked-paths",
+          "wordpress-plugins",
+          "actions-unchecked",
+          "dev-deps-unscanned",
+          "deno-lock",
+          "bun-lockb",
+          "no-lockfile-npm",
+          "no-lockfile-composer",
+          "npm-shrinkwrap-unread",
+          "vendored-js"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "files",
+      "examples"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / coverage_notes
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "component": {
+        "type": "string"
+      },
+      "detail": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "component",
+      "detail"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • removedOutput schema / properties / dependency_coverage / items / properties / ecosystem / const
      Removed value: -"Pub"
    • removedOutput schema / properties / dependency_coverage / items / properties / engine / const
      Removed value: -"codeinspectus-pub"
    • addedOutput schema / properties / dependency_coverage / items / properties / engine / enum
      Added value: +[
+  "codeinspectus-pub",
+  "osv-scanner"
+]
    • removedOutput schema / properties / dependency_coverage / items / properties / matching / const
      Removed value: -"exact-enumerated-versions"
    • addedOutput schema / properties / dependency_coverage / items / properties / matching / enum
      Added value: +[
+  "exact-enumerated-versions",
+  "osv-scanner-offline"
+]
    • changedOutput schema / properties / engine_details / items / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai",
-  "codeinspectus-pub"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "osv-scanner",
+  "codeinspectus-ai",
+  "codeinspectus-pub",
+  "synvoya"
+]
    • changedOutput schema / properties / engine_setup / properties / engines / items / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "osv-scanner"
+]
    • addedOutput schema / properties / engine_setup / properties / osv_databases
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "downloaded_at": {
+        "type": "string"
+      },
+      "ecosystem": {
+        "enum": [
+          "npm",
+          "PyPI",
+          "Packagist",
+          "Go",
+          "crates.io",
+          "RubyGems",
+          "Maven",
+          "NuGet",
+          "Pub",
+          "GitHub Actions"
+        ],
+        "type": "string"
+      },
+      "state": {
+        "enum": [
+          "ready",
+          "provenance_missing",
+          "stale"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "ecosystem",
+      "state"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / engine_family
      Added value: +{
+  "enum": [
+    "synvoya"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / package
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "ecosystem": {
+      "type": "string"
+    },
+    "name": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "ecosystem",
+    "name",
+    "version"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / scan_config / properties / include_licenses
      Added value: +{
+  "type": "boolean"
+}
    • addedOutput schema / properties / synvoya_checked
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "actions": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "images": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "inventory:osv-scanner": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "inventory:trivy": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "products": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "runtime": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "sbom:osv-scanner": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "vendored": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    }
+  },
+  "type": "object"
+}
  2. Changed1 schema field changedv3.3.1
    • addedInput schema / properties / path / minLength
      Added value: +1
  3. Changed2 schema fields changedv3.1.0
    • addedOutput schema / properties / repository_trust
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "artifacts": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "artifact_id": {
+            "pattern": "^artifact-[a-z0-9][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "confidence": {
+            "enum": [
+              "high",
+              "medium",
+              "low",
+              "none"
+            ],
+            "type": "string"
+          },
+          "evidence": {
+            "additionalProperties": false,
+            "properties": {
+              "attributes": {
+                "items": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "name": {
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "redacted": {
+                      "type": "boolean"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "boolean"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "value"
+                  ],
+                  "type": "object"
+                },
+                "maxItems": 128,
+                "type": "array"
+              },
+              "summary": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "summary",
+              "attributes"
+            ],
+            "type": "object"
+          },
+          "fingerprint": {
+            "pattern": "^sha256:[0-9a-f]{64}$",
+            "type": "string"
+          },
+          "kind": {
+            "$ref": "#/properties/repository_trust/properties/coverage/properties/capabilities/items/properties/capability"
+          },
+          "limitations": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "location": {
+            "additionalProperties": false,
+            "properties": {
+              "end_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "end_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "file": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "start_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "start_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "file"
+            ],
+            "type": "object"
+          },
+          "marker_class": {
+            "pattern": "^[a-z][a-z0-9_]{0,127}$",
+            "type": "string"
+          },
+          "remediation": {
+            "additionalProperties": false,
+            "properties": {
+              "eligible": {
+                "type": "boolean"
+              },
+              "protected_record": {
+                "type": "boolean"
+              },
+              "reason": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "requires_approval": {
+                "const": true,
+                "type": "boolean"
+              },
+              "reversible": {
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "eligible",
+              "requires_approval",
+              "reversible",
+              "protected_record",
+              "reason"
+            ],
+            "type": "object"
+          },
+          "state": {
+            "enum": [
+              "verified",
+              "probable",
+              "informational",
+              "not_verifiable"
+            ],
+            "type": "string"
+          },
+          "validator": {
+            "additionalProperties": false,
+            "properties": {
+              "authoritative": {
+                "type": "boolean"
+              },
+              "egress": {
+                "enum": [
+                  "none",
+                  "optional",
+                  "required"
+                ],
+                "type": "string"
+              },
+              "id": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "independently_verifiable": {
+                "type": "boolean"
+              },
+              "method": {
+                "enum": [
+                  "deterministic",
+                  "declarative",
+                  "statistical"
+                ],
+                "type": "string"
+              },
+              "version": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "method",
+              "authoritative",
+              "independently_verifiable",
+              "egress"
+            ],
+            "type": "object"
+          }
+        },
+        "required": [
+          "artifact_id",
+          "fingerprint",
+          "kind",
+          "state",
+          "marker_class",
+          "location",
+          "evidence",
+          "validator",
+          "confidence",
+          "limitations",
+          "remediation"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "coverage": {
+      "additionalProperties": false,
+      "properties": {
+        "capabilities": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "enum": [
+                  "source_integrity",
+                  "explicit_ai_attribution",
+                  "content_provenance",
+                  "statistical_watermark"
+                ],
+                "type": "string"
+              },
+              "limitations": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "state": {
+                "$ref": "#/properties/repository_trust/properties/coverage/properties/state"
+              },
+              "validators": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "capability",
+              "state",
+              "validators",
+              "limitations"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "limitations": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "state": {
+          "enum": [
+            "ran",
+            "partial",
+            "not_run",
+            "not_applicable",
+            "unavailable"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state",
+        "capabilities",
+        "limitations"
+      ],
+      "type": "object"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "summary": {
+      "additionalProperties": false,
+      "properties": {
+        "informational": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "not_verifiable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "probable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "total": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "verified": {
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "verified",
+        "probable",
+        "informational",
+        "not_verifiable",
+        "total"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "schema_version",
+    "coverage",
+    "summary",
+    "artifacts"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "detected_technologies",
-  "pack_coverage",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "repository_trust",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  4. Changed19 schema fields changedv2.5.0
    • addedOutput schema / properties / component_signatures
      Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "type": "object"
+}
    • addedOutput schema / properties / dependency_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "database_checked_at": {
+        "type": "string"
+      },
+      "database_version": {
+        "type": "string"
+      },
+      "ecosystem": {
+        "const": "Pub",
+        "type": "string"
+      },
+      "engine": {
+        "const": "codeinspectus-pub",
+        "type": "string"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "lockfiles": {
+        "additionalProperties": false,
+        "properties": {
+          "analyzed": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "discovered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "discovered",
+          "analyzed"
+        ],
+        "type": "object"
+      },
+      "matching": {
+        "const": "exact-enumerated-versions",
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "packages": {
+        "additionalProperties": false,
+        "properties": {
+          "eligible": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "resolved": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skipped": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "resolved",
+          "eligible",
+          "skipped"
+        ],
+        "type": "object"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "ecosystem",
+      "engine",
+      "state",
+      "lockfiles",
+      "packages",
+      "matching",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / detected_technologies
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "confidence": {
+        "enum": [
+          "high",
+          "medium"
+        ],
+        "type": "string"
+      },
+      "evidence": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "id": {
+        "type": "string"
+      },
+      "kind": {
+        "enum": [
+          "language",
+          "framework",
+          "platform"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "kind",
+      "confidence",
+      "evidence"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / engine_details / items / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "codeinspectus-ai",
+  "codeinspectus-pub"
+]
    • addedOutput schema / properties / engine_setup
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "engines": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "detail": {
+            "type": "string"
+          },
+          "engine": {
+            "enum": [
+              "opengrep",
+              "gitleaks",
+              "trivy"
+            ],
+            "type": "string"
+          },
+          "state": {
+            "enum": [
+              "ready",
+              "missing",
+              "hash_mismatch",
+              "unpinned",
+              "lockfile_error",
+              "unsupported_platform"
+            ],
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "engine",
+          "version",
+          "state"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "network_required": {
+      "type": "boolean"
+    },
+    "platform": {
+      "type": "string"
+    },
+    "repair_command": {
+      "type": "string"
+    },
+    "state": {
+      "enum": [
+        "ready",
+        "repair_required",
+        "db_refresh_recommended",
+        "unsupported_platform"
+      ],
+      "type": "string"
+    },
+    "trivy_db": {
+      "additionalProperties": false,
+      "properties": {
+        "downloaded_at": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "ready",
+            "missing",
+            "provenance_missing",
+            "stale"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "state",
+    "platform",
+    "engines",
+    "trivy_db",
+    "network_required"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / findings / items / properties / finding_kind
      Added value: +{
+  "enum": [
+    "vulnerability",
+    "license",
+    "misconfiguration",
+    "secret",
+    "sast",
+    "ai",
+    "other"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / owasp_api
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / producer_components
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / scope_role
      Added value: +{
+  "enum": [
+    "primary",
+    "supporting_context"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / vulnerability_aliases
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / git_scope
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "base": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "entries": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "binary": {
+            "type": "boolean"
+          },
+          "generated": {
+            "type": "boolean"
+          },
+          "inspected": {
+            "type": "boolean"
+          },
+          "note": {
+            "type": "string"
+          },
+          "old_path": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "added",
+              "modified",
+              "deleted",
+              "renamed",
+              "untracked",
+              "ignored"
+            ],
+            "type": "string"
+          },
+          "submodule": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "status",
+          "path",
+          "binary",
+          "generated",
+          "submodule",
+          "inspected"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "head": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "mode": {
+      "enum": [
+        "commit_diff",
+        "working_tree"
+      ],
+      "type": "string"
+    },
+    "primary_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "primary_paths": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "supporting_context_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "supporting_context_scanned": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "schema_version",
+    "mode",
+    "repository",
+    "base",
+    "entries",
+    "primary_paths",
+    "supporting_context_scanned",
+    "primary_finding_count",
+    "supporting_context_finding_count",
+    "completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / history_revision
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "commit": {
+      "pattern": "^[0-9a-f]{40,64}$",
+      "type": "string"
+    },
+    "committer_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "snapshot_completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "temporal_scope": {
+      "enum": [
+        "historical",
+        "selected_head"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "schema_version",
+    "repository",
+    "commit",
+    "committer_at",
+    "temporal_scope",
+    "snapshot_completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / pack_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "analyzers": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "frameworks": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "languages": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "note": {
+        "type": "string"
+      },
+      "pack_id": {
+        "type": "string"
+      },
+      "platforms": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "rules": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "scanner_kind": {
+        "default": "ai",
+        "enum": [
+          "ai",
+          "sast"
+        ],
+        "type": "string"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      },
+      "version": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "pack_id",
+      "version",
+      "state",
+      "languages",
+      "frameworks",
+      "platforms",
+      "analyzers",
+      "rules",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / repository_root
      Added value: +{
+  "type": "string"
+}
    • addedOutput schema / properties / secret_coverage
      Added value: +{
+  "enum": [
+    "verified",
+    "unverified"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / secret_suppression
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "channels": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "channel": {
+            "enum": [
+              "target_config",
+              "gitleaks_ignore",
+              "inline_allow"
+            ],
+            "type": "string"
+          },
+          "count": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "handling": {
+            "enum": [
+              "ignored_by_codeinspectus",
+              "coverage_unverified"
+            ],
+            "type": "string"
+          },
+          "paths": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "channel",
+          "count",
+          "paths",
+          "handling"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "channels"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / security_control_evidence
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "control_id": {
+        "type": "string"
+      },
+      "evidence_locations": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "end_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            },
+            "file": {
+              "type": "string"
+            },
+            "start_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "file",
+            "start_line",
+            "end_line"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "limitation": {
+        "type": "string"
+      },
+      "providers": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "enum": [
+          "verified_in_repository",
+          "insecure_configuration_found",
+          "not_verifiable_from_repository"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "control_id",
+      "state",
+      "providers",
+      "evidence_locations",
+      "limitation"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / trivy_db_provenance
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "instruction": {
+      "type": "string"
+    },
+    "state": {
+      "const": "unrecorded",
+      "type": "string"
+    }
+  },
+  "required": [
+    "state",
+    "instruction"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  5. Changed1 schema field changedv0.3.0
    • addedOutput schema / properties / scan_config
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "max_findings": {
+      "type": "integer"
+    },
+    "scanners": {
+      "items": {
+        "enum": [
+          "sast",
+          "secret",
+          "vuln",
+          "misconfig",
+          "license",
+          "ai"
+        ],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "severity_threshold": {
+      "$ref": "#/properties/findings/items/properties/severity"
+    }
+  },
+  "required": [
+    "max_findings"
+  ],
+  "type": "object"
+}
  6. First observedv0.2.1

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses materially useful behaviour: fully offline with zero network egress, remote manifests and revocation endpoints never fetched, no writes to code or repo, and statistical-watermark detection explicitly unavailable. It also documents defaults with rationale (licence findings off because informational and not fixable, and a rescan follows the prior scan's setting) and the three-state evidence / coverage-gap contract that shapes how results must be read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded effectively, but the body is one dense block heavy with acronyms and internal version jargon (V3, V3.1, V3.2, C2PA, RLS) that costs reading effort without helping an agent decide or invoke. It is not padded with filler, but several clauses, especially the enumeration of trust-contract internals, could be compressed or deferred to the output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-complexity, seven-parameter scan tool, the definition covers the operationally important facts: offline guarantees, write-safety, coverage gaps, licence default, and truncation via max_findings. An output schema exists, yet the description spends substantial space restating return contents (CWE-keyed findings, compliance tags, V3 evidence), which is surplus to what the schema already provides.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description genuinely adds meaning: it explains that accept_gaps accepts named gap ids for CI while coverage still reads partial and the gaps stay listed, and it explains why licence findings are off by default and that listing license in scanners also requests them. Max_findings, severity_threshold, and include_compliance are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause gives a specific verb and resource — 'Run a full local security scan of a path' — and immediately names the engines (Opengrep, Gitleaks, Trivy, native Pub SCA, AI-specific checks). An agent can tell this is the primary full-scan entry point. However, it never names which sibling to use instead (e.g. codeinspectus_rescan for a re-run or codeinspectus_compliance_report for a compliance-only view), so differentiation from the ten siblings is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: this is the full scan of a path, with targeted guidance for two parameters (pass include_licenses: true to add licence findings; accept_gaps for CI). There is no explicit when-to-use/when-not-to-use framing and no routing to alternatives such as codeinspectus_rescan when a prior scan exists, or codeinspectus_setup for engine installation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools