Commits touching a repo (or one file) within a time window, with subjects and refs.

Show the stat-and-patch diff for a single Git commit, as evidence for a specific change.

Bounded text search across supported source and configuration files; returns file-and-line evidence.

Runs detected project-native test suites in a sandbox worker or disposable local copy and reports bounded evidence.

Detect allow-listed test runners and report whether each required toolchain is locally available without executing project code.

Extract bounded cross-language dependency coordinates and Package URLs from local manifests and lockfiles without network access.

Generate a deterministic CycloneDX 1.6 component inventory from supported local manifests and lockfiles; performs no vulnerability enrichment.

Searches a log file for lines matching a query.

Gathers evidence (recent commits + diffs, code search, log search, test results) relevant to an engineering question. Returns evidence only — it does not claim a root cause; reason over the returned evidence yourself.

Build or update the local symbol map for a repository. Raw source is not stored in the index.

Find indexed symbols across all supported languages by name.

Query indexed symbol-reference edges for direct callers or callees; evidence is limited to the local index.

Export a strict source-free map of indexed paths, hashes, symbols, and graph edges; never includes raw source.

Validate and transactionally store a source-free code map for one tenant project.

Find symbols in a hosted source-free code map without accessing a customer checkout.

Query callers or callees from a hosted source-free code map.

Report hosted source-free map counts and compare an optional local source fingerprint for staleness.

List files changed by a Git revision as evidence for downstream impact reasoning.

Gather deterministic evidence for production readiness; makes no release decision.

Run the operator-configured MCP security scanner and return findings as evidence.

Run operator-installed Semgrep (SAST) and Gitleaks (secret detection) against the target repository from a disposable copy; each is independently optional and reports an honest fallback when not configured.

Run the operator-installed OSV-Scanner against detected dependency manifests for known-vulnerability matches. By default this queries the public osv.dev database over the network; set ENGINEERINGOS_OSV_SCANNER_OFFLINE=1 to use a pre-downloaded local database instead.

Gather a fast evidence-only inventory of repository shape, languages, tests, index freshness, and deployment artifacts.

Inventory languages, test files, parser backends, source size, and build ecosystems in a polyglot repository.

Inventory supported dependency manifests and lockfiles; does not make vulnerability claims.

Run detected project-native diagnostics in a disposable copy; returns evidence only and never accepts arbitrary commands.

Use the operator-configured structural symbol adapter for one repository file; returns bounded symbol evidence only.