Skip to main content
Glama
Synvoya

CodeInspectus

by Synvoya
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Scan code for security issues

codeinspectus_scan
Read-onlyIdempotent

Run an offline local security scan of a repository path to detect secrets, vulnerabilities, misconfigurations, and AI-specific risks. Returns CWE-keyed findings with fix recommendations.

Instructions

Run a full local security scan of a path: managed engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Also returns the V3 repository-trust contract with deterministic V3.1 source-integrity evidence for bidi controls, hidden/default-ignorable characters, Unicode tag and variation-selector payloads, and bounded mixed-script confusables. V3.2 additionally audits explicit AI attribution in source/git/media metadata and validates supported local C2PA assets with the official optional Content Authenticity Initiative library. Remote manifests and revocation endpoints are never fetched. Statistical-watermark detection remains explicitly unavailable. Fully offline — zero network egress at scan time. Never writes to your code or repo.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path to the repository or directory to scan.
scannersNoLimit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all.
max_findingsNoCap the number of findings returned to protect agent context (default: 200).
include_complianceNoInclude the per-framework compliance overview in the result (default: true).
severity_thresholdNoOnly return findings at or above this severity (default: info — all).

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetYes
offlineYes
scan_idYes
summaryYes
findingsYes
warningsYes
git_scopeNo
truncatedYes
disclaimerYes
git_safetyYes
started_atYes
duration_msYes
engines_runYes
scan_configNo
engine_setupNo
pack_coverageYes
trivy_db_dateNo
engine_detailsYes
repository_rootNo
secret_coverageNo
history_revisionNo
repository_trustYes
secret_suppressionNo
compliance_overviewNo
dependency_coverageNo
trivy_db_provenanceNo
component_signaturesNo
detected_technologiesYes
security_control_evidenceNo
total_findings_before_limitYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv3.3.1
    • addedInput schema / properties / path / minLength
      Added value: +1
  2. Changed2 schema fields changedv3.1.0
    • addedOutput schema / properties / repository_trust
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "artifacts": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "artifact_id": {
+            "pattern": "^artifact-[a-z0-9][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "confidence": {
+            "enum": [
+              "high",
+              "medium",
+              "low",
+              "none"
+            ],
+            "type": "string"
+          },
+          "evidence": {
+            "additionalProperties": false,
+            "properties": {
+              "attributes": {
+                "items": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "name": {
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "redacted": {
+                      "type": "boolean"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "boolean"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "value"
+                  ],
+                  "type": "object"
+                },
+                "maxItems": 128,
+                "type": "array"
+              },
+              "summary": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "summary",
+              "attributes"
+            ],
+            "type": "object"
+          },
+          "fingerprint": {
+            "pattern": "^sha256:[0-9a-f]{64}$",
+            "type": "string"
+          },
+          "kind": {
+            "$ref": "#/properties/repository_trust/properties/coverage/properties/capabilities/items/properties/capability"
+          },
+          "limitations": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "location": {
+            "additionalProperties": false,
+            "properties": {
+              "end_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "end_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "file": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "start_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "start_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "file"
+            ],
+            "type": "object"
+          },
+          "marker_class": {
+            "pattern": "^[a-z][a-z0-9_]{0,127}$",
+            "type": "string"
+          },
+          "remediation": {
+            "additionalProperties": false,
+            "properties": {
+              "eligible": {
+                "type": "boolean"
+              },
+              "protected_record": {
+                "type": "boolean"
+              },
+              "reason": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "requires_approval": {
+                "const": true,
+                "type": "boolean"
+              },
+              "reversible": {
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "eligible",
+              "requires_approval",
+              "reversible",
+              "protected_record",
+              "reason"
+            ],
+            "type": "object"
+          },
+          "state": {
+            "enum": [
+              "verified",
+              "probable",
+              "informational",
+              "not_verifiable"
+            ],
+            "type": "string"
+          },
+          "validator": {
+            "additionalProperties": false,
+            "properties": {
+              "authoritative": {
+                "type": "boolean"
+              },
+              "egress": {
+                "enum": [
+                  "none",
+                  "optional",
+                  "required"
+                ],
+                "type": "string"
+              },
+              "id": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "independently_verifiable": {
+                "type": "boolean"
+              },
+              "method": {
+                "enum": [
+                  "deterministic",
+                  "declarative",
+                  "statistical"
+                ],
+                "type": "string"
+              },
+              "version": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "method",
+              "authoritative",
+              "independently_verifiable",
+              "egress"
+            ],
+            "type": "object"
+          }
+        },
+        "required": [
+          "artifact_id",
+          "fingerprint",
+          "kind",
+          "state",
+          "marker_class",
+          "location",
+          "evidence",
+          "validator",
+          "confidence",
+          "limitations",
+          "remediation"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "coverage": {
+      "additionalProperties": false,
+      "properties": {
+        "capabilities": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "enum": [
+                  "source_integrity",
+                  "explicit_ai_attribution",
+                  "content_provenance",
+                  "statistical_watermark"
+                ],
+                "type": "string"
+              },
+              "limitations": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "state": {
+                "$ref": "#/properties/repository_trust/properties/coverage/properties/state"
+              },
+              "validators": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "capability",
+              "state",
+              "validators",
+              "limitations"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "limitations": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "state": {
+          "enum": [
+            "ran",
+            "partial",
+            "not_run",
+            "not_applicable",
+            "unavailable"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state",
+        "capabilities",
+        "limitations"
+      ],
+      "type": "object"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "summary": {
+      "additionalProperties": false,
+      "properties": {
+        "informational": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "not_verifiable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "probable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "total": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "verified": {
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "verified",
+        "probable",
+        "informational",
+        "not_verifiable",
+        "total"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "schema_version",
+    "coverage",
+    "summary",
+    "artifacts"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "detected_technologies",
-  "pack_coverage",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "repository_trust",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  3. Changed19 schema fields changedv2.5.0
    • addedOutput schema / properties / component_signatures
      Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "type": "object"
+}
    • addedOutput schema / properties / dependency_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "database_checked_at": {
+        "type": "string"
+      },
+      "database_version": {
+        "type": "string"
+      },
+      "ecosystem": {
+        "const": "Pub",
+        "type": "string"
+      },
+      "engine": {
+        "const": "codeinspectus-pub",
+        "type": "string"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "lockfiles": {
+        "additionalProperties": false,
+        "properties": {
+          "analyzed": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "discovered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "discovered",
+          "analyzed"
+        ],
+        "type": "object"
