Scan Infrastructure-as-Code for SOC 2 misconfigurations
scan_iacIdentify security misconfigurations in Infrastructure-as-Code and map findings to SOC 2 Trust Services Criteria. Runs locally, so file contents never leave your machine.
Instructions
Scans Infrastructure-as-Code for security misconfigurations and maps each finding to a SOC 2 Trust Services Criterion. Supports Terraform, CloudFormation, Kubernetes, Dockerfile, Helm, ARM and Bicep via a locally installed Checkov or Trivy.
The scan runs entirely on this machine. File contents are never transmitted anywhere.
Returns a SUMMARY AND A HANDOFF, not the findings themselves -- a real repository
produces hundreds of findings. Call list_findings with the returned batchId to page
through them, then get_finding for detail on a specific one.
The path MUST be absolute. Run pwd in the target directory if you need it.
Scope: SOC 2 Security category only. All 33 Common Criteria are catalogued, but an IaC scan is the primary evidence source for just 3 of them and partially informs 8 more -- the remaining 22 are out of reach of any infrastructure scan and need documents, people, or live cloud state. This server does not support ISO 27001, HIPAA, PCI, NIST or GDPR. Do not claim coverage it does not have.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the directory or file to scan. Must be absolute, not relative. | |
| scanner | No | Force a specific scanner. Omit to prefer Checkov, which has richer control metadata. | |
| configPath | No | Optional absolute path to a scanner config file (Checkov only). | |
| frameworks | No | Restrict the scan to these IaC frameworks. Omit to let the scanner auto-detect. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| next | Yes | ||
| caveat | Yes | ||
| counts | Yes | ||
| batchId | Yes | Pass this to list_findings and get_finding. | |
| scanner | Yes | ||
| scannedAt | Yes | ||
| fingerprint | Yes | SHA-256 over the scanned input. An identical fingerprint across two scans proves the input did not change. | |
| parseErrors | Yes | Files the scanner could not parse. A partial result, NOT a clean one. | |
| sanitization | Yes | ||
| suppressions | Yes | Checks a developer explicitly suppressed in source. These do NOT appear as findings; a suppressed check is an accepted risk, not an absent one. | |
| totalFindings | Yes | Findings produced before any cap. `counts` reflects this, not the retained list. | |
| scannerVersion | Yes | ||
| findingsTruncated | Yes | True when the retained finding list was capped. A criterion with no findings may simply have had them dropped. | |
| filesFingerprinted | Yes | ||
| frameworksDetected | Yes | ||
| fingerprintTruncated | Yes | True when the fingerprint walk hit its file cap and covers only a subset of the tree. |