Delimit Security Ingest
delimit_security_ingestImport JSON security scan results from Trivy, Semgrep, npm-audit, pip-audit, Snyk, or CodeQL and normalize them into Delimit ledger findings to block deploys on unresolved criticals.
Instructions
Ingest external security scan output and normalize into ledger findings (Pro).
When to use: after running a scanner externally — Trivy, Semgrep, npm-audit, pip-audit, Snyk, CodeQL — to feed its JSON output into Delimit's canonical schema and gate deploys on unresolved criticals. When NOT to use: to run a scan from scratch (use delimit_security_scan) or to triage findings (delimit_security_deliberate).
Sibling contrast: delimit_security_scan runs the built-in scan; delimit_security_deliberate triages findings; this is the bridge that pulls external scanner output into the same ledger.
Side effects: gated by require_premium. Writes findings to the ledger (creates new items, optionally closes resolved ones). Computes a stable fingerprint per finding to enable diffing.
Prerequisite: requires Delimit Pro. An unlicensed call returns {"error": ..., "upgrade": "https://delimit.ai/pricing"} without running.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| repo | No | "owner/repo" identifier. Empty = auto-detect. | |
| tool | Yes | Scanner name — one of "trivy", "semgrep", "npm-audit", "pip-audit", "snyk", "codeql". Required. | |
| results | Yes | JSON string of scan results, or path to a JSON file. Required. | |
| commit_sha | No | Git SHA the scan ran against. Empty = auto-detect. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||