Find dead code: unused functions, classes, imports, variables, parameters and files.

Use this to list cleanup candidates in a project. Returns JSON with a summary and per-category findings (file, line, name, confidence) plus _run_id; the full result is stored locally and can be read from the skylos://results/{run_id} resource. Read-only: it never edits code. Findings are candidates: before deleting one, check for dynamic use (getattr, string dispatch, entry points, framework decorators, tests). A non-empty analysis_errors means analysis or verification was incomplete; do not treat the findings as a complete scan.

Defect and Review records remain complete. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result without rescanning.

Works without SKYLOS_API_KEY (5 calls/day); higher limits with a key.

Scan source code for security issues such as SQL and command injection, SSRF, path traversal, eval/exec and unsafe deserialization.

Returns JSON with findings (rule ID, severity, file, line, message) and _run_id. Read-only; the scan runs locally and does not upload code. Use secrets_scan for hard-coded credentials and validate_code_change to check a diff before it lands.

Defect and Review records remain complete. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result without rescanning.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Report code-quality issues: high complexity, deep nesting, long functions, duplicate branches and similar maintainability findings.

Returns JSON with findings (rule ID, file, line, message) and _run_id. Read-only and local.

Defect and Review records remain complete. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result without rescanning.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Report architecture findings for a project: module coupling, cohesion and circular dependencies.

Returns JSON with the architecture findings and _run_id. Read-only and local. Use quality_check for function-level issues.

Defect and Review records remain complete. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result without rescanning.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Assess a project through separate Risk, Maintainability and Dead code readouts.

This tool retains its health_score name for compatibility but no longer creates a blended numeric grade. Gate policy remains independent. Returns assessment, coverage, finding counts and _run_id. Read-only and local. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Find hard-coded secrets and credentials (API keys, tokens, private keys, passwords) in source and config files.

Returns JSON with findings (provider, file, line) and _run_id. Secret values are redacted in the output. Read-only and local.

Defect and Review records remain complete. Advice is grouped by default; expand_advice=True includes every Advice record. Read _result_uri for the complete saved result without rescanning.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Plan or apply LLM-generated fixes for Skylos findings in a project.

With dry_run=True (default), static analysis returns a remediation plan without calling a model or changing files. With dry_run=False, it generates fixes and can edit files in place: this needs the skylos[llm] extra and provider configuration (including credentials when required), and sends affected code to that provider. It does not run your tests. Review every change and run trusted tests before keeping it. Costs 10 Skylos credits per real run, charged when the run starts generating fixes, right before the first model call; a run that fails after that is still charged. Dry runs, refused calls and runs with nothing to fix are free. Scan tools cost no credits.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Ask an LLM to review selected unused function, class, import and variable candidates, with its reasoning.

Use it after analyze when you need fewer false positives before deleting code. Sends code snippets and search results to the chosen model provider, so it needs the skylos[llm] extra and provider configuration, including credentials when required. Candidates outside the review limits, or whose use remains uncertain, can remain unverified. Does not edit files. Refuses to run when the static analysis was incomplete.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Report available evidence of AI-agent, bot and human contributions.

Combines git signals since the base (agent bot accounts, Co-authored-by and AI declaration trailers, agent-named commit subjects) with recorded local attribution evidence. Returns JSON with per-file attribution, evidence and coverage status. Commit declarations do not establish line authorship; missing evidence remains unknown. Read-only and local.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Build a unified-diff patch that removes (or comments out) dead code found by static analysis, after grep verification drops findings that are still referenced.

Returns the diff, patch summary, validation errors and applied status. With apply=False (default) it previews changes; with apply=True it edits files if patch validation succeeds. Refuses to run when the analysis or grep verification was incomplete. Review the diff and run trusted tests before keeping it.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Record whether a finding was accepted or dismissed so get_triage_suggestions can learn from it.

Writes the decision to the project's local Skylos state.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Suggest accept or dismiss for current findings, based on decisions recorded with learn_triage in this project.

Returns JSON suggestions with finding fingerprints, suggested actions and confidence, plus the number of learned patterns. Read-only and local.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Validate a code diff for security regressions and issues before it lands.

Takes a unified diff and checks for:

• Security control regressions (auth, CSRF, TLS, rate limiting removal)

• New dangerous patterns (eval, exec, SQL injection, etc.)

• Secrets in added code

• Hallucinated or undeclared dependencies in added imports and manifest entries (requirements*.txt, pyproject.toml, package.json, go.mod), verified against the package registries. The "registry" field reports "ok", "unreachable" or "error" (lookups incomplete — do not treat pass as clean), or "skipped".

Returns pass/fail with findings.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Verify a changed file/range for AI-code defects and security bugs.

Returns a narrow, versioned JSON verdict containing AI-code trust findings such as hallucinated references, unfinished generated code, stale references, disabled controls, and dependency hallucinations (checked by default; pass include_dependency_hallucinations=False to skip the registry lookups), plus high/critical security findings (category "security") and hard-coded secrets (category "secret", values redacted) in the selected file/range. Pass include_security_findings=False to skip the security and secret checks.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Statically verify an AI agent's guardrails before deployment.

Deterministic, local pre-deployment agent verification: inventories LLM integrations, runs the defense checks (prompt-injection exposure, dangerous sinks, tool scope, output validation, PII filtering, cost controls), and returns scores, failed checks with remediation, OWASP LLM/Agentic coverage, and a reproducible attestation digest. No model is involved in the verdict and the analysis runs locally; source code is not sent to Skylos Cloud. Optional gate: set fail_on (severity) and/or min_score (0-100).

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Summarize a project's security setup: detected web frameworks, auth decorators and middleware, security headers, rate limiting, input validation and a supported Skylos YAML policy file.

Use it before reviewing or writing security-sensitive code to learn the project's conventions. Returns JSON. Read-only and local.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Map what a code change touches, to review it: every changed Python or TypeScript/JavaScript function, method or class with its old and new code, calls added and removed, calls that only moved into a helper, its callers (with call lines, and whether each caller was updated), removed security checks and access checks, breaking or compatible signature changes, changed module values and the functions using them, and the top symbols to read first. Flags list what a person must look at.

Computed from the code, not by a model: the same commit gives the same map. Returns JSON. Read-only and local.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.