Scan Infrastructure as Code using Checkov for security issues.

This tool analyzes Infrastructure as Code files for security misconfigurations and compliance violations using Bridgecrew's Checkov scanner.

Supported formats:

• terraform: Terraform configuration files

• cloudformation: AWS CloudFormation templates

• kubernetes: Kubernetes manifests

• dockerfile: Docker files

• arm: Azure Resource Manager templates

• bicep: Azure Bicep files

• serverless: Serverless framework files

• helm: Helm charts

• github_actions: GitHub Actions workflows

• gitlab_ci: GitLab CI configurations

• ansible: Ansible playbooks

Args: code: The IaC code content to analyze format_type: The type of IaC format being scanned

Returns: A dictionary with scan results including found security issues

Scan source code using Semgrep for security vulnerabilities.

This tool analyzes source code for security vulnerabilities, bugs, and anti-patterns using Semgrep's rule engine with security-focused rulesets.

Supported languages:

• python: Python source code

• javascript: JavaScript source code

• typescript: TypeScript source code

• java: Java source code

• go: Go source code

• c: C source code

• cpp: C++ source code

• csharp: C# source code

• ruby: Ruby source code

• php: PHP source code

• scala: Scala source code

• kotlin: Kotlin source code

• rust: Rust source code

Args: code: The source code content to analyze language: The programming language of the code

Returns: A dictionary with scan results including found security issues

Scan Python code using Bandit for security issues.

This tool analyzes Python source code for common security issues using PyCQA's Bandit security linter. Bandit is specifically designed for Python and can detect issues like:

• Use of insecure functions (pickle, eval, exec)

• Hardcoded passwords and secrets

• SQL injection vulnerabilities

• Command injection risks

• Weak cryptographic practices

• Insecure random number generation

• And many other Python-specific security issues

Args: code: The Python code content to analyze

Returns: A dictionary with scan results including found security issues

Get list of supported formats and languages for all security scanning tools.

This tool returns information about what file formats and programming languages are supported by each of the security scanning tools.

Returns: A dictionary with supported formats for each tool

Scan code using ASH (Automated Security Helper) for comprehensive security analysis.

ASH is a comprehensive security scanning tool that runs multiple security scanners including Bandit, Checkov, cfn-nag, cdk-nag, detect-secrets, and more.

Note: Semgrep is excluded from ASH scans because there's a separate scan_with_semgrep tool.

This tool performs delta scanning on the provided code snippet, creating a temporary file and scanning it with ASH in local mode. This approach is optimized for scanning code changes rather than entire projects.

Supported file types:

• Python (.py): Scanned with Bandit, detect-secrets

• JavaScript/TypeScript (.js, .ts): Scanned with npm-audit

• Terraform (.tf): Scanned with Checkov

• CloudFormation (.yaml, .yml, .json): Scanned with Checkov, cfn-nag, cdk-nag

• Dockerfile: Scanned with Checkov

• And many more formats supported by the underlying scanners

For Semgrep scanning, use the separate scan_with_semgrep tool.

Args: code: The code content to analyze file_extension: File extension to determine scanner selection (e.g., '.py', '.tf', 'Dockerfile') severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL)

Returns: A dictionary with aggregated scan results from multiple scanners

Note: ASH must be installed and available in PATH. Install with: uvx git+https://github.com/awslabs/automated-security-helper.git@v3.2.1 or: pip install git+https://github.com/awslabs/automated-security-helper.git@v3.2.1

Scan Infrastructure as Code or Dockerfile using Trivy for security issues.

Trivy is a comprehensive security scanner that can detect:

• Misconfigurations in IaC files

• Security issues in Dockerfiles

• Vulnerabilities in base images (when scanning Dockerfiles)

• Best practice violations

Supported scan types:

• dockerfile: Scan Dockerfile for security issues and misconfigurations

• terraform: Scan Terraform configuration files

• kubernetes: Scan Kubernetes manifests

• config: Generic configuration file scanning

Args: code: The code content to analyze scan_type: Type of scan to perform (dockerfile, terraform, kubernetes, config)

Returns: A dictionary with scan results including found security issues

Note: Trivy must be installed and available in PATH. Install with: - macOS: brew install trivy - Linux: See https://aquasecurity.github.io/trivy/latest/getting-started/installation/

Scan a container image using Trivy for vulnerabilities.

This tool scans container images for known vulnerabilities in:

• OS packages (Alpine, Debian, Ubuntu, RHEL, etc.)

• Application dependencies (Python, Node.js, Java, Go, etc.)

• Base image vulnerabilities

The output is minimized to show only essential information:

• Vulnerability ID and severity

• Affected package and versions

• Fixed version (if available)

• Primary reference URL

This is particularly useful for:

• Scanning base images used in Dockerfiles

• Checking for vulnerabilities before deployment

• Security audits of container images

Args: image_name: Container image to scan (e.g., nginx:latest, python:3.9, ghcr.io/owner/image:tag) severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL)

Returns: A dictionary with vulnerability findings from Trivy (minimized output)

Note: Trivy must be installed and available in PATH. Install with: - macOS: brew install trivy - Linux: See https://aquasecurity.github.io/trivy/latest/getting-started/installation/

The image will be pulled if not available locally.

Scan an entire project directory with Grype for dependency vulnerabilities.

This tool scans all dependency files in a directory (Cargo.lock, package.json, requirements.txt, etc.) and reports known vulnerabilities across all ecosystems.

Unlike scan_with_ash which scans code snippets, this tool scans the actual project directory to find vulnerabilities in all dependencies.

Supported ecosystems:

• Rust (Cargo.lock)

• Python (requirements.txt, setup.py, Pipfile.lock)

• Node.js (package.json, package-lock.json, yarn.lock)

• Java (pom.xml, build.gradle)

• Go (go.mod)

• Ruby (Gemfile.lock)

• And many more

Args: directory_path: Path to the directory to scan (relative or absolute) severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL)

Returns: A dictionary with vulnerability findings from Grype

Note: Grype must be installed and available in PATH. Install with: - macOS: brew install grype - Linux: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh

Scan an entire project directory with Checkov for IaC security issues.

This tool scans all Infrastructure as Code files in a directory for security misconfigurations and compliance violations using Checkov.

Unlike scan_with_checkov which scans code snippets, this tool scans the actual project directory to find issues across all IaC files.

Supported file types:

• Terraform (.tf, .tfvars)

• CloudFormation (.yaml, .yml, .json)

• Kubernetes (.yaml, .yml)

• Dockerfile

• ARM templates (.json)

• Bicep (.bicep)

• Serverless framework (.yml, .yaml)

• Helm charts (.yaml, .yml)

• GitHub Actions (.yml, .yaml)

• GitLab CI (.yml, .yaml)

• Ansible (.yml, .yaml)

Args: directory_path: Path to the directory to scan (relative or absolute) severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL)

Returns: A dictionary with security findings from Checkov

Note: Checkov must be installed and available in PATH. Install with: - pip: pip install checkov - pipx: pipx install checkov

Scan an entire project directory with Bandit for Python security issues.

This tool scans all Python files in a directory for security issues using Bandit.

Unlike scan_with_bandit which scans code snippets, this tool scans the actual project directory to find issues across all Python files.

Bandit can detect issues like:

• Use of insecure functions (pickle, eval, exec)

• Hardcoded passwords and secrets

• SQL injection vulnerabilities

• Command injection risks

• Weak cryptographic practices

• Insecure random number generation

• And many other Python-specific security issues

Args: directory_path: Path to the directory to scan (relative or absolute) severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH)

Returns: A dictionary with security findings from Bandit

Note: Bandit must be installed and available in PATH. Install with: - pip: pip install bandit - pipx: pipx install bandit

Scan an entire project directory with Semgrep for security issues.

This tool scans all supported source code files in a directory for security vulnerabilities using Semgrep with security-focused rulesets.

Unlike scan_with_semgrep which scans code snippets, this tool scans the actual project directory to find issues across all supported files.

Supported languages:

• Python, JavaScript, TypeScript, Java, Go, C/C++

• C#, Ruby, PHP, Scala, Kotlin, Rust

• And many more

Args: directory_path: Path to the directory to scan (relative or absolute) severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL)

Returns: A dictionary with security findings from Semgrep

Note: Semgrep must be installed and available in PATH. Install with: - pip: pip install semgrep - pipx: pipx install semgrep - homebrew: brew install semgrep

Scan an entire project directory with ASH for comprehensive security analysis.

This tool scans all files in a directory using ASH (Automated Security Helper), which runs multiple security scanners including Bandit, Checkov, cfn-nag, cdk-nag, detect-secrets, grype, and more.

Unlike scan_with_ash which scans code snippets, this tool scans the actual project directory for comprehensive security analysis.

Note: Semgrep is excluded from ASH scans. Use scan_directory_with_semgrep instead.

Supported file types:

• Python (.py): Scanned with Bandit, detect-secrets

• JavaScript/TypeScript (.js, .ts): Scanned with npm-audit

• Terraform (.tf): Scanned with Checkov

• CloudFormation (.yaml, .yml, .json): Scanned with Checkov, cfn-nag, cdk-nag

• Dockerfile: Scanned with Checkov

• And many more formats supported by the underlying scanners

Args: directory_path: Path to the directory to scan (relative or absolute) severity_threshold: Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL)

Returns: A dictionary with aggregated scan results from multiple scanners

Note: ASH must be installed and available. Install with: - uvx: uvx git+https://github.com/awslabs/automated-security-helper.git@v3.2.1 - pip: pip install git+https://github.com/awslabs/automated-security-helper.git@v3.2.1

Scan an entire project directory with Syft to generate Software Bill of Materials (SBOM).

This tool catalogs all software components and dependencies in a directory using Syft. Unlike vulnerability scanners, Syft creates an inventory (SBOM) of what's in your software.

Syft catalogs:

• Container images (Docker, OCI)

• Filesystems and directories

• Archive files (tar, zip)

• Language-specific packages:

  • Python (pip, poetry, pipenv)

  • JavaScript/Node (npm, yarn, pnpm)

  • Java (Maven, Gradle)

  • Go modules

  • Ruby gems

  • Rust crates

  • PHP composer

  • .NET/C#

  • And many more

By default, only a summary is returned. Set save_sbom=True to save the full SBOM to a file in the .sbom directory at the workspace root.

The SBOM file can be used with Grype for vulnerability scanning or for compliance/auditing purposes.

Args: directory_path: Path to the directory to scan (relative or absolute) output_format: Output format - json (default), cyclonedx-json, spdx-json, or table save_sbom: Save full SBOM to file (default: False, only returns summary)

Returns: A dictionary with: - total_packages: Total number of packages found - type_counts: Package counts by type - language_counts: Package counts by language - timestamp: Scan timestamp

Note: Syft must be installed and available in PATH. Install with: - macOS: brew install syft - Linux: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh

Check if ASH (Automated Security Helper) is installed and available.

This tool verifies that ASH is properly installed and can be executed. It also checks which individual scanners are available, as some require external dependencies (e.g., cfn-nag requires Ruby, cdk-nag requires npm).

Use this before attempting to scan with ASH to ensure it's available and to understand which scanners will be used.

Returns: A dictionary with: - ASH installation status and version - Scanner availability (which tools are installed) - Formatted report for easy reading - Installation instructions for missing dependencies

Generate a SECURITY.md report from scan results.

Takes output from one or more security scans and produces a structured Markdown report with executive summary, STRIDE threat model, compliance notes, and prioritized recommendations.