+      },
+      "matching": {
+        "const": "exact-enumerated-versions",
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "packages": {
+        "additionalProperties": false,
+        "properties": {
+          "eligible": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "resolved": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skipped": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "resolved",
+          "eligible",
+          "skipped"
+        ],
+        "type": "object"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "ecosystem",
+      "engine",
+      "state",
+      "lockfiles",
+      "packages",
+      "matching",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / detected_technologies
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "confidence": {
+        "enum": [
+          "high",
+          "medium"
+        ],
+        "type": "string"
+      },
+      "evidence": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "id": {
+        "type": "string"
+      },
+      "kind": {
+        "enum": [
+          "language",
+          "framework",
+          "platform"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "kind",
+      "confidence",
+      "evidence"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / engine_details / items / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "codeinspectus-ai",
+  "codeinspectus-pub"
+]
    • addedOutput schema / properties / engine_setup
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "engines": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "detail": {
+            "type": "string"
+          },
+          "engine": {
+            "enum": [
+              "opengrep",
+              "gitleaks",
+              "trivy"
+            ],
+            "type": "string"
+          },
+          "state": {
+            "enum": [
+              "ready",
+              "missing",
+              "hash_mismatch",
+              "unpinned",
+              "lockfile_error",
+              "unsupported_platform"
+            ],
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "engine",
+          "version",
+          "state"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "network_required": {
+      "type": "boolean"
+    },
+    "platform": {
+      "type": "string"
+    },
+    "repair_command": {
+      "type": "string"
+    },
+    "state": {
+      "enum": [
+        "ready",
+        "repair_required",
+        "db_refresh_recommended",
+        "unsupported_platform"
+      ],
+      "type": "string"
+    },
+    "trivy_db": {
+      "additionalProperties": false,
+      "properties": {
+        "downloaded_at": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "ready",
+            "missing",
+            "provenance_missing",
+            "stale"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "state",
+    "platform",
+    "engines",
+    "trivy_db",
+    "network_required"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / findings / items / properties / finding_kind
      Added value: +{
+  "enum": [
+    "vulnerability",
+    "license",
+    "misconfiguration",
+    "secret",
+    "sast",
+    "ai",
+    "other"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / owasp_api
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / producer_components
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / scope_role
      Added value: +{
+  "enum": [
+    "primary",
+    "supporting_context"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / vulnerability_aliases
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / git_scope
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "base": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "entries": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "binary": {
+            "type": "boolean"
+          },
+          "generated": {
+            "type": "boolean"
+          },
+          "inspected": {
+            "type": "boolean"
+          },
+          "note": {
+            "type": "string"
+          },
+          "old_path": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "added",
+              "modified",
+              "deleted",
+              "renamed",
+              "untracked",
+              "ignored"
+            ],
+            "type": "string"
+          },
+          "submodule": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "status",
+          "path",
+          "binary",
+          "generated",
+          "submodule",
+          "inspected"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "head": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "mode": {
+      "enum": [
+        "commit_diff",
+        "working_tree"
+      ],
+      "type": "string"
+    },
+    "primary_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "primary_paths": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "supporting_context_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "supporting_context_scanned": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "schema_version",
+    "mode",
+    "repository",
+    "base",
+    "entries",
+    "primary_paths",
+    "supporting_context_scanned",
+    "primary_finding_count",
+    "supporting_context_finding_count",
+    "completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / history_revision
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "commit": {
+      "pattern": "^[0-9a-f]{40,64}$",
+      "type": "string"
+    },
+    "committer_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "snapshot_completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "temporal_scope": {
+      "enum": [
+        "historical",
+        "selected_head"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "schema_version",
+    "repository",
+    "commit",
+    "committer_at",
+    "temporal_scope",
+    "snapshot_completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / pack_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "analyzers": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "frameworks": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "languages": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "note": {
+        "type": "string"
+      },
+      "pack_id": {
+        "type": "string"
+      },
+      "platforms": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "rules": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "scanner_kind": {
+        "default": "ai",
+        "enum": [
+          "ai",
+          "sast"
+        ],
+        "type": "string"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      },
+      "version": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "pack_id",
+      "version",
+      "state",
+      "languages",
+      "frameworks",
+      "platforms",
+      "analyzers",
+      "rules",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / repository_root
      Added value: +{
+  "type": "string"
+}
    • addedOutput schema / properties / secret_coverage
      Added value: +{
+  "enum": [
+    "verified",
+    "unverified"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / secret_suppression
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "channels": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "channel": {
+            "enum": [
+              "target_config",
+              "gitleaks_ignore",
+              "inline_allow"
+            ],
+            "type": "string"
+          },
+          "count": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "handling": {
+            "enum": [
+              "ignored_by_codeinspectus",
+              "coverage_unverified"
+            ],
+            "type": "string"
+          },
+          "paths": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "channel",
+          "count",
+          "paths",
+          "handling"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "channels"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / security_control_evidence
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "control_id": {
+        "type": "string"
+      },
+      "evidence_locations": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "end_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            },
+            "file": {
+              "type": "string"
+            },
+            "start_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "file",
+            "start_line",
+            "end_line"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "limitation": {
+        "type": "string"
+      },
+      "providers": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "enum": [
+          "verified_in_repository",
+          "insecure_configuration_found",
+          "not_verifiable_from_repository"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "control_id",
+      "state",
+      "providers",
+      "evidence_locations",
+      "limitation"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / trivy_db_provenance
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "instruction": {
+      "type": "string"
+    },
+    "state": {
+      "const": "unrecorded",
+      "type": "string"
+    }
+  },
+  "required": [
+    "state",
+    "instruction"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  4. Changed1 schema field changedv0.3.0
    • addedOutput schema / properties / scan_config
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "max_findings": {
+      "type": "integer"
+    },
+    "scanners": {
+      "items": {
+        "enum": [
+          "sast",
+          "secret",
+          "vuln",
+          "misconfig",
+          "license",
+          "ai"
+        ],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "severity_threshold": {
+      "$ref": "#/properties/findings/items/properties/severity"
+    }
+  },
+  "required": [
+    "max_findings"
+  ],
+  "type": "object"
+}
  5. First observedv0.2.1

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint, so the safety profile is covered, but the description adds concrete guarantees beyond them: 'Fully offline — zero network egress at scan time', 'Never writes to your code or repo', and that remote manifests/revocation endpoints are never fetched. It also discloses limits (statistical-watermark detection unavailable) and explicit execution-count reporting, which are real behavioral disclosures.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The critical action and offline/no-write guarantees are front-loaded, which is good, but the body is a dense run-on of version-specific internals (V3 repository-trust contract, V3.1 bidi/tag/variation-selector payloads, V3.2 C2PA). Much of this belongs in an output/result schema rather than the description and inflates the text without helping tool selection.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering safety and a 100%-covered schema plus an output schema, the description carries the behavioral burden well, covering offline operation, non-mutation and scan coverage. The only meaningful gap is the absence of guidance distinguishing it from the rescan/setup siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents path, scanners, max_findings, include_compliance and severity_threshold in detail. The description adds no parameter-level syntax or format information, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Run a full local security scan of a path') and enumerates exactly which engine classes execute, so the agent knows precisely what the tool does. It does not, however, differentiate itself from the sibling codeinspectus_rescan, which an agent could easily confuse for a first run.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the 'full local security scan' framing, but the description never states when to run this versus codeinspectus_rescan (re-scan), codeinspectus_setup (prerequisites), or the SBOM/compliance siblings. No exclusions or prerequisites are given, leaving selection to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools