Skip to main content
Glama
Synvoya

CodeInspectus

by Synvoya
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Scan code for security issues

codeinspectus_scan
Read-onlyIdempotent

Scan a local code path fully offline to find security vulnerabilities, exposed secrets, misconfigurations, AI-code risks, and compliance issues with CWE-keyed fixes.

Instructions

Run a full local security scan of a path: managed engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Also returns the V3 repository-trust contract with deterministic V3.1 source-integrity evidence for bidi controls, hidden/default-ignorable characters, Unicode tag and variation-selector payloads, and bounded mixed-script confusables. V3.2 additionally audits explicit AI attribution in source/git/media metadata and validates supported local C2PA assets with the official optional Content Authenticity Initiative library. Remote manifests and revocation endpoints are never fetched. Statistical-watermark detection remains explicitly unavailable. Fully offline — zero network egress at scan time. Never writes to your code or repo.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path to the repository or directory to scan.
scannersNoLimit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all.
max_findingsNoCap the number of findings returned to protect agent context (default: 200).
include_complianceNoInclude the per-framework compliance overview in the result (default: true).
severity_thresholdNoOnly return findings at or above this severity (default: info — all).

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetYes
offlineYes
scan_idYes
summaryYes
findingsYes
warningsYes
git_scopeNo
truncatedYes
disclaimerYes
git_safetyYes
started_atYes
duration_msYes
engines_runYes
scan_configNo
engine_setupNo
pack_coverageYes
trivy_db_dateNo
engine_detailsYes
repository_rootNo
secret_coverageNo
history_revisionNo
repository_trustYes
secret_suppressionNo
compliance_overviewNo
dependency_coverageNo
trivy_db_provenanceNo
component_signaturesNo
detected_technologiesYes
security_control_evidenceNo
total_findings_before_limitYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv3.1.0
    • addedOutput schema / properties / repository_trust
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "artifacts": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "artifact_id": {
+            "pattern": "^artifact-[a-z0-9][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "confidence": {
+            "enum": [
+              "high",
+              "medium",
+              "low",
+              "none"
+            ],
+            "type": "string"
+          },
+          "evidence": {
+            "additionalProperties": false,
+            "properties": {
+              "attributes": {
+                "items": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "name": {
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "redacted": {
+                      "type": "boolean"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "boolean"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "value"
+                  ],
+                  "type": "object"
+                },
+                "maxItems": 128,
+                "type": "array"
+              },
+              "summary": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "summary",
+              "attributes"
+            ],
+            "type": "object"
+          },
+          "fingerprint": {
+            "pattern": "^sha256:[0-9a-f]{64}$",
+            "type": "string"
+          },
+          "kind": {
+            "$ref": "#/properties/repository_trust/properties/coverage/properties/capabilities/items/properties/capability"
+          },
+          "limitations": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "location": {
+            "additionalProperties": false,
+            "properties": {
+              "end_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "end_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "file": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "start_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "start_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "file"
+            ],
+            "type": "object"
+          },
+          "marker_class": {
+            "pattern": "^[a-z][a-z0-9_]{0,127}$",
+            "type": "string"
+          },
+          "remediation": {
+            "additionalProperties": false,
+            "properties": {
+              "eligible": {
+                "type": "boolean"
+              },
+              "protected_record": {
+                "type": "boolean"
+              },
+              "reason": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "requires_approval": {
+                "const": true,
+                "type": "boolean"
+              },
+              "reversible": {
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "eligible",
+              "requires_approval",
+              "reversible",
+              "protected_record",
+              "reason"
+            ],
+            "type": "object"
+          },
+          "state": {
+            "enum": [
+              "verified",
+              "probable",
+              "informational",
+              "not_verifiable"
+            ],
+            "type": "string"
+          },
+          "validator": {
+            "additionalProperties": false,
+            "properties": {
+              "authoritative": {
+                "type": "boolean"
+              },
+              "egress": {
+                "enum": [
+                  "none",
+                  "optional",
+                  "required"
+                ],
+                "type": "string"
+              },
+              "id": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "independently_verifiable": {
+                "type": "boolean"
+              },
+              "method": {
+                "enum": [
+                  "deterministic",
+                  "declarative",
+                  "statistical"
+                ],
+                "type": "string"
+              },
+              "version": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "method",
+              "authoritative",
+              "independently_verifiable",
+              "egress"
+            ],
+            "type": "object"
+          }
+        },
+        "required": [
+          "artifact_id",
+          "fingerprint",
+          "kind",
+          "state",
+          "marker_class",
+          "location",
+          "evidence",
+          "validator",
+          "confidence",
+          "limitations",
+          "remediation"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "coverage": {
+      "additionalProperties": false,
+      "properties": {
+        "capabilities": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "enum": [
+                  "source_integrity",
+                  "explicit_ai_attribution",
+                  "content_provenance",
+                  "statistical_watermark"
+                ],
+                "type": "string"
+              },
+              "limitations": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "state": {
+                "$ref": "#/properties/repository_trust/properties/coverage/properties/state"
+              },
+              "validators": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "capability",
+              "state",
+              "validators",
+              "limitations"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "limitations": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "state": {
+          "enum": [
+            "ran",
+            "partial",
+            "not_run",
+            "not_applicable",
+            "unavailable"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state",
+        "capabilities",
+        "limitations"
+      ],
+      "type": "object"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "summary": {
+      "additionalProperties": false,
+      "properties": {
+        "informational": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "not_verifiable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "probable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "total": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "verified": {
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "verified",
+        "probable",
+        "informational",
+        "not_verifiable",
+        "total"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "schema_version",
+    "coverage",
+    "summary",
+    "artifacts"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "detected_technologies",
-  "pack_coverage",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "repository_trust",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  2. Changed19 schema fields changedv2.5.0
    • addedOutput schema / properties / component_signatures
      Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "type": "object"
+}
    • addedOutput schema / properties / dependency_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "database_checked_at": {
+        "type": "string"
+      },
+      "database_version": {
+        "type": "string"
+      },
+      "ecosystem": {
+        "const": "Pub",
+        "type": "string"
+      },
+      "engine": {
+        "const": "codeinspectus-pub",
+        "type": "string"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "lockfiles": {
+        "additionalProperties": false,
+        "properties": {
+          "analyzed": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "discovered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "discovered",
+          "analyzed"
+        ],
+        "type": "object"
+      },
+      "matching": {
+        "const": "exact-enumerated-versions",
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "packages": {
+        "additionalProperties": false,
+        "properties": {
+          "eligible": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "resolved": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skipped": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "resolved",
+          "eligible",
+          "skipped"
+        ],
+        "type": "object"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "ecosystem",
+      "engine",
+      "state",
+      "lockfiles",
+      "packages",
+      "matching",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / detected_technologies
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "confidence": {
+        "enum": [
+          "high",
+          "medium"
+        ],
+        "type": "string"
+      },
+      "evidence": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "id": {
+        "type": "string"
+      },
+      "kind": {
+        "enum": [
+          "language",
+          "framework",
+          "platform"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "kind",
+      "confidence",
+      "evidence"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / engine_details / items / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "codeinspectus-ai",
+  "codeinspectus-pub"
+]
    • addedOutput schema / properties / engine_setup
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "engines": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "detail": {
+            "type": "string"
+          },
+          "engine": {
+            "enum": [
+              "opengrep",
+              "gitleaks",
+              "trivy"
+            ],
+            "type": "string"
+          },
+          "state": {
+            "enum": [
+              "ready",
+              "missing",
+              "hash_mismatch",
+              "unpinned",
+              "lockfile_error",
+              "unsupported_platform"
+            ],
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "engine",
+          "version",
+          "state"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "network_required": {
+      "type": "boolean"
+    },
+    "platform": {
+      "type": "string"
+    },
+    "repair_command": {
+      "type": "string"
+    },
+    "state": {
+      "enum": [
+        "ready",
+        "repair_required",
+        "db_refresh_recommended",
+        "unsupported_platform"
+      ],
+      "type": "string"
+    },
+    "trivy_db": {
+      "additionalProperties": false,
+      "properties": {
+        "downloaded_at": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "ready",
+            "missing",
+            "provenance_missing",
+            "stale"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "state",
+    "platform",
+    "engines",
+    "trivy_db",
+    "network_required"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / findings / items / properties / finding_kind
      Added value: +{
+  "enum": [
+    "vulnerability",
+    "license",
+    "misconfiguration",
+    "secret",
+    "sast",
+    "ai",
+    "other"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / owasp_api
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / producer_components
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / scope_role
      Added value: +{
+  "enum": [
+    "primary",
+    "supporting_context"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / vulnerability_aliases
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / git_scope
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "base": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "entries": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "binary": {
+            "type": "boolean"
+          },
+          "generated": {
+            "type": "boolean"
+          },
+          "inspected": {
+            "type": "boolean"
+          },
+          "note": {
+            "type": "string"
+          },
+          "old_path": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "added",
+              "modified",
+              "deleted",
+              "renamed",
+              "untracked",
+              "ignored"
+            ],
+            "type": "string"
+          },
+          "submodule": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "status",
+          "path",
+          "binary",
+          "generated",
+          "submodule",
+          "inspected"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "head": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "mode": {
+      "enum": [
+        "commit_diff",
+        "working_tree"
+      ],
+      "type": "string"
+    },
+    "primary_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "primary_paths": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "supporting_context_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "supporting_context_scanned": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "schema_version",
+    "mode",
+    "repository",
+    "base",
+    "entries",
+    "primary_paths",
+    "supporting_context_scanned",
+    "primary_finding_count",
+    "supporting_context_finding_count",
+    "completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / history_revision
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "commit": {
+      "pattern": "^[0-9a-f]{40,64}$",
+      "type": "string"
+    },
+    "committer_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "snapshot_completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "temporal_scope": {
+      "enum": [
+        "historical",
+        "selected_head"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "schema_version",
+    "repository",
+    "commit",
+    "committer_at",
+    "temporal_scope",
+    "snapshot_completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / pack_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "analyzers": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "frameworks": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "languages": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "note": {
+        "type": "string"
+      },
+      "pack_id": {
+        "type": "string"
+      },
+      "platforms": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "rules": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "scanner_kind": {
+        "default": "ai",
+        "enum": [
+          "ai",
+          "sast"
+        ],
+        "type": "string"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      },
+      "version": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "pack_id",
+      "version",
+      "state",
+      "languages",
+      "frameworks",
+      "platforms",
+      "analyzers",
+      "rules",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / repository_root
      Added value: +{
+  "type": "string"
+}
    • addedOutput schema / properties / secret_coverage
      Added value: +{
+  "enum": [
+    "verified",
+    "unverified"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / secret_suppression
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "channels": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "channel": {
+            "enum": [
+              "target_config",
+              "gitleaks_ignore",
+              "inline_allow"
+            ],
+            "type": "string"
+          },
+          "count": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "handling": {
+            "enum": [
+              "ignored_by_codeinspectus",
+              "coverage_unverified"
+            ],
+            "type": "string"
+          },
+          "paths": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "channel",
+          "count",
+          "paths",
+          "handling"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "channels"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / security_control_evidence
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "control_id": {
+        "type": "string"
+      },
+      "evidence_locations": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "end_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            },
+            "file": {
+              "type": "string"
+            },
+            "start_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "file",
+            "start_line",
+            "end_line"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "limitation": {
+        "type": "string"
+      },
+      "providers": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "enum": [
+          "verified_in_repository",
+          "insecure_configuration_found",
+          "not_verifiable_from_repository"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "control_id",
+      "state",
+      "providers",
+      "evidence_locations",
+      "limitation"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / trivy_db_provenance
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "instruction": {
+      "type": "string"
+    },
+    "state": {
+      "const": "unrecorded",
+      "type": "string"
+    }
+  },
+  "required": [
+    "state",
+    "instruction"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  3. Changed1 schema field changedv0.3.0
    • addedOutput schema / properties / scan_config
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "max_findings": {
+      "type": "integer"
+    },
+    "scanners": {
+      "items": {
+        "enum": [
+          "sast",
+          "secret",
+          "vuln",
+          "misconfig",
+          "license",
+          "ai"
+        ],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "severity_threshold": {
+      "$ref": "#/properties/findings/items/properties/severity"
+    }
+  },
+  "required": [
+    "max_findings"
+  ],
+  "type": "object"
+}
  4. First observedv0.2.1

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint=false, and destructiveHint=false, but the description adds real behavioral depth beyond them: it names the managed engines and AI-specific checks, discloses that remote manifests/revocation endpoints are never fetched, that statistical-watermark detection is explicitly unavailable, and that it never writes to the code or repo. These are concrete operational guarantees rather than restatement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded in the first clause, which is good, but the body balloons into version-specific V3/V3.1/V3.2 contract detail and marketing-style enumerations that are dense and repetitive. The return-contract minutiae dilute the actionable content an agent needs before calling the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich annotation set and an output schema present, the description needn't explain return values, and it still summarizes the finding format and evidence model adequately. Combined with the explicit offline/no-write guarantees, an agent has enough to call it correctly, though the missing sibling routing keeps it from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all five parameters are documented in the schema, including the scanners enum and default values, so the schema does the heavy lifting. The description's references to engines and output fields (compliance tags, native-pack counts) are about results, not parameter behavior, adding little param-specific meaning. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ("Run a full local security scan of a path") and enumerates exactly which engines and check categories run, so an agent understands precisely what the tool does. It does not, however, explicitly differentiate itself from siblings like codeinspectus_rescan or codeinspectus_generate_sbom, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description never states when to invoke this tool versus alternatives, even though obvious siblings (rescan, compliance_report, generate_sbom) exist. There are no prerequisites, no exclusions, and no routing language; usage is only weakly implied by the word "full".

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools